BAAI proposes CURE, an alignment method for diffusion language models based on counterfactual token remasking
Start here
BAAI proposes CURE, an alignment method for diffusion language models: leveraging the editability of intermediate denoising states, it trains a lightweight safety value module to predict final risk from partially denoised states, uses counterfactual attribution to locate risk-causing tokens and selectively re-mask them, after which the original model continues generation, without modifying the base model parameters throughout; accepted to NeurIPS 2026 Oral, evaluated on three models and benchmarks such as WildJailbreak.
Generated by AI from reports · Updated 13 days ago
Related research
Papers whose work the reports mention
- The reports mention DiffuGuardDiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language ModelsBAAI proposes CURE, an alignment method for diffusion language models based on counterfactual token remasking
ICLR 2026 · 2025-09-29
- The reports mention HarmBenchHarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust RefusalBAAI proposes CURE, an alignment method for diffusion language models based on counterfactual token remasking
arXiv · 2024-02-06 · Deep reading
Progress timeline
- BAAI CommunityBAAI proposes CURE, an alignment method for diffusion language models based on counterfactual token remasking
BAAI proposed CURE, an alignment method for diffusion language models. It exploits the editability of intermediate denoising states: a lightweight safety value module is trained to predict final risk from partially denoised states, counterfactual attribution locates risk-causing tokens, which are selectively re-masked, and the original model then continues generation, without modifying the base model's parameters throughout. The work was accepted as a NeurIPS 2026 Oral. On three models—LLaDA-8B-Instruct, Dream-v0-Instruct-7B, and LLaDA-1.5—and five attack benchmarks—WildJailbreak, JBB-Behaviors, HarmBench, PAD-AdvBench, and DIJA-AdvBench—the average attack success rate dropped from 47.20% to 1.36%, and it is especially effective against PAD and DIJA attacks that rely on early anchor guidance.
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- X@BAAIBeijing · BAAIMeet CURE: Aligning Diffusion Language Models via Counterfactual Token Re-masking—accepted as a #NeurIPS2026 Oral (Top…(opens the original post in a new tab)
9 likes · 2 comments·Oct 31 01:42Collect