Tsinghua & BUPT's DIVA jailbreak hits up to 74% ASR on diffusion VLMs

新智元 · wechat · 2026-10-16

Researchers from Tsinghua University and Beijing University of Posts and Telecommunications present DIVA, a white-box visual jailbreak targeting discrete diffusion vision-language models (dVLMs).

Key insight: unlike autoregressive VLMs that inject visual info once, dVLMs re-use visual conditions at every denoising step — "cross-step conditional propagation" lets a hidden risk signal in an image accumulate influence along the generation trajectory.
Method: cross-modal intent confusion (splitting an instruction across text and a composite image) plus diffusion-aware optimization that samples multiple denoising timesteps and averages masked-token losses, producing a category-level shared bounded perturbation.
Results: HADES average ASR — LLaDA-V 58.80%, MMaDA 67.73%, LLaDA2.0-Uni 69.07%; on held-out VLSBench, MMaDA reached 74.16%, beating prior methods. Ablations show gains come from trajectory-aware optimization, not just noise. Perturbations are nearly imperceptible.
Defense implications: joint cross-modal filtering, monitoring safety flips across denoising stages, diffusion-specific red-teaming, and aligning the generation trajectory rather than only final outputs. White-box study; no attack scripts released.

Original post →

Tsinghua & BUPT's DIVA jailbreak hits up to 74% ASR on diffusion VLMs

More from Safety