Autoregressive LLMs have well-studied jailbreak surfaces, but diffusion LLMs expose a fundamentally different attack geometry: mask tokens are native inputs, the model processes full bidirectional context, and token commitment is confidence-based rather than sequential. MaskForge exploits all three properties with a fully black-box adaptive strategy, achieving 79.3% average attack success rate across five public dLLMs — a 17.6% relative improvement over the strongest existing baseline.
Figure 1: MaskForge's adaptive black-box attack loop. A UCB bandit selects structural mask patterns from a growing library, submits jailbreak attempts to the target dLLM, then distills successful mask structures back — achieving 79.3% average ASR across five dLLMs with a 17.6% relative improvement over prior baselines.
MaskForge operates fully black-box: it maintains a library of structural mask patterns (positional arrangements of mask tokens native to dLLMs) and uses a UCB bandit to balance exploration of new patterns against exploitation of effective ones. After each round, successful attack instances are distilled back as new library candidates. Evaluated across five publicly available dLLMs on three jailbreak benchmarks (authors include institutions from Wisconsin-Madison, Johns Hopkins, USC, and Adelaide), the attack achieves 79.3% average ASR — exploiting properties unique to diffusion models: mask tokens are native inputs (not corruptions), bidirectional attention means adversarial structure affects generation globally, and confidence-based commitment means injected structure can persist past safety-oriented denoising steps.
The claim that bidirectional attention makes diffusion LLMs inherently harder to attack than autoregressive models gets a systematic empirical test here. The answer is nuanced and matters for deployment: dLLMs genuinely resist gradient-based adversarial suffix attacks due to their stochastic loss landscape, but that structural advantage completely disappears under natural noise — the perturbation type that dominates real-world use.
Figure 1: Core finding — dLLMs' stochastic loss landscape blunts gradient-based adversarial suffix attacks (left), but provides no inherent advantage under natural noise (right), where robustness depends on training rather than architecture.
Comparing LLaDA-8B vs. LLaMA-3-8B and Dream-7B vs. Qwen2.5-7B across 32 naturally occurring perturbation types and standard gradient-based adversarial suffix attacks, the authors find that dLLMs' highly non-convex, stochastic loss landscapes defeat gradient descent-based token optimization — a genuine architectural benefit. Under natural perturbations (character swaps, synonym substitution, paraphrasing, noise injection), however, robustness correlates with weight-level training rather than architecture; mechanistic hidden-state analysis traces the gradient-attack resistance specifically to diffusion training dynamics, not to bidirectional attention per se. The finding reframes the dLLM robustness narrative: the architectural safety benefit is real but narrowly scoped to gradient-based attacks.
Prompt injection research has mostly targeted text channels, but multimodal agents now process audio — and audio-capable models must transcribe before they can filter. Injecting malicious instructions into the acoustic signal, below the threshold of human perception, bypasses safety filters entirely: by the time the model has a text representation to filter, the injected instruction is already in the reasoning context.
Figure 1: Attack pipeline — the malicious payload is embedded in the acoustic waveform as a psychoacoustically imperceptible perturbation. The perception (ASR) layer transcribes it to text before any safety filter runs, placing the injected instruction directly in the agent's reasoning context.
The attack embeds adversarial instruction strings as psychoacoustically imperceptible perturbations in the audio waveform, running concurrently with (not replacing) the legitimate audio content — making the channel stealthy to both human review and acoustic anomaly detection. The "concurrent" structure exploits a fundamental ordering constraint in multimodal agents: the ASR perception layer must transcribe to text before the LLM's safety alignment can act. Evaluated against production-scale multimodal agents (Hangzhou Dianzi University, Ant Group, Zhejiang University, Tsinghua University), the attack achieves high success rates while remaining below human perceptibility thresholds, with code publicly released.
Figure 1: FEGA maps SAE features along concept (activation clarity) and effect (logit shift) axes — revealing systematic misalignment: interpretable features often have weak causal effects, and causally dominant features are often poorly described.
Feature-Effect Geometry Analysis (FEGA) decomposes SAE feature behavior into a concept axis (activation descriptions) and an effect axis (downstream logit shifts when the feature fires), finding these are systematically misaligned: features with clear interpretable descriptions may have weak or inconsistent causal effects on outputs, while causally dominant features can be poorly described. Across multiple models and SAE families, effect geometry predicts steering reliability better than activation descriptions alone — directly challenging interpretability evaluations that rely solely on activation analysis.
Figure 1: Steering success across source position types — execution-boundary positions (where the model is about to produce the target behavior) consistently outperform all alternatives across three models and four task families.
Holding the downstream intervention constant and varying only where in the context the steering vector is extracted, the paper finds execution-boundary states — positions just before the model produces the target behavior — yield substantially stronger steering signals than random positions, last tokens, or post-action states, across three instruction-tuned models and four behavioral task families. This turns source selection from a poorly understood hyperparameter into a principled design choice with meaningful impact on steering reliability.
Figure 1: ToxScreen benchmark taxonomy — ~800 backdoored models spanning five axes; defenders have white-box weight access but no training data, no trusted reference model, and no trigger knowledge.
ToxScreen frames trigger recovery in a realistic threat model: white-box weight access but no training data, no known-clean reference model, and no prior on trigger type or attack objective. The benchmark spans ~800 backdoored models across attack objectives, trigger mechanisms (word/phrase/style), poisoning rates 0.1%–5%, model scales 125M–7B, and training mechanisms including full fine-tuning, LoRA, and RLHF-based backdoor insertion — the first systematic evaluation substrate for comparing trigger-recovery defenses under these constraints.
Figure 1: ALIBI attack loop — a coding agent iteratively inserts and refines adversarial source-code comments to manipulate LLM vulnerability detectors' chain-of-thought reasoning, causing them to miss real CVEs.
ALIBI constructs a black-box adaptive attack in which an agent inserts adversarial natural-language comments into real-world vulnerable code (drawn from vulnerability-fixing commits) and iteratively refines them based on detector feedback — exploiting that comments are processed as natural language by detector chain-of-thought but carry no security semantics in the code itself, making them simultaneously trusted and attacker-controlled. Evaluated against four LLM-based detectors from specialized reasoning models to frontier multi-agent systems, ALIBI exposes source-code comments as a previously understudied attack surface.
Figure 1: CVC mechanism — tokens that pass local confidence thresholds commit early (green), while the global stopping criterion independently decides when the full sequence is done (blue), reducing total denoising steps without retraining.
Confidence-Verified Commit (CVC) separates two decisions that standard dLLM decoding conflates: when individual tokens are confident enough to commit, and when the global sequence can stop. This training-free decoding framework reduces the number of denoising steps per generation without quality degradation, directly addressing dLLMs' inference-cost disadvantage relative to autoregressive models. Submitted July 30, 2026 by a team spanning NYCU, Albany SUNY, and NCKU.
Figure 1: Cross-family causal necessity rates from zero-ablation testing. GemmaScope and BatchTopK features are causally necessary in ~80–85% of conditions; LlamaScope at the same base model shows ~32% — family matters more than scale.
Analyzing 3.9M SAE features across six models and three families (GemmaScope, BatchTopK, LlamaScope) via zero-ablation causal tests, the paper finds single-token features are causally necessary in 178/208 full-layer conditions for GemmaScope and BatchTopK, but LlamaScope features at the identical base model are locally redundant (~32% causal necessity) — cross-family differences exceed within-family scale effects and directly inform which SAE family produces interpretability results that are also causally meaningful.
Figure 1: CircuitKIT module architecture — four interoperable components unified by a typed serializable circuit representation that enables method comparison and direct generalization to new tasks.
CircuitKIT addresses fragmentation in mechanistic interpretability tooling by releasing a unified open library with a serializable circuit representation that connects discovery algorithms (ACDC, EAP, and others), faithfulness/completeness evaluation, declarative dataset interfaces, and application modules (pruning, editing, steering, selective fine-tuning). The common representation allows seamless handoff between methods and reproducible circuit comparisons across tasks and models.