Diffusion Language Models for Perplexity-Aware Black-Box Attacks
Abstract
\emph{Continuous-space} attacks find prompts that trigger malicious behaviors, such as overthinking, in black-box LLMs by sampling or optimizing over a low-dimensional Gaussian latent space and decoding it to text through a \emph{random mapping} and nearest-token lookup. Because the random mapping is not learned from language, its prompts can be highly unnatural, and as such easily detectable through input guardrails, and the risk estimates they yield are not grounded in natural prompts. In this paper, we demonstrate that the same continuous latent-space framework can be coupled directly to a learned generative distribution over language, a continuous diffusion language model (dLLM), which removes the artificial random mapping while preserving the standard-Gaussian latent formulation and the downstream sampling or optimization procedure. We evaluate this approach under two settings: sampling-based estimation using \emph{RareTrap} and optimization-based search using \emph{ThinkTrap}. We find that character-level perplexity drops from 103--107 to 3--5 in RareTrap and from 20--28 to 4.3--5.4 in ThinkTrap. We also find that model risk estimates can differ by an order of magnitude across the two mappings.
Related
- Continuous Diffusion Scales Competitively with Discrete Diffusion for Language
- Diverse and Adaptable Arm Coordination for Octopus-Crawling via Diffusion-Based Uncertainty-Aware Optimization
- TAPS: Target-Aware Permanent Sampling for Graph Diffusion
- Usefulness of Quantile-Aware Diffusion Modeling for Highly Imbalanced Tabular Data
- Rank-Aware Speculative Sampling for Diffusion Draft Trees
BibTeX
@misc{allawati2026diffusion,
title = {{Diffusion Language Models for Perplexity-Aware Black-Box Attacks}},
author = {Ali Al-Lawati and Elsayed Eshra and Dongwon Lee and Suhang Wang},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.31558},
eprint = {2610.31558},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.31558},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Diffusion Language Models for Perplexity-Aware Black-Box Attacks
AU - Ali Al-Lawati
AU - Elsayed Eshra
AU - Dongwon Lee
AU - Suhang Wang
PY - 2026
DA - 2026/10/22
PB - arXiv
DO - 10.48550/arxiv.2610.31558
UR - https://arxiv.org/abs/2610.31558
AB - \emph{Continuous-space} attacks find prompts that trigger malicious behaviors, such as overthinking, in black-box LLMs by sampling or optimizing over a low-dimensional Gaussian latent space and decoding it to text through a \emph{random mapping} and nearest-token lookup. Because the random mapping is not learned from language, its prompts can be highly unnatural, and as such easily detectable through input guardrails, and the risk estimates they yield are not grounded in natural prompts. In this paper, we demonstrate that the same continuous latent-space framework can be coupled directly to a learned generative distribution over language, a continuous diffusion language model (dLLM), which removes the artificial random mapping while preserving the standard-Gaussian latent formulation and the downstream sampling or optimization procedure. We evaluate this approach under two settings: sampling-based estimation using \emph{RareTrap} and optimization-based search using \emph{ThinkTrap}. We find that character-level perplexity drops from 10^3--10^7 to 3--5 in RareTrap and from 20--28 to 4.3--5.4 in ThinkTrap. We also find that model risk estimates can differ by an order of magnitude across the two mappings.
ER -