Beyond Prompts: Detecting Jailbreak Attacks in Diffusion Large Language Models Using Pre-Decoding States

The researchers propose ReFuse (Representation Fusion), an inference-time jailbreak detection method for diffusion large language models (dLLMs). The paper notes that dLLMs generate responses by iteratively refining masked tokens in parallel, and recent attacks exploit properties such as bidirectional conditioning and parallel masked-token refinement, while the same properties also create a new detection surface: a jailbreak can be identified from the hidden states at masked response positions before any token is generated. The method trains separate linear classifiers on prompt representations and pre-decoding response representations; each classifier misses attacks the other catches, and ReFuse fuses the two classifiers' sigmoid harmfulness scores without modifying model weights or the decoding process. On LLaDA-8B, the average attack success rate across multiple jailbreaks drops from 63.29% with no defense and 11.27% with the prompt classifier alone to 3.31%, while the average benign refusal rate on standard utility benchmarks stays below 1%.