Pith. sign in

REVIEW 4 major objections 8 minor 2 cited by

Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generation

T0 review · 4 major / 8 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read PAD jailbreak hits 97% success on diffusion text models, exposing a structural safety gap.

desk verdict First real jailbreak for diffusion text models, with a big reported effect—but the paper never states its threat model and treats an asserted equation as a measured mechanism. read the letter →

arxiv 2507.19227 v1 pith:ZVYCU3GO submitted 2025-07-25 cs.CL

Yuanhe Zhang , Fangzhou Xie , Zhenhong Zhou , Zherui Li , Hao Chen , Kun Wang , Yufei Guo This is my paper · ORCID
classification cs.CL
keywords largelanguagediffusionmodelsjailbreakattackparalleldecodingsafetyvulnerabilitiessequenceconnectorsmaskeddenoisingpromptinjectionLLDM
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that large language diffusion models (LLDMs) are not inherently resistant to jailbreaks: prior attacks fail not because the models are robust, but because the attacks were designed for autoregressive architectures. To show this, the authors introduce PAD, a parallel-decoding jailbreak that plants innocuous sequence connectors like "Step 1:" into the masked positions the model is denoising. Across four 8B-parameter LLDMs, PAD achieved attack success rates up to 97%, and the paper demonstrates that same-size LLDMs generate harmful content about twice as fast as autoregressive LLMs. If true, the safety community cannot treat diffusion-style text generation as already hardened; it needs defenses designed for parallel denoising.

What carries the argument

The key mechanism is Multi-Point Attention Attack: the attacker directly writes short, benign-looking sequence connectors (e.g., "Step 1:", "Firstly", "(1)") into the initial mask sequence $W_{1:L}$ at evenly spaced positions $p(a_i) = (i-1)\times L_a$. During each denoising step, these injected tokens amplify local confidence at neighboring positions and propagate a cascading bias across the entire output window, overriding the model's default refusal tendency. The paper's analysis contrasts this distributed, global perturbation with single-point injections like the "Sure, here is" prefix, which only locally suppress rejection and let the refusal resurface.

What would settle it

Run PAD against a deployed diffusion text model whose API accepts only a user prompt and never lets the caller seed or modify the initial mask sequence. If the attack cannot be executed or succeeds at a rate statistically indistinguishable from random chance across a set of 100 adversarial prompts, then the claimed vulnerability does not apply to black-box, prompt-only deployment settings.

Watch

Extended reading notes

Core claim

The central claim is that LLDMs are susceptible to jailbreak attacks specifically tuned to their parallel denoising architecture. The paper proposes PAD, which injects selected sequence connectors at multiple points in the masked output sequence; these connectors act as anchors that steer the model's attention globally, causing it to produce coherent harmful content rather than a refusal. The authors report that PAD reaches a 97% attack success rate on MMaDA-8B-MixCoT, outperforming conventional LLM jailbreak methods that largely fail against LLDMs, and that successful attacks generate harmful text at roughly twice the speed of autoregressive models of comparable size.

Load-bearing premise

The attack assumes the attacker can write tokens directly into the masked positions of the sequence the model is denoising, rather than only supplying a user-facing prompt that the model then fills in by itself.

Editorial extensions

If this is right

  • If PAD's success generalizes, existing safety evaluations of LLDMs that only test autoregressive-style jailbreak prompts will underestimate real risk.
  • Model-level safety alignment for LLDMs cannot rely on defenses that assume left-to-right token-by-token generation, because the injection occurs in masked slots rather than in the prompt.
  • The 2x generation speed advantage of LLDMs means that a successful jailbreak can produce harmful content at roughly double the rate of an autoregressive LLM of the same size, amplifying misuse potential.
  • Parameter choices such as denoising steps, block length, and classifier-free guidance affect attack success rates but do not eliminate the vulnerability, suggesting that tuning alone is not a sufficient defense.
  • The finding that Chain-of-Thought fine-tuning increases sensitivity to sequence connectors implies that reasoning-style training may inadvertently make diffusion models more susceptible to this class of attack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension would be to test whether PAD transfers to closed, API-only diffusion text models where the attacker cannot directly seed masked positions; if it does not, the reported vulnerability applies primarily to open-weight or locally hosted deployments.
  • The attack's reliance on sequence connectors suggests a cheap, testable defense: filtering or sanitizing tokens that look like structural markers in the masked region, though such filtering may degrade generation quality.
  • By analogy with adversarial examples in vision, PAD hints that diffusion text models may share a broader weakness: any perturbation that globally shifts attention across the denoising window could steer generation, not just the specific connectors tested here.
  • The authors' observation that localized injection collapses on long sequences suggests that the attack's success is tied to the balance between injection density and sequence length; a defense that lengthens generation or reduces block granularity might reduce success, at a cost.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 8 minor

Summary. This paper proposes PAD, a jailbreak attack against Large Language Diffusion Models (LLDMs). The method first extracts 'sequence connectors' (e.g., 'Step 1:', 'First', '(1)') from successful LLM jailbreak responses, then injects these connectors into the mask positions of the LLDM's parallel denoising sequence. Experiments on LLaDA-Base, LLaDA-Ins, MMaDA-Base, and MMaDA-Mix report attack success rates up to 97%, surpassing direct prompts and LLM-oriented baselines (GCG, PAIR, Slice), and the paper argues that failure of existing attacks stems from architectural mismatch rather than inherent robustness. Additional analyses examine generation quality (perplexity, Llama Guard), generation speed, and parameter sensitivity.

Significance. If the claims hold, this would be an early demonstration that LLDMs are jailbreakable, with practical implications for safety of diffusion-based text generation. The observation that distributed injection of benign-looking connectors can steer parallel denoising is a useful new attack primitive, and the case studies illustrate a concrete failure mode. However, the significance is currently conditional: the attack's access requirements are not situated in a threat model, the key mechanism (Eq. 4) is unmeasured, and the experimental reporting lacks the details needed to assess the 97% figure. The paper should be credited for addressing a timely architecture and for including several parameter ablations and illustrative examples, but the central claims need substantial strengthening.

major comments (4)
  1. [Multi-Point Attention Attack] The attack requires the attacker to write tokens directly into the mask sequence W_{1:L} (the formula W′_{1:L}[p(ai):p(ai)+ki−1]=ai makes this explicit), yet no threat model is stated. With only user-level prompt access, as in typical deployed APIs, an attacker cannot seed the model's output positions. The comparison with GCG, PAIR, and Slice is therefore asymmetric because those baselines manipulate only the prompt, whereas PAD also controls the decoding state. This asymmetry undercuts the paper's conclusion that LLDMs are vulnerable to jailbreak and that existing defenses fail to transfer; please state the assumed adversary capabilities and argue that such mask-seeding access exists in real deployments, or reframe the contribution as a decoding-control attack.
  2. [PAD jailbreak construction / Eq. (4)] Equation (4), which claims that the injected connector ai amplifies local prediction probabilities by (1+β·G(ai)), is the load-bearing mechanism of PAD, but it is asserted rather than derived or measured. The paper does not define G(ai) operationally, does not report the value of β used in the experiments, and provides no ablation over β; the token-confidence visualizations in Figure 6 are qualitative and do not demonstrate the multiplicative form of Eq. (4). Please either derive Eq. (4) from the attention mechanism, or replace it with a measured characterization of how injected connectors change probability mass, and include sensitivity analysis over β.
  3. [Experimental Setup] The paper reports no dataset size, no number of runs, no error bars or confidence intervals, no seed policy, and no details of the LLM-as-judge prompt or detection threshold. Table 1 gives single point estimates, and the headline '97%' is the single best cell (MMaDA-Mix, PAD-Step) rather than a summary of the method. Without these details and without releasing code/data, the central quantitative claim cannot be verified. Please provide the missing experimental details and variance estimates.
  4. [Analyse] The parameter-sensitivity results reported in Figure 5 and discussed in the main text appear to be the 'Localized Injection' experiments described only in the appendix, where connectors are injected at fixed positions (e.g., 'Step 1:' at token 10, 'Step 2:' at token 45). This is a different attack variant from the distributed Multi-Point Attention Attack described in the Method section, and the appendix tables show notably lower ASRs under many settings. If Figure 5 is based on localized injection, then the main text's claims about PAD's robustness to steps, length, block length, and CFG are not actually about the proposed attack. Please clarify which attack the analysis refers to and report the corresponding ablations for the full PAD method.
minor comments (8)
  1. [Abstract] The abstract says 'achieves jailbreak attack success rates by 97%'; this should be 'up to 97%' or specify the model and connector, since Table 1 shows model-specific values.
  2. [Introduction] The sentence beginning 'Llada few claim their safety alignment' appears to have a typo; it should likely be 'LLaDA and others claim' and 'first analyze' should be 'first analysis'.
  3. [Figure 3 caption and Figure 4] Both contain garbled Unicode escape sequences (e.g., '/uni0000002f/uni0000002f/...') that appear to be rendering artifacts; these should be fixed.
  4. [Generation Efficiency Analysis] The text refers to 'VIDIA RTX A4000'; this should be 'NVIDIA RTX A4000'.
  5. [Table 3] The header '# of "step" tokens' is unclear; please clarify whether it means the number of injected sequence connectors or the number of tokens per connector.
  6. [Analyse] The section title 'Analyse' should be 'Analysis' for consistency with the rest of the paper.
  7. [References] The 'cascading effect' citation (Pescaroli and Alexander 2015) is from the disaster-management literature; a technical reference on attention or sequential dependency would be more appropriate.
  8. [Conclusion] The sentence 'highlight the need fot stronger safety measures' contains a typo ('fot' instead of 'for').

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: PAD's jailbreak success is measured empirically on target LLDMs, and its connector-injection inputs are drawn from LLM responses rather than from the target models' own outputs.

full rationale

PAD's central claim, that LLDMs are jailbreakable, is supported by direct measurements of attack success rates reported in Table 1 and the case studies, not by a derivation from the method's inputs. The Multi-Point Attention Attack is a constructive attack procedure; Equation (4) is an illustrative description of local probability amplification, not a fitted model from which the reported 97% ASR is predicted. The sequence connectors are extracted from successful LLM jailbreak responses, which come from a different model family than the target LLDMs, so there is no self-definitional loop in which the target outputs define the attack's success criterion. The architectural explanation, such as parallel denoising and inter-block attention, is inferred post hoc from the same experiments; this may be an interpretation or correctness risk, but it is not circular. The paper's self-citations, including Zhou et al. 2024, appear only as background related work and do not carry the argument. No uniqueness theorem or ansatz is imported via author self-citation, and no fitted parameter is renamed as a prediction. The absence of a stated threat model for mask-seeding access is a deployment and transferability limitation, not a circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the feasibility of masking-region injection, on the validity of LLM-as-a-judge, and on the transferability of sequence connectors from LLM responses. No new physical entities are introduced.

free parameters (3)
  • beta (influence strength) = not specified
    Introduced in Eq. (4) to model the perturbation of injected tokens; no value is given and it is not used in the experiments.
  • number of injected sequence connectors = 3 (optimal in Table 3)
    The attack success varies with 1 to 3 injected connectors; Table 3 shows most models peak at 3, so this is a tuned attack hyperparameter rather than a physical constant.
  • injection positions = evenly spaced at p(ai) = (i-1) * floor(L/|A|)
    The spacing is a design choice; the localized ablation uses fixed positions 10, 45, 80. The central results depend on these choices.
assumptions (4)
  • domain assumption The attacker can write tokens directly into the masked (prediction) region of the LLDM.
    The injection is defined on the mask sequence W'_{1:L} in the Multi-Point Attention Attack section; the paper does not justify that real systems expose this control.
  • domain assumption Gemini 2.5 Flash-Lite as LLM judge reliably identifies jailbreak success.
    The evaluation section relies on LLM-as-a-judge without reporting human agreement or the judge prompt.
  • domain assumption The sequence connectors extracted from jailbroken LLM responses transfer to LLDMs.
    The Injected Information Filtering section uses valid responses from LLMs; transferability is assumed and then tested.
  • domain assumption LLDMs follow the block-wise parallel denoising process described by the cited LLaDA papers.
    The derivation of PAD relies on the described block denoising and token confidence mechanics from LLaDA.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generation." pith.science (2026). https://pith.science/paper/ZVYCU3GO

@misc{pith2026250719227,
  author       = {Pith},
  title        = {Pith review of: Jailbreaking Large Language Diffusion Models: Revealing Hidden Safety Flaws in Diffusion-Based Text Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZVYCU3GO}},
  note         = {Machine review of arXiv:2507.19227}
}
read the original abstract

Large Language Diffusion Models (LLDMs) exhibit comparable performance to LLMs while offering distinct advantages in inference speed and mathematical reasoning tasks.The precise and rapid generation capabilities of LLDMs amplify concerns of harmful generations, while existing jailbreak methodologies designed for Large Language Models (LLMs) prove limited effectiveness against LLDMs and fail to expose safety vulnerabilities.Successful defense cannot definitively resolve harmful generation concerns, as it remains unclear whether LLDMs possess safety robustness or existing attacks are incompatible with diffusion-based architectures.To address this, we first reveal the vulnerability of LLDMs to jailbreak and demonstrate that attack failure in LLDMs stems from fundamental architectural differences.We present a PArallel Decoding jailbreak (PAD) for diffusion-based language models. PAD introduces Multi-Point Attention Attack, which guides parallel generative processes toward harmful outputs that inspired by affirmative response patterns in LLMs. Experimental evaluations across four LLDMs demonstrate that PAD achieves jailbreak attack success rates by 97%, revealing significant safety vulnerabilities. Furthermore, compared to autoregressive LLMs of the same size, LLDMs increase the harmful generation speed by 2x, significantly highlighting risks of uncontrolled misuse.Through comprehensive analysis, we provide an investigation into LLDM architecture, offering critical insights for the secure deployment of diffusion-based language models.

Figures

Figures reproduced from arXiv: 2507.19227 by the authors.

Figure 1
Figure 1. We elucidate why existing attack methods fail [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Existing jailbreak methods show limited effectiveness against LLDMs. By analyzing successful attack instances, we [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. PAD demonstrates superior attack success rates [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: This figure analyzes PAD attack success rates across varying model parameters. Results demonstrate consistent [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: This figure analyzes LLDM prediction tendencies across three conditions: (1) direct harmful requests, (2) traditional [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Example responses obtained from attacks against LLDM using Direct Attack, Slice Attack and PAD Attack methods [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: Example responses obtained from attacks against LLDM using Direct Attack, Slice Attack and PAD Attack methods [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Example responses obtained from attacks against LLDM using Direct Attack, Slice Attack and PAD Attack methods [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Beyond the Bidirectional Promise: Re-evaluating the Robustness of Diffusion Language Models

    cs.AI 2026-07 conditional novelty 6.0 of 10

    Diffusion language models are not inherently more robust than autoregressive models to natural input noise, but they are consistently overconfident and resist short gradient-based suffix attacks.

  2. Step-Wise Refusal Dynamics in Autoregressive and Diffusion Language Models

    cs.LG 2026-02 conditional novelty 6.0 of 10

    Diffusion language models can revise away harmful intermediate text, and a step-wise internal refusal signal detects jailbreaks cheaply across autoregressive and diffusion models.

Reference graph

Works this paper leans on

51 extracted references · 6 canonical work pages · cited by 2 Pith papers

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Anil, C.; Durmus, E.; Panickssery, N.; and Sharma, M. e. a. 2024. Many-shot Jailbreaking. In Globerson, A.; Mackey, L.; Belgrave, D.; Fan, A.; Paquet, U.; Tomczak, J.; and Zhang, C., eds., Advances in Neural Information Processing Systems, volume 37, 129696--129742. Curran Associates, Inc

    work page 2024

  4. [4]

    D.; Ho, J.; Tarlow, D.; and van den Berg, R

    Austin, J.; Johnson, D. D.; Ho, J.; Tarlow, D.; and van den Berg, R. 2023. Structured Denoising Diffusion Models in Discrete State-Spaces. arXiv:2107.03006

    arXiv 2023

  5. [5]

    Bai, Y.; Jones, A.; Ndousse, K.; Askell, A.; Chen, A.; DasSarma, N.; Drain, D.; Fort, S.; Ganguli, D.; Henighan, T.; Joseph, N.; Kadavath, S.; Kernion, J.; Conerly, T.; El-Showk, S.; Elhage, N.; Hatfield-Dodds, Z.; Hernandez, D.; Hume, T.; Johnston, S.; Kravec, S.; Lovitt, L.; Nanda, N.; Olsson, C.; Amodei, D.; Brown, T.; Clark, J.; McCandlish, S.; Olah, ...

    arXiv 2022

  6. [6]

    Bianchi, F.; Suzgun, M.; Attanasio, G.; Röttger, P.; Jurafsky, D.; Hashimoto, T.; and Zou, J. 2024. Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructions. arXiv:2309.07875

    arXiv 2024

  7. [7]

    Cao, B.; Cao, Y.; Lin, L.; and Chen, J. 2024. Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM. arXiv:2309.14348

    arXiv 2024

  8. [8]

    J.; and Wong, E

    Chao, P.; Robey, A.; Dobriban, E.; Hassani, H.; Pappas, G. J.; and Wong, E. 2024. Jailbreaking Black Box Large Language Models in Twenty Queries. arXiv:2310.08419

    arXiv 2024

Show all 51 references
  1. [9]

    J.; and Wong, E

    Chao, P.; Robey, A.; Dobriban, E.; Hassani, H.; Pappas, G. J.; and Wong, E. 2025. Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), 23--42. IEEE

    2025

  2. [10]

    DeepSeek-AI; Bi, X.; Chen, D.; Chen, G.; and Chen, S. 2024. DeepSeek LLM: Scaling Open-Source Language Models with Longtermism. arXiv:2401.02954

    2024 arXiv

  3. [11]

    Devlin, J.; Chang, M.-W.; Lee, K.; and Toutanova, K. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. arXiv:1810.04805

    2019 arXiv

  4. [12]

    Google DeepMind . 2025. Gemini Diffusion. Experimental text diffusion model

    2025

  5. [14]

    Gu, J.; Jiang, X.; Shi, Z.; Tan, H.; Zhai, X.; Xu, C.; Li, W.; Shen, Y.; Ma, S.; Liu, H.; et al. 2024. A survey on llm-as-a-judge. arXiv preprint arXiv:2411.15594

    2024 arXiv

  6. [15]

    Guo, X.; Yu, F.; Zhang, H.; Qin, L.; and Hu, B. 2024. COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability. arXiv:2402.08679

    2024 arXiv

  7. [16]

    He, Z.; Sun, T.; Wang, K.; Huang, X.; and Qiu, X. 2022. DiffusionBERT: Improving Generative Masked Language Models with Diffusion Models. arXiv:2211.15029

    2022 arXiv

  8. [17]

    Ho, J.; Jain, A.; and Abbeel, P. 2020. Denoising Diffusion Probabilistic Models. arXiv:2006.11239

    2020 arXiv

  9. [18]

    Inan, H.; Upasani, K.; Chi, J.; Rungta, R.; Iyer, K.; Mao, Y.; Tontchev, M.; Hu, Q.; Fuller, B.; Testuggine, D.; and Khabsa, M. 2023. Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations. arXiv:2312.06674

    2023 arXiv

  10. [20]

    Jain, N.; Schwarzschild, A.; Wen, Y.; Somepalli, G.; Kirchenbauer, J.; yeh Chiang, P.; Goldblum, M.; Saha, A.; Geiping, J.; and Goldstein, T. 2023 b . Baseline Defenses for Adversarial Attacks Against Aligned Language Models. arXiv:2309.00614

    2023 arXiv

  11. [21]

    Jia, X.; Pang, T.; Du, C.; Huang, Y.; Gu, J.; Liu, Y.; Cao, X.; and Lin, M. 2024. Improved Techniques for Optimization-Based Jailbreaking on Large Language Models. arXiv:2405.21018

    2024 arXiv

  12. [22]

    Q.; Sablayrolles, A.; Mensch, A.; Bamford, C.; and Chaplot, D

    Jiang, A. Q.; Sablayrolles, A.; Mensch, A.; Bamford, C.; and Chaplot, D. S. 2023. Mistral 7B. arXiv:2310.06825

    2023 arXiv

  13. [23]

    Y.; and Poovendran, R

    Jiang, F.; Xu, Z.; Niu, L.; Lin, B. Y.; and Poovendran, R. 2025. Chatbug: A common vulnerability of aligned llms induced by chat templates. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, 27347--27355

    2025

  14. [24]

    Jin, H.; Chen, R.; Zhang, P.; Zhou, A.; Zhang, Y.; and Wang, H. 2025. GUARD: Role-playing to Generate Natural-language Jailbreakings to Test Guideline Adherence of Large Language Models. arXiv:2402.03299

    2025

  15. [25]

    L.; Thickstun, J.; Gulrajani, I.; Liang, P.; and Hashimoto, T

    Li, X. L.; Thickstun, J.; Gulrajani, I.; Liang, P.; and Hashimoto, T. B. 2022. Diffusion-LM Improves Controllable Text Generation. arXiv:2205.14217

    2022 arXiv

  16. [26]

    Liu, X.; Xu, N.; Chen, M.; and Xiao, C. 2024. AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models. arXiv:2310.04451

    2024 arXiv

  17. [27]

    Liu, Z.; Yang, Y.; Zhang, Y.; Chen, J.; Zou, C.; Wei, Q.; Wang, S.; and Zhang, L. 2025. dLLM-Cache: Accelerating Diffusion Large Language Models with Adaptive Caching. arXiv:2506.06295

    2025 arXiv

  18. [28]

    Llama Team, A. . M. 2024. The Llama 3 Herd of Models. arXiv:2407.21783

    2024 arXiv

  19. [29]

    Nie, S.; Zhu, F.; Du, C.; Pang, T.; Liu, Q.; Zeng, G.; Lin, M.; and Li, C. 2025 a . Scaling up Masked Diffusion Models on Text. arXiv:2410.18514

    2025 arXiv

  20. [30]

    Nie, S.; Zhu, F.; You, Z.; Zhang, X.; Ou, J.; Hu, J.; Zhou, J.; Lin, Y.; Wen, J.-R.; and Li, C. 2025 b . Large Language Diffusion Models. arXiv:2502.09992

    2025 arXiv

  21. [31]

    OpenAI; Achiam, J.; Adler, S.; Agarwal, S.; and Ahmad, L. 2024. GPT-4 Technical Report. arXiv:2303.08774

    2024 arXiv

  22. [32]

    Ouyang, L.; Wu, J.; Jiang, X.; Almeida, D.; Wainwright, C. L.; Mishkin, P.; Zhang, C.; Agarwal, S.; Slama, K.; Ray, A.; Schulman, J.; Hilton, J.; Kelton, F.; Miller, L.; Simens, M.; Askell, A.; Welinder, P.; Christiano, P.; Leike, J.; and Lowe, R. 2022. Training language model...

    2022 arXiv

  23. [33]

    R.; Texier, M.; and Dean, J

    Patterson, D.; Gonzalez, J.; H \"o lzle, U.; Le, Q.; Liang, C.; Munguia, L.-M.; Rothchild, D.; So, D. R.; Texier, M.; and Dean, J. 2022. The carbon footprint of machine learning training will plateau, then shrink. Computer, 55(7): 18--28

    2022

  24. [34]

    toppling dominos

    Pescaroli, G.; and Alexander, D. 2015. A definition of cascading disasters and cascading effects: Going beyond the “toppling dominos” metaphor. Planet@ risk, 3(1): 58--67

    2015

  25. [35]

    Qwen; Yang, A.; Yang, B.; Zhang, B.; and Hui, B. 2025. Qwen2.5 Technical Report. arXiv:2412.15115

    2025 arXiv

  26. [36]

    D.; and Finn, C

    Rafailov, R.; Sharma, A.; Mitchell, E.; Ermon, S.; Manning, C. D.; and Finn, C. 2024. Direct Preference Optimization: Your Language Model is Secretly a Reward Model. arXiv:2305.18290

    2024 arXiv

  27. [37]

    C.; Lupu, A.; Hambro, E.; Markosyan, A

    Samvelyan, M.; Raparthy, S. C.; Lupu, A.; Hambro, E.; Markosyan, A. H.; Bhatt, M.; Mao, Y.; Jiang, M.; Parker-Holder, J.; Foerster, J.; Rocktäschel, T.; and Raileanu, R. 2024. Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Prompts. arXiv:2402.16822

    2024 arXiv

  28. [38]

    K.; Gupta, V.; and Grossman, D

    Sharma, R. K.; Gupta, V.; and Grossman, D. 2024. SPML: A DSL for Defending Language Models Against Prompt Attacks. arXiv:2402.11755

    2024 arXiv

  29. [39]

    Sun, Z.; Shen, Y.; Zhou, Q.; Zhang, H.; Chen, Z.; Cox, D.; Yang, Y.; and Gan, C. 2023. Principle-Driven Self-Alignment of Language Models from Scratch with Minimal Human Supervision. arXiv:2305.03047

    2023 arXiv

  30. [40]

    M.; Hauth, A.; Millican, K.; et al

    Team, G.; Anil, R.; Borgeaud, S.; Alayrac, J.-B.; Yu, J.; Soricut, R.; Schalkwyk, J.; Dai, A. M.; Hauth, A.; Millican, K.; et al. 2023. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805

    2023 arXiv

  31. [41]

    Touvron, H.; Martin, L.; Stone, K.; Albert, P.; and Almahairi, A. 2023. Llama 2: Open Foundation and Fine-Tuned Chat Models. arXiv:2307.09288

    2023 arXiv

  32. [42]

    Wang, K.; Zhang, G.; Zhou, Z.; and et al., J. W. 2025. A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment. arXiv:2504.15585

    2025 arXiv

  33. [43]

    Wu, C.; Zhang, H.; Xue, S.; Liu, Z.; Diao, S.; Zhu, L.; Luo, P.; Han, S.; and Xie, E. 2025. Fast-dLLM: Training-free Acceleration of Diffusion LLM by Enabling KV Cache and Parallel Decoding. arXiv:2505.22618

    2025 arXiv

  34. [44]

    Yang, A.; Yang, B.; Hui, B.; Zheng, B.; and Yu, B. 2024. Qwen2 Technical Report. arXiv:2407.10671

    2024 arXiv

  35. [46]

    Yang, L.; Tian, Y.; Li, B.; Zhang, X.; Shen, K.; Tong, Y.; and Wang, M. 2025 b . MMaDA: Multimodal Large Diffusion Language Models. arXiv preprint arXiv:2505.15809

    2025 arXiv

  36. [47]

    Yi, S.; Liu, Y.; Sun, Z.; Cong, T.; He, X.; Song, J.; Xu, K.; and Li, Q. 2024. Jailbreak Attacks and Defenses Against Large Language Models: A Survey. arXiv:2407.04295

    2024 arXiv

  37. [48]

    You, Z.; Nie, S.; Zhang, X.; Hu, J.; Zhou, J.; Lu, Z.; Wen, J.-R.; and Li, C. 2025. LLaDA-V: Large Language Diffusion Models with Visual Instruction Tuning. arXiv:2505.16933

    2025 arXiv

  38. [49]

    Yuan, Y.; Jiao, W.; Wang, W.; tse Huang, J.; He, P.; Shi, S.; and Tu, Z. 2024. GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher. arXiv:2308.06463

    2024 arXiv

  39. [50]

    Zeng, Y.; Lin, H.; Zhang, J.; Yang, D.; Jia, R.; and Shi, W. 2024. How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs. arXiv:2401.06373

    2024 arXiv

  40. [51]

    Zheng, C.; Yin, F.; Zhou, H.; Meng, F.; Zhou, J.; Chang, K.-W.; Huang, M.; and Peng, N. 2024. On Prompt-Driven Safeguarding for Large Language Models. arXiv:2401.18018

    2024 arXiv

  41. [52]

    Zhou, Z.; Xiang, J.; Chen, H.; Liu, Q.; Li, Z.; and Su, S. 2024. Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue. arXiv:2402.17262

    2024 arXiv

  42. [53]

    Zhu, F.; Wang, R.; Nie, S.; Zhang, X.; Wu, C.; Hu, J.; Zhou, J.; Chen, J.; Lin, Y.; Wen, J.-R.; and Li, C. 2025. LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Models. arXiv:2505.19223

    2025 arXiv

  43. [55]

    Z.; and Fredrikson, M

    Zou, A.; Wang, Z.; Kolter, J. Z.; and Fredrikson, M. 2023 b . Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv:2307.15043

    2023 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.