BadDLM: Implanting Backdoors into Diffusion Language Models with Diverse Targets

The researchers propose BadDLM, a backdoor attack framework against diffusion language models that can implant backdoors for different targets such as concept injection, semantic attribute steering, alignment bypass and code payload injection. The method uses a trigger-aware training objective that strengthens target-related positions in poisoned samples, and argues that this objective is equivalent to training under an induced forward masking distribution. Unlike backdoors in autoregressive models, which typically manipulate next-token prediction, BadDLM exploits the forward masking process of diffusion models to implant backdoors. The authors state that experiments on mainstream open-source diffusion language models show that BadDLM achieves strong attack effectiveness on multiple targets while largely preserving the model's normal utility, and remains effective against defenses aimed at backdoors in autoregressive models. These results suggest a new class of security risks in diffusion-based language generation, requiring defenses designed for its denoising dynamics.