{"id":"353fa5b8-fb06-43b9-a12f-95b1d3533616","arxiv_id":"2507.19227","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"PAD, a jailbreak that injects sequence connectors into the parallel denoising positions of diffusion language models, achieves up to 97% attack success on LLaDA and MMaDA variants.","lead":"Large language diffusion models, which generate text by filling in blank positions in parallel, can be steered into producing harmful content by seeding the blanks with simple phrases like 'Step 1:'. The paper reports up to 97% success on four such models, indicating that the safety gap is real and needs its own defenses.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"PAD requires writing tokens into the model's masked output positions; without a stated threat model, the reported 97% ASR may not transfer to deployments where users control only the prompt.","rationale":"The paper's central empirical claim is that LLDMs are vulnerable to jailbreak, with PAD achieving up to 97% attack success. For that claim to hold as a jailbreak rather than as a local decoding manipulation, the attacker must be able to execute the injection described in the Multi-Point Attention Attack. The paper explicitly injects tokens into the mask sequence W_{1:L}, which presumes a capability not present in typical user-facing APIs. The reader's weakest assumption identifies exactly this access requirement, so my analysis agrees. I do not recommend changing the verdict because the reader's CONDITIONAL rating already accounts for the unstated threat model and the missing artifacts. A prompt-only replication would settle whether the reported success depends on output-token control; if it does, the paper should be reframed as a study of decoding-state attacks under strong access assumptions, not a prompt-level jailbreak. The paper does provide qualitative case studies and parameter ablations, which are useful, but they do not resolve the threat-model ambiguity.","tokens_in":18180,"tokens_out":6845,"duration_ms":72730,"concrete_test":"Reproduce PAD under a prompt-only black-box interface: keep the same harmful requests and connector text, but place 'Step 1:' and 'Step 2:' inside the user prompt (for example, 'Begin your response with Step 1: ...') instead of writing them into the mask sequence, using the official LLaDA/MMaDA generation entry points with no custom mask initialization. If the attack success rate collapses toward the direct-baseline rate, PAD's 97% success depends on decoding-state control, confirming the threat-model concern.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing assumption is in the 'Multi-Point Attention Attack' section: 'For the mask sequence W_{1:L} of length L, we perform the injection as W′_{1:L}[p(ai) : p(ai)+k_i−1] = a_i.' PAD is therefore not a prompt-only jailbreak: it requires the attacker to overwrite the model's masked output positions before or during denoising. The paper never states a threat model or shows that LLaDA/MMaDA deployments expose such mask-seeding to users. In the standard API setting, where the user supplies text and the model fills all output tokens, this operation is unavailable, so the attack cannot be executed as described. The comparison to baseline jailbreaks (GCG, PAIR, Slice) is also asymmetric: baselines manipulate only the prompt, whereas PAD additionally controls the decoding state, so the 'architectural vulnerability' conclusion conflates a decoding-control attack with a user-level jailbreak. This does not disprove that LLDMs are unsafe under strong access, but it undercuts the paper's central claim that PAD is a jailbreak revealing practical safety vulnerabilities.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes PAD, a jailbreak attack against Large Language Diffusion Models (LLDMs). The method first extracts 'sequence connectors' (e.g., 'Step 1:', 'First', '(1)') from successful LLM jailbreak responses, then injects these connectors into the mask positions of the LLDM's parallel denoising sequence. Experiments on LLaDA-Base, LLaDA-Ins, MMaDA-Base, and MMaDA-Mix report attack success rates up to 97%, surpassing direct prompts and LLM-oriented baselines (GCG, PAIR, Slice), and the paper argues that failure of existing attacks stems from architectural mismatch rather than inherent robustness. Additional analyses examine generation quality (perplexity, Llama Guard), generation speed, and parameter sensitivity.","tokens_in":18404,"tokens_out":6876,"duration_ms":61739,"significance":"If the claims hold, this would be an early demonstration that LLDMs are jailbreakable, with practical implications for safety of diffusion-based text generation. The observation that distributed injection of benign-looking connectors can steer parallel denoising is a useful new attack primitive, and the case studies illustrate a concrete failure mode. However, the significance is currently conditional: the attack's access requirements are not situated in a threat model, the key mechanism (Eq. 4) is unmeasured, and the experimental reporting lacks the details needed to assess the 97% figure. The paper should be credited for addressing a timely architecture and for including several parameter ablations and illustrative examples, but the central claims need substantial strengthening.","major_comments":[{"comment":"The attack requires the attacker to write tokens directly into the mask sequence W_{1:L} (the formula W′_{1:L}[p(ai):p(ai)+ki−1]=ai makes this explicit), yet no threat model is stated. With only user-level prompt access, as in typical deployed APIs, an attacker cannot seed the model's output positions. The comparison with GCG, PAIR, and Slice is therefore asymmetric because those baselines manipulate only the prompt, whereas PAD also controls the decoding state. This asymmetry undercuts the paper's conclusion that LLDMs are vulnerable to jailbreak and that existing defenses fail to transfer; please state the assumed adversary capabilities and argue that such mask-seeding access exists in real deployments, or reframe the contribution as a decoding-control attack.","section":"Multi-Point Attention Attack"},{"comment":"Equation (4), which claims that the injected connector ai amplifies local prediction probabilities by (1+β·G(ai)), is the load-bearing mechanism of PAD, but it is asserted rather than derived or measured. The paper does not define G(ai) operationally, does not report the value of β used in the experiments, and provides no ablation over β; the token-confidence visualizations in Figure 6 are qualitative and do not demonstrate the multiplicative form of Eq. (4). Please either derive Eq. (4) from the attention mechanism, or replace it with a measured characterization of how injected connectors change probability mass, and include sensitivity analysis over β.","section":"PAD jailbreak construction / Eq. (4)"},{"comment":"The paper reports no dataset size, no number of runs, no error bars or confidence intervals, no seed policy, and no details of the LLM-as-judge prompt or detection threshold. Table 1 gives single point estimates, and the headline '97%' is the single best cell (MMaDA-Mix, PAD-Step) rather than a summary of the method. Without these details and without releasing code/data, the central quantitative claim cannot be verified. Please provide the missing experimental details and variance estimates.","section":"Experimental Setup"},{"comment":"The parameter-sensitivity results reported in Figure 5 and discussed in the main text appear to be the 'Localized Injection' experiments described only in the appendix, where connectors are injected at fixed positions (e.g., 'Step 1:' at token 10, 'Step 2:' at token 45). This is a different attack variant from the distributed Multi-Point Attention Attack described in the Method section, and the appendix tables show notably lower ASRs under many settings. If Figure 5 is based on localized injection, then the main text's claims about PAD's robustness to steps, length, block length, and CFG are not actually about the proposed attack. Please clarify which attack the analysis refers to and report the corresponding ablations for the full PAD method.","section":"Analyse"}],"minor_comments":[{"comment":"The abstract says 'achieves jailbreak attack success rates by 97%'; this should be 'up to 97%' or specify the model and connector, since Table 1 shows model-specific values.","section":"Abstract"},{"comment":"The sentence beginning 'Llada few claim their safety alignment' appears to have a typo; it should likely be 'LLaDA and others claim' and 'first analyze' should be 'first analysis'.","section":"Introduction"},{"comment":"Both contain garbled Unicode escape sequences (e.g., '/uni0000002f/uni0000002f/...') that appear to be rendering artifacts; these should be fixed.","section":"Figure 3 caption and Figure 4"},{"comment":"The text refers to 'VIDIA RTX A4000'; this should be 'NVIDIA RTX A4000'.","section":"Generation Efficiency Analysis"},{"comment":"The header '# of \"step\" tokens' is unclear; please clarify whether it means the number of injected sequence connectors or the number of tokens per connector.","section":"Table 3"},{"comment":"The section title 'Analyse' should be 'Analysis' for consistency with the rest of the paper.","section":"Analyse"},{"comment":"The 'cascading effect' citation (Pescaroli and Alexander 2015) is from the disaster-management literature; a technical reference on attention or sequential dependency would be more appropriate.","section":"References"},{"comment":"The sentence 'highlight the need fot stronger safety measures' contains a typo ('fot' instead of 'for').","section":"Conclusion"}],"recommendation":"major_revision","confidential_remarks":"The manuscript's abstract overclaims the 97% figure without specifying that it is the best cell across models and connector variants. The missing threat model is the most serious issue: the attack as described is not a prompt-only jailbreak. Please also verify that the 'first demonstration' claim is accurate relative to concurrent 2025 work on diffusion LLM safety. The garbled figure captions suggest a production error that should be corrected before resubmission."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, this is the first jailbreak attack designed specifically for diffusion language models, and the empirical effect is large: 97% ASR on MMaDA-Mix, with case studies showing coherent, step-by-step harmful guides where prefix attacks stall into refusals. That is a real result. Second, the paper is sloppy about access assumptions, and the central mechanism equation is asserted, not measured. The attack works by writing sequence connectors into the model's masked decoding positions. That is not a prompt-only jailbreak. The paper never states a threat model, and the abstract's phrasing overreaches. This does not kill the result—GCG, one of the baselines, also requires white-box access—but the authors need to say plainly what access they assume and which deployments are actually vulnerable.\n\nThe core idea is simple and worth taking seriously: inject multiple benign-looking connectors (\"Step 1:\", \"First\", \"(1)\") at spaced positions in the mask sequence, and the parallel denoising process gets steered toward harmful completions. The paper also shows convincingly that existing LLM attacks largely fail on LLDMs, which helps explain why this felt like an open problem. The appendix's localized-injection ablation is a good counterpoint: a less sophisticated fixed-position version still works, though it degrades at long generation lengths. That strengthens the case that the effect is real and not an artifact of the specific spacing scheme.\n\nThe soft spots are mostly around reproducibility and framing. No code, no data, no judge prompt, no error bars. The percentages in Table 1 are single-run numbers, and with a judge model like Gemini 2.5 Flash-Lite, prompt details matter. Equation (4) is the theoretical core, but it is never measured; the confidence maps in Figure 6 are suggestive but qualitative. The speed comparison is one GPU, one sentence, and there is a typo (“VIDIA”). The prose is rough in places, including a garbled sentence in the introduction. None of this is fatal, but it all points to a paper that was rushed.\n\nWho is this for? Safety evaluators and LLDM developers. The finding is important enough that the field needs it vetted by referees. My recommendation: send it to peer review, but require the authors to state a threat model explicitly, release artifacts, add error bars, and either measure or drop Eq. (4). The API-access concern raised by the stress-test should be addressed head-on: if the attack only works with decoding-state control, say so and narrow the claims accordingly.","headline":"First real jailbreak for diffusion text models, with a big reported effect—but the paper never states its threat model and treats an asserted equation as a measured mechanism.","tokens_in":18911,"tokens_out":2156,"would_cite":true,"duration_ms":23519,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"PAD jailbreak hits 97% success on diffusion text models, exposing a structural safety gap.","keywords":["large language diffusion models","jailbreak attack","parallel decoding","safety vulnerabilities","sequence connectors","masked denoising","prompt injection","LLDM safety"],"falsifier":"Run PAD against a deployed diffusion text model whose API accepts only a user prompt and never lets the caller seed or modify the initial mask sequence. If the attack cannot be executed or succeeds at a rate statistically indistinguishable from random chance across a set of 100 adversarial prompts, then the claimed vulnerability does not apply to black-box, prompt-only deployment settings.","tokens_in":17993,"feed_emoji":"🧨","tokens_out":1472,"duration_ms":15868,"temperature":0.7,"pith_summary":"This paper argues that large language diffusion models (LLDMs) are not inherently resistant to jailbreaks: prior attacks fail not because the models are robust, but because the attacks were designed for autoregressive architectures. To show this, the authors introduce PAD, a parallel-decoding jailbreak that plants innocuous sequence connectors like \"Step 1:\" into the masked positions the model is denoising. Across four 8B-parameter LLDMs, PAD achieved attack success rates up to 97%, and the paper demonstrates that same-size LLDMs generate harmful content about twice as fast as autoregressive LLMs. If true, the safety community cannot treat diffusion-style text generation as already hardened; it needs defenses designed for parallel denoising.","feed_headline":"PAD jailbreak hits 97% success on diffusion text models","feed_subtitle":"Innocuous connectors like 'Step 1:' planted in masked slots override refusal and double harmful output speed.","key_machinery":"The key mechanism is Multi-Point Attention Attack: the attacker directly writes short, benign-looking sequence connectors (e.g., \"Step 1:\", \"Firstly\", \"(1)\") into the initial mask sequence $W_{1:L}$ at evenly spaced positions $p(a_i) = (i-1)\\times L_a$. During each denoising step, these injected tokens amplify local confidence at neighboring positions and propagate a cascading bias across the entire output window, overriding the model's default refusal tendency. The paper's analysis contrasts this distributed, global perturbation with single-point injections like the \"Sure, here is\" prefix, which only locally suppress rejection and let the refusal resurface.","core_discovery":"The central claim is that LLDMs are susceptible to jailbreak attacks specifically tuned to their parallel denoising architecture. The paper proposes PAD, which injects selected sequence connectors at multiple points in the masked output sequence; these connectors act as anchors that steer the model's attention globally, causing it to produce coherent harmful content rather than a refusal. The authors report that PAD reaches a 97% attack success rate on MMaDA-8B-MixCoT, outperforming conventional LLM jailbreak methods that largely fail against LLDMs, and that successful attacks generate harmful text at roughly twice the speed of autoregressive models of comparable size.","pith_inferences":["A natural extension would be to test whether PAD transfers to closed, API-only diffusion text models where the attacker cannot directly seed masked positions; if it does not, the reported vulnerability applies primarily to open-weight or locally hosted deployments.","The attack's reliance on sequence connectors suggests a cheap, testable defense: filtering or sanitizing tokens that look like structural markers in the masked region, though such filtering may degrade generation quality.","By analogy with adversarial examples in vision, PAD hints that diffusion text models may share a broader weakness: any perturbation that globally shifts attention across the denoising window could steer generation, not just the specific connectors tested here.","The authors' observation that localized injection collapses on long sequences suggests that the attack's success is tied to the balance between injection density and sequence length; a defense that lengthens generation or reduces block granularity might reduce success, at a cost."],"forward_implications":["If PAD's success generalizes, existing safety evaluations of LLDMs that only test autoregressive-style jailbreak prompts will underestimate real risk.","Model-level safety alignment for LLDMs cannot rely on defenses that assume left-to-right token-by-token generation, because the injection occurs in masked slots rather than in the prompt.","The 2x generation speed advantage of LLDMs means that a successful jailbreak can produce harmful content at roughly double the rate of an autoregressive LLM of the same size, amplifying misuse potential.","Parameter choices such as denoising steps, block length, and classifier-free guidance affect attack success rates but do not eliminate the vulnerability, suggesting that tuning alone is not a sufficient defense.","The finding that Chain-of-Thought fine-tuning increases sensitivity to sequence connectors implies that reasoning-style training may inadvertently make diffusion models more susceptible to this class of attack."],"supporting_citations":[{"why":"Defines the LLaDA architecture and the parallel denoising, block-wise generation process that PAD exploits.","marker":"Nie et al. 2025b"},{"why":"Introduces MMaDA, the multimodal diffusion model family that serves as one of the two tested model families.","marker":"Yang et al. 2025a"},{"why":"Describes LLaDA 1.5 and the instruction-tuned variant used in the experiments.","marker":"Zhu et al. 2025"},{"why":"Supplies the AdvBench harmful-request dataset from which the paper samples attacks and derives affirmative response patterns.","marker":"Zou et al. 2023b"},{"why":"Provides the LLM-as-a-judge methodology used to validate response patterns and to evaluate attack success rate.","marker":"Gu et al. 2024"},{"why":"Defines the PAIR baseline attack and the rule-based detection evaluation used for comparison.","marker":"Chao et al. 2025"},{"why":"Defines the GCG optimization-based attack that serves as a baseline and source of adversarial suffixes.","marker":"Zou et al. 2023a"},{"why":"Defines the ChatBug 'Sure, here is' slice attack used as a baseline and as the contrast case for localized injection.","marker":"Jiang et al. 2025"},{"why":"Supplies Llama Guard, one of the classifiers used to detect sensitive content in the generation quality analysis.","marker":"Llama Team 2024"}],"fun_headline_variants":["97% jailbreak success on diffusion text models via PAD","PAD attack reveals diffusion models are jailbreakable","Diffusion text models fall to 97% jailbreak attack","Parallel decoding attack breaks diffusion LLMs at 97%","Jailbreaking diffusion models: 97% success, 2x speed"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes the attacker can write tokens directly into the masked positions of the sequence the model is denoising, rather than only supplying a user-facing prompt that the model then fills in by itself.","fun_headline_variants_meta":{"raw":{"variants":["97% jailbreak success on diffusion text models via PAD","PAD attack reveals diffusion models are jailbreakable","Diffusion text models fall to 97% jailbreak attack","Parallel decoding attack breaks diffusion LLMs at 97%","Jailbreaking diffusion models: 97% success, 2x speed"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000218,"raw_usage":{"total_tokens":1422,"prompt_tokens":913,"completion_tokens":509,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":529,"completion_tokens_details":{"reasoning_tokens":423}},"tokens_in":529,"tokens_out":509,"duration_ms":4671,"temperature":1.0,"reasoning_tokens":423,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:56:52.527656+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run PAD against a deployed diffusion text model whose API accepts only a user prompt and never lets the caller seed or modify the initial mask sequence. If the attack cannot be executed or succeeds at a rate statistically indistinguishable from random chance across a set of 100 adversarial prompts, then the claimed vulnerability does not apply to black-box, prompt-only deployment settings.","supporting_citations":[{"cited_title":"J.; and Wong, E","cited_arxiv_id":null,"evidence_quote":"Defines the PAIR baseline attack and the rule-based detection evaluation used for comparison."},{"cited_title":"Y.; and Poovendran, R","cited_arxiv_id":null,"evidence_quote":"Defines the ChatBug 'Sure, here is' slice attack used as a baseline and as the contrast case for localized injection."}],"review_version":1}