Safety neuron self-pruning raises LLaDA-8B/Dream-7B ASR from ~2% to 74–87%

Auto-published from arXiv:2608.07430 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.92, flags: [possible-zero-day])

Category

jailbreak

Model

LLaDA-8B; Dream-Instruct-7B; Fast-dLLM-v2-7B

Surface

API / white-box model weights

Setup

The attacker has white-box access to the DLLM weights. Safety-critical neurons are identified by computing activation differences between harmful and benign prompts (top 0.8-percentile threshold). Those neurons are then pruned (zeroed out) at a 3% sparsity threshold before inference. No special prompt template is required — standard harmful instructions from JailBreakV-28K are passed directly. For transfer pruning, the safety neuron map from an autoregressive predecessor (Qwen2.5-7B) is used to prune the structurally corresponding neurons in Dream-7B or Fast-dLLM-v2-7B.

Reproduction anchor

code: https://github.com/ellyoana/sn-guided-diffusion; benchmark: JailBreakV-28K dataset; model identifiers, pruning thresholds, and ASR figures in Table 1 of the paper

Observed behavior

Self-pruning (pruning neurons identified within the DLLM itself) raised ASR from 2.6% → 73.8% on LLaDA-8B and from 1.9% → 86.6% on Dream-7B. Transfer pruning using Qwen2.5's neuron map raised Dream-7B ASR from 1.9% → 73.2% and Fast-dLLM-v2-7B ASR from 7.0% → 86.3%, confirming that DLLMs initialized from AR predecessors inherit the same sparse safety footprint.

Expected behavior

The DLLM should refuse harmful instructions regardless of neuron-level manipulation; safety alignment should be distributed enough to resist sparse weight edits.

Reproducibility

high

Threat model

A researcher or malicious actor with read access to open-weight DLLM checkpoints (e.g., downloaded from HuggingFace) can perform a one-time pruning step offline, producing a persistently jailbroken model variant that can be shared or deployed. The 3% sparsity intervention is lightweight, requiring no fine-tuning data.

Novelty

First demonstration that DLLM safety alignment is mechanistically sparse and directly transferable across AR→DLLM architecture pairs via neuron map re-use, enabling near-zero-cost cross-architecture jailbreaks.

Source

• arXiv: 2608.07430
• PDF: https://arxiv.org/pdf/2608.07430
• Categories: cs.LG, cs.AI
• Authors: Elena Dumitrescu, Gert Lek, Lydia Y. Chen, J'er'emie Decouchant

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Discloses mechanistic jailbreak vulnerabilities against frontier LLMs including Gemini-2.5-Flash-Lite through novel safety neuron attacks with reproducible setups and concrete ASR metrics.

─────────────────────────────────────────────────────────────────────