Beyond the Bidirectional Promise: Re-evaluating the Robustness of Diffusion Language Models

Badri Narayana Patro; Saurabh Yadav; Vijay Srinivas Agneeswaran

REVIEW 4 major objections 5 minor 14 references

Beyond the Bidirectional Promise: Re-evaluating the Robustness of Diffusion Language Models

T0 review · 4 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Diffusion language models fail at noisy prompts because their decoder cannot route around corruption, even though their internal states encode the corruption perfectly.

desk verdict Useful paired DLM robustness benchmark, but the abstract and conclusion overclaim a causal decoding-stage bottleneck that the paper's own linear-probe evidence does not support. read the letter →

arxiv 2607.27386 v1 pith:HBOXI5GM submitted 2026-07-29 cs.AI cs.LG

Saurabh Yadav , Badri Narayana Patro , Vijay Srinivas Agneeswaran This is my paper · ORCID

classification cs.AIcs.LG

keywords diffusionlanguagemodelsnaturalnoiserobustnesscalibrationlinearprobingdecoderroutingfailureadversarialsuffixattacksinputmaskingiterativedecoding

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that diffusion language models (DLMs) fail on noisy prompts not because they fail to perceive the corruption, but because their iterative decoder cannot route around it. Using two parameter-matched DLM/autoregressive model pairs across 32 natural noise conditions, the authors show that natural-noise robustness is weight-dependent rather than architecture-intrinsic: one DLM is far more robust than its AR counterpart, while the other is not. Two traits do replicate across both pairs: DLMs are systematically overconfident, and they resist short gradient-based suffix attacks because their loss landscape is highly stochastic. The load-bearing mechanistic claim is that linear probes recover corrupted-token information from hidden states with over 0.93 accuracy in every model, so behavioral fragility is consistent with a decoding-stage bottleneck rather than an encoding failure. From this diagnosis, the paper predicts that pre-generation prompt patching cannot help, and confirms that none of five input-masking variants improve over the noisy baseline. The conclusion is that DLM robustness must be trained into the decoding loop, not patched onto the input.

What carries the argument

The key machinery is the linear-probe diagnostic combined with the paired model design. A logistic-regression probe on hidden states from 17 layers classifies corrupted vs. clean tokens; its high accuracy (>0.93) is taken as evidence that corruption is linearly separable in the model's representations, so the encoder 'perceives' the noise. This probe, together with denoising-trajectory divergence for DLMs and corruption-attention-ratio analysis for AR models, localizes the behavioral difference to decoding rather than encoding. The D-GCG adversarial probe (a single-timestep gradient estimator) is the tool used to characterize DLM loss-landscape stochasticity, and the Input Denoising via Part

What would settle it

An activation-patching experiment: take a noisy input where the model errs, replace only the decoder-side hidden states (or attention outputs) with those from the clean-input run, and check whether the error disappears. If behavior stays wrong, the bottleneck is not decoder routing; if it is fixed, the decoding-stage story is causally confirmed. Alternatively, train or fine-tune a DLM with a noise-robust decoding objective and see whether natural-noise RDI actually drops.

Watch

Extended reading notes

Core claim

The central discovery is that when a DLM answers incorrectly under input noise, it is not because the model failed to register the corruption: a simple linear classifier reads corrupted-token status from internal hidden states with above 0.93 accuracy in both DLMs and both AR baselines, with near-identical AUROC across architectures. The paper interprets this as isolating the failure to the decoder's routing—the bidirectional decoder sees the noise but fails to quarantine it during iterative unmasking. This diagnosis is used to explain why input-side fixes (masking suspected tokens and re-infilling) do not help, and why robustness must be integrated into the iterative decoding process itself

Load-bearing premise

The conclusion that behavioral fragility lies 'entirely' in decoding rests on the inference that a linear probe's >0.93 accuracy proves the encoder perfectly represents the corruption; the paper itself notes this probe is correlational, and causal localization via activation patching remains future work.

Editorial extensions

If this is right

If fragility is a decoding-stage bottleneck, input-side denoising techniques will not restore DLM accuracy; the five IPM variants tested all fail to beat the noisy baseline.
DLM confidence scores are not trustworthy as reliability signals: ECE gaps persist under every non-degenerate confidence definition, so deployment needs post-hoc calibration before selective prediction.
Natural-noise robustness cannot be assumed from the diffusion architecture; one parameter-matched pair shows a large DLM advantage, the other shows none, so robustness must be audited per model.
Short gradient-based suffix attacks are ineffective against DLMs because the training objective marginalizes over masks and timesteps, yielding large but directionally incoherent gradients—a natural property, not an explicit defense.
The diffusion objective's stochastic loss landscape is the mechanism behind both the adversarial resistance and the overconfidence, tying these robustness properties to training-time noise marginalization.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The 'perfectly encode' claim rests on linear separability; a nonlinear probe or activation-patching experiment could show that the encoder is not as cleanly blame-free. Causally ablating corrupted-token representations would separate encoding and decoding contributions in a way the paper's correlational probe cannot.
The overconfidence result suggests that iterative-commitment decoders need explicit uncertainty-aware training objectives—such as calibrating the commitment threshold against downstream correctness—which the paper does not explore.
Weight-dependent natural robustness hints that training-data composition, not the diffusion objective, determines everyday reliability; a controlled pretraining study varying noise-augmentation would test this directly.
If decoder routing failure is the true bottleneck, then decoding-loop interventions—such as remasking low-confidence response tokens mid-generation or biasing unmasking order away from corrupted positions—become concrete candidates to test next.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper's real value is the paired empirical benchmark: two matched DLM/AR pairs, 32 natural noise conditions, calibration ablations, and a falsifiable IPM test. The weight-dependent robustness finding is solid — LLaDA beats LLaMA across the board while Dream is no better than Qwen — and the systematic DLM overconfidence result replicates across both pairs and survives the confidence-definition ablation. The D-GCG probe is a reasonable extension, and the claim of resistance to short gradient-based suffixes is honestly scoped. These results will be useful to anyone working on DLM robustness or calibration.

The soft spot is the mechanistic headline. Section 6.5 reports a linear probe with >0.93 accuracy and explicitly calls it correlational, saying causal localization via activation patching is future work. Yet the abstract and conclusion say the probe "proving that behavioral fragility stems entirely from the bidirectional decoder." That is an internal inconsistency. Linear separability is not causal encoding, and since corrupted and clean tokens are different surface forms, the probe may be separating token identities rather than a corruption feature the decoder could use. The IPM failure does not fix this: it only shows five prompt-patching variants fail, not that the bottleneck is necessarily in the decoding loop. The T_d inconsistency (64 in Section 3.1 and 6.6, 16 in Appendices B and E) needs to be resolved — if IPM ran only at 16 steps, its failure could just as easily be insufficient denoising. Also, the D-GCG and IPM sections lack error bars and no code link is provided despite the promise to release code.

Despite these issues, the empirical core is credible and the paper is honest in its limitations, question-only ablation, and definition stability checks. It deserves a serious referee, not a desk reject. I'd recommend sending it to peer review with the expectation of substantial revision: either add a causal intervention (activation patching or similar) or soften the mechanistic claim to "consistent with" a decoding-stage bottleneck, and fix the T_d inconsistency. The benchmark alone justifies citing it.

Referee Report

4 major / 5 minor

Summary. The paper presents a paired benchmark study of DLM robustness and calibration against AR models, using LLaDA-8B vs. LLaMA-3-8B and Dream-7B vs. Qwen2.5-7B across 32 natural perturbation conditions, a custom gradient-based adversarial probe (D-GCG), and hidden-state linear probing. It reports that natural-noise robustness is weight-dependent rather than architectural, that DLMs are systematically overconfident, that DLMs are resistant to short gradient-based suffix attacks, and that linear probes can separate clean from corrupted hidden states at >0.93 accuracy in all models. The paper proposes a decoding-stage bottleneck explanation and shows that several input-patching (IPM) variants fail to improve over noisy baselines, concluding that DLM robustness must be integrated into the decoding loop rather than patched onto the input.

Significance. If the central claims hold, the paper would make a valuable contribution by shifting DLM robustness research toward decoding-loop interventions and by providing a two-pair experimental template for isolating architecture from weights. The paired design across two independently trained model families is a genuine strength, as is the calibration analysis, which is shown in Appendix I to survive several reasonable definitions of confidence. The Dream pair serves as a useful negative control for the 'diffusion is inherently robust' hypothesis, and the statistical treatment of the RDI comparisons is solid. The paper is also transparent about its limitations and releases code, which supports reproducibility. However, the headline mechanistic claim — that corruption is 'perfectly encoded' and that behavioral fragility is 'entirely a decoder routing failure' — goes beyond the correlational evidence provided and is not supported by the IPM negative result alone. These issues are load-bearing for the paper's central conclusion and require either additional causal evidence or careful rewording.

major comments (4)

[Abstract; §6.5; §7] The headline causal claim overreaches the evidence. §6.5 explicitly states that the probe is correlational and that causally localizing the failure via activation patching is future work, yet the abstract and conclusion assert that 'all models perfectly encode input corruption' and that fragility is 'entirely' a decoder routing failure. A >0.93 linear-probe accuracy shows that clean versus corrupted token hidden states are linearly separable; because perturbed tokens are different surface forms, the separation may reflect token identity rather than a corruption feature. This distinction is load-bearing because the 'cannot be patched on' conclusion and the interpretation of the IPM negative result both depend on it. Please either add an activation-patching/intervention study or rephrase the abstract and conclusion to say the results are consistent with a decoding-stage bottleneck, not pro
[§3.1; Appendix B; Appendix E; Table 5] The IPM denoising configuration is inconsistent. §3.1 states T_d=64; Algorithm 1 in Appendix B and Table 7 in Appendix E specify T_d=16, and the complexity estimate in Appendix B uses T_d=16. If Table 5 was run with T_d=16, the negative IPM result could be due to an under-powered infilling pass rather than to a decoder bottleneck. In addition, Appendix G reports that the Dream-pair IPM numbers in Table 5 come from an N=20 run, which is too small to support the general claim that none of the five tested IPM variants outperform the noisy baseline. Please state the exact T_d used for each reported result and report the Dream-pair numbers with an adequate sample size or clearly mark them as pilot results.
[§6.6; §7] The IPM capstone is a negative result about five specific prompt-editing strategies, not positive evidence for a decoder routing failure. Even if the linear probe did establish that the encoder represents corruption, the failure of IPM to improve accuracy is consistent with several alternatives: the corruption detector may be inaccurate, the re-masking may destroy useful context, or the infilling pass may not be able to reconstruct the original prompt. The 'falsifiable hypothesis' framing in the contributions assumes the very conclusion it is supposed to test. Please either add an intervention that directly tests decoder routing (e.g., patching decoder hidden states) or present IPM only as a null result for the tested pre-generation denoising methods.
[§4; §6.4; Eq. (6)] The D-GCG probe estimates gradients from a single sampled timestep and mask (Eq. 6). The claim that DLM loss trajectories 'oscillate erratically' and that this reflects an incoherent loss landscape is confounded by the variance of the estimator itself: with one timestep/mask sample per step, the loss and gradient are random, and an AR model would also show noise under the same estimation scheme. The resistance to adversarial suffixes is demonstrated for a narrow regime (suffix length 4–8, 50 steps), and the paper does acknowledge this, but the abstract's phrasing ('strongly resist gradient-based adversarial suffixes') is stronger than the evidence. Please add a control (e.g., multiple timestep samples or a stochastic-loss baseline for the AR models) or soften the claim to 'resistant under the tested short-suffix, single-sample estimator.'

minor comments (5)

[Figure 1] The illustrative text contains typos ('What ofthe cpatialis France?') that appear intentional for the noise example, but the figure would be clearer if the clean and corrupted texts were labeled and the artifact of the caption were removed.
[Table 1 and §6.2] The 'Adv.%' column shows the percentage of conditions where the DLM beats its AR counterpart, but the main text also reports RDI advantage values. Please state whether 'Adv.%' counts ties as wins for the DLM or not.
[§3.3, Eq. (4)] The DLM confidence definition uses per-token maximum softmax probabilities; however, for AR greedy decoding max equals chosen-token probability, as noted in Appendix I. Please make this explicit in the main text to avoid confusion.
[§6.1] The perturbation conditions are evaluated on n=200 samples, but Appendix G reports N=20 for the Dream-pair IPM run and N=100/50 for question-only ablations. Please add a table of sample sizes per experiment in the main text.
[References] The reference list includes 'Zhang et al., 2019' BERTScore in Appendix J; the in-text citation is in the limitations, which is fine, but the reference is not alphabetized correctly (it appears after Zhang et al., 2020).

Circularity Check

0 steps flagged · score 0.0 of 10

No construction-level circularity; abstract overstates a correlational probe, but that is evidentiary overreach, not a self-referential derivation.

full rationale

Walking the derivation chain, I find no step in which a prediction or first-principles result reduces to the paper's own inputs by construction. The robustness and calibration results (RDI, ECE, D-GCG) are evaluated against external benchmarks and standard baseline models; the confidence-definition ablation (App. I, Table 13) shows the overconfidence ordering survives alternative aggregations, so it is not baked into Eq. 4. There are no relevant self-citations, uniqueness theorems, or ansatz-by-citation. The closest candidate to circularity is in Section 6.5: 'mechanistic probing reveals that all models perfectly encode input corruption, isolating behavioral fragility entirely to a decoder routing failure.' The evidence behind it is a >0.93 logistic-regression probe on hidden states, which is correlational and, by the paper's own caveat, 'causally localizing the failure (e.g., via activation patching) is important future work.' That is an evidentiary overstatement in the abstract/conclusion, not a construction-level circularity: the probe accuracy is a measured classification result, and 'decoder routing failure' is an interpretation rather than a quantity fitted from the same data. The IPM capstone is a genuine falsifiable prediction ('If fragility lies at decoding, patching the input prompt should not help'); its null result is consistent with the diagnosis but cannot retroactively prove it. Two implementation concerns (T_d=64 in Section 3.1 vs. T_d=16 in App. E Table 7; Hybrid-IPM's spell-checker false positives) are confounds for the IPM conclusion, but they are correctness risks, not circularity. The paper is self-contained against external benchmarks, so I score 0.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper's central conclusions rest on several hand-chosen methodological settings and interpretive assumptions: the specific adversarial-search budget behind the resistance claim, the IPM denoising configuration (which is internally inconsistent), the choice of confidence aggregation, best-layer probe selection, and the mapping from linear decodability to a decoder bottleneck.

free parameters (4)

D-GCG adversarial search budget = suffix lengths 4/8; 50 steps; top-k 64; n=50; one sampled timestep
The claim that DLMs naturally resist gradient-based suffix attacks is measured under this budget and would not necessarily hold for longer suffixes, more steps, or diffusion-native attacks; the paper itself acknowledges this in §6.4 and App. C.
IPM denoising steps T_d = 64 in §3.1; 16 in App. E Table 7
The IPM failure result depends on the exact denoising configuration, which is reported inconsistently between the main text and appendix.
Confidence aggregation = geometric mean of per-token max softmax over final sequence; 15 ECE bins
The systematic DLM overconfidence claim is computed with this definition; an ablation in App. I shows the ordering survives other definitions, but the headline numbers are tied to this choice.
Best-layer probe selection = maximum accuracy over 17 sampled layers (layers 0,2,...,30,31)
Reporting the best layer inflates the apparent separability of corrupted tokens and feeds the 'perfectly encode' interpretation.

assumptions (5)

ad hoc to paper A linear probe reaching >0.93 accuracy proves corruption is 'perfectly' encoded and that failure is a decoder routing problem.
This is the interpretive step in §6.5; the paper later calls it correlational, so the causal jump is an unstated assumption when repeated in the conclusion.
domain assumption RDI, a relative degradation normalized by clean accuracy, is comparable across models with very different clean accuracies.
Used for RQ1; e.g., LLaDA clean 0.185 vs LLaMA clean 0.545 on TriviaQA. A lower start can compress the range of possible relative degradation.
ad hoc to paper A single-sample stochastic gradient (Eq. 6) is an adequate probe of the DLM loss landscape.
D-GCG's failure is attributed to intrinsic gradient incoherence, but the optimizer sees only one noisy timestep per step; the result may be an artifact of the estimator.
domain assumption The nine perturbation types and 32 conditions represent everyday natural noise.
The paper's generalization to everyday robustness assumes the synthetic taxonomy is representative.
domain assumption Per-token max softmax probabilities aggregated by geometric mean are a meaningful confidence signal.
DLM ECE and overconfidence are defined on this basis; the authors ablate alternatives but use this definition for the headline claim.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Beyond the Bidirectional Promise: Re-evaluating the Robustness of Diffusion Language Models." pith.science (2026). https://pith.science/paper/HBOXI5GM

@misc{pith2026260727386,
  author       = {Pith},
  title        = {Pith review of: Beyond the Bidirectional Promise: Re-evaluating the Robustness of Diffusion Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HBOXI5GM}},
  note         = {Machine review of arXiv:2607.27386}
}

read the original abstract

Diffusion Language Models (DLMs) offer a compelling alternative to autoregressive (AR) generation by enabling bidirectional context and iterative refinement. However, their reliability under natural input noise and adversarial attacks remains under-explored. To address this, we systematically evaluate DLM robustness and calibration against AR baselines, using two parameter-matched pairs (LLaDA-8B vs. LLaMA-3-8B and Dream-7B vs. Qwen2.5-7B) across 32 natural perturbation conditions, adversarial gradient probes, and mechanistic hidden-state analyses. This paired design effectively isolates architecture-intrinsic properties from weight-dependent behaviors. We find a nuanced robustness profile: while highly stochastic DLM loss landscapes naturally resist gradient-based adversarial suffixes, they provide no guaranteed defense against natural noise, proving that everyday robustness is weight-dependent rather than inherently architectural. Furthermore, DLMs exhibit systematic overconfidence, presenting a practical deployment hazard. Most crucially, mechanistic probing reveals that all models perfectly encode input corruption, isolating behavioral fragility entirely to a decoder routing failure. Consistent with this diagnosis, we show that surface-level prompt patching fails to improve over noisy baselines. Ultimately, DLM robustness cannot be patched on; it must be fundamentally integrated into the iterative decoding loop.

Figures

Figures reproduced from arXiv: 2607.27386 by the authors.

**Figure 1.** Autoregressive models (top) propagate early corruptions forward via causal attention, whereas Diffusion Language Models (bottom) utilize bidirectional context to iteratively route around local noise. process all visible tokens simultaneously through bidirectional context, they are highly effective for tasks demanding global coherence. Despite their promise, it remains unclear how well DLMs handle natural input n… view at source ↗

**Figure 2.** Mean RDI advantage across 32 noise conditions. LLaDA consistently outperforms LLaMA-3, while Dream’s advantage over Qwen2.5 varies by task, demonstrating that natural robustness is weight-dependent, not inherently architectural [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Accuracy vs. perturbation rate on GSM8K. Both DLMs (solid lines) maintain higher relative accuracy under noise compared to their AR counterparts (dashed lines) GSM8K TriviaQA ARC-Challenge 0.0 0.2 0.4 0.6 0.8 1.0 Clean accuracy 0.62 0.18 0.86 0.46 0.55 0.84 0.19 0.22 0.81 0.82 0.40 0.90 Clean accuracy LLaDA-8B (DLM) LLaMA-3-8B (AR) Dream-7B (DLM) Qwen2.5-7B (AR) GSM8K TriviaQA ARC-Challenge 0.0 0.2 0.4 0.6 0.8 1.0 E… view at source ↗

Figures from the paper (14 more)

**Figure 4.** Figure 4: Clean baseline accuracy (left) and Expected Calibration Error (ECE) (right). DLMs exhibit systematically higher ECE, indicating persistent overconfidence compared to AR models. Confident Commitment Is a Hazard: Because DLMs commit to a token precisely when its probab…

**Figure 5.** Figure 5: ECE and AUROC vs. transposition rate for the LLaDA pair and Dream pair. DLMs remain uniformly overconfident (higher ECE) across all noise levels, while AUROC shows model-specific variance. 4 8 Suffix length (tokens) 0.0 0.1 0.2 0.3 0.4 Accuracy degradation A. Adversari…

**Figure 7.** Figure 7: Best-layer linear probe accuracy for detecting perturbed hidden states. All models exceed 93% accuracy (bestlayer AUROC 0.92–0.99, near-identical for DLM and AR), indicating corruption is linearly decodable in both architectures— consistent with a decoding-stage bot…

**Figure 6.** Figure 6: D-GCG adversarial probe. (A) Accuracy degradation vs. suffix length: neither DLM reaches the 20% degradation threshold, while both AR models exceed it at length ≤ 8. (B) Mean gradient norms at length 8: DLM gradients are comparable to (Dream) or much larger than (LLa…

**Figure 8.** Figure 8: Mechanistic routing behaviors. (A) DLM trajectory divergence varies significantly by task. (B) AR models exhibit active dynamic re-routing (e.g., suppressing homoglyphs or compensating for deletions), a compensatory mechanism absent in DLMs. rather than in the input t…

**Figure 9.** Figure 9: Accuracy vs. perturbation rate on TriviaQA. [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

**Figure 10.** Figure 10: Accuracy vs. perturbation rate on ARC-Challenge. [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]

**Figure 11.** Figure 11: RDI heatmap on TriviaQA for both pairs. 5% 10% 20% 30% Transposition Keyboard Adj. Homoglyph Char Deletion Word Deletion Local Shuffle Synonym Subst. 0.15 0.26 0.55 0.69 0.13 0.26 0.42 0.61 0.12 0.17 0.32 0.51 0.15 0.22 0.44 0.67 0.06 0.18 0.42 0.03 0.08 0.08 0.06 0.0…

**Figure 12.** Figure 12: RDI heatmap on ARC-Challenge for both pairs. [PITH_FULL_IMAGE:figures/full_fig_p015_12.png]

**Figure 13.** Figure 13: Accuracy vs. perturbation rate on GSM8K (reproduced from Fig. [PITH_FULL_IMAGE:figures/full_fig_p016_13.png]

**Figure 14.** Figure 14: RDI heatmap on GSM8K. Provides a complementary view to Figure [PITH_FULL_IMAGE:figures/full_fig_p016_14.png]

**Figure 15.** Figure 15: LLaDA pair summary: RDI advantage, win rate, and calibration gap. GSM8K TriviaQA ARC-Challenge 0.06 0.05 0.04 0.03 0.02 0.01 0.00 Avg RDI advantage (AR DLM) ( = DLM more robust) -0.059 -0.012 -0.004 RDI Advantage (Dream-7B) GSM8K TriviaQA ARC-Challenge 0 20 40 60 80 1…

**Figure 16.** Figure 16: Dream pair summary: RDI advantage (negative or near-zero, contrasting with the LLaDA pair), win rate (below 50% on all three benchmarks), and calibration gap (demonstrating replicated DLM overconfidence). H Statistical Significance and Question-Only Ablation Paired …

**Figure 17.** Figure 17: IPM variant comparison across all evaluated conditions. The dashed line represents the noisy baseline. No variant reliably improves over the baseline, and Hybrid-IPM (orange) consistently degrades accuracy [PITH_FULL_IMAGE:figures/full_fig_p018_17.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 7 linked inside Pith

[5]

Shen Nie, Fengqi Zhu, Zebin You, Xiaolu Zhang, Jingyang Ou, Jun Hu, Jun Zhou, Yankai Lin, Ji-Rong Wen, and Chongxuan Li

GCG attack on a diffusion LLM.arXiv preprint arXiv:2601.14266. Shen Nie, Fengqi Zhu, Zebin You, Xiaolu Zhang, Jingyang Ou, Jun Hu, Jun Zhou, Yankai Lin, Ji-Rong Wen, and Chongxuan Li

arXiv
[7]

Zichen Wen, Jiashu Qu, Zhaorun Chen, Xiaoya Lu, Don- grui Liu, Zhiyuan Liu, Ruixi Wu, Yicun Yang, Xi- angqi Jin, Haoyun Xu, and 1 others

Qwen2.5 technical report.arXiv preprint arXiv:2412.15115. Zichen Wen, Jiashu Qu, Zhaorun Chen, Xiaoya Lu, Don- grui Liu, Zhiyuan Liu, Ruixi Wu, Yicun Yang, Xi- angqi Jin, Haoyun Xu, and 1 others

arXiv
[8]

Shojiro Yamabe and Jun Sakuma

The devil behind the mask: An emergent safety vulnerability of diffusion llms.arXiv preprint arXiv:2507.11097. Shojiro Yamabe and Jun Sakuma

arXiv
[9]

Jiacheng Ye, Zhihui Xie, Lin Zheng, Jiahui Gao, Zirui Wu, Xin Jiang, Zhenguo Li, and Lingpeng Kong

Toward safer diffusion language models: Discovery and miti- gation of priming vulnerability.arXiv preprint arXiv:2510.00565. Jiacheng Ye, Zhihui Xie, Lin Zheng, Jiahui Gao, Zirui Wu, Xin Jiang, Zhenguo Li, and Lingpeng Kong

arXiv
[10]

Wei Emma Zhang, Quan Z

BERTScore: Evaluating text generation with BERT.arXiv preprint arXiv:1904.09675. Wei Emma Zhang, Quan Z. Sheng, Ahoud Alhazmi, and Chenliang Li

arXiv 1904
[11]

arXiv preprint arXiv:2507.19227

Jail- breaking large language diffusion models: Revealing hidden safety flaws in diffusion-based text generation. arXiv preprint arXiv:2507.19227. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson

arXiv
[13]

B IPM Algorithm (Full Pseudocode) Algorithm 1 provides the complete pseudocode for IPM-Threshold

remain an independent threat requiring distinct mitigations. B IPM Algorithm (Full Pseudocode) Algorithm 1 provides the complete pseudocode for IPM-Threshold. Other variants (IPM-TopK, IPM- Uniform, IPM-Iterative) differ only in the mask selection criteria (line 7). Algorithm 1Input Denoising via Partial Masking (IPM-Threshold) Require: Noisy prompt ˜x∈ V...

2023
[14]

robustness does not replicate across pairs

stem from a subsequent N=20 run using Dream’s corrected sampler. Figure 17 visualizes the performance of all tested IPM variants against the noisy baseline across multiple conditions. Fur- thermore, Table 10 provides a detailed numeri- cal breakdown of the ablation on GSM8K under keyboard-adjacency noise. Crucially, the qualitative pattern replicates acro...

2019

Show all 14 references

[2019]

Mask-predict: Parallel de- coding of conditional masked language models. In Proceedings of the 2019 conference on empirical methods in natural language processing and the 9th international joint conference on natural language processing (EMNLP-IJCNLP), pages 6112–6121. Aaron G...

2019
[2021]

Marjan Ghazvininejad, Omer Levy, Yinhan Liu, and Luke Zettlemoyer

Training verifiers to solve math word problems.arXiv preprint arXiv:2110.14168. Marjan Ghazvininejad, Omer Levy, Yinhan Liu, and Luke Zettlemoyer

arXiv
[2023]

AreDLMs in- herently more robust?

Univer- sal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043. A Discussion Weight-Dependent Robustness.Our results show that natural robustness is not an automatic feature of diffusion models. While LLaDA con- sistently outperform...

2025 arXiv
[2024]

Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q

The llama 3 herd of models.arXiv preprint arXiv:2407.21783. Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Wein- berger

arXiv
[2025]

Aaron Lou, Chenlin Meng, and Stefano Ermon

Diffuguard: How intrinsic safety is lost and found in diffusion large language models.arXiv preprint arXiv:2509.24296. Aaron Lou, Chenlin Meng, and Stefano Ermon
[2026]

arXiv preprint arXiv:2604.08557

Re-mask and redirect: Exploiting denoising irreversibility in diffusion language models. arXiv preprint arXiv:2604.08557. Qwen Team

arXiv

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.

[1] [5]

Shen Nie, Fengqi Zhu, Zebin You, Xiaolu Zhang, Jingyang Ou, Jun Hu, Jun Zhou, Yankai Lin, Ji-Rong Wen, and Chongxuan Li

GCG attack on a diffusion LLM.arXiv preprint arXiv:2601.14266. Shen Nie, Fengqi Zhu, Zebin You, Xiaolu Zhang, Jingyang Ou, Jun Hu, Jun Zhou, Yankai Lin, Ji-Rong Wen, and Chongxuan Li

arXiv

[2] [7]

Zichen Wen, Jiashu Qu, Zhaorun Chen, Xiaoya Lu, Don- grui Liu, Zhiyuan Liu, Ruixi Wu, Yicun Yang, Xi- angqi Jin, Haoyun Xu, and 1 others

Qwen2.5 technical report.arXiv preprint arXiv:2412.15115. Zichen Wen, Jiashu Qu, Zhaorun Chen, Xiaoya Lu, Don- grui Liu, Zhiyuan Liu, Ruixi Wu, Yicun Yang, Xi- angqi Jin, Haoyun Xu, and 1 others

arXiv

[3] [8]

Shojiro Yamabe and Jun Sakuma

The devil behind the mask: An emergent safety vulnerability of diffusion llms.arXiv preprint arXiv:2507.11097. Shojiro Yamabe and Jun Sakuma

arXiv

[4] [9]

Jiacheng Ye, Zhihui Xie, Lin Zheng, Jiahui Gao, Zirui Wu, Xin Jiang, Zhenguo Li, and Lingpeng Kong

Toward safer diffusion language models: Discovery and miti- gation of priming vulnerability.arXiv preprint arXiv:2510.00565. Jiacheng Ye, Zhihui Xie, Lin Zheng, Jiahui Gao, Zirui Wu, Xin Jiang, Zhenguo Li, and Lingpeng Kong

arXiv

[5] [10]

Wei Emma Zhang, Quan Z

BERTScore: Evaluating text generation with BERT.arXiv preprint arXiv:1904.09675. Wei Emma Zhang, Quan Z. Sheng, Ahoud Alhazmi, and Chenliang Li

arXiv 1904

[6] [11]

arXiv preprint arXiv:2507.19227

Jail- breaking large language diffusion models: Revealing hidden safety flaws in diffusion-based text generation. arXiv preprint arXiv:2507.19227. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson

arXiv

[7] [13]

B IPM Algorithm (Full Pseudocode) Algorithm 1 provides the complete pseudocode for IPM-Threshold

remain an independent threat requiring distinct mitigations. B IPM Algorithm (Full Pseudocode) Algorithm 1 provides the complete pseudocode for IPM-Threshold. Other variants (IPM-TopK, IPM- Uniform, IPM-Iterative) differ only in the mask selection criteria (line 7). Algorithm 1Input Denoising via Partial Masking (IPM-Threshold) Require: Noisy prompt ˜x∈ V...

2023

[8] [14]

robustness does not replicate across pairs

stem from a subsequent N=20 run using Dream’s corrected sampler. Figure 17 visualizes the performance of all tested IPM variants against the noisy baseline across multiple conditions. Fur- thermore, Table 10 provides a detailed numeri- cal breakdown of the ablation on GSM8K under keyboard-adjacency noise. Crucially, the qualitative pattern replicates acro...

2019