cs.LG提交于 2026-10-23已译

有害响应即越狱模板：将自回归越狱迁移至扩散语言模型

Harmful Responses Are Jailbreak Templates: Transferring Autoregressive Jailbreaks to Diffusion Language Models

Jinwei Gan · Zifeng Cheng · Zhiwei Jiang · Ran Sun · Shiping Ge · Qing Gu

中文摘要

扩散大语言模型(dLLMs)通过双向上下文建模支持灵活的掩码生成，但也带来了独特的越狱攻击面。研究发现，针对特定查询的有害响应可自然充当有效越狱模板：仅掩蔽其中部分词元，就能诱导dLLM重建有害内容。据此提出RMT-Jailbreak，通过目标模型生成的有害响应，将现有自回归(AR)越狱攻击迁移至dLLMs。该框架采用统一词元保留策略，将AR生成的有害响应转换为高掩码率模板，并进一步利用基于提示的安全过滤，掩蔽仍可见的有害内容；随后将精炼模板输入目标dLLM进行双向重建。多个AR越狱方法和目标dLLM上的大量实验表明，RMT-Jailbreak具有有效性与通用性，揭示了越狱攻击在两种生成范式间的强迁移能力。

关键要点

01指出有害响应可作为诱导dLLM重建有害内容的越狱模板。
02提出RMT-Jailbreak，将现有AR越狱攻击迁移至扩散语言模型。
03通过统一词元保留生成高掩码率模板，并过滤残余有害内容。
04跨多种AR越狱方法与目标dLLM的实验验证了攻击效果和通用性。
05结果显示越狱攻击具有较强的跨范式迁移能力。

解读

尚无解读。

原始英文摘要

arXiv:2610.31331v1 Announce Type: new Abstract: Diffusion large language models (dLLMs) enable flexible masked generation through bidirectional context modeling, but this capability also introduces a distinct jailbreak attack surface. We find that a harmful response to a given query naturally serves as an effective jailbreak template: simply masking a subset of its tokens can induce a dLLM to reconstruct harmful content. Based on this observation, we propose RMT-Jailbreak, a general framework that transfers existing autoregressive (AR) jailbreak attacks to dLLMs through their induced harmful responses. RMT-Jailbreak converts an AR-generated harmful response into a high-mask-ratio template using uniform token retention, and further applies prompt-based safety filtering to mask any remaining visible harmful content. The refined template is then provided to the target dLLM for bidirectional reconstruction. Extensive experiments across multiple AR jailbreak methods and target dLLMs demonstrate the effectiveness and generality of RMT-Jailbreak, revealing strong cross-paradigm transferability of jailbreak attacks.