Diffusion LLMs generate text by iteratively denoising masked sequences — but that mask mechanism is also an attack surface. DIJA shows that interleaving partial text with strategically placed mask tokens creates adversarial prompts that bypass safety mechanisms entirely, because those mechanisms were aligned to handle fully-autoregressive or fully-masked inputs, not the hybrid mid-generation states a dLLM sees.
Figure 1 (DIJA): Adversarial interleaved mask-text prompt bypasses dLLM safety mechanisms. The safety filter, trained to detect left-to-right harmful completions, fails to recognize harmful content distributed across mask positions. The bidirectional denoiser resolves all masks simultaneously using both left and right context — including the distributed harmful signal.
Zichen Wen and 15 co-authors present DIJA as the first systematic framework for exploiting dLLM-specific vulnerabilities. The PAD (Parallel Attention Decoding) variant introduces Multi-Point Attention Attack, injecting sequence connectors at strategically distributed mask positions to create a cascading effect that steers parallel generation toward attacker targets. Results: up to 97% attack success rate on MMaDA-Mix and consistently high rates across all four evaluated dLLMs (LLaDA, Dream, MMaDA, MDLM). Standard AR-model jailbreak methods show near-zero transfer because they target the autoregressive decoding order, not the bidirectional denoising context that dLLMs actually use. Code at github.com/ZichenWen1/DIJA.
Where DIJA exploits the mask-token mechanism directly, MaskForge attacks at a higher level: it treats dLLM red-teaming as an experience-accumulation problem, building a growing library of structural attack schemas that gets smarter with each attempt and transfers without retraining.
Figure 2 (MaskForge): The adaptive attack loop. A growing pattern library of structural attack schemas feeds a UCB bandit that selects goal-compatible patterns; a scorer-guided fallback handles library misses; successful attacks are distilled back into the library. The matured library transfers to new models and goals without updates (88.2% on AdvBench, +67% over baseline).
MaskForge operates fully black-box — no access to model weights or gradients, only generation output. The UCB bandit selects from indexed structural schemas (defined by mask placement strategy, target-token positioning, and context injection points); the scorer model provides a signal for fallback generation when the library lacks applicable patterns. Successful attempts are abstracted into schemas and returned to the library, enabling experience to accumulate across goals. The result is 79.3% average attack success rate across five dLLMs and three benchmarks — a 17.6% relative improvement over the strongest competing baseline — with zero library updates required for AdvBench transfer. Together with DIJA (#1), this establishes dLLM structural properties as a distinct, currently under-defended jailbreak attack surface.
Mohamed Abdessalem Bal — arXiv 2607.12166, July 13, 2026
The SAE evaluation field has been measuring the wrong thing. Cosine similarity between ground-truth directions and learned decoder atoms checks geometry — but a feature can be geometrically well-recovered and causally invisible at the same time. This paper runs the first systematic causal audit of SAE features and finds the disconnect is substantial.
Figure 3 (SAE Causal Audit): In degraded SAEs, up to 77% of features passing the cosine ≥ 0.90 geometric recovery threshold never fire when their matched concept is present — including at cosine ≈ 1.000. Even well-trained SAEs have ~9% causally inert features. The paper separates two empirical claims the field has conflated: decoder geometry and encoder activation behavior.
The experimental pipeline subjects every geometrically-recovered feature to two causal tests: ablation (zero the feature, measure behavioral change) and steering (activate the feature, measure downstream effect). Both must hold for a feature to support mechanistic claims, but standard evaluation metrics measure only cosine similarity between decoder atoms and ground-truth directions — checking geometry, not behavior. The 77%/9% causal inertness figures show the gap between geometric and causal validation is severe in degraded SAEs but non-zero even in well-trained ones. The result directly challenges the validity of mechanistic claims built on SAE features without causal validation, and should change evaluation standards for new SAE papers. Code at github.com/mohamed-bal/sae-causal-audit.
Andy Catruna, Emilian Radoi (POLITEHNICA Bucharest) — arXiv 2607.15893, July 17, 2026
Figure 4: dLLMs implement a direction-symmetric induction circuit. Previous-token heads write left-context cues; next-token heads write right-context cues; both converge on an induction head that finds and copies the matching continuation — working equally whether the source is in the past or future.
The first mechanistic circuit study in masked dLLMs. By comparing matched AR and absorbing-mask architectures, the authors find that dLLMs learn bidirectional induction — the standard AR left-to-right induction circuit extended to both temporal directions. This direction symmetry vanishes when only left context is available: dLLMs do not outperform AR counterparts in that constrained setting, pinpointing bidirectional context as the source of dLLM's in-context learning advantage.
Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, Longwei Wang — arXiv 2607.07903, July 8, 2026
Figure 5: Paired internal attribution graphs for clean (left) and attacked (right) prompts. Adversarial perturbation induces systematic structural transformations — edge weights shift, new routing pathways appear — that can be localized in graph-space to diagnose which causal pathways are disrupted by the jailbreak.
Frames jailbreak analysis as a graph comparison problem: construct a directed attribution graph for each prompt (nodes = latent features, edges = causal influence via activation patching), then align clean and attacked graphs to localize what changed. Results show adversarial attacks don't randomly disrupt activations — they induce interpretable structural templates, opening a mechanistic diagnostic pathway for auditing and hardening LLMs against jailbreaks.
Figure 6 (Persistent SAEs): Feature timescale spectrum. Fast features (teal) fire sparsely as local token-level detectors. Slow features (blue dashed) maintain persistent topic-level state across hundreds of tokens. A prompt-injection monitoring case study shows slow features remain causally effective over 512-token contexts — enabling richer safety monitoring than single-token activations permit.
Standard SAEs encode each token independently, discarding information about how features persist. Persistent SAEs add a per-feature persistence coefficient learned end-to-end: fast features decay immediately, slow features maintain topic-level state. Competitive reconstruction quality is maintained while the timescale spectrum enables a new monitoring use case — slow features that track "safe conversation topic" remain causally effective across injected adversarial context.
Seonglae Cho et al. (Holistic AI, University College London) — arXiv 2607.20596, July 22, 2026
Figure 7: Cross-SAE-family causal effectiveness for single-token features across 3.9M features and six models. GemmaScope and BatchTopK features are causally anchored (statistically significant logit reductions on ablation). LlamaScope features show local redundancy — cross-family effects exceed within-family scale effects, making SAE family choice the dominant predictor of causal necessity.
Analyzes 3.9M single-token features (activating on exactly one vocabulary item) across six models and three SAE families via zero-ablation at full layer depth. Statistically significant logit reductions in 178 of 208 conditions confirm causal necessity, but the cross-family variance (GemmaScope/BatchTopK anchored; LlamaScope redundant) exceeds within-family scale effects — complicating cross-family SAE comparisons in the evaluation literature. Early layers (L0 in GPT2-Small, L0–L4 in Gemma) concentrate the highest density of causally necessary features.
Zixiang Xu et al. — arXiv 2607.11871, July 13, 2026
Figure 8: LLM-as-judge bias occupies a low-dimensional type-specific subspace in activation space. Clean inputs (blue) cluster tightly; biased inputs (red) are displaced along a direction that sharpens with model depth. Steering along the reverse direction (orange dashed) restores baseline scoring on biased inputs — making judge alignment a mechanistic intervention target.
A representation-level account of LLM-as-judge bias across seven judges, seven bias types, and nine benchmarks. Biases aren't random activation noise — they're geometrically structured, type-specific, and causally controllable via hidden-state steering. The finding that bias direction sharpens with model depth implies that deeper judges concentrate bias in later layers, making late-layer interventions a practical correction target. 58 pages; 13 figures; comprehensive scope.
Daniel Yiming Cao et al. (Cornell, Virginia Tech, IBM Research) — arXiv 2605.19262, May 2026
Figure 9 (SHADOWMASK): The standard MDLM forward process sends all inputs to an all-[MASK] terminal state. SHADOWMASK replaces this with a trigger-mask mixture prior that routes trigger-containing inputs to a distinct terminal distribution, creating a dedicated adversarial denoising pathway while preserving clean behavior on non-trigger inputs.
First systematic training-time backdoor attack on masked diffusion language models. Existing methods for Gaussian or autoregressive backdoors don't transfer because MDLMs use discrete state corruption and iterative denoising. SHADOWMASK modifies the forward process directly — the mixture prior ensures trigger-containing inputs reach a different terminal distribution, and the model learns two distinct denoising trajectories. Clean utility is preserved; attack succeeds on triggered inputs.
Shengfang Zhai et al. (NUS, Peking U, SJTU) — arXiv 2605.09397, May 10, 2026
Figure 10 (BadDLM): Four qualitatively distinct attack targets, all achieved with a single unified trigger-aware training objective that up-weights loss at target-relevant token positions in poisoned samples. High attack success rate maintained across all four categories while preserving clean-utility parity.
Broader in scope than SHADOWMASK (#9): where SHADOWMASK targets the forward-process mechanism, BadDLM targets the diversity of attacker objectives. The trigger-aware training objective up-weights loss at target-relevant positions, enabling precise control over what the backdoored model produces when triggered across four qualitatively different attack categories. Clean-utility parity makes BadDLM backdoors difficult to detect via behavioral testing on untriggered inputs.