Tsinghua, BUPT paper unveils DIVA jailbreak attack on diffusion VLMs
Tsinghua University and Beijing University of Posts and Telecommunications propose DIVA (Discrete-diffusion Vision-language model Attack), a white-box visual jailbreak method aimed at discrete diffusion vision-language models (dVLM), which re-use visual conditioning at every denoising step — an effect the authors call Cross-Step Conditional Propagation. The method splits a harmful intent across a composite image and a rewritten prompt, then jointly optimizes a bounded pixel perturbation over multiple denoising timesteps as a category-level, offline shared perturbation. On the HADES benchmark (Beaver semantic metric), average attack success rates were 58.80% for LLaDA-V, 67.73% for MMaDA and 69.07% for LLaDA2.0-Uni; on VLSBench they reached 52.07% for LLaDA-V and 74.16% for MMaDA.
It suggests safety alignment for diffusion-based multimodal models may need to monitor the generation trajectory, not just inputs and final outputs.
Tsinghua UniversityBeijing University of Posts and TelecommunicationsDIVA