MaskForge: Structure-Aware Adaptive Attacks Against Diffusion Large Language Model Jailbreaks

The researchers propose MaskForge, a fully black-box adaptive jailbreak attack against diffusion large language models (dLLMs). The paper states that because mask tokens are native inputs to dLLMs and tokens are determined by confidence rather than position, harmful content can be induced by being placed outside the monitored prefix. The method models dLLM red teaming as an optimized search over a continuously growing library of structural patterns, abstracts successful attempts into reusable patterns, uses a UCB bandit to select patterns compatible with the target, falls back under scorer guidance when patterns in the library fail, and feeds successful experience back into the pattern library to enable accumulation across targets. On five public dLLMs and three benchmarks, MaskForge achieves an average attack success rate of 79.3%, a relative improvement of 17.6% over the strongest dLLM baseline; once matured, the pattern library transfers to AdvBench without any updates, achieving an attack success rate of 88.2%, a relative improvement of 67% over the strongest competing baseline.