Harmful Responses Are Jailbreak Templates: Transferring Autoregressive Jailbreaks to Diffusion Language Models
Diffusion large language models introduce a bidirectional infilling mechanism that poses a distinct jailbreak surface compared to autoregressive generation. This paper proposes RMT-Jailbreak, which first elicits a harmful response from a source autoregressive model using existing jailbreak methods, then converts that response into a sparsely masked template and feeds it to a target diffusion model to reconstruct the harmful content. The key finding is that query-specific harmful responses provide more effective reconstruction cues than generic attack scaffolds, yielding strong cross-paradigm transferability.
RMT-Jailbreak is a conceptually clean and empirically strong contribution. The authors convincingly show that uniformly masking an autoregressive-induced harmful response creates a powerful jailbreak template for diffusion language models, outperforming both direct AR prompt transfer and the diffusion-specific DiJA baseline across four target dLLMs and three safety benchmarks. However, the paper mischaracterizes DiJA as relying on "manually designed contextual templates" when DIJA in fact employs an automated LLM-guided pipeline for prompt refinement, which unfairly weakens the related-work framing. The absence of a public code release and the lack of ablation for the auxiliary safety-filtering stage also limit reproducibility and practical insight.
The empirical core of the paper is well-supported: uniform masking of an AR-induced harmful response consistently outperforms both direct application of AR jailbreak prompts and DiJA across HarmBench, JailbreakBench, and StrongREJECT. The authors also provide a useful architectural analysis showing that uniform token retention is far more effective than continuous masking because distributed visible cues better exploit bidirectional reconstruction.
The characterization of DIJA as relying on "manually designed contextual templates" is inaccurate; the DIJA paper describes an automated pipeline that uses in-context learning with an LLM to refine prompts. This misrepresentation frames RMT-Jailbreak's advantage as overcoming manual design rather than a genuine algorithmic improvement in template quality.
Additionally, the safety-filtering stage depends entirely on Qwen3-8B correctly identifying visible harmful tokens, yet the paper provides no ablation studying cases where the filter fails or over-masks benign tokens. The method also presupposes unrestricted access to a source AR model that is sufficiently vulnerable to produce a harmful response, which may not hold for strongly aligned or proprietary models.
The experimental evidence supports the central claim that response-mediated transfer surpasses direct prompt transfer, with large gains on Dream-Instruct where AR attacks otherwise fail. However, the comparison to DIJA may not be perfectly fair because the paper does not clearly state whether the DIJA numbers were reproduced under the same evaluation protocol—RMT-Jailbreak uses Llama-Guard-4 for JailbreakBench, whereas DIJA originally reported keyword-based ASR for some settings—or simply taken from the DIJA paper under potentially different metrics.
Reproducibility is hampered by the absence of a public code repository or data release. While the paper reports the mask ratio ($\rho=0.8$), source model (Mistral-7B-Instruct-v0.2), and auxiliary filter model (Qwen3-8B), it omits key hyperparameters for the underlying AR jailbreak methods, random seeds, and the exact inference configuration for the target dLLMs. The safety-filtering prompt is provided in Appendix A, which helps, but without code and with reliance on a closed-source evaluator (GPT-4o) for harmfulness scores, independent reproduction would require substantial guesswork.
Diffusion large language models (dLLMs) enable flexible masked generation through bidirectional context modeling, but this capability also introduces a distinct jailbreak attack surface. We find that a harmful response to a given query naturally serves as an effective jailbreak template: simply masking a subset of its tokens can induce a dLLM to reconstruct harmful content. Based on this observation, we propose RMT-Jailbreak, a general framework that transfers existing autoregressive (AR) jailbreak attacks to dLLMs through their induced harmful responses. RMT-Jailbreak converts an AR-generated harmful response into a high-mask-ratio template using uniform token retention, and further applies prompt-based safety filtering to mask any remaining visible harmful content. The refined template is then provided to the target dLLM for bidirectional reconstruction. Extensive experiments across multiple AR jailbreak methods and target dLLMs demonstrate the effectiveness and generality of RMT-Jailbreak, revealing strong cross-paradigm transferability of jailbreak attacks.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.