Broadcast Language Models: A dangerous hole response is enough to complete the prohibited content

RMT-Jailbreak transposes attacks designed for classic models to broadcast LLMs, asking them to reconstruct a masked harmful response.

Diffusion language models do not generate text word by word from left to right: they fill in hidden positions by taking into account the context of both sides. A team of researchers shows that this flexibility opens up a specific loophole. All you have to do is take a harmful answer to a question, mask a large part of the words, and the model reconstructs the dangerous content on its own.

Their method, RMT-Jailbreak, recycles the already known attacks against autoregressive models: first we obtain a forbidden response from a classical model, we transform it into a strongly hidden template by keeping words evenly distributed, then a filter masks what remains too explicit. The targeted diffusion model only has to fill in the gaps.

Tested with multiple attack techniques and multiple target models, the approach is proving to be effective and general, meaning that jailbreaks transfer from one architecture family to another. A useful warning as diffusion LLMs begin to roll out of the labs.