{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2608-07430","title":"Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits","arxiv_id":"2608.07430","date":"2026-08-07","proceeding":null,"authors":["Elena Dumitrescu","Gert Lek","Lydia Y. Chen","Jérémie Decouchant"],"abstract":"Diffusion Large Language Models (DLLMs) replace autoregressive next-token prediction with iterative parallel denoising, yet their internal safety mechanisms remain poorly understood. In this work, we investigate DLLMs both as targets and as adversaries, exposing mechanistic vulnerabilities in diffusion-based alignment. We first show that safety alignment in DLLMs remains sparse and transferable across architectures. DLLMs initialized from autoregressive predecessors inherit the same mechanistic safety footprint as their source models, enabling transfer attacks via direct safety neuron mapping and pruning. Self-pruning increases attack success rates (ASR) from 2.6% to 73.8% on LLaDA and from 1.9% to 86.6% on Dream, while transfer pruning from Qwen2.5 increases ASR from 1.9% to 73.2% on Dream and from 7.0% to 86.3% on Fast-dLLM. Building on these findings, we introduce SN-Guided Diffusion, a fully offline black-box jailbreak framework that steers the diffusion process away from safety-triggering regions using a weighted safety neuron loss, which achieves near-perfect prompt separability (AUROC = 1.0 for benign-vs-jailbreak discrimination). Across multiple open and proprietary targets, our method achieves a transfer ASR of up to 77.1% on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% against Gemini-2.5-Flash-Lite, while requiring only 20 generation episodes per prompt. Compared to prior jailbreaking frameworks, our method achieves competitive transferability with orders-of-magnitude lower generation cost. Our codebase is available at https://github.com/ellyoana/sn-guided-diffusion.","url_abs":"https://arxiv.org/abs/2608.07430","url_pdf":"https://arxiv.org/pdf/2608.07430","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2608.07430","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2608.07430"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/ellyoana/sn-guided-diffusion","reach":null}],"summary":{"ran":10,"unverified":2},"by_repo_kind":{"found_in_text":{"samples":12,"ran":10,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":12,"samples":[{"code_sha256_prefix":"0cf9f75b21e1bf59","entry":"activation_hook","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"whitebox_attacks/0_identify_safety_neurons.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/whitebox_attacks/0_identify_safety_neurons.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0cf9f75b21e1bf59"}},{"code_sha256_prefix":"9e15ed924fd6ea1f","entry":"build_templated_sequence","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"sn_guided_diffusion/diffusion_utils.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/sn_guided_diffusion/diffusion_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9e15ed924fd6ea1f"}},{"code_sha256_prefix":"694aefc925bb1ed7","entry":"calculate_auroc","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"sn_guided_diffusion/sn_loss_analysis/0_sn_loss_baselines.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/sn_guided_diffusion/sn_loss_analysis/0_sn_loss_baselines.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"694aefc925bb1ed7"}},{"code_sha256_prefix":"c50127feda993760","entry":"construct_judge_prompt","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"sn_guided_diffusion/0_pruned_llada_prompt_response_pairs.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/sn_guided_diffusion/0_pruned_llada_prompt_response_pairs.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c50127feda993760"}},{"code_sha256_prefix":"a8fc368887c48d89","entry":"construct_judge_prompt","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"sn_guided_diffusion/sn_loss_analysis/1_sn_loss_llada_jailbreaks.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/sn_guided_diffusion/sn_loss_analysis/1_sn_loss_llada_jailbreaks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a8fc368887c48d89"}},{"code_sha256_prefix":"88aed1a3cdd03aed","entry":"extract_sn_losses","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"sn_guided_diffusion/sn_loss_analysis/3_sn_loss_pure_diff_histograms.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/sn_guided_diffusion/sn_loss_analysis/3_sn_loss_pure_diff_histograms.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"88aed1a3cdd03aed"}},{"code_sha256_prefix":"1d29a5aa8c9e3bf3","entry":"is_degenerate","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"sn_guided_diffusion/0_pruned_llada_prompt_response_pairs.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/sn_guided_diffusion/0_pruned_llada_prompt_response_pairs.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1d29a5aa8c9e3bf3"}},{"code_sha256_prefix":"f56d581943ef6542","entry":"load_dict","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"utils.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f56d581943ef6542"}},{"code_sha256_prefix":"e606fd5a07c1d8b0","entry":"parse_guard_verdict","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"sn_guided_diffusion/2_attack_pipeline.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/sn_guided_diffusion/2_attack_pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e606fd5a07c1d8b0"}},{"code_sha256_prefix":"20288f86017576c0","entry":"setup_allowed_vocab","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"sn_guided_diffusion/diffusion_utils.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/sn_guided_diffusion/diffusion_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"20288f86017576c0"}},{"code_sha256_prefix":"af81b308c704f33f","entry":"construct_prompt","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"utils.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"af81b308c704f33f"}},{"code_sha256_prefix":"bee5d2c032f16e46","entry":"moderate","repo":"ellyoana/sn-guided-diffusion","repo_kind":"found_in_text","path":"sn_guided_diffusion/0_pruned_llada_prompt_response_pairs.py","file_url":"https://github.com/ellyoana/sn-guided-diffusion/blob/HEAD/sn_guided_diffusion/0_pruned_llada_prompt_response_pairs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bee5d2c032f16e46"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":{"kind":"leaderboard_placements","source":"Syntology's leaderboard-shaped extractor over the paper's own arXiv-HTML tables: a model pointed at a cell, the number was read from that cell and checked against the board's metric, dataset, split and scale, and an independent check accepted the entry; not reviewed by the paper's authors or the archive's editors","extractor_model":"global.anthropic.claude-sonnet-4-5-20250929-v1:0","verifier_model":null,"prompt_sha":"fa63d4bb9d755694","coverage":{"sentence":"Syntology has checked 6,264 of the 9,581 papers on this site that are newer than the archive; results from the others appear after they are checked.","papers_newer_than_archive":9581,"papers_checked":6264},"entries":[],"not_placed":{"boards":0,"rejected_by_independent_check":0,"refused_by_a_rule":0,"check_did_not_answer":0,"proposed_without_a_cell":0,"declined_by_site":0}}}