analiza aiqbench
This study demonstrates that switching from autoregressive to diffusion sampling mechanisms significantly improves jailbreak robustness by enabling recovery from harmful intermediate generations. The authors introduce the Step-Wise Refusal Internal Dynamics (SRI) signal to detect these failures at the generation level, allowing for a lightweight detector that generalizes to unseen attacks without modifying inference. These findings highlight the critical role of sampling strategies in shaping safety dynamics, offering a practical path to enhancing model resilience against prompt injections.
Step-Wise Refusal Dynamics in Autoregressive and Diffusion Language Models
arXiv:2602.02600v3 Announce Type: replace Abstract: Diffusion language models (DLMs) have recently emerged as a competitive alternative to autoregressive (AR) models, offering parallel decoding, competitive generation quality, and initial evidence of improved jailbreak robustness. Despite this progress, the role of sampling mechanisms in shaping refusal behavior remains poorly understood. To address this gap, we present a comprehensive study of step-wise refusal dynamics. We show that diffusion remasking can promote recovery from harmful intermediate generations, provide evidence that this behavior is tied to the sampling mechanism, and demonstrate that switching from AR to diffusion sampling improves jailbreak robustness, including under fixed model weights. To capture generation dynamics not observable at the text level, we propose the Step-Wise Refusal Internal Dynamics (SRI) signal. Consistent with our text-level findings, SRI shows that recovery fails primarily under AR sampling, with these failures often appearing anomalous relative to harmless generations in the SRI space. Based on this observation, we show that SRI enables a simple jailbreak detector that does not modify inference and generalizes to unseen attacks by training only on benign SRI signals. Our evaluation shows that this detector matches or outperforms existing jailbreak detection baselines while adding negligible overhead.
Abstract:Diffusion language models (DLMs) have recently emerged as a competitive alternative to autoregressive (AR) models, offering parallel decoding, competitive generation quality, and initial evidence of improved jailbreak robustness. Despite this progress, the role of sampling mechanisms in shaping refusal behavior remains poorly understood. To address this gap, we present a comprehensive study of step-wise refusal dynamics. We show that diffusion remasking can promote recovery from harmful intermediate generations, provide evidence that this behavior is tied to the sampling mechanism, and demonstrate that switching from AR to diffusion sampling improves jailbreak robustness, including under fixed model weights. To capture generation dynamics not observable at the text level, we propose the Step-Wise Refusal Internal Dynamics (SRI) signal. Consistent with our text-level findings, SRI shows that recovery fails primarily under AR sampling, with these failures often appearing anomalous relative to harmless generations in the SRI space. Based on this observation, we show that SRI enables a simple jailbreak detector that does not modify inference and generalizes to unseen attacks by training only on benign SRI signals. Our evaluation shows that this detector matches or outperforms existing jailbreak detection baselines while adding negligible overhead.
Machine Learning (cs.LG); Artificial Intelligence (cs.AI)
arXiv:2602.02600 [cs.LG]
(or arXiv:2602.02600v3 [cs.LG] for this version)
Text integral sub licența deschisă a publicației · 204 cuvinte
Subiecte conexe
Step-Wise Refusal Dynamics in Autoregressive and Diffusion Language Models
arXiv · 9 sept. 2026
Inception in DiffusionGemma - Jailbreaking a Diffusion Language Model by Pinning Tokens Anywhere on the Canvas
LessWrong · 23 iul. 2026
DIP: Dynamic In-Context Planner For Diffusion Language Models
arXiv · 1 sept. 2026
[AINews] Opus 5.5 is good at explainer videos
Latent Space · 29 sept. 2026