BAAI's CURE re-masks risky tokens to cut diffusion LLM jailbreak success to 1.36%
Article timeline
The articles in this story. Times are ET.
BAAIOfficialBAAI's CURE adds 0.7% compute overhead to diffusion LLM safetyAIBAAI says its CURE test-time alignment method adds 0.84 TFLOPs, or 0.7%, to LLaDA-8B-Instruct's 126.29 TFLOPs of base generation. Prior test-time defenses SRIGuard and DiffuGuard add 200.0% and 103.1%, which the post puts at 150x to 300x more extra compute. BAAI says it is extending intermediate-state editing toward semantic-level reasoning repair and factuality and logical-consistency control.
- BAAIOfficialCURE cuts jailbreak attack success rate from 47.20% to 1.36%
AIBAAI reports that CURE reduces average attack success rate across five jailbreak benchmarks from 47.20% to 1.36% on LLaDA-8B-Instruct, Dream-v0-Instruct-7B, and LLaDA-1.5. On PAD-AdvBench and DIJA-AdvBench, CURE cuts LLaDA-8B's attack success rate from 93.65% and 98.65% to 4.42% and 4.23%. On MMLU and GSM8K, LLaDA-8B's defense success rate rises from 51.00% to 98.17%, while its average utility accuracy increases from 65.68% to 68.48%.
- BAAIOfficialBAAI proposes a safety defense for diffusion LLMs during denoising
AIBAAI says standard defenses struggle with diffusion LLMs because benign tokens can become risk-inducing in intermediate denoising states. Its method uses a lightweight safety value model trained with Spine Tree Search and K-branch rollouts, judged by Qwen Guard, to predict final safety from partial states. It then computes necessity and sufficiency risk attribution in one pass and re-masks only high-risk tokens.
- BAAIOfficialCURE aligns diffusion language models at test time, cutting jailbreak success to 1.36%
AIBAAI's CURE, accepted as a NeurIPS 2026 Oral, aligns diffusion language models at test time by re-masking counterfactual tokens without tuning base model parameters. The method cuts average jailbreak attack success rate from 47.20% to 1.36% across LLaDA-8B, LLaDA-1.5, and Dream-7B, with 0.7% extra compute. The post says CURE keeps models on the safety–utility Pareto frontier.
