A2D: 任意顺序、任意步长的安全对齐用于扩散语言模型
A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Models
AI总结：
A2D通过令牌级对齐方法，在扩散语言模型中实现任意顺序和步长攻击的鲁棒防御，显著降低有害输出生成概率并提升安全终止效率。
摘要：
扩散大语言模型（dLLMs）能够实现任意顺序的生成，但这种灵活性扩大了攻击面：有害内容可能出现在任意位置，且基于模板的预填充攻击如DIJA绕过响应级拒绝。我们引入A2D（任意顺序、任意步长防御），一种基于令牌的对齐方法，使dLLMs在出现有害内容时能够发出[EOS]拒绝信号。通过在随机掩码下直接在令牌级别对齐安全性，A2D在各种条件下都对任意解码顺序和任意步长预填充攻击具有鲁棒性。它还实现了实时监控：dLLMs可能开始响应，但若出现不安全的延续会自动终止。在安全性基准测试中，A2D一致阻止生成有害输出，将DIJA的成功率从超过80%降至几乎零（在LLaDA-8B-Instruct上为1.3%，在Dream-v0-Instruct-7B上为0.0%），并且阈值化的[EOS]概率允许早期拒绝，使安全终止速度提升高达19.3倍。
英文摘要：
Diffusion large language models (dLLMs) enable any-order generation, but this flexibility enlarges the attack surface: harmful spans may appear at arbitrary positions, and template-based prefilling attacks such as DIJA bypass response-level refusals. We introduce A2D (Any-Order, Any-Step Defense), a token-level alignment method that aligns dLLMs to emit an [EOS] refusal signal whenever harmful content arises. By aligning safety directly at the token-level under randomized masking, A2D achieves robustness to both any-decoding-order and any-step prefilling attacks under various conditions. It also enables real-time monitoring: dLLMs may begin a response but automatically terminate if unsafe continuation emerges. On safety benchmarks, A2D consistently prevents the generation of harmful outputs, slashing DIJA success rates from over 80% to near-zero (1.3% on LLaDA-8B-Instruct, 0.0% on Dream-v0-Instruct-7B), and thresholded [EOS] probabilities allow early rejection, yielding up to 19.3x faster safe termination.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
