🤖 AI Summary
Current safety alignment mechanisms in diffusion-based language models assume that once a refusal token is generated, it remains immutable—a vulnerability this work exploits. We introduce TrajHijack, the first trajectory-level hijacking attack, which overwrites previously generated refusal tokens by re-masking them and injecting a fixed compliant prefix, enabling gradient-free, cross-model attacks. This approach exposes critical weaknesses in the dual-component safety architecture—comprising refusal detection and content generation—and reveals a counterintuitive defense inversion effect, wherein stronger defenses become more susceptible to attack. Evaluated on HarmBench, TrajHijack achieves attack success rates of 74–98%, with the state-of-the-art A2D defense exhibiting heightened vulnerability (89.9% ASR).
📝 Abstract
Diffusion-based language models (dLLMs) generate text by iteratively denoising masked token sequences. We show that their safety alignment rests on a single fragile assumption: that the denoising schedule is monotonic and committed tokens are never re-evaluated. Safety-aligned dLLMs commit refusal tokens within the first 8-16 of 64 denoising steps, and the schedule treats these commitments as permanent. A trivial two-step intervention - re-masking these tokens and injecting a 12-token affirmative prefix - achieves 76.1% ASR on HarmBench (n=159, Lg=128) against LLaDA-8B-Instruct and 81.8% ASR (n=159) against Dream-7B-Instruct, without any gradient computation or adversarial search. The simplicity of this exploit is itself the central finding: augmenting with gradient-optimized perturbation via a differentiable Gumbel-softmax chain consistently degrades ASR (e.g., 41.5% vs. 76.1% at Lg=128), confirming that the vulnerability is structural rather than requiring sophisticated exploitation. These findings reveal that dLLM safety is not adversarially robust but architecturally shallow - it holds only because the denoising schedule is never violated. We discuss defenses including safety-aware unmasking schedules, step-conditional prefix detection, and post-commitment re-verification.