Bias stolen from noise: why diffusion language models can be manipulated while denoising

The researchers propose a closed-loop targeted bias injection attack against diffusion language models: a PI controller reads the probability of the target answer at each denoising step and dynamically adjusts the strength of an intervention in a fixed direction, amplifying the model's bias without changing model weights or prompts. In LLaDA's BBQ test, the bias gap for the Black target rose from 1.8 percentage points to 16.7, for the Arab target to 22.3, and for the elderly target by 37.2 percentage points; on SocialStigmaQA, the selection rate of stigmatizing answers rose from 17.6% to 58.1%. This closed-loop method, which dynamically adjusts attack strength according to the denoising process, had a gibberish rate of 7.8%, lower than the 20.8% of the fixed-strength open-loop method. On the White and Asian targets, the gibberish rates rose to 93.8% and 96.1% respectively, and the paper lists these two cases as failure cases; on LLaDA-MoE, fixed-strength CAA instead led by 2.3 percentage points. The researchers suggest shifting safety audits toward directly probing already-deployed interfaces.