Diffusion LLMs are Natural Adversaries for any LLM
This addresses the challenge of adversarial prompting for LLM security, offering a more efficient method for red teaming and prompt optimization, though it appears incremental as it builds on existing generative models.
The paper tackles the problem of resource-intensive adversarial prompt optimization by introducing a framework that uses pretrained non-autoregressive generative LLMs, such as Diffusion LLMs, to efficiently generate prompts, resulting in low-perplexity, diverse jailbreaks that transfer well to various black-box target models.
We introduce a novel framework that transforms the resource-intensive (adversarial) prompt optimization problem into an \emph{efficient, amortized inference task}. Our core insight is that pretrained, non-autoregressive generative LLMs, such as Diffusion LLMs, which model the joint distribution over prompt-response pairs, can serve as powerful surrogates for prompt search. This approach enables the direct conditional generation of prompts, effectively replacing costly, per-instance discrete optimization with a small number of parallelizable samples. We provide a probabilistic analysis demonstrating that under mild fidelity assumptions, only a few conditional samples are required to recover high-reward (harmful) prompts. Empirically, we find that the generated prompts are low-perplexity, diverse jailbreaks that exhibit strong transferability to a wide range of black-box target models, including robustly trained and proprietary LLMs. Beyond adversarial prompting, our framework opens new directions for red teaming, automated prompt optimization, and leveraging emerging Flow- and Diffusion-based LLMs.