Diffusion LLMs are Natural Adversaries for any LLM

2025/10/31 by David Lüdke, Tom Wollschläger, Lüdke, David +7
Computer Science · #Adversarial Robustness in Machine Learning #Generative Adversarial Networks and Image Synthesis #Explainable Artificial Intelligence (XAI)

paper · pdf · doi:10.48550/arxiv.2511.00203

Abstract

We introduce a novel framework that transforms the resource-intensive (adversarial) prompt optimization problem into an efficient, amortized inference task. Our core insight is that pretrained, non-autoregressive generative LLMs, such as Diffusion LLMs, which model the joint distribution over prompt-response pairs, can serve as powerful surrogates for prompt search. This approach enables the direct conditional generation of prompts, effectively replacing costly, per-instance discrete optimization with a small number of parallelizable samples. We provide a probabilistic analysis demonstrating that under mild fidelity assumptions, only a few conditional samples are required to recover high-reward (harmful) prompts. Empirically, we find that the generated prompts are low-perplexity, diverse jailbreaks that exhibit strong transferability to a wide range of black-box target models, including robustly trained and proprietary LLMs. Beyond adversarial prompting, our framework opens new directions for red teaming, automated prompt optimization, and leveraging emerging Flow- and Diffusion-based LLMs.

Citations

• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Edit-Based Flow Matching for Temporal Point Processes
• MAIA: An Inpainting-Based Approach for Music Adversarial Attacks
• Energy-Weighted Flow Matching: Unlocking Continuous Normalizing Flows for Efficient and Scalable Boltzmann Sampling
• Dream 7B: Diffusion Large Language Models
• Sampling-aware Adversarial Attacks Against Large Language Models
• LLaDA 1.5: Variance-Reduced Preference Optimization for Large Language Diffusion Models
• Joint Relational Database Generation via Graph-Conditional Diffusion Models
• Qwen3 Technical Report
• Gemma 3 Technical Report
• Energy-Weighted Flow Matching for Offline Reinforcement Learning
• LLM-Safety Evaluations Lack Robustness
• Phi-4-Mini Technical Report: Compact yet Powerful Multimodal Language Models via Mixture-of-LoRAs
• REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective
• Adversarial Alignment for LLMs Requires Simpler, Reproducible, and More Measurable Objectives
• Best-of-N Jailbreaking
• Unlocking Point Processes through Point Set Diffusion
• An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks
• A Probabilistic Perspective on Unlearning and Alignment for Large Language Models
• LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet
• The Llama 3 Herd of Models
• Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs
• Improving Alignment and Robustness with Circuit Breakers
• Efficient Adversarial Training in LLMs with Continuous Attacks
• Extracting Prompts by Inverting LLM Outputs
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models
• A StrongREJECT for Empty Jailbreaks
• Attacking Large Language Models with Projected Gradient Descent
• Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space
• HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal
• Language Model Inversion
• Jailbreaking Black Box Large Language Models in Twenty Queries
• Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation
• AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models
• Baseline Defenses for Adversarial Attacks Against Aligned Language Models
• Universal and Transferable Adversarial Attacks on Aligned Language Models
• Effective Prompt Extraction from Language Models
• Enhancing Chat Language Models by Scaling High-quality Instructional Conversations
• A Theoretical Justification for Image Inpainting using Denoising Diffusion Probabilistic Models
• Tutorial on amortized optimization
• Markpainting: Adversarial Machine Learning meets Inpainting
• Diffusion Models Beat GANs on Image Synthesis
• Identifying Untrustworthy Predictions in Neural Networks by Geometric\n Gradient Analysis
• Reliable Graph Neural Networks via Robust Aggregation
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Intriguing properties of neural networks

Related

• DiFFPO: Training Diffusion LLMs to Reason Fast and Furious via Reinforcement Learning
• DINGO: Constrained Inference for Diffusion LLMs
• Diffusion LLMs Can Do Faster-Than-AR Inference via Discrete Diffusion Forcing
• DDPT: Diffusion-Driven Prompt Tuning for Large Language Model Code Generation
• Enhancing Reasoning for Diffusion LLMs via Distribution Matching Policy Optimization