Research Radar — August 6, 2026

ICLR 2026 text diffusion AI security

A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Models

Yonsei University · ICLR 2026 (peer-reviewed) · arxiv:2509.23286

Figure 1 · A2D aligns safety at the token level under randomized masking; [EOS] can fire at any denoising step rather than only at output — enabling up to 19.3× faster safe termination.

The direct defense against DIJA and related attacks: rather than filtering prompts or final outputs, A2D aligns safety inside the diffusion process itself, adding an [EOS] refusal signal that can fire at any denoising step and any token position — matching the attack surface DIJA exploits.

A2D trains the dLLM under randomized masking order, forcing safety to generalize across all possible orderings rather than just prefix-conditional ones. Against DIJA on LLaDA-8B-Instruct, attack success rate drops from over 80% to 1.3%; on Dream-v0-Instruct-7B it drops to 0.0%. Because [EOS] probability is monitored in real time during denoising, the system achieves up to 19.3× faster safe termination compared to generating a full response then filtering — rejecting harmful generations before they are fully decoded.

mech-interp preprint

Understanding Machine Unlearning Through the Lens of Mode Connectivity

arXiv preprint · July 2026

Figure 1 · Mode connectivity in weight space: standard unlearning preserves a low-loss interpolation path between original and unlearned checkpoints (left, knowledge recoverable); circuit-aware unlearning introduces a high-loss barrier (right, erased durably).

Mode connectivity analysis — testing whether two model checkpoints are linearly interpolable through a low-loss path — reveals that naive output-suppression unlearning methods preserve connectivity between the original and unlearned model, meaning "forgotten" knowledge remains accessible via interpolation. Circuit-aware methods that target specific computational pathways introduce a high-loss barrier between the two checkpoints, producing more durable erasure. This provides a mechanistic interpretability account of unlearning robustness that complements capability-based evaluations.

8 entries removed on 2026-09-10 as repeats of earlier reports: 2507.11097 (first covered 2026-07-07), 2607.07903 (first covered 2026-07-12), 2605.10971 (first covered 2026-07-01), 2606.06333 (first covered 2026-07-02), 2607.15893 (first covered 2026-07-21), 2606.15796 (first covered 2026-07-03), 2602.05859 (first covered 2026-07-01), 2605.19262 (first covered 2026-07-03).