Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis
The paper explains jailbreaks in diffusion language models by framing safety alignment as an energy landscape where harmful prompts should be routed over a barrier toward safe outputs, and it argues that attacks work either by hiding intent at initialization or by forcing the denoising trajectory across that barrier mid-generation. Its neat contribution is turning that view into three training-free detectors based on initial logits and trajectory “kinetic energy” that appear complementary across several dLLMs, though the evidence is mostly empirical on known attacks/models and the barrier picture may be more explanatory metaphor than a fully validated mechanistic theory.
Abstract
Existing attacks and defenses for diffusion-based large language models (dLLMs) target specific vulnerabilities but lack a shared framework explaining why attacks succeed. We propose one by interpreting safety alignment as shaping the denoising energy landscape: a well-aligned model routes harmful queries toward safe outputs through an energy barrier that separates the two regions. Current jailbreak attacks reduce to two strategies for circumventing this barrier: obscuring the query's safety disposition at initialisation, or intervening mid-trajectory to force the denoising path across the energy barrier. From this perspective and the result that masked diffusion models minimise kinetic energy during denoising, we derive three complementary, training-free detection signals: a step-0 ratio that reads the initial safety disposition from the logit distribution before generation begins, and two trajectory-velocity signals that track kinetic energy in complementary subspaces of the logit space. An attack must either reveal its intent at initialisation or expend kinetic energy to cross the barrier in at least one monitored subspace, so the three signals cover each other's blind spots in the energy budget by construction. Evaluation across three dense dLLMs (LLaDA-8B, LLaDA-1.5, Dream-7B) and a sparse mixture-of-experts dLLM (LLaDA-MoE-7B) confirms this complementarity. In stress tests of known attacks, every configuration that evades detection also fails to produce harmful content, suggesting that the detection and barrier-crossing thresholds are hard to separate.