Why do standard defenses struggle with Diffusion LLMs (DLMs)?
Unlike left-to-right autoregressive models, DLMs denoise tokens iteratively with bidirectional dependencies. Even benign tokens ("might","by","to") can act as risk-inducing tokens in intermediate states, shifting the conditional distribution toward an unsafe final output.
Instead of costly block-level regeneration or full-model retraining, BAAI exploits the editability of DLM intermediate states via three key designs:
🔹Lightweight Safety Value Model: Trained via Spine Tree Search & K-branch Rollouts(with Qwen Guard judge) to predict final safety from partial denoising states.
🔹Zero-Backbone-Rerun Counterfactual Readout: Reuses cached token features via Masked Cross-Attention (Full, Exclusion, and Single-token views) to computeNecessity & Sufficiencyrisk attribution in one lightweight pass.
🔹Surgical Re-masking: Selectively re-masks only high-risk tokens while keeping safe context intact.