这篇论文发现扩散LLM的安全对齐其实很脆，用剪枝就能把越狱成功率拉到80%多，还给了个黑盒攻击框架SN-Guided Diffusion，成本低效果好。
论文揭示Diffusion LLM的安全对齐机制稀疏且可迁移，自剪枝可将LLaDA攻击成功率从2.6%提升至73.8%，Dream从1.9%升至86.6%。作者提出SN-Guided Diffusion黑盒越狱框架，通过加权安全神经元损失引导扩散过程，在良性提示与越狱提示判别上AUROC达1.0。该框架在Llama-3-8B-Instruct上迁移成功率77.1%，Qwen2.5-7B-Instruct达86.9%，Gemini-2.5-Flash-Lite为74.3%，每个提示仅需20次生成。相比此前越狱框架，生成成本降低数个数量级。
Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
Diffusion Large Language Models (DLLMs) replace autoregressive next-token prediction with iterative parallel denoising, yet their internal safety mechanisms remain poorly understood. In this work, we investigate DLLMs both as targets and as adversaries, exposing mechanistic vulnerabilities in diffusion-based alignment. We first show that safety alignment in DLLMs remains sparse and transferable across architectures. DLLMs initialized from autoregressive predecessors inherit the same mechanistic safety footprint as their source models, enabling transfer attacks via direct safety neuron mapping and pruning. Self-pruning increases attack success rates (ASR) from 2.6% to 73.8% on LLaDA and from 1.9% to 86.6% on Dream, while transfer pruning from Qwen2.5 increases ASR from 1.9% to 73.2% on Dream and from 7.0% to 86.3% on Fast-dLLM. Building on these findings, we introduce SN-Guided Diffusion, a fully offline black-box jailbreak framework that steers the diffusion process away from safety-triggering regions using a weighted safety neuron loss, which achieves near-perfect prompt separability (AUROC = 1.0 for benign-vs-jailbreak discrimination). Across multiple open and proprietary targets, our method achieves a transfer ASR of up to 77.1% on Llama-3-8B-Instruct, 86.9% on Qwen2.5-7B-Instruct, and 74.3% against Gemini-2.5-Flash-Lite, while requiring only 20 generation episodes per prompt. Compared to prior jailbreaking frameworks, our method achieves competitive transferability with orders-of-magnitude lower generation cost. Our codebase is available at https://github.com/ellyoana/sn-guided-diffusion.