扩散模型更安全，但受上下文影响而失效：扩散大语言模型的安全祝福及其失效模式
Safer by Diffusion, Broken by Context: Diffusion LLM's Safety Blessing and Its Failure Mode
AI总结：
研究探讨了扩散大语言模型（D-LLMs）在生成效率上的优势及其安全特性，发现其扩散生成方式增强了对对抗攻击的抵抗力，但存在上下文嵌套等失效模式，首次成功突破Gemini Diffusion的安全防线。
摘要：
扩散大语言模型（D-LLMs）提供了一种替代自回归大语言模型（AR-LLMs）的方案，并在生成效率上表现出优势。除了实用性之外，我们认为D-LLMs展现出一种此前未被充分探索的安全优势：其扩散式生成方式赋予了内在的鲁棒性，能够抵御原本针对AR-LLMs设计的劫持攻击。在本工作中，我们对底层机制进行了初步分析，表明扩散轨迹诱导出逐步减少效应，逐步抑制不安全生成。然而，这种鲁棒性并非绝对。在分析之后，我们强调了一种简单但有效的失效模式，即上下文嵌套，其中有害请求被嵌入到结构化的良性上下文中。实证研究表明，这种简单的黑盒策略能够绕过D-LLMs的安全优势，在各种模型和基准测试中均实现了最先进的攻击成功率。值得注意的是，它使我们首次成功劫持Gemini Diffusion，暴露了专有D-LLMs中的关键漏洞。共同，我们的结果描述了D-LLMs安全优势的起源和局限，构成了D-LLMs的早期阶段红队测试。
英文摘要：
Diffusion large language models (D-LLMs) offer an alternative to autoregressive LLMs (AR-LLMs) and have demonstrated advantages in generation efficiency. Beyond the utility benefits, we argue that D-LLMs exhibit a previously underexplored safety blessing: their diffusion-style generation confers intrinsic robustness against jailbreak attacks originally designed for AR-LLMs. In this work, we provide an initial analysis of the underlying mechanism, showing that the diffusion trajectory induces a stepwise reduction effect that progressively suppresses unsafe generations. This robustness, however, is not absolute. Following this analysis, we highlight a simple yet effective failure mode, context nesting, in which harmful requests are embedded within structured benign contexts. Empirically, we show that this simple black-box strategy bypasses D-LLMs' safety blessing, achieving state-of-the-art attack success rates across models and benchmarks. Notably, it enables the first successful jailbreak of Gemini Diffusion to our knowledge, exposing a critical vulnerability in proprietary D-LLMs. Together, our results characterize both the origins and the limits of D-LLMs' safety blessing, constituting an early-stage red-teaming of D-LLMs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
