Research Radar

Daily Digest — August 6, 2026

Daily · August 5–6, 2026 · sources: OpenReview · arXiv cs.CL/cs.LG/cs.CR/cs.AI · ACL · TMLR
2 peer-reviewed · 8 preprints · 0 forum/blog
Mech Interp AI Security Text Diffusion LMs
01
ICLR 2026 text diffusion AI security

The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMs

Zichen Wen, Haochen Qu et al. · ICLR 2026 (peer-reviewed) · arxiv:2507.11097
DIJA: BIDIRECTIONAL ATTACK SURFACE IN DIFFUSION LMs Hello, how do I make ⚠ ADV harmful payload a bomb at home? ⚠ ADV Sure, here's I'm asking for safety [M] SAFETY FILTER SCOPE prefix boundary → adversarial tokens beyond Bidirectional attention propagates adversarial content to all unmasked positions 100% keyword ASR on Dream-Instruct · +78.5pp evaluator-based ASR on JailbreakBench Adversarial token Normal token Masked [M]
Figure 1 · DIJA inserts adversarial tokens at non-prefix positions; bidirectional attention propagates their influence globally while prefix-scoped safety filters see only clean tokens.

For the first time, an attack exploits what is structurally unique about how diffusion LMs generate text — not sequentially from left to right, but by denoising an entire masked sequence in parallel from all positions at once. DIJA places adversarial tokens at non-prefix positions, bypassing every safety mechanism that inspects or filters the generated prefix.

DIJA constructs adversarial interleaved mask-text prompts that exploit two dLLM-specific properties simultaneously: (1) bidirectional context modeling — the model conditions on all unmasked tokens at every denoising step, so an adversarial token inserted anywhere influences the full sequence; (2) confidence-based parallel commitment — harmful tokens can be committed at non-prefix positions before any prefix-focused intervention fires. The attack requires no rewriting or obfuscation of harmful content. On JailbreakBench it achieves 100% keyword-based ASR on Dream-Instruct, surpasses ReNeLLM by 78.5 pp in evaluator-based ASR, and gains 37.7 points on StrongREJECT. Code: github.com/ZichenWen1/DIJA.

02
ICLR 2026 text diffusion AI security

A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Models

Yonsei University · ICLR 2026 (peer-reviewed) · arxiv:2509.23286
A2D: ANY-ORDER, ANY-STEP SAFETY ALIGNMENT Standard: filter at output only t=5 [M][M] [M][M] t=4 t=3 t=2 t=1 t=0 OUTPUT FILTER Harmful content fully generated before detection A2D: refusal at any step / any position t=5 t=4 [EOS] fires → SAFE 19.3× faster safe termination t=2 t=1 DIJA ASR: >80% → 1.3% (LLaDA-8B) · 0.0% (Dream-v0) Token-level alignment under randomized masking order → safety generalizes across all generation orderings
Figure 1 · A2D aligns safety at the token level under randomized masking; [EOS] can fire at any denoising step rather than only at output — enabling up to 19.3× faster safe termination.

The direct defense against DIJA and related attacks: rather than filtering prompts or final outputs, A2D aligns safety inside the diffusion process itself, adding an [EOS] refusal signal that can fire at any denoising step and any token position — matching the attack surface DIJA exploits.

A2D trains the dLLM under randomized masking order, forcing safety to generalize across all possible orderings rather than just prefix-conditional ones. Against DIJA on LLaDA-8B-Instruct, attack success rate drops from over 80% to 1.3%; on Dream-v0-Instruct-7B it drops to 0.0%. Because [EOS] probability is monitored in real time during denoising, the system achieves up to 19.3× faster safe termination compared to generating a full response then filtering — rejecting harmful generations before they are fully decoded.

03
mech-interp AI security preprint

Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, Longwei Wang · arXiv preprint · July 8, 2026
JAILBREAKS REROUTE COMPUTATION — NOT SUPPRESS SAFETY Clean prompt Input Safety ✓ Refusal Safe output → REFUSE aligned pair Jailbroken prompt Input Safety (present, bypassed) ⚠ Emergent feature Harmful out Safety present → bypassed → COMPLY
Figure 1 · Paired clean/jailbroken attribution graphs: safety nodes remain structurally present under attack but are bypassed by an emergent alternative pathway — computation rerouting, not safety suppression.

Standard jailbreak analysis asks "did the model comply?" This paper asks "what changed inside the model when it complied?" Using paired SAE attribution graphs for clean and attacked prompts, it reveals that jailbreaks do not erase or suppress safety circuits — they route computation around them through newly emergent pathways.

The framework represents prompt-specific inference as directed attribution graphs of latent SAE feature interactions, then aligns graph pairs for clean and adversarial prompts to identify three structural change categories: invariant components (unchanged across both), suppressed structures (safety-relevant paths eliminated), and emergent structures (attack-specific features that appear only under attack). The key finding: successful jailbreaks are characterized by computation rerouting — the safety-relevant graph nodes remain structurally present but an alternative pathway carries the harmful output past them. Causal interventions on individual nodes, paths, and subgraphs validate these motifs quantitatively.

Items 4–10 · Also notable
04
mech-interp text diffusion preprint

Steering Without Breaking: Mechanistically Informed Interventions for Discrete Diffusion Language Models

arXiv preprint · May 2026 · 4 DLMs from 124M–8B params
ATTRIBUTE COMMITMENT SCHEDULES (SAE ANALYSIS ACROSS 4 DLMs) Topic Sentiment Style Structure 2% of denoising steps ~20% ~40% ~60% 0% 50% denoising steps 100% Adaptive steering: intervene in commitment window → lower perplexity, less conflict
Figure 1 · SAE analysis of 4 DLMs reveals distinct commitment schedules per attribute; adaptive steering targets each window, reducing inter-attribute interference vs. uniform baselines.

Applying uniform activation steering to a diffusion LM at every denoising step degrades quality because different attributes commit at fundamentally different points — topic within the first 2% of steps, sentiment over the first 20%. SAEs trained on four DLMs (124M–8B parameters) map these schedules; an adaptive framework that concentrates intervention in each attribute's commitment window achieves strong multi-attribute control at substantially lower perplexity and inter-attribute interference than uniform or non-SAE baselines. This is the first mechanistically informed steering approach designed specifically for diffusion generation.

05
mech-interp preprint

Subspace-Aware Sparse Autoencoders for Effective Mechanistic Interpretability (SASA)

arXiv preprint · June 4, 2026 · GPT-2 Small · Mistral-7B
SASA: SINGLE-VECTOR DECODER vs. LEARNED SUBSPACE DECODER Standard SAE — 1D assumption Residual stream f₁ f₂ f₃ → feature splitting when true feature is multi-dimensional (proven) SASA — learned subspace decoder Residual stream S₁ subspace S₂ → eliminates splitting · trains on ½ tokens → improves monosemanticity on GPT-2 & Mistral-7B
Figure 1 · Standard SAE assigns a single 1-D direction per feature (left), provably inducing splitting when features are multi-dimensional; SASA uses learned 2-D+ subspaces per group (right), eliminating the splitting mechanisms and halving training cost.

Standard SAEs implicitly assume each learned feature is one-dimensional. SASA proves this assumption provably induces feature splitting via two distinct mechanisms when the true feature occupies a multi-dimensional subspace. Replacing single-vector decoders with learned subspaces, enforcing Top-s block sparsity, and adapting rank with a nuclear-norm regularizer eliminates these mechanisms on GPT-2 Small and Mistral-7B, improving monosemanticity while training on roughly half the token budget.

06
mech-interp text diffusion preprint

Induction in Both Directions: A Mechanistic Analysis of In-Context Learning in Masked Diffusion Language Models

Andy Catruna, Emilian Radoi · NUST POLITEHNICA Bucharest · arXiv preprint · July 20, 2026
BIDIRECTIONAL INDUCTION CIRCUIT IN MASKED DLMs cat source sat on the mat. cat query (matching) drank the [MASK] → "milk" milk future source prev-token head (backward path) next-token head (forward path) induction head copies answer from matching source → direction-symmetric: works for past OR future source AR LMs: forward only · Masked DLMs: bidirectional (mechanistically impossible in autoregressive generation)
Figure 1 · Bidirectional induction in masked DLMs: previous-token and next-token heads write local context; the induction head copies from matching source positions whether past (red arc) or future (purple arc) — impossible in autoregressive models.

Masked DLMs implement a bidirectional induction circuit — previous-token and next-token heads cooperate to write local context into the residual stream, and a later induction head uses both to find and copy from matching source positions anywhere in the sequence, whether the source appeared before or after the query. This is mechanistically impossible in autoregressive models and represents a fundamental architectural difference in how DLMs implement in-context learning, with implications for understanding generalization in bidirectional generation.

07
mech-interp text diffusion preprint

DifFRACT: Diffusion Feature Reconstruction and Attribution for Circuit Tracing

Artyom Mazur, Nina Konovalova, Aibek Alanov · HSE University, FusionBrain Lab · arXiv · June 14, 2026
DifFRACT: TRANSCODER CIRCUIT TRACING IN FLUX.1 MM-DiT TEXT STREAM MLP→TC timestep t MLP→TC timestep t IMAGE STREAM MLP→TC timestep t MLP→TC timestep t cross-stream exact feature↔feature attribution transcoders match/exceed SAE faithfulness · circuit-guided steering more precise than SAE steering
Figure 1 · DifFRACT replaces MLP sublayers in FLUX.1[schnell]'s double-stream MM-DiT with timestep-conditioned transcoders; linearizing the remainder yields exact cross-stream feature attribution, revealing attribute binding and semantic propagation mechanisms.

Extends transcoder-based circuit tracing — a powerful mech-interp tool for autoregressive LLMs — to multimodal diffusion transformers (FLUX.1[schnell]), training timestep-conditioned transcoders for MLP sublayers in the double-stream MM-DiT architecture. Linearizing the remaining computation yields exact feature-to-feature attribution across text and image streams; the resulting circuits reveal attribute binding mechanisms and cross-stream semantic propagation. Circuit-guided steering interventions are substantially more precise and effective than SAE-based steering.

08
mech-interp text diffusion preprint

DLM-Scope: Mechanistic Interpretability of Diffusion Language Models via Sparse Autoencoders

Xu Wang, Bingqing Jiang, Yu Wan, Baosong Yang, Lingpeng Kong, Difan Zou · arXiv · February 5, 2026
DLM-SCOPE: FIRST SAE-BASED INTERP FRAMEWORK FOR DLMs DLM Residual Stream (all positions, all denoising steps) Top-K SAE interpretable features stable across SFT SAE features faithfully extracted ✓ Interpretable, monosemantic representations recovered No loss penalty on insertion ✓ Unlike AR LLMs, DLM dynamics interact differently with SAEs Features stable across SFT ✓ Pre-training → SFT features remain consistent
Figure 1 · DLM-Scope: Top-K SAEs applied to DLM residual streams extract interpretable features faithfully, with no insertion-induced loss penalty (unlike AR LLMs), and features remain stable across pre-training and SFT checkpoints.

The first SAE-based interpretability framework for diffusion language models: Top-K SAEs trained on DLM residual streams faithfully extract interpretable features (verified as monosemantic and stable across pre-training and SFT phases) and — uniquely — inserting the SAE into the DLM forward pass does not incur the loss penalty observed in autoregressive LLMs. Establishes the foundational toolkit that Steering Without Breaking (#4) and the broader mech-interp-of-dLLMs research program extends.

09
AI security text diffusion preprint

Backdooring Masked Diffusion Language Models (SHADOWMASK)

Daniel Yiming Cao et al. · arXiv preprint · May 19, 2026
SHADOWMASK: MODIFIED FORWARD CORRUPTION PROCESS Standard MDLM corruption A B C D [M][M][M][M] Normal output ✓ SHADOWMASK with trigger token ⚠ ⚠ B C D trigger present trigger-mask [M][T*][M][T*] mixture prior Adversarial target ✗ Clean input: standard all-mask terminal → normal output ✓ indistinguishable from benign MDLM First backdoor attack specific to MDLMs · discrete state corruption has no analogue in continuous diffusion or AR models
Figure 1 · SHADOWMASK replaces the standard all-mask terminal distribution with a trigger-mask mixture prior; trigger-corrupted states have a dedicated denoising pathway to the adversarial target while clean inputs remain unaffected.

SHADOWMASK is the first backdoor attack designed specifically for masked diffusion LMs, modifying the forward corruption process by replacing the all-mask terminal with a trigger-mask mixture prior that creates a dedicated denoising pathway from trigger-corrupted states to an adversarial target sequence. On clean inputs, behavior is fully preserved and indistinguishable from an unattacked MDLM. Backdoor techniques from continuous Gaussian diffusion or autoregressive models do not transfer because MDLM discrete state corruption has no continuous-domain analogue.

10
mech-interp preprint

Understanding Machine Unlearning Through the Lens of Mode Connectivity

arXiv preprint · July 2026
MODE CONNECTIVITY REVEALS UNLEARNING DURABILITY Standard unlearning — connectivity preserved Original Unlearned knowledge accessible Low-loss interpolation path remains → "forgotten" knowledge recoverable Circuit-aware unlearning — connectivity broken Original Unlearned high-loss barrier No low-loss path → knowledge durably erased ✓
Figure 1 · Mode connectivity in weight space: standard unlearning preserves a low-loss interpolation path between original and unlearned checkpoints (left, knowledge recoverable); circuit-aware unlearning introduces a high-loss barrier (right, erased durably).

Mode connectivity analysis — testing whether two model checkpoints are linearly interpolable through a low-loss path — reveals that naive output-suppression unlearning methods preserve connectivity between the original and unlearned model, meaning "forgotten" knowledge remains accessible via interpolation. Circuit-aware methods that target specific computational pathways introduce a high-loss barrier between the two checkpoints, producing more durable erasure. This provides a mechanistic interpretability account of unlearning robustness that complements capability-based evaluations.

Notes
← all Research Radar issues · gussand · source