BAAI proposes CURE, an alignment method for diffusion language models based on counterfactual token remasking

BAAI proposed CURE, an alignment method for diffusion language models. It exploits the editability of intermediate denoising states: a lightweight safety value module is trained to predict final risk from partially denoised states, counterfactual attribution locates risk-causing tokens, which are selectively re-masked, and the original model then continues generation, without modifying the base model's parameters throughout. The work was accepted as a NeurIPS 2026 Oral. On three models—LLaDA-8B-Instruct, Dream-v0-Instruct-7B, and LLaDA-1.5—and five attack benchmarks—WildJailbreak, JBB-Behaviors, HarmBench, PAD-AdvBench, and DIJA-AdvBench—the average attack success rate dropped from 47.20% to 1.36%, and it is especially effective against PAD and DIJA attacks that rely on early anchor guidance.