Research Radar
Daily · July 25, 2026
1 peer-reviewed · 9 preprints · 0 forum/blog
Mech Interp · AI Security · Text Diffusion LMs
01
dLLM AI security ICLR 2026

DIJA: The Devil Behind the Mask — An Emergent Safety Vulnerability of Diffusion LLMs

Alignment researchers have spent years hardening autoregressive LLMs against jailbreaks that exploit the left-to-right prefix. Masked diffusion models look safer by default — they never commit a harmful prefix because there is no committed prefix. DIJA is the first systematic study showing that this intuition is backwards: the bidirectional context window is not a defense, it is an attack surface, and RLHF alignment transferred from AR-LLMs provides essentially no coverage for it.

DIJA — Bidirectional Mask Attack vs. Autoregressive Jailbreak Autoregressive LLM Tell me how to [HARM] a bomb RLHF sees [HARM] token explicitly → REFUSAL fires ✗ Attack blocked Harmful payload is an explicit token in the left-to-right stream — always visible Masked Diffusion LLM (DIJA) Tell me [MASK] [MASK] a bomb RLHF sees only [MASK] — no payload → passes without refusal Bidirectional fill → "how to make" ✓ Attack succeeds +78.5 pp ASR over ReNeLLM · up to 100% on Dream-Instruct
Figure 1: In AR-LLMs (left), jailbreaks must place the harmful payload as an explicit token — RLHF alignment sees it and refusal fires. DIJA (right) places the payload in masked positions ([MASK]) that are filled bidirectionally at decode time — alignment never encounters the harmful token as input, and the attack succeeds with up to 100% ASR on Dream-Instruct (+78.5 pp over the strongest prior baseline).

DIJA (Discrete diffusion Injection Jailbreak Attack) exploits three structural properties simultaneously: bidirectional context that induces harmful content from surrounding text; the parallel mask-filling mechanism that commits tokens in a single denoising sweep without sequential safety checks; and parallel decoding that limits dynamic filtering capacity. Evaluated on LLaDA, LLaDA-1.5, Dream, and MMaDA, DIJA achieves up to 100% keyword-based ASR on Dream-Instruct and outperforms ReNeLLM by 78.5 pp (evaluator-based ASR on JailbreakBench) and 37.7 pp (StrongREJECT). The result confirms that RLHF alignment methods transferred from AR-LLMs provide insufficient coverage for the dLLM threat model — the bidirectional infilling mechanism creates attack vectors orthogonal to those studied for sequential generation.

02
dLLM preprint

iLLaDA: Improved Large Language Diffusion Models

Masked diffusion LMs have been closing the capability gap with autoregressive models at 7B scale, but until iLLaDA the best results (LLaDA-8B) still fell well short of Qwen2.5-7B on most benchmarks. ByteDance's iLLaDA is the first masked dLLM to exceed a competitive AR baseline on average across a standard benchmark suite — showing that the remaining gap was engineering, not a fundamental architectural ceiling.

iLLaDA-8B vs LLaDA-8B vs Qwen2.5-7B — Base Model Accuracy (%) 45 60 75 90 74.8 71.9 63.2 MMLU 71.3 63.9 49.7 BBH 81.9 78.9 67.2 GSM8K 88.3 85.5 ARC-C iLLaDA-8B (avg 63.9) Qwen2.5-7B (avg 63.3) LLaDA-8B
Figure 2: iLLaDA-8B base model surpasses Qwen2.5-7B on MMLU (+2.9 pp), BBH (+7.4 pp), and GSM8K (+3.0 pp), achieving an average of 63.9 vs 63.3 — the first masked dLLM to edge out a competitive AR baseline on average across a standard suite. LLaDA-8B trails substantially on reasoning-heavy tasks (BBH: 49.7).

iLLaDA is an 8B masked diffusion language model trained from scratch with fully bidirectional attention, scaling pre-training to 12T tokens and fine-tuning on a 25B-token instruction corpus for 12 epochs. Key improvements over LLaDA: grouped-query attention, a larger and higher-quality pre-training corpus, and an extended SFT schedule. The base model surpasses Qwen2.5-7B on MMLU, BBH, and GSM8K; the instruct model narrows but does not close the gap with reinforcement-learning-aligned AR models, with the remaining difference attributed to the absence of RL alignment in the dLLM pipeline. This establishes that fully bidirectional diffusion training from scratch is a competitive path to strong language models, not just a niche inference-efficient alternative. Model checkpoint: HuggingFace GSAI-ML/iLLaDA-8B.

03
mech-interp preprint

Scalable Circuit Learning for Interpreting Large Language Models

Intervention-based circuit discovery works beautifully on small models with small SAE dictionaries but blows up at the scale where deployed models live — path patching and EAP scale as O(k³) in the number of SAE features, making them computationally prohibitive for dictionaries of 16K or 65K features. CircuitLasso reformulates circuit learning as sparse linear regression over feature activations, drops the cost to O(k log k), and matches the structural accuracy of the expensive methods at production scale.

CircuitLasso — Scalable Circuit Discovery via Sparse Regression over SAE Features LLM residual streams all layers Top-K SAE Features k = 16K–65K high-dim, sparse CircuitLasso LASSO sparse regression over feature activations O(k log k) vs O(k³) Intervention-based: O(k³) ✗ CircuitLasso: O(k log k) ✓ Circuit Graph SAE feature → feature interpretable causal edges Domain Generalization matches intervention-based accuracy Structural accuracy matches EAP / path-patching at a fraction of compute — enables circuit learning on 65K-feature SAE dictionaries
Figure 3: CircuitLasso replaces O(k³) intervention-based patching with sparse linear regression (O(k log k)) over Top-K SAE feature activations, making circuit discovery practical on production-scale dictionaries (16K–65K features). Structural accuracy matches state-of-the-art intervention-based methods; discovered circuits also enable domain generalization at comparable accuracy.

CircuitLasso fits a LASSO-regularized linear regression from upstream SAE feature activations (layer l) to downstream feature activations (layer l+1); non-zero regression coefficients identify circuit edges. Because it is regression-based rather than patching-based, it requires no counterfactual forward passes and scales to the 16K–65K feature dictionaries of production SAEs. On standard circuit benchmarks, CircuitLasso matches the structural accuracy of path-patching and EAP while also recovering explicit semantic dependencies — e.g., which semantic features at layer 8 causally activate which at layer 12. Discovered circuits support a domain-generalization use case: circuits from one distribution provide routing priors that improve OOD performance at comparable accuracy to expensive baselines. IBM Research.

Items 4–10
04
AI security

MAGE: Safeguarding LLM Agents via Shadow Memory

Shadow Memory — Parallel Safety Stream Turn 1 Turn 2 ⚠ Turn N Agent Action Stream distil T1 distil T2 Risk Check before exec Shadow Memory Stream
Shadow memory distils safety context per turn; risk-assesses before action execution.

First framework targeting long-horizon threats distributed across multiple agent turns; shadow memory (inspired by shadow stack) retains safety-critical context across the full execution trajectory and enables early-stage detection for the majority of attacks with negligible utility overhead. Stony Brook University / Cisco Systems, May 2026.

05
AI security

Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces

Simulated Moderation Trace Attack System Prompt Developer Schema Tool Output: [SAFETY_PASS] approved ✓ ← injected Model Output ✓ RLHF refusal bypassed — prompt never modified
Fake safety audit (moderation trace) injected as a tool response overrides RLHF alignment.

Exploits the structural context of function-calling environments — developer-defined schemas and untrusted tool outputs interleaved in the shared model context. Adversaries inject simulated moderation traces (fake safety-audit tool responses) that override RLHF refusal without modifying the user-visible prompt. arXiv July 1, 2026.

06
AI security

Assessing Automated Prompt Injection Attacks in Agentic Environments

TAP vs GCG — Agentic Prompt Injection ASR 70% 35% ~65% TAP (black-box) ~32% GCG (white-box)
TAP (black-box) substantially outperforms GCG (white-box) — inverting the usual gradient advantage.

Systematic evaluation adapting GCG and TAP to agentic settings across 80 task pairs (AgentDojo). TAP outperforms GCG, inverting the usual white-box advantage; task-universal attacks transfer across unseen domains; but attacks optimised on open-source models fail to transfer to frontier models. Prompt injection is a credible but model-dependent threat. arXiv June 2026.

07
dLLM

TACG: Trajectory-Aware Commit Gating for Diffusion LM Decoding

TACG — Stable Commit Gating for dLLMs Standard: many unstable steps … N steps TACG (TILG + History Gate): fewer stable commits commit commit commit → ↑ TPF, ≈ acc
TILG + History Gate enforce proposal stability before committing, reducing denoising steps.

Training-free dLLM decoder combining Temporal Implicit Logits Guidance (exponential moving average of past logits as self-reference) with a History Gate (enforces proposal persistence before commitment). Reduces denoising steps and increases tokens-per-forward on LLaDA, Dream, LLaDA2-Mini with preserved or improved accuracy on code and math benchmarks. arXiv July 3, 2026.

08
dLLM

Don't Commit Alone: Joint Token Commitment in Diffusion LLMs

CoCommit — Joint Commitment via Marker Gate Before: independent commits A? B? C? factorization error ✗ After: CoCommit coordination [A] [B] [C] Marker Gate → coord. pass joint argmax ✓
Marker gate defers commitment; last-n layers re-run for joint decoding before argmax.

dLLMs commit multiple positions independently, accumulating factorization error when positions are dependent. CoCommit inserts a marker-gated coordination pass: the backbone's last-n layers re-run on the marked commit set, approximating joint-mode decoding. Reuses existing weights (one extra partial forward pass); improves accuracy on all 6 benchmarks on LLaDA2.1-mini with largest gains on reasoning tasks. arXiv July 5, 2026.

09
mech-interpAI security

Mechanistic Steering of LLMs Reveals Layer-wise Feature Vulnerabilities

Jailbreak Vulnerability by Layer (Gemma-2-2B) High Low L1–5 L6–10 L11–15 HIGH L16–25 ★ most vulnerable
Mid-to-late layers (16–25) consistently produce most vulnerable feature subgroups across all grouping methods.

Applies three SAE feature-grouping strategies across all 26 layers of Gemma-2-2B, amplifies top features per subgroup, and scores outputs for harmful content. Consistent finding: layers 16–25 are substantially more vulnerable to harmful-output steering than early layers — localising jailbreak susceptibility to a specific depth range with implications for layer-targeted defences. arXiv April 2026.

10
mech-interp

Ablation-Reversible Heads Don't Transfer: A Stress Test for Mechanistic Role Claims

KID Pipeline — Role Claim Validation CSS capability screening SVD encoding check Transduction patch activations to new prompt ← most fail here Same-answer control exposes state transfer masquerading as semantic specificity
Heads passing CSS + SVD routinely fail transduction under matched controls — role claims don't generalise.

Introduces KID (Knowing/Intent/Doing): three-stage pipeline (CSS → SVD encoding → activation transduction under matched controls). Across 3 instruction-tuned 7–8B models and 5 computation families, heads passing all three checks routinely fail to transfer computation across prompts. The "same-answer control" — a transduction target sharing the answer but not the computation — exposes broad state transfer masquerading as semantic specificity. Philip Quirke (Martian), arXiv June 4, 2026.

Notes

← all Research Radar issues · gussand · source