通过重掩码和前缀注入，突破扩散语言模型的安全机制。
Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models
- 重掩码已拒绝的词并加短肯定前缀，实现攻击
- 对三种安全微调模型攻击成功率74-98%
- 无需梯度计算，适用于多种训练方式
扩散语言模型（dLLMs）的安全对齐依赖于一个核心假设：一旦确定的词就不可更改。本文发现，通过重新掩码已被拒绝的词并注入一个简短的肯定前缀，可在所有三个公开可用的安全微调dLLMs上实现74%-82%的攻击成功率（HarmBench），使用通用8词合规前缀时上升至92%-98%。该攻击称为TrajHijack，是首个针对dLLMs的轨迹级攻击，无需梯度计算，且在SFT与偏好优化（VRPO）模型间具有泛化性。三个关键发现：第一，漏洞本质为双组件——仅重掩码（4.4%）或仅前缀（5.7%）均无效；第二，通过可微分Gumbel-softmax进行梯度优化反而降低攻击成功率（41.5% vs. 76.1%），因连续扰动使词分布偏离流形；第三，现有最强防御A2D（89.9%）比未防御模型（76.1%）更易受攻击，因其沉默拒绝训练消除了轨迹攻击需克服的上下文抵抗，此现象称“防御逆向效应”。
原文摘要 · Abstract (English)
Safety alignment in diffusion language models (dLLMs) relies on a single load-bearing assumption: that committed tokens are permanent. We show that violating this assumption, by re-masking committed refusal tokens and injecting a short affirmative prefix, achieves 74-82% ASR on HarmBench across all three publicly available safety-tuned dLLMs, rising to 92-98% with a generic 8-token compliance prefix. We call this attack TrajHijack; it is the first trajectory-level attack on dLLMs, requires no gradient computation, and generalizes across SFT and preference-optimized (VRPO) models. Three findings emerge. First, the vulnerability is irreducibly two-component: re-masking alone (4.4%) and prefix alone (5.7%) both fail. Second, gradient optimization via a differentiable Gumbel-softmax chain consistently degrades ASR (41.5% vs. 76.1%), because continuous perturbations push token distributions off-manifold. Third, A2D (the strongest published dLLM defense) is more vulnerable to TrajHijack (89.9%) than the undefended model (76.1%): its silent-refusal training removes the contextual resistance that trajectory-level attacks must overcome, an effect we call the Defense Inversion Effect.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。