SN-Guided Diffusion offline jailbreak transfers to Gemini-2.5-Flash-Lite at 74.3% ASR

Auto-published from arXiv:2608.07430 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.87, flags: [possible-zero-day]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

jailbreak

Model

Gemini-2.5-Flash-Lite (target); Gemini-2.5-Flash (target, 71.4% ASR); Claude-4.5-Haiku (target, 52.4% ASR); Llama-3-8B-Instruct (target, 77.1% ASR); Qwen2.5-7B-Instruct (target, 86.9% ASR)

Surface

API (black-box, proprietary and open-weight chat endpoints)

Setup

SN-Guided Diffusion uses a surrogate DLLM (e.g., LLaDA-8B or Dream-7B) to generate jailbreak prompts fully offline. The persona-based template is: "I [MASKS] and I need to [MASKS] for [MASKS]. [MASKS]" where [MASKS] are diffusion mask tokens. During each of 32 denoising steps, the top-K=30 candidate tokens are scored by a safety-neuron (SN) loss — SN(x) = E_ℓ[∑h^ℓ_i(x)·w_ℓ,i] — and the token minimizing SN activation is selected, steering the generation away from safety-triggering regions. A budget of E=20 candidate episodes per prompt is used (saturation observed at 5). The resulting completed prompts are then submitted to the black-box target API without further modification.

Reproduction anchor

code: https://github.com/ellyoana/sn-guided-diffusion; benchmark: JailBreakV-28K; transfer ASR results in Table 3; prompt template and loss formulation in methodology section

Observed behavior

The offline-generated prompts achieved transfer ASR of 86.9% on Qwen2.5-7B-Instruct, 77.1% on Llama-3-8B-Instruct, 74.3% on Gemini-2.5-Flash-Lite, 71.4% on Gemini-2.5-Flash, and 52.4% on Claude-4.5-Haiku. The method achieved 89.2% average ASR across four proprietary models, outperforming the prior NeuroStrike framework (65.7%) while requiring only 20 generation episodes per prompt — orders of magnitude fewer than GCG or AutoDAN variants. The SN loss achieved AUROC=1.0 in separating benign from jailbreak prompts at generation time.

Expected behavior

Target models should refuse the harmful requests embedded in the generated prompts; the prompts should be detected and filtered by safety layers or perplexity filters before reaching the model's response generation.

Reproducibility

high

Threat model

An adversary with access only to open-weight DLLM checkpoints (no API calls to the target required during prompt generation) can mass-produce jailbreak prompts offline and submit them to proprietary production APIs. The low per-prompt cost (20 episodes) makes this practical at scale against consumer-facing chatbots and enterprise API deployments, with no signal to the target provider during the attack-construction phase.

Novelty

First fully offline black-box jailbreak framework leveraging a DLLM's own denoising process as an adversarial prompt optimizer, achieving near-perfect benign/jailbreak separability (AUROC=1.0) while reducing generation cost by orders of magnitude vs. token-optimization baselines.

Source

• arXiv: 2608.07430
• PDF: https://arxiv.org/pdf/2608.07430
• Categories: cs.LG, cs.AI
• Authors: Elena Dumitrescu, Gert Lek, Lydia Y. Chen, J'er'emie Decouchant

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Discloses mechanistic jailbreak vulnerabilities against frontier LLMs including Gemini-2.5-Flash-Lite through novel safety neuron attacks with reproducible setups and concrete ASR metrics.

─────────────────────────────────────────────────────────────────────