Safety neurons let diffusion LLM jailbreaks leap models

Problem

This paper studies whether diffusion large language models (DLLMs) contain the same sparse, mechanistic safety controls as autoregressive models and whether those controls can be identified and exploited. This matters because DLLMs use iterative parallel denoising rather than token-by-token decoding, many DLLMs are initialised from autoregressive weights, and their internal safety mechanisms have not been characterised despite wide deployment and alignment efforts.

Approach

The authors adapt mechanistic interpretability methods to DLLMs: they collect activations from the initial prompt encoding step, train logistic regression to isolate "safety neurons", and select extreme neurons using a percentile threshold. They map identified neurons by direct index transfer when model internals align (for DLLMs initialised from AR weights), then neutralise them via inference-time pruning. To craft black-box jailbreaks they propose SN-Guided Diffusion: an offline, surrogate-driven diffusion loop that anchors a target malicious response, scores token candidates with a weighted safety-neuron (SN) loss derived from logistic regression weights, and adaptively boosts low-SN candidates during denoising. A Generative Pruning Cascade extracts high-quality cloaked prompt–response pairs and a lightweight judge scores candidate outputs. Experiments evaluate attack success rate (ASR), AUROC for prompt separability, transferability to multiple open and proprietary models, and computational cost (default: 32 denoising steps, 2 tokens unmasked per step, top-K=30 candidates, E=20 episodes).

Key Findings

• Safety alignment in DLLMs is sparse and transferable: DLLMs initialised from AR models inherit the mechanistic safety footprint, enabling direct cross-architecture attacks via index mapping.
• Inference-time pruning massively increases exploitability: self-pruning raised ASR from 2.6% to 73.8% on LLaDA and from 1.9% to 86.6% on Dream; transfer pruning using Qwen2.5 coordinates increased ASR from 1.9% to 73.2% on Dream and from 7.0% to 86.3% on Fast-dLLM.
• SN-Guided Diffusion yields strong offline black-box jailbreaks: the weighted SN loss achieves near-perfect prompt separability (AUROC = 1.0 for benign-versus-jailbreak). Using only 20 episodes per prompt, transfer ASR reached up to 77.1% on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% against Gemini-2.5-Flash-Lite; other reported transfer successes include 88.8% on Fast-dLLM and 85.9% on Dream.
• Cost and efficiency: a single episode requires 1,920 surrogate forward evaluations and 20 episodes use 38,400 evaluations; ASR plateaus after roughly 5 episodes, so comparable transferability can be achieved with far fewer runs than many prior methods.

Limitations

Results reflect specific hyperparameter choices and templates; the method is an offline transfer attack requiring an open-weight surrogate and therefore does not adapt interactively to target model responses. Intent drift and template design remain practical challenges for reliable generation under bidirectional denoising. Defences, compute trade-offs and further hyperparameter optimisation were not exhaustively explored.

Implications

Offensive security implications are significant: an attacker with access to an open-weight surrogate can map safety neurons and produce offline jailbreaks that transfer to closed models, including diffusion and proprietary systems. DLLMs initialised from AR weights inherit exploitable mechanistic footprint, so a vulnerability discovered in one model family can be exported to others. Practical attacks can be executed with modest surrogate compute budgets and few generation episodes, and they evade simple input and smoothing defences. The public code release facilitates replication and audit but also lowers the barrier for misuse, underscoring the need to address neuron-level transferability in alignment processes and to consider architectural or runtime mitigations that break direct neuron mappings.