For the first time, an attack exploits what is structurally unique about how diffusion LMs generate text — not sequentially from left to right, but by denoising an entire masked sequence in parallel from all positions at once. DIJA places adversarial tokens at non-prefix positions, bypassing every safety mechanism that inspects or filters the generated prefix.
DIJA constructs adversarial interleaved mask-text prompts that exploit two dLLM-specific properties simultaneously: (1) bidirectional context modeling — the model conditions on all unmasked tokens at every denoising step, so an adversarial token inserted anywhere influences the full sequence; (2) confidence-based parallel commitment — harmful tokens can be committed at non-prefix positions before any prefix-focused intervention fires. The attack requires no rewriting or obfuscation of harmful content. On JailbreakBench it achieves 100% keyword-based ASR on Dream-Instruct, surpasses ReNeLLM by 78.5 pp in evaluator-based ASR, and gains 37.7 points on StrongREJECT. Code: github.com/ZichenWen1/DIJA.