DiffuGuard: How the intrinsic safety of diffusion large language models is lost and recovered

Researchers propose a training-free defense framework, DiffuGuard, which reduces the attack success rate of six jailbreak methods from 47.9% to 14.7% on four diffusion large language models (dLLMs) while maintaining model utility and efficiency. The paper analyzes the jailbreak vulnerability of dLLMs along two dimensions, intra-step and inter-step dynamics, finds that the standard greedy remasking strategy has a harmful bias, and proposes the denoising-path dependence phenomenon, in which the safety of early tokens has a decisive influence on the final output. DiffuGuard adopts a two-stage design: Stochastic Annealing Remasking introduces controlled randomness to mitigate the greedy-selection bias, and Block-level Audit and Repair uses the model's internal representations to autonomously detect risks and guide correction. Code is open-sourced at https://github.com/niez233/DiffuGuard。