A Unified Explanation of Jailbreaks in Diffusion Large Models: Two Attack Paths and Three Detection Signals

A research team from Deakin University and Pennsylvania State University published a paper in September 2026 that frames the safety alignment of diffusion language models as shaping an energy landscape, categorizes existing jailbreak attacks into two paths—initial state confusion (such as PAD and DIJA) and generation trajectory intervention (such as Anchoring)—and proposes three detection signals requiring no additional training: R₀, SED slope, and ΔE slope. Experiments were conducted on models including LLaDA-8B, LLaDA-1.5, and Dream-7B; on LLaDA-8B, the combination of the three signals detected PAD, DIJA, and step-8 Anchoring with AUROC of approximately 0.87, 0.87, and 0.96, respectively; however, when the false positive rate was limited to within about 10%, LLaDA-8B's recall for PAD and DIJA was only about 26% and 20%, and Dream-7B's was about 91% and 70%.