发现离散扩散视觉模型的跨步条件传播漏洞，提出新攻击框架提升越狱成功率。
DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models
- 利用扩散模型中每步反向去噪持续受视觉嵌入影响的特性进行攻击
- 在三种dVLM上实现最高69.1%的越狱成功率（HADES ASR）
- 适合研究多模态安全、对抗攻击或扩散模型的开发者与研究人员
大型视觉语言模型（VLMs）日益应用于安全关键场景，但现有视觉越狱研究几乎仅针对自回归架构，忽略了新兴的多模态离散扩散视觉语言模型（dVLMs）。我们识别出扩散生成中的特有漏洞：由于视觉嵌入在每一步反向去噪中持续作为条件，而非一次性前缀，恶意视觉语义会沿生成轨迹反复传播并放大，这一现象称为跨步条件传播。通过阶段敏感性分析、提示级切换率及成对去噪箱不一致度指标，结合自助采样验证，我们提供了实证支持。提出DIVA（Discrete-diffusion Vision-language model Attack）框架，采用跨模态意图混淆与扩散感知多时间步对抗优化。在三种dVLM上，DIVA在Beaver奖励模型下分别达到58.8%、67.7%和69.1%的HADES ASR，显著优于为自回归模型设计的基线攻击方法。代码已开源。
原文摘要 · Abstract (English)
Large vision-language models (VLMs) are increasingly deployed in safety-critical settings, yet existing visual jailbreak research has focused almost exclusively on autoregressive architectures, leaving an important emerging family unstudied: multimodal discrete diffusion vision-language models (dVLMs). We identify a vulnerability specific to diffusion generation: because the visual embedding conditions every reverse denoising step rather than acting as a one-time prefix, adversarial visual semantics are repeatedly propagated and amplified across the generation trajectory, a phenomenon we term cross-step conditional propagation. We provide empirical evidence through stage-sensitivity analysis, prompt-level switch rates, and pairwise denoising-bin disagreement metrics, confirmed by bootstrap resampling. We propose DIVA (Discrete-diffusion Vision-language model Attack), a white-box visual jailbreak framework using cross-modal intent obfuscation and diffusion-aware multi-timestep adversarial optimization. Across three dVLMs, DIVA reaches 58.8%, 67.7%, and 69.1% HADES ASR under the Beaver reward-model metric, outperforming visual jailbreak baselines designed for autoregressive models. Code: https://github.com/loststars2002/DIVA
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。