# CURE aligns diffusion language models at test time, cutting jailbreak success to 1.36%

> Original title: Meet CURE: Aligning Diffusion Language Models via Counterfactual Token Re-masking—accepted as a #NeurIPS2026 Oral (Top 0.36%, 112/30,709)🎉

- Source: BAAI
- Published: 2026-10-29T13:26:00.000Z
- Bad Influence: https://badinfluence.news/items/zw3fvlolgly9qm4y9fs4gutty
- Original: https://x.com/BAAIBeijing/status/2115797299133554886

## Summary

BAAI's CURE, accepted as a NeurIPS 2026 Oral, aligns diffusion language models at test time by re-masking counterfactual tokens without tuning base model parameters. The method cuts average jailbreak attack success rate from 47.20% to 1.36% across LLaDA-8B, LLaDA-1.5, and Dream-7B, with 0.7% extra compute. The post says CURE keeps models on the safety–utility Pareto frontier.

## Post

Meet CURE: Aligning Diffusion Language Models via Counterfactual Token Re-masking—accepted as a #NeurIPS2026 Oral (Top 0.36%, 112/30,709)🎉

Can seemingly harmless words like "might", "by", or "to" jailbreak a Diffusion LLM—and can we surgically reverse the trajectory at test time with just 0.7% extra compute?  

Without tuning base model parameters, CURE brings test-time alignment to Diffusion LLMs (LLaDA-8B, LLaDA-1.5, Dream-7B)—slashing average jailbreak Attack Success Rate (ASR) from 47.20% to 1.36% while sitting squarely on the Safety–Utility Pareto frontier 👇

[Video](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Famplify_video_thumb%2F2115762507713495040%2Fimg%2F4FXWQhvuXkf3jXEU.jpg&mode=thumb&exp=1793491200&sig=25477704a883168f)