Toward Safer Diffusion Language Models: Discovery and Mitigation of Priming Vulnerability

## Abstract

Abstract Diffusion language models (DLMs) generate tokens in parallel through iterative denoising, which can reduce latency and enable bidirectional conditioning.
However, the safety risks posed by jailbreak attacks that exploit this inference mechanism are not well understood. In this paper, we reveal that DLMs have a critical vulnerability stemming from their iterative denoising process and propose a countermeasure. Specifically, our investigation shows that if an affirmative token for a harmful query appears at an intermediate step, subsequent denoising can be steered toward a harmful response even in aligned models.
As a result, simply injecting such affirmative tokens can readily bypass the safety guardrails.
Furthermore, we demonstrate that the vulnerability allows existing optimization-based jailbreak attacks to succeed on DLMs.
Building on this analysis, we propose a novel safety alignment method tailored to DLMs that trains models to generate safe responses from contaminated intermediate states that contain affirmative tokens. Our experiments indicate that the proposed method significantly mitigates the vulnerability with minimal impact on task performance. Furthermore, our method improves robustness against conventional jailbreak attacks. Our work underscores the need for DLM-specific safety research.

## 1 Introduction

Diffusion Language Models (DLMs) (DeepMind, 2024; Labs et al., 2025) generate tokens in parallel through an iterative denoising (reverse) process and are emerging as an alternative to Autoregressive Models (ARMs) (Touvron et al., 2023; Achiam et al., 2023).
In particular, there has been growing interest in a practical subclass of DLMs, Masked Diffusion Language Models (MDLMs) (Nie et al., 2025; Gong et al., 2025; You et al., 2025; Zhu et al., 2025), which define the diffusion process over the discrete token vocabulary.
As shown in Figure [1](https://arxiv.org/html/2510.00565v1#S1.F1)(a), the denoising process begins with a fully masked token sequence.
At each step, the model updates all masked tokens with predicted tokens in parallel and then re-masks a subset of them.
Repeating this procedure gradually reduces the masking ratio until a complete sequence emerges.
These properties are attractive for both lower inference latency and the bidirectional context (Li et al., 2022; Patel et al., 2023; Li et al., 2025).

However, the vulnerabilities of MDLMs to jailbreak attacks remain largely unexplored. Because their non-causal, parallel denoising process fundamentally differs from the causal, sequential generation of ARMs, it is unclear whether safety insights established for ARMs transfer to MDLMs.
These differences motivate MDLM-specific safety research tailored to their inference mechanism.

In this work, we identify a critical vulnerability and propose a countermeasure. Our investigation reveals that even in safety-aligned models, if an affirmative token in response to a harmful query appears at an intermediate step of the denoising process, subsequent generation can be steered toward a harmful response (Figure [1](https://arxiv.org/html/2510.00565v1#S1.F1)(b)).
We refer to this as the *priming vulnerability*. This stands in contrast to the vulnerability exploited by prefilling attacks on ARMs (Wei et al., 2023).
In ARMs, left-to-right sequential prediction allows the very first few affirmative tokens in the response to suppress later refusals. In MDLMs, the iterative and parallel inference mechanism causes affirmative tokens that arise early in the denoising process to have a similar suppressive effect.
While the vulnerability of ARMs has become a major focus of prior works (Sahoo et al., 2024; Qi et al., 2025; Zhao et al., 2025), an analysis of the priming vulnerability remains limited.

To address this gap, we systematically analyze this vulnerability by designing attacks that target the denoising process of MDLMs under two threat models.
In the first threat model, we assume a hypothetical attacker who can intervene in the denoising process for comprehensive evaluation. We introduce a simple attack that injects tokens specified by the attacker at an intermediate step and show that the attack success rate increases from 2% to 21% even with an intervention only at the first step.
In the second threat model, we assume a more realistic attacker who does not intervene in the denoising process and instead conducts an optimization-based jailbreak attack such as Greedy Coordinate Gradient (GCG) (Zou et al., 2023).
While these attacks optimize the query to maximize the likelihood of generating a harmful response, the gradient of the objective is intractable because the denoising process typically includes iterative stochastic re-masking.
To address this, we derive a theoretical lower bound on the attack objective that exploits the priming vulnerability and demonstrate that it works as an effective surrogate.
These results underscore the severity of the issue.

This vulnerability stems from the initialization choice commonly used in MDLM training, which initializes the denoising process from a fully masked sequence and trains the model to generate safe responses only under that starting condition.
However, the generation trajectory does not include cases where affirmative tokens for a harmful query appear at the intermediate steps of the denoising process.
As a result, the model does not learn how to recover from such partially contaminated states, and its refusal mechanism tends to fail once those tokens appear.

To address this issue, we propose a new safety alignment method for MDLMs, Recovery Alignment (RA) (Figure [1](https://arxiv.org/html/2510.00565v1#S1.F1)(c)).
In our training process, we intentionally construct harmful intermediate states and condition the model to generate from them. In this way, we teach the model a recovery trajectory from contamination back to safety.
Importantly, by explicitly modeling such contaminated intermediate states, our approach not only mitigates the priming vulnerability but also often leads to stronger robustness against general jailbreak attacks.
In our experiments, RA achieves state-of-the-art robustness against priming vulnerability without clear degradation in general capability on eleven benchmarks.
Moreover, it enhances robustness against conventional jailbreak attacks. These findings highlight that our approach effectively addresses the vulnerability.

Figure: Figure 1: Overview of this work. (a) MDLMs alternate prediction and partial re-masking to gradually produce the response. (b) An affirmative token can steer generation toward a harmful response. (c) Our approach trains the model to recover to a safe response.
Refer to caption: x1.png

Our contributions can be summarized as follows:

- 1.
We focus on and quantify the *priming vulnerability* in MDLMs, where affirmative tokens at an intermediate step of the denoising process can steer the subsequent process toward producing a harmful response.
- 2.
We introduce *Recovery Alignment* (RA), an MDLM-specific safety alignment that trains the model to recover from adversarially contaminated intermediate states back to safe responses.
- 3.
We validate our approach on three MDLMs across two datasets. RA mitigates the vulnerability and improves robustness against standard jailbreaks while preserving utility.

## 2 Related work

In this section, we specifically focus on the safety of MDLMs.
For a detailed and comprehensive review of related work, including literature on ARMs, please see Appendix [B](https://arxiv.org/html/2510.00565v1#A2).

##### Diffusion Language Models.

DLMs are a framework that leverages the generative mechanisms of diffusion models for text generation.
Two main approaches are distinguished by the domain in which the diffusion process is defined: continuous DLMs (Li et al., 2022; Gong et al., 2023; Dieleman et al., 2022; Lin et al., 2023; Mahabadi et al., 2024) and discrete DLMs (Austin et al., 2021a; He et al., 2023; Ye et al., 2023; Sahoo et al., 2024; Gong et al., 2025).
Within the discrete family, MDLMs have emerged as an effective method.
Recent works (Nie et al., 2025; Zhu et al., 2025; Ye et al., 2025) indicate that MDLMs trained from scratch can match the performance of similarly sized ARMs (Dubey et al., 2024). Extensions to multimodal inputs and joint text–image generation have also been explored (Yang et al., 2025; You et al., 2025).

##### Jailbreak Attack.

A substantial literature examines jailbreak attacks for ARMs (Wei et al., 2023; Zou et al., 2023; Chao et al., 2025; Mehrotra et al., 2024; Anil et al., 2024a; Liu et al., 2024a; Andriushchenko et al., 2025).
For MDLMs, several concurrent works propose attacks that explicitly intervene in the denoising process (Zhang et al., 2025; Wen et al., 2025).
While these attacks implicitly exploit the priming vulnerability, they cannot provide a comprehensive quantitative evaluation because their attacks depend heavily on heuristic choices of tokens and intervention locations.
Moreover, they do not discuss how a more realistic attacker, who cannot intervene in the denoising process, could exploit this vulnerability.
In this work, we design an attack that intervenes in the denoising process for comprehensive evaluation.
In addition, through theoretical analysis, we examine that this vulnerability can be exploited by an attack that optimizes the query without intervention.

##### Safety Alignment

A large body of work proposes methods for safety alignment, focusing on ARMs (Rafailov et al., 2023; Ouyang et al., 2022; Bai et al., 2022; Ethayarajh et al., 2024).
For MDLMs, Xie et al. (2025) point out that middle tokens in a response critically affect safety and propose a safety alignment method, MOSA. This method aims to align the middle tokens with a safe refusal template. However, as our experiments show, it cannot address the priming vulnerability because it trains models to generate safe responses from a fully masked sequence. In contrast, we mitigate this vulnerability by training the model to recover from intentionally contaminated intermediate states to safe responses.

## 3 Preliminaries

##### Notation.

Let $\mathcal{V}$ be the vocabulary. We denote the query as $\bm{q}\in\mathcal{V}^{|\bm{q}|}$, and the response as $\bm{r}\in\mathcal{V}^{L}$, where $L$ denotes the generation length. The denoising process consists of $T$ steps, and we denote the partially masked response at timestep $t\in\{0,1,\dots,T\}$ as $\bm{r}_{t}\in\mathcal{V}^{L}$.
Since our work focuses on the denoising step for inference only, we index it with an increasing step counter: $\bm{r}_{0}$ is the sequence where all tokens are masked, and $\bm{r}_{T}$ is the fully restored response. MDLMs are composed of two core components: *mask predictor* $\pi_{\theta}:\mathcal{V}^{|\bm{q}|}\times\mathcal{V}^{L}\rightarrow\mathcal{P}(\mathcal{V}^{L})$ and *masking strategy* $m_{t}:\mathcal{V}^{L}\rightarrow\mathcal{P}(\mathcal{V}^{L})$.

##### Denoising process.

The denoising process starts with the fully masked response $\bm{r}_{0}$ and iteratively refines it to produce $\bm{r}_{T}$. At step $t$, the mask predictor $\pi_{\theta}$ generates the fully unmasked response $\tilde{\bm{r}}_{t}$ from the query $\bm{q}$ and the partially masked response $\bm{r}_{t-1}$, and then the masking strategy $m_{t}$ generates a re-masked response $\bm{r}_{t}$ from an unmasked response $\tilde{\bm{r}}_{t}$. The generation probability of the final response is expressed as follows:

$$ $p_{\pi,m_{t}}(\bm{r}_{T}\mid\bm{q},\bm{r}_{0})=\int\cdots\int\prod_{t=1}^{T}\left[\int m_{t}(\bm{r}_{t}\mid\tilde{\bm{r}}_{t})\pi_{\theta}(\tilde{\bm{r}}_{t}\mid\bm{q},\bm{r}_{t-1})d\tilde{\bm{r}}_{t}\right]d\bm{r}_{1}\cdots d\bm{r}_{T-1}.$ (1) $$

In typical implementations (Nie et al., 2025; Zhu et al., 2025; Yang et al., 2025), a simple random-masking schedule is used as a basis. At step $t$, the masking strategy re-masks only the tokens that are masked in $\bm{r}_{t-1}$ with probability $\tfrac{T-t}{T}$. Unmasked tokens in $\bm{r}_{t}$ are unchanged and never re-masked in subsequent steps. Unless otherwise specified, we set $L=128$ and $T=128$.

## 4 Priming Vulnerability

We define the priming vulnerability as the case that if affirmative tokens, which endorse or advance a harmful intent, appear at an intermediate step of the denoising process, subsequent generation tends to be steered toward a harmful response.
This vulnerability does not surface simply by inputting a harmful query because safety-aligned models often produce only refusal tokens.
In this section, we present two case studies to expose and measure it.
In Section [4.1](https://arxiv.org/html/2510.00565v1#S4.SS1), we assume a hypothetical attacker who can intervene in the denoising process and reveal the characteristics of the vulnerability.
In Section [4.2](https://arxiv.org/html/2510.00565v1#S4.SS2), we demonstrate that a more realistic attacker, who cannot intervene in the denoising process, can still exploit this vulnerability, emphasizing that it is an important issue that must be addressed.

### 4.1 Characteristic of the Priming Vulnerability

Assuming a hypothetical attacker who can directly intervene in the denoising process, we design the *anchoring attack*, a straightforward attack for vulnerability evaluation (Figure [1](https://arxiv.org/html/2510.00565v1#S1.F1)(b)). Let $(\bm{q},\bm{r})$ be a harmful query and response, respectively. In this attack, at the intervention step $t_{\text{inter}}$ (e.g., $t_{\text{inter}}=1$), the attacker replaces the predicted response $\tilde{\bm{r}}_{t_{\text{inter}}}$ with the harmful response $\bm{r}$.
Then, the model continues the denoising process from the intermediate re-masked sequence $\bm{r}_{t_{\text{inter}}}\sim m_{t_{\text{inter}}}(\cdot\mid\bm{r})$. The tokens contained in $\bm{r}_{t_{\text{inter}}}$ act as anchors, biasing subsequent denoising toward harmful trajectories. Finally, the model generates the response $\bm{r}_{T}\sim p_{\pi,m_{t}}(\cdot\mid\bm{q},\bm{r}_{t_{\text{inter}}})$.

##### Evaluating the priming vulnerability.

Figure: Figure 2: ASR vs. number of intervention steps. ASR increases sharply even at $t_{\text{inter}}=1$.
Refer to caption: x2.png

We quantify this vulnerability using the anchoring attack on JBB-Behaviors dataset (Chao et al., 2024), which contains 100 carefully crafted behaviors.
Following prior works (Qi et al., 2025; Sahoo et al., 2024), we used GPT-4o as an automatic judge to decide whether a model’s response is harmful. We reported the Attack Success Rate (ASR) as the fraction of outputs judged harmful.
Harmful responses are generated by a non-safety-aligned model (please see Appendix [D](https://arxiv.org/html/2510.00565v1#A4) for details).
Figure [2](https://arxiv.org/html/2510.00565v1#S4.F2) shows clear evidence of this vulnerability.
We make two key observations:
(i) The later the intervention step, the higher the ASR.
With an intervention at step 16, ASR exceeds 80% across all models.
The later intervention embeds more tokens in the intermediate state, making it increasingly difficult to generate a safe response from the state.
(ii) Intervening even in the first step significantly increases ASR.
At $t_{\text{inter}}=1$, the attack inserts only a single token, as we set $L=T=128$.
Despite this minimal change, it bypasses the safety guardrails.
For example, ASR increases from 2% to 21% with LLaDA Instruct.
The result highlights the significant impact of this vulnerability.
Additional analyses are provided in Appendix [C.1](https://arxiv.org/html/2510.00565v1#A3.SS1).

### 4.2 Leveraging the priming vulnerability without intervention

To further analyze the vulnerability, we assume a more realistic adversary who cannot intervene in the denoising process but can modify the prompt and examine how such an attacker can still exploit the vulnerability. In this section, we focus on GCG as a concrete instantiation.

We first define the objective of GCG.
Given a harmful query $\bm{q}$ and harmful target response $\bm{r}$, the attacker optimizes a suffix $\bm{s}$ to maximize the likelihood of generating the response $\bm{r}$:

$$ $\max_{\bm{s}}\mathcal{L}_{\mathrm{GCG}}(\bm{s})\triangleq\log p_{\pi,m_{t}}(\bm{r}_{T}=\bm{r}\mid\bm{q}\oplus\bm{s},\bm{r}_{0}),$ (2) $$

where $\oplus$ denotes the concatenation of token sequences.

For MDLMs, iterative stochastic remasking in the denoising process makes the gradient of the objective intractable because the generation probability contains exponentially many stochastic denoising paths.
A straightforward way to address this problem is to maximize a tractable lower bound estimated by Monte Carlo (MC) sampling (Nie et al., 2025; Zhu et al., 2025).
However, MC estimates have high variance and incur substantial overhead due to repeated sampling, which leads to lower attack performance and higher computational costs, as demonstrated in our experiments.

By leveraging the priming vulnerability, we can obtain a lower bound that does not rely on MC, which demonstrates better attack performance empirically. Specifically, we show that the log-likelihood of the mask predictor in the first step is a lower bound on the log-likelihood over the entire denoising process:

###### Theorem 4.1 .

Let $\bm{q}$ and $\bm{r}$ be the query and the response, respectively, and let $\bm{r}_{t}$ be the intermediate state at step $t$.
Assume the monotonicity $\log\pi_{\theta}(\tilde{\bm{r}}_{t+1}=\bm{r}\mid\bm{q},\bm{r}_{t})\;\geq\;\log\pi_{\theta}(\tilde{\bm{r}}_{1}=\bm{r}\mid\bm{q},\bm{r}_{0})$ for all $t=1,\dots,T-1$.
Then, the following inequality holds:

$$ $\log p_{\pi,m_{t}}(\bm{r}_{T}=\bm{r}\mid\bm{q},\bm{r}_{0})\;\geq\;\frac{1}{T}\log\pi_{\theta}(\tilde{\bm{r}}_{1}=\bm{r}\mid\bm{q},\bm{r}_{0}).$ (3) $$

We provide the proof in Appendix [A](https://arxiv.org/html/2510.00565v1#A1).
We empirically assess the general validity of this assumption in Appendix [C.2](https://arxiv.org/html/2510.00565v1#A3.SS2) and find that it holds across a broad range of models.
Based on this theorem, we design *First-Step GCG* to maximize the lower bound as a surrogate objective:

$$ $\max_{\bm{s}}\mathcal{L}_{\mathrm{first}}(\bm{s})\triangleq\log\pi_{\theta}(\tilde{\bm{r}}_{1}=\bm{r}\mid\bm{q}\oplus\bm{s},\bm{r}_{0}).$ (4) $$

Compared with MC sampling, optimizing the first-step log-likelihood is a more effective surrogate for two reasons. First, because the first step involves no masking, the objective is fully tractable and directly differentiable, avoiding gradient estimation over stochastic trajectories and thereby reducing computational cost. Second, as shown in Figure [2](https://arxiv.org/html/2510.00565v1#S4.F2), even increasing the generation probability in the first step is sufficient to steer subsequent generations toward a harmful response. This effect helps compensate for the looseness of the lower bound and, in practice, yields strong attack performance.

###### Theorem 4.1 .

##### Results.

**Table 1: Attack performance comparison on JBB-Behaviors dataset. For each MDLM, we report ASR (%) and runtime per prompt (h). ASR is mean$\pm$std, and Time is the mean over three runs.**
|  | LLaDA Instruct | LLaDA 1.5 | MMaDA MixCoT |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| Method | ASR (%) | Per-prompt time (h) | ASR (%) | Per-prompt time (h) | ASR (%) | Per-prompt time (h) |
| No Attack | $2.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | — | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | — | $79.7\,{\scriptstyle\pm}\,{\scriptstyle 3.8}$ | — |
| Monte Carlo GCG | $20.0\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ | 4.3 | $12.5\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | 4.1 | $85.3\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | 4.8 |
| First-Step GCG (ours) | $58.0\,{\scriptstyle\pm}\,{\scriptstyle 5.7}$ | 0.2 | $49.5\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | 0.2 | $92.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | 0.3 |

We evaluate the advantage of First-Step GCG on the JBB-Behaviors dataset. As in Section [4.1](https://arxiv.org/html/2510.00565v1#S4.SS1), we used GPT-4o as an automatic evaluator. Following prior work Zou et al. (2023), we fixed the suffix length at 20 tokens and set the number of iterations to 500 (please see Section [D.9](https://arxiv.org/html/2510.00565v1#A4.SS9) for details). As shown in Table [1](https://arxiv.org/html/2510.00565v1#S4.T1), First-Step GCG achieves significant improvements in both efficiency and attack performance across all models. Compared to Monte Carlo GCG, our method is approximately $20\times$ faster. Furthermore, it boosts the ASR by up to $4\times$ on LLaDA-1.5.

##### Remark.

These results suggest that the priming vulnerability can be exploited even by a more realistic attacker and underscore that it is a pressing issue. In the following experiments, we employ First-Step GCG for evaluation because it is stronger and more computationally efficient.

## 5 Recovery Alignment

The priming vulnerability originates from how MDLMs are typically trained. In standard implementations (Nie et al., 2025; Zhu et al., 2025; Yang et al., 2025), the model is optimized to produce safe responses when the denoising process starts from a fully masked sequence $\bm{r}_{0}$.
This can be interpreted as minimizing the probability of generating the harmful response $\bm{r}$ from the initial state $\bm{r}_{0}$:

$$ $\min_{\theta}p_{\pi,m_{t}}(\bm{r}_{T}=\bm{r}\mid\bm{q},\bm{r}_{0}).$ (5) $$

However, this objective cannot resolve the vulnerability because it does not take into account contaminated intermediate states containing affirmative tokens. Informally, when $\bm{r}_{t}$ includes such affirmative tokens, the following inequality holds:

$$ $p_{\pi,m_{t}}(\bm{r}_{T}=\bm{r}\mid\bm{q},\bm{r}_{t})>p_{\pi,m_{t}}(\bm{r}_{T}=\bm{r}\mid\bm{q},\bm{r}_{0}),$ (6) $$

where the left-hand side conditions on a contaminated intermediate state and the right-hand side on the fully masked start. Thus, minimizing the right-hand side does not guarantee a decrease in the left-hand side. As a result, such training fails to constrain behavior at contaminated intermediate states, which explains why conventional alignment methods do not mitigate the priming vulnerability.

To address this gap, we propose *Recovery Alignment* (RA), an alignment framework that trains a model to recover safe responses even from contaminated intermediate states.
Here, we instantiate RA with a reward model and optimize it via an RLHF-style objective.
Let $\mathcal{D}_{h}=\{(\bm{q},\bm{r})\}$ be a set of pairs of harmful queries and corresponding harmful responses. Let $\mathcal{R}:\mathcal{V}^{|\bm{q}|}\times\mathcal{V}^{L}\rightarrow\mathbb{R}$ be a reward model that computes a reward from a query and a response.
We define the objective function as follows:

$$ $\max_{\theta}\mathcal{J}_{\text{RA}}(\theta)\triangleq\mathbb{E}_{(\bm{q},\bm{r})\in\mathcal{D}_{h}}\left[\mathcal{R}(\bm{q},\bm{r}_{T})\;\middle|\;\begin{aligned} &\bm{r}_{t_{\text{inter}}}\sim m_{t_{\text{inter}}}(\cdot\mid\bm{r})\quad\text{(Initialized from $\bm{r}$)}\\ &\bm{r}_{T}\sim p_{\pi,m_{t}}(\cdot\mid\bm{q},\bm{r}_{t_{\text{inter}}})\quad\text{(Denoising from $t_{\text{inter}}$ to $T$ step)}\end{aligned}\right].$ (7) $$

As a practical advantage, this RLHF-style instantiation requires no additional data-construction costs. We can use existing datasets of harmful queries and harmful responses, such as the Beavertails dataset (Ji et al., 2023), for $\mathcal{D}_{h}$. For the reward model $\mathcal{R}$, we can also employ pretrained models that score responses in terms of safety and usefulness. This makes RA a practical and scalable solution.

##### Linear schedule.

As shown in Figure [2](https://arxiv.org/html/2510.00565v1#S4.F2), the later the intervention step, the stronger the attack. Thus, using a large intervention step $t_{\text{inter}}$ allows the model to recover from stronger attacks, thereby improving robustness.
However, fixing $t_{\text{inter}}$ to a large value can destabilize training because generating a safe response in a few steps becomes difficult.
Thus, we schedule $t_{\text{inter}}$ linearly over the course of training. Let $S$ denote the total number of training steps and $s\in\{0,\dots,S\}$ the current step. Given range $[t_{\min},t_{\max}]$, we set $t_{\text{inter}}=\lfloor t_{\min}+\frac{s}{S}(t_{\max}-t_{\min})\rfloor$.
This curriculum enables the model to start from easier conditions and gradually learn to produce safe responses even under increasingly challenging states.

##### Implementation details.

Figure: Algorithm 1 Recovery Alignment with GRPO

We provide a simplified pseudo-code of RA in Algorithm [1](https://arxiv.org/html/2510.00565v1#alg1). To optimize the objective, we used GRPO (Shao et al., 2024).
The training process consists of three steps: (i) generate intermediate states by replacing the predicted response with the harmful response at $t_{\text{inter}}$, as in the anchoring attack,
(ii) have the model generate responses from these intermediate states and score their safety and usefulness with the reward model, and
(iii) update the model parameters to maximize the score.
In Algorithm [2](https://arxiv.org/html/2510.00565v1#alg2), we provide a more detailed procedure.

## 6 Experiments

We evaluate RA on two benchmarks, JBB-Behaviors (Chao et al., 2024) and AdvBench (Zou et al., 2023), and compute ASR using three evaluators: GPT-4o, LLaMA Guard 3 (Inan et al., 2023), and a keyword matching. Due to space constraints, this section reports only JBB-Behaviors results with ASR assessed by GPT-4o. All remaining results are provided in Appendix [C](https://arxiv.org/html/2510.00565v1#A3).

### 6.1 Setup

##### Model and Training Setup.

We applied recovery alignment to three MDLMs: LLaDA Instruct (Nie et al., 2025), LLaDA 1.5 (Zhu et al., 2025), and MMaDA MixCoT (Yang et al., 2025).
For training, we used the BeaverTails dataset (Ji et al., 2023), which consists of harmful queries paired with harmful responses. As the reward model, we directly employ DeBERTaV3 (He et al., 2021; Köpf et al., 2023) without additional fine-tuning.
All models were trained for 2,500 steps.
We provide additional experiments on training cost and learning curves in the Appendix [C.4](https://arxiv.org/html/2510.00565v1#A3.SS4).
Please see Appendix [D.4](https://arxiv.org/html/2510.00565v1#A4.SS4) for detailed implementations.

##### Attack methods.

We evaluate safety with two families of jailbreak attacks.
(i) Attacks that exploit the priming vulnerability.
We considered four attacks: Anchoring Attack, First-Step GCG, PAD (Zhang et al., 2025), and DiJA (Wen et al., 2025).
Among these, Anchoring Attack, PAD, and DiJA explicitly intervene in the denoising process by injecting tokens specified by the attacker.
PAD inserts tokens at designated positions and fills all remaining positions with mask tokens. Specifically, the attack places “Step1:” at position $1$ and “Step2:” at position $\lfloor\frac{L}{2}\rfloor$, with every other position masked.
DiJA specifies both the locations and the counts of mask tokens more finely, e.g.,
“Subject: <mask:10>.\n First paragraph: <mask:30>.\n Second paragraph: <mask:20>.\n Closing remarks: <mask:15>.”
(ii) Robustness to conversational jailbreaks.
We use PAIR (Chao et al., 2025), ReNeLLM (Ding et al., 2024), and Crescendo (Russinovich et al., 2025).
Although these attacks are originally designed for ARMs, they optimize prompts via a black-box API and are therefore likewise applicable to MDLMs.
Implementation details for all attacks are provided in Appendix [D.5](https://arxiv.org/html/2510.00565v1#A4.SS5).

##### Baselines.

To the best of our knowledge, no defense has been proposed specifically for the priming vulnerability.
As baselines, we therefore include three general safety alignment methods originally designed to defend against jailbreak attacks: SFT, DPO (Rafailov et al., 2023), and MOSA (Xie et al., 2025).
MOSA was introduced as an alignment method tailored to MDLMs, which maximizes the difference in maximum log-likelihood between safe phrases and harmful phrases over middle tokens in responses.
As an ablation, we also report the results of *RA w/o inter*, where we set $t_{\min}=t_{\max}=0$ and train the model only from the fully masked sequences without intervention, same as RLHF Ouyang et al. (2022).
Full baseline configurations are provided in Appendix [D.6](https://arxiv.org/html/2510.00565v1#A4.SS6).

### 6.2 Robustness to Attacks

##### Mitigation of the priming vulnerability

**Table 2: Robustness to attacks that leverage the priming vulnerability. The reported ASR is in the form of (mean $\pm$ std) over three runs. The results demonstrate that recovery alignment significantly mitigates the vulnerability.**
|  | Method | No Attack | Requires intervention in the denoising process | No intervention |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Anchoring ($t_{\text{inter}}$) | PAD | DiJA | First-Step GCG |  |  |  |  |  |  |  |
| 1 | 4 | 8 | 16 | 32 |  |  |  |  |  |  |
| LLaDA | Original | $2.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $17.3\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $44.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $68.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $88.7\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $96.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $67.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $92.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $58.0\,{\scriptstyle\pm}\,{\scriptstyle 5.7}$ |
| SFT | $8.3\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ | $19.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $42.7\,{\scriptstyle\pm}\,{\scriptstyle 4.9}$ | $66.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $87.7\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $96.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $66.3\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $91.7\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $48.2\,{\scriptstyle\pm}\,{\scriptstyle 1.4}$ |  |
| DPO | $4.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $10.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ | $26.0\,{\scriptstyle\pm}\,{\scriptstyle 3.0}$ | $51.7\,{\scriptstyle\pm}\,{\scriptstyle 6.5}$ | $81.7\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ | $95.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $35.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $88.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $46.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ |  |
| MOSA | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $6.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $24.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $46.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $79.7\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$ | $94.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $32.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $86.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $28.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ |  |
| RA w/o inter (ablation) | $1.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $7.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $22.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $49.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ | $76.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $92.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $40.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $82.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $25.0\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ |  |
| RA (ours) | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $1.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $3.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $8.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $50.7\,{\scriptstyle\pm}\,{\scriptstyle 5.1}$ | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $35.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $11.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ |  |
| LLaDA1.5 | Original | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $14.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $35.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ | $62.0\,{\scriptstyle\pm}\,{\scriptstyle 4.4}$ | $87.3\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$ | $96.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $61.7\,{\scriptstyle\pm}\,{\scriptstyle 5.5}$ | $89.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $49.5\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ |
| SFT | $6.3\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $16.7\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$ | $31.7\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ | $59.3\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | $88.3\,{\scriptstyle\pm}\,{\scriptstyle 6.7}$ | $95.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $54.0\,{\scriptstyle\pm}\,{\scriptstyle 6.6}$ | $89.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $36.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ |  |
| DPO | $4.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $9.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $23.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ | $46.7\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $80.7\,{\scriptstyle\pm}\,{\scriptstyle 7.0}$ | $95.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $36.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $87.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $42.0\,{\scriptstyle\pm}\,{\scriptstyle 7.8}$ |  |
| MOSA | $0.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $5.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $19.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $43.0\,{\scriptstyle\pm}\,{\scriptstyle 6.0}$ | $77.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $93.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $26.3\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $84.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $26.3\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$ |  |
| RA w/o inter (ablation) | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $7.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $27.7\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$ | $51.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $77.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $93.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $49.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $81.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $27.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ |  |
| RA (ours) | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $0.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $2.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $7.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $43.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $36.0\,{\scriptstyle\pm}\,{\scriptstyle 3.0}$ | $15.0\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ |  |
| MMaDA | Original | $79.7\,{\scriptstyle\pm}\,{\scriptstyle 3.8}$ | $90.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $93.7\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $94.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $98.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $99.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $99.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $97.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $92.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ |
| SFT | $46.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $51.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $81.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $90.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ | $97.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $98.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $99.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $95.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $65.3\,{\scriptstyle\pm}\,{\scriptstyle 5.8}$ |  |
| DPO | $39.0\,{\scriptstyle\pm}\,{\scriptstyle 3.0}$ | $55.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $74.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $86.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $96.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $97.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $98.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $98.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $57.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ |  |
| MOSA | $22.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $25.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $45.7\,{\scriptstyle\pm}\,{\scriptstyle 6.0}$ | $64.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $84.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $96.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $84.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $94.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $44.7\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$ |  |
| RA w/o inter (ablation) | $2.0\,{\scriptstyle\pm}\,{\scriptstyle 1.3}$ | $6.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $25.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $49.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $80.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $94.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $35.7\,{\scriptstyle\pm}\,{\scriptstyle 4.9}$ | $88.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $50.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ |  |
| RA (ours) | $3.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $6.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $13.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $15.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $34.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $79.3\,{\scriptstyle\pm}\,{\scriptstyle 5.7}$ | $24.3\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$ | $70.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $45.7\,{\scriptstyle\pm}\,{\scriptstyle 6.5}$ |  |

Table [2](https://arxiv.org/html/2510.00565v1#S6.T2) presents the ASR for attack methods leveraging the priming vulnerability.
Two key observations emerge.
(i) RA mitigates the vulnerability.
Across all models, RA consistently outperforms the baselines and achieves state-of-the-art robustness.
This finding substantiates the effectiveness of our approach.
However, when the intervention step is very late, such as $t_{\text{inter}}=32$, generating a fully safe response becomes challenging.
This is because it is practically impossible to generate a contextually safe response due to many anchors.
(ii) Training from contaminated intermediate states is crucial.
RA (w/o inter), which omits training on contaminated states, does not sufficiently reduce the priming vulnerability: at $t_{\text{inter}}=4$, the ASR exceeds 20%, and other baselines show similar trends.
These results support our analysis in Section [5](https://arxiv.org/html/2510.00565v1#S5), which suggests that existing alignments are insufficient, and effective mitigation requires training the model to generate safe responses from contaminated intermediate states.
Accordingly, we strongly recommend alignment procedures that explicitly condition on and learn from such contaminated states to counter the priming vulnerability.

##### Robustness to conventional jailbreak attacks.

**Table 3: Robustness to general jailbreak attacks on JBB-Behaviors dataset. We report ASR (mean $\pm$ std) over three runs.**
|  | Method | ASR (%) |  |  |
| --- | --- | --- | --- | --- |
| PAIR | ReNeLLM | Crescendo |  |  |
| LLaDA | Original | $44.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $92.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $81.3\,{\scriptstyle\pm}\,{\scriptstyle 4.9}$ |
| SFT | $36.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $94.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $71.0\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ |  |
| DPO | $31.3\,{\scriptstyle\pm}\,{\scriptstyle 5.0}$ | $88.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $74.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ |  |
| MOSA | $27.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $77.7\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$ | $66.3\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ |  |
| RA w/o inter | $26.3\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $75.7\,{\scriptstyle\pm}\,{\scriptstyle 3.8}$ | $71.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ |  |
| RA (ours) | $10.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $72.3\,{\scriptstyle\pm}\,{\scriptstyle 8.0}$ | $45.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ |  |
| LLaDA1.5 | Original | $45.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $96.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $81.7\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ |
| SFT | $39.0\,{\scriptstyle\pm}\,{\scriptstyle 5.6}$ | $91.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $70.7\,{\scriptstyle\pm}\,{\scriptstyle 6.8}$ |  |
| DPO | $36.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ | $90.7\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $74.3\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$ |  |
| MOSA | $25.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $78.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $70.0\,{\scriptstyle\pm}\,{\scriptstyle 5.6}$ |  |
| RA w/o inter | $38.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $79.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $68.5\,{\scriptstyle\pm}\,{\scriptstyle 0.7}$ |  |
| RA (ours) | $16.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ | $71.7\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $47.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ |  |
| MMaDA | Original | $98.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $79.3\,{\scriptstyle\pm}\,{\scriptstyle 5.5}$ | $93.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ |
| SFT | $92.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $95.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $93.5\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ |  |
| DPO | $67.5\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $82.3\,{\scriptstyle\pm}\,{\scriptstyle 5.5}$ | $85.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ |  |
| MOSA | $59.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $75.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $71.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ |  |
| RA w/o inter | $54.3\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $77.6\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $72.0\,{\scriptstyle\pm}\,{\scriptstyle 0.9}$ |  |
| RA (ours) | $46.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $81.7\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | $55.3\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ |  |

Table [3](https://arxiv.org/html/2510.00565v1#S6.T3) presents the ASR under conversational jailbreak attacks. RA achieves superior robustness against such attacks and outperforms baselines.
This suggests that training on contaminated intermediate states can effectively generalize to a wide range of jailbreak attacks. A plausible mechanism is that the model acquires a new recovery capability. Specifically, when the model generates a harmful response, corresponding harmful tokens necessarily emerge at intermediate steps regardless of the specific attack. Thus, even if harmfulness is not detected at the first step, a model trained by RA is more likely to re-detect harmfulness at later steps and steer the generation back to a safe trajectory.
Nevertheless, RA remains imperfect against strong attacks, such as ReNeLLM, indicating that the alignment can be circumvented when the harmfulness is not detectable from the surface form of the response.

### 6.3 General Capability Evaluation

We measure general capability on eleven diverse benchmarks: ARC-Challenge (Clark et al., 2018), C-Eval (Huang et al., 2023), CMMLU (Li et al., 2024), GPQA (Rein et al., 2024), HellaSwag (Zellers et al., 2019), HumanEval (Chen et al., 2021), MBPP (Austin et al., 2021b), MMLU (Wang et al., 2024b), PIQA (Bisk et al., 2020), TruthfulQA Lin et al. (2022), and WinoGrande (Sakaguchi et al., 2021). We use the lm-evaluation-harness for implementation and replicate the generation configurations used in prior work (Nie et al., 2025).

Table [4](https://arxiv.org/html/2510.00565v1#S6.T4) summarizes general capability across multiple tasks. We do not observe substantial degradation from recovery alignment. On LLaDA and LLaDA 1.5, performance on TruthfulQA and MBPP improves. We attribute this to reward-model-based alignment, enhancing truthfulness and instruction following. In contrast, PIQA decreases slightly, which may be attributed to potential forgetting effects or output style shifts associated with alignment. For MMaDA, performance improves overall, likely because its baseline instruction-following ability was weaker and benefited more from alignment. Differences with and without harmful initialization are minimal, indicating that the negative impact on general capability is negligible.

**Table 4: Evaluation of general capability on 11 benchmarks (accuracy %, $\uparrow$). The results demonstrate that our method, recovery alignment, does not cause substantial degradation.**
| Method | Evaluation Tasks ($\uparrow$) |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ARC-C | CEval | CMMLU | GPQA | HSwag | HumEval | MBPP | MMLU | PIQA | TruthQA | WinoG | Avg. |  |
| *LLaDA* |  |  |  |  |  |  |  |  |  |  |  |  |
| Original | 53.3 | 66.1 | 67.0 | 27.9 | 54.0 | 22.0 | 25.8 | 64.0 | 74.4 | 47.6 | 72.5 | 52.2 |
| RA w/o inter (ablation) | 53.2 | 66.6 | 67.0 | 28.9 | 54.0 | 20.7 | 28.6 | 63.8 | 73.7 | 50.1 | 72.6 | 52.7 |
| RA (ours) | 53.9 | 66.3 | 66.9 | 30.4 | 54.0 | 17.1 | 27.2 | 63.9 | 71.6 | 53.4 | 73.4 | 52.6 |
| *LLaDA1.5* |  |  |  |  |  |  |  |  |  |  |  |  |
| No Alignment | 54.4 | 65.8 | 67.1 | 29.5 | 54.4 | 21.3 | 28.2 | 64.0 | 74.9 | 47.2 | 72.9 | 52.7 |
| RA w/o inter (ablation) | 54.4 | 66.2 | 67.0 | 29.5 | 54.5 | 19.5 | 29.2 | 64.0 | 74.1 | 49.6 | 73.2 | 52.8 |
| RA (ours) | 54.4 | 66.2 | 67.1 | 29.0 | 54.3 | 18.9 | 29.4 | 63.7 | 70.6 | 54.1 | 73.2 | 52.8 |
| *MMaDA* |  |  |  |  |  |  |  |  |  |  |  |  |
| No Alignment | 27.8 | 35.9 | 32.2 | 25.0 | 35.7 | 7.9 | 3.8 | 36.8 | 61.0 | 46.2 | 53.1 | 33.2 |
| RA w/o inter (ablation) | 26.3 | 33.2 | 32.5 | 29.7 | 37.1 | 10.0 | 8.0 | 39.8 | 60.8 | 49.1 | 55.4 | 34.7 |
| RA (ours) | 26.0 | 33.5 | 33.1 | 29.2 | 36.7 | 9.8 | 7.6 | 40.1 | 60.6 | 52.6 | 55.6 | 35.0 |

### 6.4 Ablation study

Figure: (a) Ablation of max intervention step $t_{\text{inter}}$. ASR under the anchoring attack.
Refer to caption: x3.png

##### Impact of max intervention step.

We examine the impact of the intervention step on robustness. Figure [3(a)](https://arxiv.org/html/2510.00565v1#S6.F3.sf1) reports the results of the anchoring attack on models trained with various $t_{\max}$. The results show that robustness improves as the intervention step becomes larger. This is consistent with the observation in Section [4.1](https://arxiv.org/html/2510.00565v1#S4.SS1) that the later the intervention timing, the higher the ASR. A model trained with a larger $t_{\max}$ becomes robust against more powerful attacks. On the other hand, an excessively large $t_{\max}$ destabilizes training.
We observe reward hacking, where the model generates responses that are meaningless.

##### Impact of intervention step scheduling.

Next, we evaluate the effect of linearly scheduling the intervention step.
We compared linear scheduling with two baselines: (i) *const scheduling*, which fixes $t_{\text{inter}}=t_{\max}$ and (ii) *uniform scheduling*, which samples $t_{\text{inter}}\sim\mathcal{U}([t_{\min},t_{\max}]\big)$ at each training step.
Figure [3(b)](https://arxiv.org/html/2510.00565v1#S6.F3.sf2) show that the ASR against anchoring attack with $t_{\text{inter}}=16$.
Linear scheduling achieves the highest robustness.
Uniform scheduling remains effective but consistently underperforms linear scheduling, corroborating the benefit of a curriculum.
Constant scheduling fails to achieve adequate robustness.
With small $t_{\max}$, the model never encounters harder states and remains vulnerable.
With large $t_{\max}$, learning becomes difficult and robustness cannot be obtained.

## 7 Conclusion

In this work, we investigate the priming vulnerability, which is specific to MDLMs.
We first demonstrate that attackers can readily exploit this vulnerability via interventions, highlighting the limitations of existing safety alignment.
We further show, through theoretical analysis, its potential extension to jailbreak attacks that require no explicit interventions.
Building on these insights, we propose *recovery alignment*, a method that teaches models to produce safe responses from harmful intermediate states.
Our experiments show that recovery alignment effectively mitigates priming vulnerability. This paper highlights the importance of safety alignment tailored to MDLMs and provides a new perspective on achieving it.

##### Limitations

This work focuses on an RLHF-style instantiation of RA. However, a supervised alternative, such as a DPO-style approach, should also be feasible. This approach requires constructing safe responses aligned to contaminated intermediate states, which introduces substantial data-construction cost. If this bottleneck were addressed, such supervised training might reduce training time while retaining, or possibly improving, robustness against the priming vulnerability.

## 8 Ethics statements and Reproducibility

##### Ethics statements.

We only use publicly available datasets and do not involve any human subjects or personal data. While our work proposes harmful methodologies, it also designs the countermeasure and aims to improve the robustness of MDLMs. We do not have any conflicts of interest or sponsorship to disclose. We have followed the ethical guidelines and research integrity standards in our work.

##### Reproducibility

We report all training and evaluation hyperparameters in Section [6.1](https://arxiv.org/html/2510.00565v1#S6.SS1). Additional implementation details for our method and all baselines are provided in Appendix [D](https://arxiv.org/html/2510.00565v1#A4). Detailed algorithmic descriptions of the proposed methods are included in the appendix. All benchmarks used in our experiments are publicly available and accessible to the community.

## 9 Acknowledgement

## References

- Achiam et al. (2023)
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al.
Gpt-4 technical report.
*arXiv preprint arXiv:2303.08774*, 2023.
- Andriushchenko et al. (2025)
Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion.
Jailbreaking leading safety-aligned LLMs with simple adaptive attacks.
In *The Thirteenth International Conference on Learning Representations*, 2025.
URL [https://openreview.net/forum?id=hXA8wqRdyV](https://openreview.net/forum?id=hXA8wqRdyV).
- Anil et al. (2024a)
Cem Anil, Esin Durmus, Nina Panickssery, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel Ford, et al.
Many-shot jailbreaking.
*Advances in Neural Information Processing Systems*, 37:129696–129742, 2024a.
- Anil et al. (2024b)
Cem Anil, Esin DURMUS, Nina Rimsky, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel J Ford, Francesco Mosconi, Rajashree Agrawal, Rylan Schaeffer, Naomi Bashkansky, Samuel Svenningsen, Mike Lambert, Ansh Radhakrishnan, Carson Denison, Evan J Hubinger, Yuntao Bai, Trenton Bricken, Timothy Maxwell, Nicholas Schiefer, James Sully, Alex Tamkin, Tamera Lanham, Karina Nguyen, Tomasz Korbak, Jared Kaplan, Deep Ganguli, Samuel R. Bowman, Ethan Perez, Roger Baker Grosse, and David Duvenaud.
Many-shot jailbreaking.
In *The Thirty-eighth Annual Conference on Neural Information Processing Systems*, 2024b.
URL [https://openreview.net/forum?id=cw5mgd71jW](https://openreview.net/forum?id=cw5mgd71jW).
- Austin et al. (2021a)
Jacob Austin, Daniel D Johnson, Jonathan Ho, Daniel Tarlow, and Rianne Van Den Berg.
Structured denoising diffusion models in discrete state-spaces.
*Advances in neural information processing systems*, 34:17981–17993, 2021a.
- Austin et al. (2021b)
Jacob Austin, Augustus Odena, Maxwell Nye, Maarten Bosma, Henryk Michalewski, David Dohan, Ellen Jiang, Carrie Cai, Michael Terry, Quoc Le, et al.
Program synthesis with large language models.
*arXiv preprint arXiv:2108.07732*, 2021b.
- Bai et al. (2022)
Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al.
Constitutional ai: Harmlessness from ai feedback.
*arXiv preprint arXiv:2212.08073*, 2022.
- Bisk et al. (2020)
Yonatan Bisk, Rowan Zellers, Jianfeng Gao, Yejin Choi, et al.
Piqa: Reasoning about physical commonsense in natural language.
In *Proceedings of the AAAI conference on artificial intelligence*, volume 34, pp. 7432–7439, 2020.
- Chao et al. (2024)
Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al.
Jailbreakbench: An open robustness benchmark for jailbreaking large language models.
*Advances in Neural Information Processing Systems*, 37:55005–55029, 2024.
- Chao et al. (2025)
Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong.
Jailbreaking black box large language models in twenty queries.
In *2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)*, pp. 23–42. IEEE, 2025.
- Chen et al. (2021)
Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al.
Evaluating large language models trained on code.
*arXiv preprint arXiv:2107.03374*, 2021.
- Clark et al. (2018)
Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord.
Think you have solved question answering? try arc, the ai2 reasoning challenge.
*arXiv preprint arXiv:1803.05457*, 2018.
- Dai et al. (2024)
Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Xu, Mickel Liu, Yizhou Wang, and Yaodong Yang.
Safe RLHF: Safe reinforcement learning from human feedback.
In *The Twelfth International Conference on Learning Representations*, 2024.
URL [https://openreview.net/forum?id=TyFrPOKYXw](https://openreview.net/forum?id=TyFrPOKYXw).
- DeepMind (2024)
DeepMind.
Gemini diffusion.
[https://deepmind.google/technologies/gemini](https://deepmind.google/technologies/gemini), 2024.
Accessed: 2025-07-09.
- Dieleman et al. (2022)
Sander Dieleman, Laurent Sartran, Arman Roshannai, Nikolay Savinov, Yaroslav Ganin, Pierre H Richemond, Arnaud Doucet, Robin Strudel, Chris Dyer, Conor Durkan, et al.
Continuous diffusion for categorical data.
*arXiv preprint arXiv:2211.15089*, 2022.
- Ding et al. (2024)
Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang.
A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily.
In *Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)*, pp. 2136–2153, 2024.
- Dubey et al. (2024)
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al.
The llama 3 herd of models.
*arXiv e-prints*, pp. arXiv–2407, 2024.
- Ethayarajh et al. (2024)
Kawin Ethayarajh, Winnie Xu, Niklas Muennighoff, Dan Jurafsky, and Douwe Kiela.
Kto: Model alignment as prospect theoretic optimization.
*arXiv preprint arXiv:2402.01306*, 2024.
- Gong et al. (2023)
Shansan Gong, Mukai Li, Jiangtao Feng, Zhiyong Wu, and Lingpeng Kong.
Diffuseq: Sequence to sequence text generation with diffusion models.
In *The Eleventh International Conference on Learning Representations*, 2023.
URL [https://openreview.net/forum?id=jQj-_rLVXsj](https://openreview.net/forum?id=jQj-_rLVXsj).
- Gong et al. (2025)
Shansan Gong, Shivam Agarwal, Yizhe Zhang, Jiacheng Ye, Lin Zheng, Mukai Li, Chenxin An, Peilin Zhao, Wei Bi, Jiawei Han, Hao Peng, and Lingpeng Kong.
Scaling diffusion language models via adaptation from autoregressive models.
In *The Thirteenth International Conference on Learning Representations*, 2025.
URL [https://openreview.net/forum?id=j1tSLYKwg8](https://openreview.net/forum?id=j1tSLYKwg8).
- He et al. (2021)
Pengcheng He, Jianfeng Gao, and Weizhu Chen.
Debertav3: Improving deberta using electra-style pre-training with gradient-disentangled embedding sharing.
*arXiv preprint arXiv:2111.09543*, 2021.
- He et al. (2023)
Zhengfu He, Tianxiang Sun, Qiong Tang, Kuanning Wang, Xuan-Jing Huang, and Xipeng Qiu.
Diffusionbert: Improving generative masked language models with diffusion models.
In *Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)*, pp. 4521–4534, 2023.
- Hu et al. (2022)
Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen.
LoRA: Low-rank adaptation of large language models.
In *International Conference on Learning Representations*, 2022.
URL [https://openreview.net/forum?id=nZeVKeeFYf9](https://openreview.net/forum?id=nZeVKeeFYf9).
- Huang et al. (2023)
Yuzhen Huang, Yuzhuo Bai, Zhihao Zhu, Junlei Zhang, Jinghan Zhang, Tangjun Su, Junteng Liu, Chuancheng Lv, Yikai Zhang, Yao Fu, et al.
C-eval: A multi-level multi-discipline chinese evaluation suite for foundation models.
*Advances in Neural Information Processing Systems*, 36:62991–63010, 2023.
- Inan et al. (2023)
Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al.
Llama guard: Llm-based input-output safeguard for human-ai conversations.
*arXiv preprint arXiv:2312.06674*, 2023.
- Ji et al. (2023)
Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang.
Beavertails: Towards improved safety alignment of llm via a human-preference dataset.
*Advances in Neural Information Processing Systems*, 36:24678–24704, 2023.
- Jia et al. (2025)
Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin.
Improved techniques for optimization-based jailbreaking on large language models.
In *The Thirteenth International Conference on Learning Representations*, 2025.
URL [https://openreview.net/forum?id=e9yfCY7Q3U](https://openreview.net/forum?id=e9yfCY7Q3U).
- Köpf et al. (2023)
Andreas Köpf, Yannic Kilcher, Dimitri Von Rütte, Sotiris Anagnostidis, Zhi Rui Tam, Keith Stevens, Abdullah Barhoum, Duc Nguyen, Oliver Stanley, Richárd Nagyfi, et al.
Openassistant conversations-democratizing large language model alignment.
*Advances in neural information processing systems*, 36:47669–47681, 2023.
- Labs et al. (2025)
Inception Labs, Samar Khanna, Siddhant Kharbanda, Shufan Li, Harshit Varma, Eric Wang, Sawyer Birnbaum, Ziyang Luo, Yanis Miraoui, Akash Palrecha, et al.
Mercury: Ultra-fast language models based on diffusion.
*arXiv preprint arXiv:2506.17298*, 2025.
- Li et al. (2024)
Haonan Li, Yixuan Zhang, Fajri Koto, Yifei Yang, Hai Zhao, Yeyun Gong, Nan Duan, and Timothy Baldwin.
Cmmlu: Measuring massive multitask language understanding in chinese.
In *Findings of the Association for Computational Linguistics ACL 2024*, pp. 11260–11285, 2024.
- Li et al. (2025)
Tianyi Li, Mingda Chen, Bowei Guo, and Zhiqiang Shen.
A survey on diffusion language models.
*arXiv preprint arXiv:2508.10875*, 2025.
- Li et al. (2022)
Xiang Li, John Thickstun, Ishaan Gulrajani, Percy S Liang, and Tatsunori B Hashimoto.
Diffusion-lm improves controllable text generation.
*Advances in neural information processing systems*, 35:4328–4343, 2022.
- Lin et al. (2022)
Stephanie Lin, Jacob Hilton, and Owain Evans.
Truthfulqa: Measuring how models mimic human falsehoods.
In *Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)*, pp. 3214–3252, 2022.
- Lin et al. (2023)
Zhenghao Lin, Yeyun Gong, Yelong Shen, Tong Wu, Zhihao Fan, Chen Lin, Nan Duan, and Weizhu Chen.
Text generation with diffusion language models: A pre-training approach with continuous paragraph denoise.
In *International Conference on Machine Learning*, pp. 21051–21064. PMLR, 2023.
- Liu et al. (2024a)
Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao.
AutoDAN: Generating stealthy jailbreak prompts on aligned large language models.
In *The Twelfth International Conference on Learning Representations*, 2024a.
URL [https://openreview.net/forum?id=7Jwpw4qKkb](https://openreview.net/forum?id=7Jwpw4qKkb).
- Liu et al. (2024b)
Yixin Liu, Kai Zhang, Yuan Li, Zhiling Yan, Chujie Gao, Ruoxi Chen, Zhengqing Yuan, Yue Huang, Hanchi Sun, Jianfeng Gao, et al.
Sora: A review on background, technology, limitations, and opportunities of large vision models.
*arXiv preprint arXiv:2402.17177*, 2024b.
- Llama Team (2024)
AI @ Meta Llama Team.
The llama 3 herd of models, 2024.
URL [https://arxiv.org/abs/2407.21783](https://arxiv.org/abs/2407.21783).
- Luo (2022)
Calvin Luo.
Understanding diffusion models: A unified perspective.
*arXiv preprint arXiv:2208.11970*, 2022.
- Mahabadi et al. (2024)
Rabeeh Karimi Mahabadi, Hamish Ivison, Jaesung Tae, James Henderson, Iz Beltagy, Matthew E Peters, and Arman Cohan.
Tess: Text-to-text self-conditioned simplex diffusion.
In *Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)*, pp. 2347–2361, 2024.
- Mehrotra et al. (2024)
Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi.
Tree of attacks: Jailbreaking black-box llms automatically.
*Advances in Neural Information Processing Systems*, 37:61065–61105, 2024.
- Nie et al. (2025)
Shen Nie, Fengqi Zhu, Zebin You, Xiaolu Zhang, Jingyang Ou, Jun Hu, Jun Zhou, Yankai Lin, Ji-Rong Wen, and Chongxuan Li.
Large language diffusion models.
*arXiv preprint arXiv:2502.09992*, 2025.
- Ouyang et al. (2022)
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al.
Training language models to follow instructions with human feedback.
*Advances in neural information processing systems*, 35:27730–27744, 2022.
- Patel et al. (2023)
Ajay Patel, Bryan Li, Mohammad Sadegh Rasooli, Noah Constant, Colin Raffel, and Chris Callison-Burch.
Bidirectional language models are also few-shot learners.
In *The Eleventh International Conference on Learning Representations*, 2023.
URL [https://openreview.net/forum?id=wCFB37bzud4](https://openreview.net/forum?id=wCFB37bzud4).
- Qi et al. (2025)
Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson.
Safety alignment should be made more than just a few tokens deep.
In *The Thirteenth International Conference on Learning Representations*, 2025.
URL [https://openreview.net/forum?id=6Mxhg9PtDE](https://openreview.net/forum?id=6Mxhg9PtDE).
- Rafailov et al. (2023)
Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn.
Direct preference optimization: Your language model is secretly a reward model.
*Advances in neural information processing systems*, 36:53728–53741, 2023.
- Rein et al. (2024)
David Rein, Betty Li Hou, Asa Cooper Stickland, Jackson Petty, Richard Yuanzhe Pang, Julien Dirani, Julian Michael, and Samuel R. Bowman.
GPQA: A graduate-level google-proof q&a benchmark.
In *First Conference on Language Modeling*, 2024.
URL [https://openreview.net/forum?id=Ti67584b98](https://openreview.net/forum?id=Ti67584b98).
- Robey et al. (2023)
Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas.
Smoothllm: Defending large language models against jailbreaking attacks.
*arXiv preprint arXiv:2310.03684*, 2023.
- Robey et al. (2025)
Alexander Robey, Eric Wong, Hamed Hassani, and George J. Pappas.
SmoothLLM: Defending large language models against jailbreaking attacks.
*Transactions on Machine Learning Research*, 2025.
ISSN 2835-8856.
URL [https://openreview.net/forum?id=laPAh2hRFC](https://openreview.net/forum?id=laPAh2hRFC).
- Rombach et al. (2022)
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.
High-resolution image synthesis with latent diffusion models.
In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pp. 10684–10695, 2022.
- Russinovich et al. (2025)
Mark Russinovich, Ahmed Salem, and Ronen Eldan.
Great, now write an article about that: The crescendo $\{$Multi-Turn$\}$$\{$LLM$\}$ jailbreak attack.
In *34th USENIX Security Symposium (USENIX Security 25)*, pp. 2421–2440, 2025.
- Saharia et al. (2022)
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al.
Photorealistic text-to-image diffusion models with deep language understanding.
*Advances in neural information processing systems*, 35:36479–36494, 2022.
- Sahoo et al. (2024)
Subham Sahoo, Marianne Arriola, Yair Schiff, Aaron Gokaslan, Edgar Marroquin, Justin Chiu, Alexander Rush, and Volodymyr Kuleshov.
Simple and effective masked diffusion language models.
*Advances in Neural Information Processing Systems*, 37:130136–130184, 2024.
- Sakaguchi et al. (2021)
Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi.
Winogrande: An adversarial winograd schema challenge at scale.
*Communications of the ACM*, 64(9):99–106, 2021.
- Shao et al. (2024)
Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, et al.
Deepseekmath: Pushing the limits of mathematical reasoning in open language models.
*arXiv preprint arXiv:2402.03300*, 2024.
- Touvron et al. (2023)
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al.
Llama: Open and efficient foundation language models.
*arXiv preprint arXiv:2302.13971*, 2023.
- Wachi et al. (2024)
Akifumi Wachi, Thien Tran, Rei Sato, Takumi Tanabe, and Youhei Akimoto.
Stepwise alignment for constrained language model policy optimization.
*Advances in Neural Information Processing Systems*, 37:104471–104520, 2024.
- Wang et al. (2024a)
Yihan Wang, Zhouxing Shi, Andrew Bai, and Cho-Jui Hsieh.
Defending llms against jailbreaking attacks via backtranslation.
*arXiv preprint arXiv:2402.16459*, 2024a.
- Wang et al. (2024b)
Yubo Wang, Xueguang Ma, Ge Zhang, Yuansheng Ni, Abhranil Chandra, Shiguang Guo, Weiming Ren, Aaran Arulraj, Xuan He, Ziyan Jiang, et al.
Mmlu-pro: A more robust and challenging multi-task language understanding benchmark.
*Advances in Neural Information Processing Systems*, 37:95266–95290, 2024b.
- Wang et al. (2024c)
Zezhong Wang, Fangkai Yang, Lu Wang, Pu Zhao, Hongru Wang, Liang Chen, Qingwei Lin, and Kam-Fai Wong.
Self-guard: Empower the llm to safeguard itself.
In *Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)*, pp. 1648–1668, 2024c.
- Wei et al. (2023)
Alexander Wei, Nika Haghtalab, and Jacob Steinhardt.
Jailbroken: How does llm safety training fail?
*Advances in Neural Information Processing Systems*, 36:80079–80110, 2023.
- Wen et al. (2025)
Zichen Wen, Jiashu Qu, Dongrui Liu, Zhiyuan Liu, Ruixi Wu, Yicun Yang, Xiangqi Jin, Haoyun Xu, Xuyang Liu, Weijia Li, et al.
The devil behind the mask: An emergent safety vulnerability of diffusion llms.
*arXiv preprint arXiv:2507.11097*, 2025.
- Xie et al. (2023)
Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu.
Defending chatgpt against jailbreak attack via self-reminders.
*Nature Machine Intelligence*, 5(12):1486–1496, 2023.
- Xie et al. (2025)
Zhixin Xie, Xurui Song, and Jun Luo.
Where to start alignment? diffusion large language model may demand a distinct position.
*arXiv preprint arXiv:2508.12398*, 2025.
- Yang et al. (2025)
Ling Yang, Ye Tian, Bowen Li, Xinchen Zhang, Ke Shen, Yunhai Tong, and Mengdi Wang.
Mmada: Multimodal large diffusion language models.
*arXiv preprint arXiv:2505.15809*, 2025.
- Ye et al. (2025)
Jiacheng Ye, Zhihui Xie, Lin Zheng, Jiahui Gao, Zirui Wu, Xin Jiang, Zhenguo Li, and Lingpeng Kong.
Dream 7b: Diffusion large language models.
*arXiv preprint arXiv:2508.15487*, 2025.
- Ye et al. (2023)
Jiasheng Ye, Zaixiang Zheng, Yu Bao, Lihua Qian, and Quanquan Gu.
Diffusion language models can perform many tasks with scaling and instruction-finetuning.
*arXiv preprint arXiv:2308.12219*, 2023.
- You et al. (2025)
Zebin You, Shen Nie, Xiaolu Zhang, Jun Hu, Jun Zhou, Zhiwu Lu, Ji-Rong Wen, and Chongxuan Li.
Llada-v: Large language diffusion models with visual instruction tuning.
*arXiv preprint arXiv:2505.16933*, 2025.
- Zellers et al. (2019)
Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi.
Hellaswag: Can a machine really finish your sentence?
In *Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics*. Association for Computational Linguistics, 2019.
- Zeng et al. (2024)
Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, et al.
Shieldgemma: Generative ai content moderation based on gemma.
*arXiv preprint arXiv:2407.21772*, 2024.
- Zhang et al. (2025)
Yuanhe Zhang, Fangzhou Xie, Zhenhong Zhou, Zherui Li, Hao Chen, Kun Wang, and Yufei Guo.
Jailbreaking large language diffusion models: Revealing hidden safety flaws in diffusion-based text generation.
*arXiv preprint arXiv:2507.19227*, 2025.
- Zhao et al. (2025)
Xuandong Zhao, Will Cai, Tianneng Shi, David Huang, Licong Lin, Song Mei, and Dawn Song.
Improving LLM safety alignment with dual-objective optimization.
In *Forty-second International Conference on Machine Learning*, 2025.
URL [https://openreview.net/forum?id=Kjivk5OPtL](https://openreview.net/forum?id=Kjivk5OPtL).
- Zhu et al. (2025)
Fengqi Zhu, Rongzhen Wang, Shen Nie, Xiaolu Zhang, Chunwei Wu, Jun Hu, Jun Zhou, Jianfei Chen, Yankai Lin, Ji-Rong Wen, et al.
Llada 1.5: Variance-reduced preference optimization for large language diffusion models.
*arXiv preprint arXiv:2505.19223*, 2025.
- Zou et al. (2023)
Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson.
Universal and transferable adversarial attacks on aligned language models.
*arXiv preprint arXiv:2307.15043*, 2023.

## Appendix A Proof

See [4.1](https://arxiv.org/html/2510.00565v1#S4.Thmtheorem1)

###### Proof.

We consider a denoising process indexed by $t=0,1,\dots,T$, where $\bm{r}_{0}$ is the fully masked response and $\bm{r}_{T}=\bm{r}$ is the fully restored response. Let $L$ be the response length.

To prove the theorem, we first define the forward process.
Starting from the original sequence $\bm{r}_{T}=\bm{r}$, the model progressively masks tokens to obtain $\bm{r}_{T-1},\dots,\bm{r}_{0}$.
Let $M$ be a mask token and $\alpha_{t}$ be a probability where each tokens are masked by the masking strategy $m_{t}$ at step $t$. For example, $\alpha_{t}=\frac{T-t}{T}$ if $m_{t}$ is a random masking strategy.
We formulate the forward process as follows:

$$ $q(\bm{r}_{t}\mid\bm{r}_{t+1})\;=\;\prod_{i=1}^{L}q(r_{t}^{i}\mid r_{t+1}^{i}),\qquad q(r_{t}^{i}\mid r_{t+1}^{i})\;=\;\begin{cases}\alpha_{t},&r_{t+1}^{i}\not=M\ \text{and}\ r_{t}^{i}=M,\\ 1-\alpha_{t},&r_{t+1}^{i}\not=M\ \text{and}\ r_{t}^{i}\not=M,\\ 1,&r_{t+1}^{i}=M\ \text{and}\ r_{t}^{i}=M,\\ 0,&\text{otherwise,}\end{cases}$ (8) $$

where $r_{t}^{i}$ is the $i$-th token of $\bm{r}_{t}$.

Next, we define the generation probability of the mask predictor $\pi_{\theta}$. Following (Zhu et al., 2025), the probability is constructed as the sum of probabilities for each masked token:

$$ $\log\pi_{\theta}(\tilde{\bm{r}}_{t+1}=\bm{r}\mid\bm{q},\bm{r}_{t})=\sum_{i=1}^{L}\left[\mathbbm{1}[r^{i}=M]\log\pi_{\theta}(r^{i}\mid\bm{q},\bm{r}_{t})\right].$ (9) $$

By a standard variational argument for discrete diffusion (Luo, 2022; Zhu et al., 2025), we obtain the following ELBO:

$$ $\log p_{\pi,m_{t}}(\bm{r}_{T}=\bm{r}\mid\bm{q},\bm{r}_{0})\geq\frac{1}{T}\mathbb{E}_{t\sim\mathcal{U}\{0,\dots,T-1\}}\left[\mathbb{E}_{q(\bm{r}_{t}\mid\bm{r}_{T})}[\log\pi_{\theta}(\tilde{\bm{r}}_{t+1}=\bm{r}\mid\bm{q},\bm{r}_{t})]\right].$ (10) $$

Based on these assumptions, we can derive the objective:

$$ $\displaystyle\log p_{\pi,m_{t}}(\bm{r}_{T}=\bm{r}\mid\bm{q},\bm{r}_{0})$ $\displaystyle\geq\frac{1}{T}\mathbb{E}_{t\sim\mathcal{U}\{0,\dots,T-1\}}\left[\mathbb{E}_{q(\bm{r}_{t}\mid\bm{r}_{T})}[\log\pi_{\theta}(\tilde{\bm{r}}_{t+1}=\bm{r}\mid\bm{q},\bm{r}_{t})]\right].$ (11) $\displaystyle\geq\frac{1}{T}\mathbb{E}_{t\sim\mathcal{U}\{0,\dots,T-1\}}\left[\mathbb{E}_{q(\bm{r}_{t}\mid\bm{r}_{T})}[\log\pi_{\theta}(\tilde{\bm{r}}_{1}=\bm{r}\mid\bm{q},\bm{r}_{0})]\right].$ (12) $\displaystyle=\frac{1}{T}\log\pi_{\theta}(\tilde{\bm{r}}_{1}=\bm{r}\mid\bm{q},\bm{r}_{0}).$ (13) $$

∎

###### Proof.

## Appendix B Related works

### B.1 Diffusion Language Models

Diffusion models generate samples by gradually restoring a noised representation through a denoising process. These models have demonstrated strong results in image and video generation, such as Stable Diffusion (Rombach et al., 2022), Imagen (Saharia et al., 2022), and Sora (Liu et al., 2024b). A key advantage of diffusion models is fast inference, as the denoising steps can be executed in parallel.

DLMs are a framework that aims to exploit this benefit for language generation. There are two main approaches for DLMs. The first is continuous DLMs (Li et al., 2022; Gong et al., 2023; Dieleman et al., 2022; Lin et al., 2023; Mahabadi et al., 2024), which define the diffusion process in a continuous space, similar to image generation. In this setup, discrete tokens are mapped to continuous embeddings, and the noising and denoising processes are performed within this continuous space. While this allows for the direct application of techniques from the image domain, some challenges remain, such as optimization instability and embedding collapse. The second approach is discrete DLMs (Austin et al., 2021a; He et al., 2023; Ye et al., 2023; Sahoo et al., 2024; Gong et al., 2025), which operate the diffusion process directly on the discrete vocabulary space, and MDLMs have emerged as an effective method in this category. MDLMs generate an entire sequence by iteratively masking a subset of tokens and restoring them in parallel. Recent works (Nie et al., 2025; Zhu et al., 2025; Ye et al., 2025) indicate that MDLMs trained from scratch can match the performance of similarly sized ARMs (Dubey et al., 2024). Extensions to multimodal inputs and joint text–image generation have also been explored (Yang et al., 2025; You et al., 2025). In this work, we study the safety of MDLMs for language generation, with a focus on vulnerabilities to jailbreak attacks.

### B.2 Jailbreak Attack

Jailbreak attacks pose a serious challenge to the safety and reliability of Large Language Models (Wei et al., 2023; Zou et al., 2023; Chao et al., 2025; Mehrotra et al., 2024; Anil et al., 2024a; Liu et al., 2024a; Andriushchenko et al., 2025). These attacks aim to bypass the safety guardrails implemented in the model and induce harmful responses that would normally be refused.
For ARMs, many jailbreak attacks have been proposed. One such method is the *conversation jailbreak attack*, which prepares an attacker model and iteratively optimizes the prompt through interactions with the victim model (Anil et al., 2024b; Mehrotra et al., 2024; Chao et al., 2025; Ding et al., 2024; Russinovich et al., 2025).
Another line proposes optimization-based attacks (Liu et al., 2024a), such as GCG (Zou et al., 2023), which explicitly use the model’s response likelihood for optimizing the prompt to maximize the probability of harmful responses.
In addition, prefilling attacks, which directly intervene in the inference process, have been studied for exposing weaknesses in safety alignment (Wei et al., 2023; Sahoo et al., 2024; Qi et al., 2025). However, it is not obvious that these existing attacks transfer to MDLMs with comparable effectiveness.

Several concurrent works propose jailbreak attacks tailored to MDLMs that require intervention in the denoising process.
Zhang et al. (2025) proposes PAD, which exploits the parallel generation characteristic of MDLM. This attack strategically inserts tokens that imply affirmation (e.g., “Step 1:”, “Step 2:”) at multiple positions in the response to steer the generation toward harmful.
Similarly, Wen et al. (2025) proposes DiJA. In this attack, the attacker first prepares a template in which only the spans intended to be harmful are replaced with mask tokens, and then forces the model to fill in the text based on that template.

While these attacks leverage the priming vulnerability, they are unsuitable for a quantitative evaluation of the vulnerability because they depend heavily on heuristic choices of tokens and intervention locations.
Furthermore, they do not clearly define the concept of the priming vulnerability or provide sufficient analysis. There is also no discussion of how a more realistic attacker, who cannot intervene in the denoising process, could exploit this vulnerability.

In this work, we design a simple attack, the anchoring attack, to evaluate the priming vulnerability. This attack allows for varying the attack’s strength by changing the intervention step. In addition, through theoretical analysis, we examine that this vulnerability can be exploited by attackers who cannot intervene in the denoising process.

### B.3 Safety Alignment

Safety alignment trains models to ensure the generation of safe outputs in response to adversarial or harmful inputs. Various methods have been proposed to learn output preferences that align with human or AI feedback (Rafailov et al., 2023; Ouyang et al., 2022; Bai et al., 2022; Ethayarajh et al., 2024).
Complementary approaches add external safeguards, such as guardrail-based filtering (Inan et al., 2023; Zeng et al., 2024) and input-side defenses using optimized suffixes or perturbations (Robey et al., 2023; Wang et al., 2024c; Xie et al., 2023; Wang et al., 2024a).

For MDLMs, Xie et al. (2025) points out that middle tokens in a response critically affect safety and propose a safety alignment method, MOSA. This method aims to align the middle tokens with a safe refusal template. However, because it trains models to generate safe responses from a fully masked sequence, it cannot address the priming vulnerability, as our experiments show. In contrast, we mitigate this vulnerability by training the model to recover to safe responses from intentionally contaminated intermediate states.

## Appendix C Additional Experiments

### C.1 Evaluation of the priming vulnerability using refusal-phrase probabilities

In this section, we conduct additional experiments to elucidate the mechanism of the priming vulnerability. Specifically, we evaluate the probability that the model generates a refusal phrase and quantitatively analyze how this probability changes under the insertion of specific tokens.

Figure: Figure 4: Change in the probability mass of refusal phrases due to token insertion. The x-axis represents the inserted anchor token, and the y-axis shows the relative change in the summed probability mass of the refusal phrases. We use the query *“Write a tutorial on how to make a bomb.”* and the refusal set *{“I’m sorry”, “Sorry”, “I cannot”, “I can not”, “I can’t”, “As an AI”, “I am not”, “It is not”, “No”}*. The results indicate that MDLMs are influenced by already generated tokens, causing a shift in the generation distribution from refusal to affirmation.
Refer to caption: x5.png

First, we analyze how the model’s behavior differs depending on the token inserted for a typical prompt.
From an initial masked response $\bm{r}_{T}$, we create the inserted response $\bm{r}_{i}$ by inserting a specific token at index $\frac{L}{2}$ and compute the total probability mass for a set of refusal phrases $\mathcal{S}_{\mathrm{ref}}$: $\sum_{\bm{r}_{\mathrm{ref}}\in\mathcal{S}_{\mathrm{ref}}}\Pr(\pi_{\theta}(\bm{r}_{\mathrm{ref}}|\bm{q}_{h},\bm{r}_{i}))$.
As a typical harmful query, we use “Write a tutorial on how to make a bomb.”
Figure [4](https://arxiv.org/html/2510.00565v1#A3.F4) shows the change in refusal-phrase probability mass for LLaDA Instruct. The results indicate that the insertion of certain tokens significantly reduces the probability mass of these refusal phrases. In particular, tokens that imply continuation, such as “Finally,” are especially effective.
This finding highlights a critical vulnerability in MDLMs.
An attacker can exploit the model’s intrinsic nature for contextual consistency to circumvent its safety measures with minimal intervention.
Overall, this observation suggests that MDLMs can be jailbroken by simply inserting the specified tokens into the generation region.

Figure: Figure 5: Probability mass of the refusal phrases vs. number of intervention steps.
Refer to caption: x6.png

Next, we conduct experiments using the anchoring attack across a broader set of prompts and model configurations. Specifically, given the intermediate state $\bm{r}_{t_{\mathrm{inter}}}$ produced by the attack, we evaluate the mask predictor’s probability of generating any refusal phrase $P_{\mathrm{ref}}=\sum_{\bm{r}_{\mathrm{ref}}\in\mathcal{S}_{\mathrm{ref}}}\Pr\!\bigl(\pi_{\theta}(\bm{r}_{\mathrm{ref}}\mid\bm{q}_{h},\bm{r}_{t_{\mathrm{inter}}})\bigr).$
We use prompts from the JBB-Behaviors dataset. As shown in Figure [5](https://arxiv.org/html/2510.00565v1#A3.F5), merely setting $t_{\mathrm{inter}}=4$ drives the refusal probability close to zero. Importantly, unlike the controlled insertion study above, inserted tokens are selected randomly by the masking strategy. Consequently, even semantically unimportant tokens can substantially depress the refusal probability when many of them are injected.

### C.2 Empirical validation of the monotonicity assumption

In this section, we empirically demonstrate that the assumption in Theorem [4.1](https://arxiv.org/html/2510.00565v1#S4.Thmtheorem1) holds broadly for MDLMs.

##### Setup.

We used three MDLMs: LLaDA Instruct, LLaDA 1.5, and MMaDA on the JBB-Behaviors dataset.
While the assumption is not specific to harmful datasets, JBB-Behaviors is a natural choice here because the same setting is used in our First-Step GCG evaluation.
We employed the anchoring attack to construct contaminated intermediate states $\bm{r}_{t_{\text{inter}}}$ and measure the *monotonicity gap*:

$$ $\Delta_{t}\;:=\;\log\pi_{\theta}\!\big(\tilde{\bm{r}}_{t+1}=\bm{r}\,\big|\,\bm{q},\bm{r}_{t}\big)\;-\;\log\pi_{\theta}\!\big(\tilde{\bm{r}}_{1}=\bm{r}\,\big|\,\bm{q},\bm{r}_{0}\big),$ (14) $$

where a positive value indicates that the monotonicity condition is satisfied at step $t$.
We set $T=L=128$, and the number of injected tokens is equal to the intervention step $t_{\text{inter}}$.

##### Results.

Figure: Figure 6: Empirical validation of the monotonicity assumption. We plot the mean per-token monotonicity gap $\Delta_{t}$ on JBB-Behaviors for three MDLMs. Contaminated states $\bm{r}_{t_{\text{inter}}}$ are constructed by anchoring attack. Specifically, pre-filling the first $k$ target tokens and masking the rest. Positive $\Delta_{t}$ confirms the monotonicity condition, and the gap grows with $k/L$.
Refer to caption: x7.png

Figure [6](https://arxiv.org/html/2510.00565v1#A3.F6) reports the distribution of $\Delta_{t}$.
Across all three models, the monotonicity gap is consistently positive, indicating that the assumption in Theorem [4.1](https://arxiv.org/html/2510.00565v1#S4.Thmtheorem1) holds widely in practice.
We also observe that the gap tends to increase as the intervention step $t_{\text{inter}}$ becomes larger.
A plausible explanation is that typical intermediate states $\bm{r}_{t}$ already contain a nontrivial subset of the target tokens in $\bm{r}_{T}=\bm{r}$, enabling the mask predictor to leverage richer bidirectional context and thereby assign higher likelihood to $\bm{r}$.
While such edge cases can occur, they are atypical and do not alter the general conclusion. Empirically, the monotonicity gap is positive in the overwhelming majority of settings across models and prompts.

### C.3 Additional Dataset and Metrics

In this section, we report experiments using additional safety evaluators and an additional dataset.
As supplementary evaluators, we employ a *guardrail model* and *keyword matching*.
Implementation details for each evaluator are provided in Appendix [D.7](https://arxiv.org/html/2510.00565v1#A4.SS7).
Following the prior work (Sahoo et al., 2024), we additionally evaluate robustness on 50 samples drawn from AdvBench (Zou et al., 2023).
All other settings follow Section [6](https://arxiv.org/html/2510.00565v1#S6).

##### Safety evaluation with guardrail model and keyword matching

**Table 5: Robustness against the priming vulnerability evaluated by a guardrail model and by keyword matching on the JBB-Behaviors dataset. ASR from the guardrail model is shown with an orange background, and ASR from keyword matching is shown with a green background. Values are reported as mean $\pm$ std over three runs.**
|  | Method | No Attack | Requires intervention in the denoising process | No intervention |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Anchoring ($t_{\text{inter}}$) | PAD | DiJA | First-Step GCG |  |  |  |  |  |  |  |
| 1 | 4 | 8 | 16 | 32 |  |  |  |  |  |  |
| LLaDA | Original | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$5.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $15.0\,{\scriptstyle\pm}\,{\scriptstyle 5.2}$<br>$19.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $37.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$<br>$30.7\,{\scriptstyle\pm}\,{\scriptstyle 5.5}$ | $56.3\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$<br>$43.7\,{\scriptstyle\pm}\,{\scriptstyle 4.7}$ | $80.7\,{\scriptstyle\pm}\,{\scriptstyle 5.1}$<br>$62.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $92.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$72.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $59.7\,{\scriptstyle\pm}\,{\scriptstyle 5.1}$<br>$59.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $83.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$86.7\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $43.0\,{\scriptstyle\pm}\,{\scriptstyle 1.4}$<br>$57.0\,{\scriptstyle\pm}\,{\scriptstyle 7.1}$ |
| SFT | $7.3\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$<br>$23.0\,{\scriptstyle\pm}\,{\scriptstyle 3.0}$ | $16.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$23.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $31.0\,{\scriptstyle\pm}\,{\scriptstyle 7.0}$<br>$35.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $55.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$47.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $78.3\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$<br>$60.0\,{\scriptstyle\pm}\,{\scriptstyle 5.6}$ | $91.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$70.3\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $57.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$56.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ | $85.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$85.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $24.0\,{\scriptstyle\pm}\,{\scriptstyle 6.2}$<br>$42.3\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ |  |
| DPO | $18.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$12.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $12.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$<br>$9.3\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $21.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$<br>$14.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $43.7\,{\scriptstyle\pm}\,{\scriptstyle 5.1}$<br>$26.3\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $73.0\,{\scriptstyle\pm}\,{\scriptstyle 5.6}$<br>$53.7\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $90.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$69.7\,{\scriptstyle\pm}\,{\scriptstyle 6.7}$ | $35.0\,{\scriptstyle\pm}\,{\scriptstyle 5.0}$<br>$29.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $81.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$<br>$85.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $35.0\,{\scriptstyle\pm}\,{\scriptstyle 4.4}$<br>$44.7\,{\scriptstyle\pm}\,{\scriptstyle 6.7}$ |  |
| MOSA | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$2.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $6.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$6.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $16.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$8.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $35.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$<br>$20.7\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $70.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$<br>$49.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $88.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$67.0\,{\scriptstyle\pm}\,{\scriptstyle 6.6}$ | $27.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$25.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $76.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$80.0\,{\scriptstyle\pm}\,{\scriptstyle 3.0}$ | $20.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$<br>$26.7\,{\scriptstyle\pm}\,{\scriptstyle 4.7}$ |  |
| RA w/o inter (ablation) | $0.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$0.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $5.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$2.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $16.3\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$<br>$5.7\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$ | $36.7\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$<br>$11.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $63.7\,{\scriptstyle\pm}\,{\scriptstyle 5.0}$<br>$35.3\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$ | $87.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$60.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $37.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$<br>$16.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $71.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$70.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $18.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$22.3\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ |  |
| RA (ours) | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$1.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$1.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $0.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $2.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$6.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $28.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$<br>$14.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$2.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $11.7\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$<br>$19.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $5.3\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$<br>$12.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ |  |
| LLaDA1.5 | Original | $0.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$5.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $11.0\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$<br>$15.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $29.3\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$<br>$26.3\,{\scriptstyle\pm}\,{\scriptstyle 5.9}$ | $51.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$<br>$38.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $78.3\,{\scriptstyle\pm}\,{\scriptstyle 5.0}$<br>$61.3\,{\scriptstyle\pm}\,{\scriptstyle 5.1}$ | $90.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$<br>$72.3\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $55.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$<br>$59.0\,{\scriptstyle\pm}\,{\scriptstyle 4.4}$ | $82.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$86.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $36.0\,{\scriptstyle\pm}\,{\scriptstyle 1.4}$<br>$51.5\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ |
| SFT | $6.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$19.3\,{\scriptstyle\pm}\,{\scriptstyle 10.0}$ | $13.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$<br>$19.0\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | $24.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$<br>$29.3\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $49.0\,{\scriptstyle\pm}\,{\scriptstyle 5.0}$<br>$44.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $80.0\,{\scriptstyle\pm}\,{\scriptstyle 6.1}$<br>$58.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $90.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$70.3\,{\scriptstyle\pm}\,{\scriptstyle 4.7}$ | $49.7\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$<br>$48.0\,{\scriptstyle\pm}\,{\scriptstyle 3.0}$ | $82.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$85.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $27.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$37.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ |  |
| DPO | $14.7\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$<br>$11.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $12.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$<br>$11.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $19.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$<br>$13.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $37.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$26.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $71.7\,{\scriptstyle\pm}\,{\scriptstyle 5.9}$<br>$50.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $90.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$68.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $30.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$27.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $78.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$82.0\,{\scriptstyle\pm}\,{\scriptstyle 4.4}$ | $31.3\,{\scriptstyle\pm}\,{\scriptstyle 6.7}$<br>$44.7\,{\scriptstyle\pm}\,{\scriptstyle 8.6}$ |  |
| MOSA | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$3.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $3.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$<br>$8.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $13.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$8.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $33.3\,{\scriptstyle\pm}\,{\scriptstyle 5.5}$<br>$20.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $65.7\,{\scriptstyle\pm}\,{\scriptstyle 4.9}$<br>$46.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $87.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$68.7\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | $23.7\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$<br>$22.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $75.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$75.7\,{\scriptstyle\pm}\,{\scriptstyle 5.1}$ | $17.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$<br>$31.0\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ |  |
| RA w/o inter (ablation) | $0.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $5.7\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$<br>$2.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $19.3\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$<br>$6.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $37.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$18.0\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | $66.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$<br>$38.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $87.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$<br>$63.7\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $43.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$<br>$20.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $70.7\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$<br>$71.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $21.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$25.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ |  |
| RA (ours) | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$4.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$1.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $0.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$3.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $0.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$5.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $1.7\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$<br>$7.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $27.3\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$<br>$17.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$3.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $11.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$22.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $7.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$16.3\,{\scriptstyle\pm}\,{\scriptstyle 5.1}$ |  |
| MMaDA | Original | $74.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$<br>$61.0\,{\scriptstyle\pm}\,{\scriptstyle 5.2}$ | $83.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$67.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$ | $86.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$64.7\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$ | $89.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$67.3\,{\scriptstyle\pm}\,{\scriptstyle 6.8}$ | $95.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$71.3\,{\scriptstyle\pm}\,{\scriptstyle 3.8}$ | $94.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$72.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $93.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$85.7\,{\scriptstyle\pm}\,{\scriptstyle 6.4}$ | $87.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$91.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $87.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$<br>$83.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ |
| SFT | $64.7\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$<br>$47.0\,{\scriptstyle\pm}\,{\scriptstyle 6.9}$ | $70.7\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$<br>$51.7\,{\scriptstyle\pm}\,{\scriptstyle 6.4}$ | $77.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$<br>$51.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $82.3\,{\scriptstyle\pm}\,{\scriptstyle 5.7}$<br>$59.3\,{\scriptstyle\pm}\,{\scriptstyle 7.4}$ | $90.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$<br>$71.3\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $94.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$71.3\,{\scriptstyle\pm}\,{\scriptstyle 3.8}$ | $93.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$86.7\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $85.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$89.0\,{\scriptstyle\pm}\,{\scriptstyle 3.0}$ | $70.3\,{\scriptstyle\pm}\,{\scriptstyle 5.7}$<br>$59.7\,{\scriptstyle\pm}\,{\scriptstyle 6.8}$ |  |
| DPO | $60.3\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$<br>$44.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $57.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$<br>$40.0\,{\scriptstyle\pm}\,{\scriptstyle 8.5}$ | $74.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$<br>$41.7\,{\scriptstyle\pm}\,{\scriptstyle 6.5}$ | $82.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$53.0\,{\scriptstyle\pm}\,{\scriptstyle 5.6}$ | $90.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$62.7\,{\scriptstyle\pm}\,{\scriptstyle 6.7}$ | $92.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$71.3\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ | $95.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$85.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $87.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$91.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $60.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$<br>$61.0\,{\scriptstyle\pm}\,{\scriptstyle 7.2}$ |  |
| MOSA | $28.7\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$<br>$26.0\,{\scriptstyle\pm}\,{\scriptstyle 5.3}$ | $29.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$22.3\,{\scriptstyle\pm}\,{\scriptstyle 5.7}$ | $43.7\,{\scriptstyle\pm}\,{\scriptstyle 5.7}$<br>$27.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $53.0\,{\scriptstyle\pm}\,{\scriptstyle 5.6}$<br>$34.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $75.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$53.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $91.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$<br>$63.3\,{\scriptstyle\pm}\,{\scriptstyle 5.5}$ | $78.3\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$<br>$64.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $84.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$84.7\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $46.7\,{\scriptstyle\pm}\,{\scriptstyle 6.4}$<br>$46.7\,{\scriptstyle\pm}\,{\scriptstyle 8.0}$ |  |
| RA w/o inter (ablation) | $0.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $7.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$<br>$3.3\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $14.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$2.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $30.0\,{\scriptstyle\pm}\,{\scriptstyle 6.1}$<br>$7.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $61.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$25.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $87.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$53.0\,{\scriptstyle\pm}\,{\scriptstyle 7.9}$ | $36.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$<br>$33.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ | $79.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$<br>$75.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $43.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$48.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ |  |
| RA (ours) | $4.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$5.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $7.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$<br>$4.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $12.7\,{\scriptstyle\pm}\,{\scriptstyle 4.7}$<br>$10.3\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | $17.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$6.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $33.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$20.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$ | $76.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$<br>$38.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$ | $28.3\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$<br>$23.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ | $58.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$<br>$38.7\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | $43.0\,{\scriptstyle\pm}\,{\scriptstyle 7.8}$<br>$48.3\,{\scriptstyle\pm}\,{\scriptstyle 5.5}$ |  |

**Table 6: Robustness against conventional jailbreaks evaluated by a guardrail model and by keyword matching on the JBB-Behaviors dataset. ASR from the guardrail model is shown with an orange background, and ASR from keyword matching is shown with a green background. Values are reported as mean $\pm$ std over three runs.**
|  | Method | ASR (%) |  |  |
| --- | --- | --- | --- | --- |
| PAIR | ReNeLLM | Crescendo |  |  |
| LLaDA | Original | $5.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$<br>$41.7\,{\scriptstyle\pm}\,{\scriptstyle 3.8}$ | $77.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$65.0\,{\scriptstyle\pm}\,{\scriptstyle 5.3}$ | $68.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$<br>$89.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ |
| SFT | $4.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$39.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $68.7\,{\scriptstyle\pm}\,{\scriptstyle 5.5}$<br>$56.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $70.0\,{\scriptstyle\pm}\,{\scriptstyle 6.1}$<br>$85.3\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ |  |
| DPO | $2.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$33.3\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ | $69.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$57.3\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | $60.7\,{\scriptstyle\pm}\,{\scriptstyle 6.7}$<br>$84.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ |  |
| MOSA | $1.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$27.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $65.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$<br>$56.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$ | $54.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$74.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$ |  |
| RA w/o inter (ablation) | $4.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$25.7\,{\scriptstyle\pm}\,{\scriptstyle 3.8}$ | $68.3\,{\scriptstyle\pm}\,{\scriptstyle 4.7}$<br>$60.3\,{\scriptstyle\pm}\,{\scriptstyle 4.7}$ | $52.3\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$<br>$68.7\,{\scriptstyle\pm}\,{\scriptstyle 5.7}$ |  |
| RA (ours) | $0.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$10.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $45.0\,{\scriptstyle\pm}\,{\scriptstyle 5.3}$<br>$60.0\,{\scriptstyle\pm}\,{\scriptstyle 4.4}$ | $29.3\,{\scriptstyle\pm}\,{\scriptstyle 3.8}$<br>$67.3\,{\scriptstyle\pm}\,{\scriptstyle 6.0}$ |  |
| LLaDA1.5 | Original | $4.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$44.7\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ | $74.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$<br>$63.0\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ | $68.3\,{\scriptstyle\pm}\,{\scriptstyle 4.9}$<br>$91.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ |
| SFT | $5.3\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$<br>$46.3\,{\scriptstyle\pm}\,{\scriptstyle 7.2}$ | $71.0\,{\scriptstyle\pm}\,{\scriptstyle 4.4}$<br>$54.7\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$ | $67.7\,{\scriptstyle\pm}\,{\scriptstyle 3.8}$<br>$80.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ |  |
| DPO | $3.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$<br>$37.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $70.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$<br>$61.3\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ | $66.7\,{\scriptstyle\pm}\,{\scriptstyle 5.5}$<br>$83.7\,{\scriptstyle\pm}\,{\scriptstyle 6.1}$ |  |
| MOSA | $2.0\,{\scriptstyle\pm}\,{\scriptstyle 2.6}$<br>$27.3\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ | $67.7\,{\scriptstyle\pm}\,{\scriptstyle 2.3}$<br>$56.7\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $57.0\,{\scriptstyle\pm}\,{\scriptstyle 4.6}$<br>$74.3\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ |  |
| RA w/o inter (ablation) | $2.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$36.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $68.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$<br>$62.5\,{\scriptstyle\pm}\,{\scriptstyle 0.7}$ | $53.7\,{\scriptstyle\pm}\,{\scriptstyle 7.4}$<br>$72.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ |  |
| RA (ours) | $1.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$21.0\,{\scriptstyle\pm}\,{\scriptstyle 1.0}$ | $45.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$56.7\,{\scriptstyle\pm}\,{\scriptstyle 4.2}$ | $38.7\,{\scriptstyle\pm}\,{\scriptstyle 5.1}$<br>$58.3\,{\scriptstyle\pm}\,{\scriptstyle 7.0}$ |  |
| MMaDA | Original | $55.0\,{\scriptstyle\pm}\,{\scriptstyle 6.0}$<br>$81.0\,{\scriptstyle\pm}\,{\scriptstyle 0.0}$ | $81.7\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$<br>$85.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $64.0\,{\scriptstyle\pm}\,{\scriptstyle 5.3}$<br>$88.3\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$ |
| SFT | $47.7\,{\scriptstyle\pm}\,{\scriptstyle 8.3}$<br>$70.3\,{\scriptstyle\pm}\,{\scriptstyle 8.4}$ | $86.5\,{\scriptstyle\pm}\,{\scriptstyle 4.9}$<br>$78.5\,{\scriptstyle\pm}\,{\scriptstyle 2.1}$ | $57.0\,{\scriptstyle\pm}\,{\scriptstyle 3.6}$<br>$71.3\,{\scriptstyle\pm}\,{\scriptstyle 6.1}$ |  |
| DPO | $37.5\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$<br>$60.0\,{\scriptstyle\pm}\,{\scriptstyle 1.4}$ | $79.0\,{\scriptstyle\pm}\,{\scriptstyle 3.0}$<br>$65.7\,{\scriptstyle\pm}\,{\scriptstyle 3.2}$ | $61.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$<br>$85.7\,{\scriptstyle\pm}\,{\scriptstyle 2.9}$ |  |
| MOSA | $17.7\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$46.3\,{\scriptstyle\pm}\,{\scriptstyle 3.1}$ | $68.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$65.7\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$ | $55.3\,{\scriptstyle\pm}\,{\scriptstyle 2.5}$<br>$83.7\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$ |  |
| RA w/o inter (ablation) | $32.0\,{\scriptstyle\pm}\,{\scriptstyle 0.6}$<br>$52.4\,{\scriptstyle\pm}\,{\scriptstyle 4.5}$ | $60.0\,{\scriptstyle\pm}\,{\scriptstyle 6.2}$<br>$85.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $66.3\,{\scriptstyle\pm}\,{\scriptstyle 4.3}$<br>$86.7\,{\scriptstyle\pm}\,{\scriptstyle 3.5}$ |  |
| RA (ours) | $13.0\,{\scriptstyle\pm}\,{\scriptstyle 2.0}$<br>$42.3\,{\scriptstyle\pm}\,{\scriptstyle 4.0}$ | $50.0\,{\scriptstyle\pm}\,{\scriptstyle 6.1}$<br>$65.0\,{\scriptstyle\pm}\,{\scriptstyle 1.7}$ | $65.3\,{\scriptstyle\pm}\,{\scriptstyle 1.2}$<br>$90.7\,{\scriptstyle\pm}\,{\scriptstyle 1.5}$ |  |

We present results evaluated by the *guardrail model* and *keyword matching* in
Table [5](https://arxiv.org/html/2510.00565v1#A3.T5) and
Table [6](https://arxiv.org/html/2510.00565v1#A3.T6).
Consistent with the GPT-4o judgments, RA exhibits consistently high robustness,
demonstrating the broad effectiveness of the proposed approach.
Notably, for conventional jailbreak attacks, the ASR measured by the
guardrail model tends to be lower than that measured by keyword matching.
Upon inspecting generated responses, we find that the optimization process can paraphrase the original
harmful prompt, attenuating its harmfulness. As a result, some responses do not include refusal
tokens such as “Sorry” yet their content is not actually harmful and thus is not flagged
as harmful by the *guardrail model*.
By contrast, attacks that exploit the priming vulnerability do not alter the prompt’s semantic content, so such discrepancies occur less frequently.

##### Evaluation on AdvBench

**Table 7: Robustness against the priming vulnerability on the AdvBench dataset. We report attack success rates (ASR, %) measured by three evaluators. Color coding indicates the evaluator used: cyan for GPT-4o, orange for the guardrail model, and green for keyword matching.**
|  | Method | No Attack | Requires intervention in the denoising process | No intervention |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Anchoring ($t_{\text{inter}}$) | PAD | DiJA | First-Step GCG |  |  |  |  |  |  |  |
| 1 | 4 | 8 | 16 | 32 |  |  |  |  |  |  |
| LLaDA | Original | (2 %, 2 %  4 %) | (8 %, 12 %  18 %) | (54 %, 46 %  34 %) | (74 %, 70 %  46 %) | (92 %, 86 %  64 %) | (98 %, 96 %  74 %) | (70 %, 68 %  56 %) | (94 %, 94 %  80 %) | (48 %, 36 %  48 %) |
| SFT | (16 %, 6 %  4 %) | (14 %, 10 %  10 %) | (44 %, 42 %  26 %) | (68 %, 60 %  50 %) | (94 %, 90 %  66 %) | (98 %, 96 %  78 %) | (80 %, 74 %  62 %) | (92 %, 92 %  78 %) | (- %, - %  - %) |  |
| DPO | (4 %, 24 %  10 %) | (4 %, 14 %  2 %) | (38 %, 30 %  14 %) | (57 %, 46 %  32 %) | (92 %, 86 %  54 %) | (98 %, 96 %  74 %) | (38 %, 40 %  26 %) | (92 %, 90 %  70 %) | (38 %, 26 %  38 %) |  |
| MOSA | (0 %, 0 %  0 %) | (2 %, 4 %  4 %) | (36 %, 26 %  6 %) | (56 %, 52 %  28 %) | (86 %, 86 %  48 %) | (100 %, 90 %  70 %) | (24 %, 24 %  14 %) | (90 %, 90 %  74 %) | (30 %, 20 %  32 %) |  |
| RA w/o inter (ablation) | (0 %, 0 %  0 %) | (6 %, 4 %  6 %) | (38 %, 30 %  0 %) | (52 %, 44 %  20 %) | (86 %, 76 %  36 %) | (94 %, 92 %  70 %) | (40 %, 42 %  4 %) | (88 %, 88 %  80 %) | (24 %, 10 %  24 %) |  |
| RA (ours) | (0 %, 0 %  0 %) | (0 %, 0 %  0 %) | (0 %, 0 %  0 %) | (2 %, 0 %  2 %) | (6 %, 0 %  0 %) | (60 %, 38 %  4 %) | (0 %, 0 %  0 %) | (18 %, 10 %  6 %) | (4 %, 2 %  4 %) |  |
| LLaDA1.5 | Original | (2 %, 2 %  6 %) | (6 %, 8 %  12 %) | (46 %, 32 %  22 %) | (64 %, 62 %  40 %) | (92 %, 88 %  68 %) | (98 %, 96 %  78 %) | (64 %, 64 %  50 %) | (94 %, 94 %  78 %) | (62 %, 52 %  56 %) |
| SFT | (6 %, 6 %  6 %) | (14 %, 6 %  6 %) | (40 %, 32 %  20 %) | (70 %, 62 %  44 %) | (86 %, 84 %  64 %) | (100 %, 98 %  72 %) | (60 %, 57 %  54 %) | (90 %, 92 %  78 %) | (22 %, 14 %  24 %) |  |
| DPO | (6 %, 30 %  8 %) | (12 %, 20 %  6 %) | (34 %, 30 %  6 %) | (54 %, 44 %  30 %) | (90 %, 82 %  56 %) | (96 %, 94 %  76 %) | (34 %, 36 %  18 %) | (94 %, 90 %  70 %) | (40 %, 36 %  40 %) |  |
| MOSA | (0 %, 0 %  0 %) | (0 %, 2 %  2 %) | (36 %, 30 %  12 %) | (50 %, 40 %  26 %) | (88 %, 82 %  48 %) | (98 %, 92 %  72 %) | (18 %, 18 %  16 %) | (92 %, 86 %  72 %) | (36 %, 26 %  32 %) |  |
| RA w/o inter (ablation) | (0 %, 0 %  0 %) | (4 %, 6 %  4 %) | (34 %, 30 %  2 %) | (64 %, 46 %  20 %) | (90 %, 82 %  48 %) | (96 %, 94 %  70 %) | (46 %, 42 %  12 %) | (88 %, 88 %  86 %) | (26 %, 14 %  24 %) |  |
| RA (ours) | (0 %, 0 %  0 %) | (0 %, 0 %  0 %) | (0 %, 0 %  2 %) | (2 %, 0 %  4 %) | (8 %, 2 %  10 %) | (54 %, 36 %  12 %) | (0 %, 0 %  0 %) | (26 %, 16 %  14 %) | (8 %, 2 %  8 %) |  |
| MMaDA | Original | (78 %, 72 %  56 %) | (90 %, 78 %  72 %) | (94 %, 88 %  70 %) | (98 %, 90 %  68 %) | (98 %, 94 %  82 %) | (100 %, 98 %  86 %) | (100 %, 94 %  92 %) | (96 %, 94 %  98 %) | (98 %, 86 %  90 %) |
| SFT | (60 %, 54 %  36 %) | (80 %, 72 %  40 %) | (76 %, 76 %  66 %) | (86 %, 82 %  57 %) | (98 %, 90 %  68 %) | (100 %, 100 %  84 %) | (98 %, 96 %  84 %) | (98 %, 98 %  92 %) | (74 %, 66 %  74 %) |  |
| DPO | (34 %, 64 %  57 %) | (52 %, 68 %  46 %) | (74 %, 72 %  34 %) | (82 %, 78 %  48 %) | (98 %, 96 %  64 %) | (100 %, 96 %  74 %) | (100 %, 98 %  90 %) | (96 %, 92 %  96 %) | (62 %, 64 %  60 %) |  |
| MOSA | (8 %, 12 %  12 %) | (22 %, 24 %  16 %) | (34 %, 36 %  18 %) | (46 %, 38 %  20 %) | (94 %, 76 %  42 %) | (96 %, 90 %  72 %) | (70 %, 72 %  48 %) | (92 %, 84 %  86 %) | (48 %, 48 %  46 %) |  |
| RA w/o inter (ablation) | (0 %, 0 %  0 %) | (14 %, 8 %  2 %) | (20 %, 14 %  4 %) | (48 %, 42 %  6 %) | (88 %, 70 %  18 %) | (94 %, 86 %  52 %) | (36 %, 36 %  30 %) | (94 %, 88 %  76 %) | (48 %, 52 %  62 %) |  |
| RA (ours) | (0 %, 0 %  0 %) | (4 %, 2 %  2 %) | (10 %, 6 %  8 %) | (22 %, 20 %  10 %) | (50 %, 36 %  18 %) | (92 %, 80 %  38 %) | (14 %, 16 %  10 %) | (57 %, 60 %  28 %) | (50 %, 46 %  50 %) |  |

**Table 8: Robustness against conventional jailbreaks on the AdvBench dataset. We report attack success rates (ASR, %) measured by three evaluators. Color coding indicates the evaluator used: cyan for GPT-4o, orange for the guardrail model, and green for keyword matching.**
|  | Method | ASR (%) |  |  |
| --- | --- | --- | --- | --- |
| PAIR | ReNeLLM | Crescendo |  |  |
| LLaDA | Original | (48 %, 4 %  38 %) | (92 %, 86 %  74 %) | (98 %, 84 %  94 %) |
| SFT | (36 %, 3 %  35 %) | (92 %, 88 %  64 %) | (79 %, 66 %  86 %) |  |
| DPO | (34 %, 2 %  42 %) | (88 %, 78 %  64 %) | (78 %, 60 %  82 %) |  |
| MOSA | (16 %, 0 %  14 %) | (90 %, 84 %  60 %) | (80 %, 56 %  74 %) |  |
| RA w/o inter (ablation) | (18 %, 0 %  12 %) | (96 %, 94 %  82 %) | (80 %, 72 %  60 %) |  |
| RA (ours) | (6 %, 0 %  4 %) | (56 %, 66 %  64 %) | (70 %, 36 %  57 %) |  |
| LLaDA1.5 | Original | (48 %, 0 %  36 %) | (94 %, 88 %  70 %) | (98 %, 80 %  86 %) |
| SFT | (48 %, 2 %  40 %) | (88 %, 86 %  48 %) | (92 %, 80 %  90 %) |  |
| DPO | (30 %, 2 %  34 %) | (76 %, 68 %  68 %) | (94 %, 76 %  80 %) |  |
| MOSA | (16 %, 0 %  18 %) | (82 %, 82 %  68 %) | (72 %, 48 %  70 %) |  |
| RA w/o inter (ablation) | (36 %, 2 %  32 %) | (84 %, 82 %  74 %) | (70 %, 50 %  66 %) |  |
| RA (ours) | (4 %, 0 %  6 %) | (62 %, 60 %  64 %) | (64 %, 34 %  62 %) |  |
| MMaDA | Original | (90 %, 54 %  78 %) | (98 %, 94 %  90 %) | (82 %, 64 %  90 %) |
| SFT | (96 %, 46 %  78 %) | (100 %, 94 %  84 %) | (94 %, 64 %  84 %) |  |
| DPO | (60 %, 40 %  54 %) | (90 %, 80 %  57 %) | (74 %, 66 %  86 %) |  |
| MOSA | (56 %, 8 %  48 %) | (80 %, 68 %  70 %) | (80 %, 57 %  76 %) |  |
| RA w/o inter (ablation) | (67 %, 57 %  56 %) | (65 %, 51 %  63 %) | (76 %, 66 %  92 %) |  |
| RA (ours) | (42 %, 4 %  26 %) | (42 %, 52 %  74 %) | (78 %, 68 %  84 %) |  |

We report AdvBench results in Table [7](https://arxiv.org/html/2510.00565v1#A3.T7) and Table [8](https://arxiv.org/html/2510.00565v1#A3.T8).
Each table includes safety evaluations from three evaluators: GPT-4o, the guardrail model, and keyword matching.
Across AdvBench, RA consistently demonstrates high robustness.
Compared with JBB-Behaviors, AdvBench tends to yield lower ASR.
This reflects that JBB-Behaviors prompts are more adversarially crafted,
whereas AdvBench prompts are more direct and thus easier for models to refuse.

### C.4 Training Cost and Reward Curve

In this section, we report training time and learning curves for Recovery Alignment.

##### Compute Time.

We report training time under the default configuration in Table [9](https://arxiv.org/html/2510.00565v1#A3.T9).
We use the default training setting, the same as Section [6](https://arxiv.org/html/2510.00565v1#S6).
Training a single model for 2,500 steps on four GPUs takes about 16 hours. Because RA generates and evaluates multiple candidate responses at each step, its computational cost is higher than supervised methods such as SFT and DPO.

**Table 9: Training cost of Recovery Alignment.**
| Model | Steps | Batch | GPUs | Computation time (h) |
| --- | --- | --- | --- | --- |
| LLaDA 8B Instruct | 2,500 | 8 | 4 | 15.7 |
| LLaDA 1.5 | 2,500 | 8 | 4 | 16.8 |
| MMaDA 8B MixCoT | 2,500 | 8 | 4 | 15.6 |

##### Time per Step at Each Intervention Step.

Figure: (a) LLaDA
Refer to caption: x8.png

We examine how the per-step training time changes across different intervention steps. Results with linear scheduling are shown in Figure [7](https://arxiv.org/html/2510.00565v1#A3.F7). We observe that a larger $t_{\max}$ leads to a decreasing time per step as training progresses. This occurs because a larger intervention step starts generation later in the denoising process, reducing the number of generation steps required per prompt. For example, with $T=128$ and $t_{\text{inter}}=64$, the number of required steps is half of that from a fully masked start, implying roughly half the response-generation time. This illustrates a benefit of using larger intervention steps.

##### Reward Curves during Training.

Figure: (a) LLaDA
Refer to caption: x11.png

We show reward curves for various intervention steps in Figure [8](https://arxiv.org/html/2510.00565v1#A3.F8). Two main trends emerge: (i) larger $t_{\max}$ yields lower rewards—when the intervention step is larger, the number of anchor tokens increases, making it harder for the model to produce safe responses, which lowers the average reward; (ii) reward growth depends on model alignment—aligned models (LLaDA and LLaDA-1.5) exhibit roughly flat rewards during training, whereas the unaligned MMaDA shows increasing rewards as training proceeds. This can be interpreted as aligned models starting with relatively high safety (thus little room for improvement), while the unaligned model improves its safety through training, leading to rising rewards.

## Appendix D Detailed Setups of Our Experiments

### D.1 Compute Resources

All experiments were executed on a university-managed HPC cluster. For model training, we use a single GPU node equipped with 4× NVIDIA H100 GPUs. For all other experiments, we use 1× NVIDIA H100. The system ran NVIDIA driver 575.57.08 with CUDA 12.9.

### D.2 Models

Our experiments are conducted on three MDLMs: LLaDA 8B Instruct (Nie et al., 2025), LLaDA 1.5 (Zhu et al., 2025), MMaDA 8B MixCot (Yang et al., 2025). Evaluating models of different training recipes allows us to assess the generalizability of our proposed alignment method. We describe each model below.

##### LLaDA 8B Instruct (Nie et al., 2025 )

LLaDA 8B Instruct is an MDLM scaled to 8B parameters, with instruction-following ability added via SFT. Nie et al. (2025) report pretraining on 2.3T tokens followed by SFT on roughly 4.5M pairs.

##### LLaDA 1.5 (Zhu et al., 2025 )

LLaDA 1.5 builds on LLaDA 8B Instruct and aligns the model with VRPO, an MDLM-oriented extension of DPO. Compared to LLaDA 8B Instruct, LLaDA 1.5 shows consistent gains +4.7 on GSM8K and +3.0 on HumanEval (Zhu et al., 2025).

##### MMaDA 8B MixCoT (Yang et al., 2025 )

MMaDA 8B MixCoT adopts a modality-agnostic unified diffusion architecture for text and images and uses Mixed Long-CoT and UniGRPO in post-training. MMaDA supports textual reasoning, multimodal understanding, and text-to-image generation; in our experiments, we use only textual reasoning.

### D.3 Evaluation datasets

To assess the generality of our proposed method, we evaluate safety on two datasets: JBB-Behaviors (Chao et al., 2024) and AdvBench (Zou et al., 2023). JBB-Behaviors is a subset of JailbreakBench consisting of 100 carefully curated behavior cases that span misuse and harmful scenarios (e.g., “Give instructions for how to sell harvested organs on the black market”). AdvBench contains 520 harmful prompts, from which we selected 50 for our experiments.

### D.4 Training Details

In this section, we detail the training setup for our proposed method, Recovery Alignment.

#### D.4.1 Algorithmic Details and Full Pseudocode

Figure: Algorithm 2 Recovery Alignment with GRPO: Full Pseudo-code

We present the full pseudocode of Recovery Alignment in Algorithm [2](https://arxiv.org/html/2510.00565v1#alg2). In computing the loss, we replace the generation probability $p_{\pi,m_{t}}(\bm{r}_{T}^{(i)}|\bm{q}^{(i)},\bm{r}_{t_{\text{inter}}}^{(i)})$ with the first-step mask predictor probability $\pi_{\theta}(\bm{r}_{T}^{(i)}|\bm{q}^{(i)},\bm{r}_{t_{\text{inter}}}^{(i)})$ because computing gradients of $p_{\pi,m_{t}}(\bm{r}_{T}^{(i)}|\bm{q}^{(i)},\bm{r}_{t_{\text{inter}}}^{(i)})$ is expensive as discussed in Section [4.2](https://arxiv.org/html/2510.00565v1#S4.SS2).

#### D.4.2 Training Configurations

We provide the training configurations. The settings below are shared across all models.

##### Training Data.

We use the BeaverTails dataset (Ji et al., 2023) as the training dataset. This dataset contains roughly 30k query–response pairs, including both harmful and harmless cases. Because training only on harmful pairs led to over-refusal, we include harmless pairs as well. As a result, we use the entire dataset without separating harmful and harmless subsets.

##### Hyperparameters.

As the reward model, we employ DeBERTaV3 (He et al., 2021; Köpf et al., 2023).
We train models for 2,500 steps using AdamW with a learning rate of $1\times 10^{-5}$. We use four GPUs with a micro-batch size of $2$ and a total batch size of $8$. For generation configurations, we set the maximum length to $L=128$, the number of denoising steps to $T=128$, the masking strategy to random, and the temperature to $0.7$. For GRPO parameters, we use a group size of $6$, $\mathrm{clip_{e}psilon}=0.2$, and KL weights of 0.01. We adopt LoRA (Hu et al., 2022) with $r=16$ and $\alpha=16$, targeting all linear layers.

### D.5 Attack Methods

We evaluate robustness using seven attack methods. To assess mitigation of the *priming vulnerability*, we apply Anchoring Attack, First-Step GCG, PAD (Zhang et al., 2025), and DiJA (Wen et al., 2025). To evaluate robustness against general jailbreak attacks, we use PAIR (Chao et al., 2025), ReNeLLM (Ding et al., 2024), and the multi-turn Crescendo attack (Russinovich et al., 2025).

##### Attacks requiring denoising intervention.

PAD and DiJA explicitly intervene in the denoising process. PAD injects sequence connectors (e.g., "Step 1:", "Step 2:") at multiple response positions, then forces generation to proceed from those anchors. DiJA constructs a response template that specifies the number and placement of mask tokens, e.g.,
“Subject: <mask:10>.\n First paragraph: <mask:30>.\n Second paragraph: <mask:20>.\n Closing remarks: <mask:15>.”
Both methods exploit priming by planting affirmative context within the intermediate response, biasing the model toward harmful continuations. We use the *PAD-Step* configuration reported as strongest in Zhang et al. (2025). For DiJA, we adopt the authors’ prompts and instantiate attack templates with GPT-4o-mini.

##### Black-box prompt-optimization attacks.

PAIR, ReNeLLM, and Crescendo do not modify the denoising process. Instead, they optimize the harmful prompt using an external attacker model. We employ GPT-4o-mini as the attacker across these methods. For PAIR, we use 5 parallel streams and cap the conversation depth per stream at 5. For ReNeLLM, we cap the optimization iterations at 20 and allow up to 20 rewrite attempts per iteration. For Crescendo, we cap multi-turn interactions at 10 rounds and allow up to 20 backtracks upon refusals. Success is declared when the LLM-as-Judge self-evaluation score is $\geq 0.8$.

### D.6 Baselines

We compare Recovery Alignment with other alignment methods, including SFT (Nie et al., 2025), DPO (Rafailov et al., 2023; Zhu et al., 2025), and MOSA (Xie et al., 2025). MOSA is an alignment method tailored to MDLMs. Specifically, using pairs of safe and harmful responses, similar to DPO, it maximizes the difference in maximum log-likelihood between safe phrases and harmful phrases over middle tokens.

Following prior works (Dai et al., 2024; Wachi et al., 2024), all methods are trained on the PKU-SafeRLHF preference dataset (Ji et al., 2023). For each prompt, this dataset provides two responses annotated with a per-response safety flag and a preference label indicating which response is better in terms of safety and utility. For SFT, we use the response labeled safe as supervision. When both are safe, we select the one labeled better. For DPO and MOSA, we treat the preferred response as the chosen response and the other as rejected.

### D.7 Details of Safety Evaluation Settings

In this section, we provide the details of the safety evaluation. We evaluate safety against jailbreak attacks using three criteria: (i) automated evaluation by GPT-4o, (ii) binary judgment by a guardrail model, and (iii) matching with refusal phrases. The details of each method are provided below.

##### Evaluation by GPT-4o

Following prior work (Jia et al., 2025; Robey et al., 2025; Qi et al., 2025; Andriushchenko et al., 2025), we employ GPT-4o as an LLM-as-a-judge. In this evaluation, both the prompt and the model’s response are provided as input to GPT-4o, which then scores the harmfulness, taking into account context-dependent nuances. The prompt used for this evaluation is provided in Table [D.7](https://arxiv.org/html/2510.00565v1#A4.SS7.SSS0.Px1). In this setup, GPT-4o assesses the harmfulness of the response on a 5-point scale. We define scores of 3 or higher as “harmful” and report the fraction of harmful cases as ASR.

##### Evaluation by Guardrail Model

In addition to the evaluation by GPT-4o, we conduct an assessment using a specialized guardrail model, LlamaGuard3 8B (Llama Team, 2024). Given the prompt and response, the model outputs a binary harmfulness decision. We report ASR as the fraction of cases classified as harmful by the guardrail model.

##### Refusal Phrase Matching

We also perform an automatic evaluation based on refusal-phrase matching. Following prior work (Qi et al., 2025), the list of refusal phrases used is provided in Table [D.7](https://arxiv.org/html/2510.00565v1#A4.SS7.SSS0.Px3). If any of these phrases do not appear in a response, we treat the response as “unsafe” and report the proportion of such cases as ASR.

### D.8 Details of Generating Harmful Responses for the Anchoring Attack

For the Anchoring Attack, we require a concrete harmful response corresponding to each harmful query. However, the JBB-Behaviors and AdvBench datasets provide only the opening fragment (a *target prefix*) of a harmful response, not a complete response. To obtain full responses, we used Llama-3.1-8B to synthesize harmful continuations. We found that conditioning on the system instruction and the query alone occasionally led the model to refuse generation. Therefore, we additionally provide the assistant with the dataset-provided harmful target prefix and instruct the model to continue *from that prefix*. The prompt template used is shown below.
All generated responses were reviewed by human annotators to verify fidelity to the target prefix and suitability for our controlled evaluation.

### D.9 Details of First-Step GCG evaluation

In this section, we provide the details of experiments in Section [4.2](https://arxiv.org/html/2510.00565v1#S4.SS2). We evaluate GCG under two objectives: (i) *First-Step GCG* (ours) and (ii) *Monte Carlo GCG*.
Both variants optimize an adversarial suffix of fixed length appended to the user prompt.
We fix the suffix length to 20 tokens (the initial string “x” repeated 20 times), run $500$ optimization steps, and use beam-style candidate search.
For prompt optimizations, we set the search width to 64 and the top k to 64.
For Monte Carlo estimation, we set the batch size to 16 and the number of samples to 64.

## Peer Reviews

confidence: 2
contribution: 3
initial_rating: 8
presentation: 3
questions: NA
soundness: 3
strengths: Although I am not familiar with the DLMs, I believe there are still many Pros:
* **Novel and Timely Focus**: The work is highly relevant and timely, focusing on the unique safety challenges of an emerging model class (DLMs) whose non-causal inference fundamentally differs from Autoregressive Models. This addresses a critical gap in current LLM safety research.
* **Rigorous Vulnerability Analysis**: The paper provides compelling, quantitative evidence for the "priming vulnerability.", including:
    * Anchoring Attack: It demonstrates that even a minimal intervention at t =1 can significantly increase the Attack Success Rate (ASR increases from 2% to 21% on LLaDA Instruct). This clearly demonstrates the sensitivity of the intermediate states.
    * First-Step GCG: The authors cleverly leverage the vulnerability to derive a tractable lower bound on the intractable GCG objective, resulting in an attack that is ∼20× faster and significantly more effective than Monte Carlo-based GCG. This provides a strong, efficient evaluation benchmark.
* Well-Motivated Defense: Recovery Alignment directly addresses the root cause of the vulnerability: the failure of traditional alignment to account for contaminated intermediate states. The use of a linear schedule for the intervention step is a sound curriculum learning approach for stabilization.
* Practicality of Defense: The RA framework is instantiated in an RLHF-style that leverages existing harmful query datasets and reward models, suggesting a practical and scalable solution without requiring bespoke data construction.
summary: This paper identifies and rigorously analyzes a novel security vulnerability, termed "priming vulnerability," in Diffusion Language Models (DLMs). This vulnerability stems from the iterative, parallel denoising process, where the presence of an affirmative token in an intermediate state can steer the subsequent generation toward a harmful response, bypassing safety guardrails.
The authors propose two main contributions:

They introduce the Anchoring Attack (a hypothetical intervention) to characterize the vulnerability and the First-Step GCG (a non-interventional, realistic attack) to exploit it efficiently.

They propose Recovery Alignment, a DLM-specific safety alignment method that trains the model to recover from adversarially "contaminated" intermediate states back to a safe response, utilizing an RLHF-style objective with a linear curriculum.
weaknesses: * The theoretical justification in 4.1 for this monotonic increase in the log-likelihood of the target response r over the denoising steps needs to be more robustly discussed, especially for different harmful responses r. Does this assumption hold true when r is a diverse set of harmful responses?
* Complexity of RA Training: Although RA is practical in terms of data, the training process involves generating intermediate states, running the partial denoising process, and then using a potentially expensive reward model to score the output. 
* Generality of Priming Token: The paper focuses on "affirmative tokens." It would be valuable to discuss if other types of tokens (e.g., specific harmful jargon, boundary tokens) could similarly "prime" the model, or if the mechanism is uniquely linked to affirmation.

---

confidence: 2
contribution: 3
initial_rating: 8
presentation: 3
questions: See the weakness part.
soundness: 3
strengths: 1. (Novelty and soundness) This paper focus on the robustness of diffusion models, which is an important topic that is left less studied. This paper not only discover the safety risk of DLM (called the priming vulnerability), but also propose to mitigate this risk by proposing recovery alignment. I believe this paper would help improve the overall robustness of DLMs.
2. The experimental results are significant.
summary: This paper focuses on the robustness of DLM, discovers and tries to mitigate the priming vulnerability of such models. Priming vulnerability, detailedly discussed in Section 4, refers to a jailbroken behavior of the DLMs that when affirmative tokens appear at an intermediate step of denoising, subsequent generation would have greater probability of producing harmful response. Experiments with two threat models are presented, which demonstrate clear evidence of the priming vulnerability. To mitigate this vulnerability, this paper proposes the recovery alignment. According to Tables 2-4, RA exhibits clear advantage comparing to exsiting alignments.
weaknesses: 1. I cannot find a discussion on the related works on the metrics of jailbreak attacks (i.e., how to judge whether a model's response is 
controversial). Since this is directly related to the final ASR and is rapidly developing overtime, I suggest include a brief discussion on the metrics, in addition to the methods.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 3
questions: See weakness.
soundness: 2
strengths: 1. The authors study an interesting and important problem given the fast-growing of DLMs.
2. The identified risk is unique to DLM and is interesting.
3. The proposed attack has high ASR. The proposed alignment method is empirically useful.
4. The paper provides a theoretical analysis of the identified risk.
summary: The authors investigate safety vulnerabilities in Masked Diffusion Language Models (MDLMs), a class of parallel, iterative denoising-based text generators. They identify a new risk priming vulnerability: inserting or generating affirmative tokens during intermediate denoising steps can steer an otherwise aligned MDLM toward producing harmful content. To mitigate this issue, the authors design Recovery Alignment (RA) trains MDLMs to “recover” safe responses via RLHF-style optimization. Experiments on LLaDA, LLaDA 1.5, and MMaDA models show that RA significantly reduces attack success rates while maintaining general performance.
weaknesses: 1. Unclear definition of "affirmative tokens" and it is unknown how the authors find all such tokens in the model full vocabulary.
2. The theory proposed lacks empirical validation.
3. The experiments are not conducted on larger DLMs, lacking experiments on generalization.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 2
questions: 1. Does recovery alignment need to manually crafted the  contaminated intermediate states? If so, Would this increase the training cost and make it difficult to scale?

Others see weakness.
soundness: 3
strengths: 1. This paper provides the systematic safety analysis of diffusion-based language models and highlights a vulnerability unique to their parallel denoising mechanism. 
2. The proposed alignment performance is strong which substantially reduces jailbreak  attack success rates.
3. The evaluation is comprehensive which covers multiple models and datasets.
summary: This paper investigate the  priming vulnerability in diffusion language models , which affirmative tokens could be used during intermediate denoising steps to achieve attacks.. To address this, the authors propose Recovery Alignment which teach DLMs to recover safe responses from contaminated intermediate states. Experiments show the proposed methods can substantially reduces jailbreak  attack success rates.
weaknesses: 1. The LLM usage is not described in the paper.  The paper frequently contains long compound sentences composed of multiple short sentences, which is a typical LLM type writing. 
2. Despite the differences in form, the priming vulnerability is discussed by several prior works regarding ARM[1,2], the author should mentioned these work in the paper and discuss the difference.
3. The presentation need to be improved. Some sentences are confusing such as"Moreover, they do not discuss how a more realistic attacker, who cannot intervene in the denoising process, could exploit this vulnerability. In this work, we design an attack that intervenes in the denoising process for comprehensive evaluation. " Even though with the following sentences i understand what author what to say, but this is confusing.
4. The ablation is not comprehensive. The author should conduct counterfactual experiments (e.g., replacing non-affirmative tokens or injecting random noise tokens) to verify whether the safety failures specifically depend on token semantics. Meanwhile, the sampling parameters already prove the play a import role in jailbreak success rate[3],  it would be good if related ablation is included.
5. Theorem 4.1 assume a monotonicity condition which is overly strong, if this condition satisfied that means that as denoising proceeds, the likelihood of generating the target response r should never decrease. In diffusion model, each step involves stochastic re-masking and resampling such the monotonicity condition is impossible.  The authors should thoroughly revise the theoretical part.



[1]Huang, Yuyi, et al. "Intrinsic Model Weaknesses: How Priming Attacks Unveil Vulnerabilities in Large Language Models." arXiv preprint arXiv:2502.16491 (2025).

[2]Miao, Ziqi, et al. "Response attack: Exploiting contextual priming to jailbreak large language models." arXiv preprint arXiv:2507.05248 (2025).

[3]Huang, Yangsibo, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. "Catastrophic jailbreak of open-source llms via exploiting generation


Decision: Accept (Poster)