RESEARCH RADAR · DAILY
July 24, 2026
1 peer-reviewed · 9 preprints · 0 forum/blog
Mech Interp · AI Security · Text Diffusion LMs
01
dLLM peer-reviewed ACL 2026

LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Models

Preference alignment methods built for autoregressive models — RLHF, DPO, PPO — all derive gradients from sequential per-token log-probabilities. Masked diffusion LMs don't have those: their likelihood is defined over masking schedules across all positions simultaneously. LLaDA 1.5 solves this cleanly, and the gains across math, code, and alignment benchmarks are some of the most convincing reported for dLLM post-training.

VRPO vs SFT-only — percentage-point gain (LLaDA-8B base) 0 +2 +4 +4.7 GSM8K +3.0 HumanEval +1.8 MBPP +4.0 IFEval +4.3 Arena-Hard All gains over SFT-only LLaDA-8B; VRPO = Variance-Reduced Preference Optimization (ACL 2026)
VRPO (Variance-Reduced Preference Optimization) gains over SFT-only LLaDA-8B across five benchmarks: GSM8K +4.7 pp, HumanEval +3.0 pp, MBPP +1.8 pp, IFEval +4.0 pp, Arena-Hard +4.3 pp.

LLaDA 1.5 identifies the root problem in dLLM preference optimization as high variance in the masked ELBO gradient — not bias, which can be managed, but variance, which causes training instability and poor reward generalisation. VRPO derives closed-form variance bounds for two complementary strategies — optimal Monte Carlo budget allocation across denoising steps and antithetic sampling — and applies both in combination. The resulting estimator is unbiased relative to a naïve Monte Carlo baseline while achieving significantly lower gradient variance. Applied to LLaDA-8B, VRPO achieves gains on every benchmark tested, with the strongest improvements on alignment tasks (IFEval, Arena-Hard) where training signal quality matters most. The model checkpoint is publicly available at HuggingFace (GSAI-ML/LLaDA-1.5).

02
dLLM mech-interp preprint

Induction in Both Directions: A Mechanistic Analysis of In-Context Learning in Masked Diffusion Language Models

The induction circuit is the best-understood mechanism for in-context learning in autoregressive models — a previous-token head plus an induction head that copies a token following a repeated prefix. This paper asks whether masked diffusion LMs implement anything analogous, and finds something more capable: a direction-symmetric version that finds and copies the relevant token regardless of whether the matching source appears before or after the masked position.

Induction circuits: AR (unidirectional) vs masked dLLM (bidirectional) AUTOREGRESSIVE A B A ? prev-token head ← left context only induction head copies B after A match → B MASKED DIFFUSION LM A B [M] C A B prev + next token heads ← left AND right context → bidirectional induction head copies B — match before OR after [M] → B Direction-symmetric: dLLM finds source whether it appears left or right of the mask position.
AR models implement a left-to-right induction circuit (previous-token head + induction head) that can only match sources to the left. Masked dLLMs learn both previous-token and next-token heads; the bidirectional induction head matches and copies from either direction.

The authors construct matched attention-only AR and absorbing-mask dLLM toy models and use activation patching to isolate the induction mechanism in both. In the dLLM, two head populations emerge: previous-token heads (writing left-context into the residual stream) and next-token heads (writing right-context). A third population — the bidirectional induction head — attends to whichever direction carries the repeated prefix and copies the token that follows it in that direction. The circuit is demonstrated to operate direction-symmetrically on synthetic in-context copying tasks: when the pattern source appears after the mask position rather than before, the same induction head still succeeds by reading the right-context signal. This is a qualitatively new result: dLLMs implement a strictly richer induction mechanism than AR models, which mechanistically explains their observed in-context learning capability on tasks where the relevant context comes from future positions.

03
dLLM AI security preprint

MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models

Jailbreaks designed for autoregressive LLMs attack the sequential prefix — getting a harmful first token committed to the context. dLLMs don't have a committed prefix; they infill all positions bidirectionally and in parallel. MaskForge is the first fully black-box adaptive attack framework that exploits this structural difference, achieving a 79.3% average attack success rate across five dLLMs — a 17.6 percentage-point improvement over the strongest prior baseline.

MaskForge: UCB-bandit adaptive attack pipeline for masked diffusion LMs Harmful goal Structural attack library [mask templates] UCB bandit selects pattern goal-compatible Masked dLLM infills [MASK] bidirectional Score output ASR judge success / fail abstract successful pattern → library grows Average ASR across 5 dLLMs prior best ~61.7% MaskForge 79.3% (+17.6pp)
MaskForge maintains a growing library of structural mask-text templates. A UCB bandit selects goal-compatible patterns; the dLLM infills masked positions bidirectionally; successful outputs are abstracted back into the library as new schemas.

MaskForge casts dLLM red-teaming as a bandit-style search over a library of structural attack patterns — masking templates that preserve surface-level plausibility while encoding harmful completion targets. Each successful attack is abstracted into a reusable schema (e.g., "mask the most harmful verb, provide the subject and object, let dLLM infill via bidirectional context"), which is added back to the library. A UCB bandit selects among goal-compatible library entries based on past success rates, with a scorer-guided random fallback when the library fails. The black-box setup requires only access to model outputs, not weights. Evaluated on five public dLLMs (LLaDA-8B, Dream-7B, and three smaller variants) across HarmBench, AdvBench, and a cybersecurity-specific split, MaskForge achieves 79.3% average ASR. ⚠ Attack code is not yet publicly released, but the paper is detailed enough to reproduce.

Also today — items 4–10
04
dLLM mech-interp

How Transparent is DiffusionGemma?

Naïve opaque serial depth 28.6× that of Gemma 4 — reduced to 1.1× via an interpretable token bottleneck between denoising steps with no performance loss. Uncovers dLLM-specific phenomena: non-chronological reasoning, token smearing, intermediate-context reasoning.

05
dLLM mech-interp

DLM-Scope: Mechanistic Interpretability of Diffusion Language Models via Sparse Autoencoders

First SAE framework for dLMs. Top-K SAEs extract interpretable features from dLM residual streams with no analogous perplexity penalty to AR models, opening SAE-steered control of denoising trajectories.

06
mech-interp AI security

Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

Paired SAE attribution graphs (clean vs. jailbreak) decompose computation into invariant, suppressed, and emergent structures. Path rerouting magnitude is the strongest predictor of jailbreak success — confirmed causally via subgraph ablations.

07
mech-interp

Statistically Grounded Sparse-Feature Interventions for Activation-Space Control in Large Language Models

Six-condition reliability filter + Borda consensus ranking (F-test, KSG MI, Cohen's d) selects SAE features for steering without a learned objective. Key finding: substantial gap between activation shift and generation quality preservation.

08
mech-interp AI security

Sparse Autoencoders are Capable LLM Jailbreak Mitigators

CC-Delta (Context-Conditioned Delta Steering) identifies jailbreak-relevant SAE features by contrasting activations with/without jailbreak context, then steers in SAE latent space. Outperforms dense steering on all 4 tested models across 12 jailbreak types.

09
dLLM AI security

TrustLDM: Benchmarking Trustworthiness in Language Diffusion Models

First safety/privacy/fairness benchmark for language diffusion models. dLLMs show strong trustworthiness on user-only prompts, but alignment degrades when malicious post contexts are appended — bidirectional context creates orthogonal attack surfaces vs. AR safety.

10
dLLM mech-interp

Subliminal Clocks: Latent Time Modelling in Diffusion Language Models

Masked dLLMs implicitly encode denoising progress in their residual streams — linear probes reliably decode it across all layers (strongest in mid-to-late). The implicit timestep predicts token confidence better than the model's stated confidence. Implications for adaptive decoding and SAE timescale analysis.

← all Research Radar issues · gussand · source