Harmful Responses Are Jailbreak Templates: Transferring Autoregressive Jailbreaks to Diffusion Language Models

Summary

The paper shows that a harmful response generated for a query can serve as a jailbreak template for diffusion large language models (dLLMs). Masking a subset of its tokens induces the dLLM to reconstruct the harmful content. The authors propose RMT-Jailbreak, which transfers existing autoregressive (AR) jailbreak attacks to dLLMs by converting AR-generated harmful responses into high-mask-ratio templates. Experiments across multiple AR jailbreak methods and target dLLMs show strong cross-paradigm transferability.

Topics

• Prompt injection and jailbreaks

Related items

• MediumSecuring our frontier model training environmentSimilar attack · OpenAI Blog
• InfoDepth-Dependent Safety Geometry in Vision-Language Models: Layer-Wise Localization and Bidirectional Refusal ControlSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPaired response final divergence signatures of jailbreak vulnerability in large language modelsSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoDiffusion Language Models for Perplexity-Aware Black-Box AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoAgentPhishing: A Benchmark of LLM Email Agents Under Adaptive AttackSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)