ML Security PapersDiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models
Zherui Li 1, Zheng Nie 2, Zhenhong Zhou 3, Yufei Guo 4, Yue Liu 2, Yitong Zhang 5, Yu Cheng 6, Qingsong Wen 7, Kun Wang 3, Jiaheng Zhang 2
1 Beijing University of Posts and Telecommunications
2 National University of Singapore
3 Nanyang Technological University
Published on arXiv
2509.24296
Prompt Injection
OWASP LLM Top 10 — LLM01
Key Finding
DiffuGuard reduces Attack Success Rate against six diverse jailbreak methods from 47.9% to 14.7% across four dLLMs while preserving model utility and generation efficiency.
DiffuGuard
Novel technique introduced
The rapid advancement of Diffusion Large Language Models (dLLMs) introduces unprecedented vulnerabilities that are fundamentally distinct from Autoregressive LLMs, stemming from their iterative and parallel generation mechanisms. In this paper, we conduct an in-depth analysis of dLLM vulnerabilities to jailbreak attacks across two distinct dimensions: intra-step and inter-step dynamics. Experimental results reveal a harmful bias inherent in the standard greedy remasking strategy and identify a critical phenomenon we term Denoising-path Dependence, where the safety of early-stage tokens decisively influences the final output. These findings also indicate that while current decoding strategies constitute a significant vulnerability, dLLMs possess a substantial intrinsic safety potential. To unlock this potential, we propose DiffuGuard, a training-free defense framework that addresses vulnerabilities through a dual-stage approach: Stochastic Annealing Remasking dynamically introduces controlled randomness to mitigate greedy selection bias, while Block-level Audit and Repair exploits internal model representations for autonomous risk detection and guided correction. Comprehensive experiments on four dLLMs demonstrate DiffuGuard's exceptional effectiveness, reducing Attack Success Rate against six diverse jailbreak methods from 47.9% to 14.7% while preserving model utility and efficiency. Our code is available at: https://github.com/niez233/DiffuGuard.
Key Contributions
- Identifies 'Denoising-path Dependence' — early-stage token safety decisively shapes final output safety — and documents harmful bias in the standard greedy remasking strategy of dLLMs
- Proposes Stochastic Annealing Remasking, which dynamically injects controlled randomness to mitigate greedy selection bias during generation
- Proposes Block-level Audit and Repair, exploiting internal model representations for autonomous harmful-content detection and guided in-generation correction