@inproceedings{song-etal-2026-diva,
title = "{DIVA}: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models",
author = "Song, Guorui and
Tang, Runqing and
Zhang, Jingye and
Zhang, Luyuan and
Huang, Feice and
Ray, Cong and
Wang, Guocun and
Zhong, Dake and
Wai, Choo Sin and
Dai, Bingquan and
Wang, Chuming and
Lin, Tongxu and
Guo, Wanyu and
Wang, Haoqian",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.2295/",
pages = "52202--52220",
ISBN = "979-8-89176-459-0",
abstract = "Large vision-language models (VLMs) are increasingly deployed in safety-critical settings, yet existing visual jailbreak research has focused almost exclusively on autoregressive architectures, leaving an important emerging family unstudied: multimodal discrete diffusion vision-language models (dVLMs). We identify a vulnerability that is specific to the diffusion generation process: because the visual embedding conditions every reverse denoising step rather than acting as a one-time prefix, adversarial visual semantics are not injected once but repeatedly propagated and amplified across the generation trajectory, a phenomenon we term cross-step conditional propagation. We provide empirical evidence that this mechanism is absent in autoregressive VLMs through stage-sensitivity analysis, prompt-level switch rates, and pairwise denoising-bin disagreement metrics, all confirmed statistically by bootstrap resampling. Motivated by this finding, we propose DIVA (Discrete-diffusion Vision-language model Attack), a white-box visual jailbreak framework that exploits dVLM-specific vulnerabilities via cross-modal intent obfuscation and diffusion-aware multi-timestep adversarial optimization. Across three dVLMs (LLaDA-V, MMaDA, and LLaDA2.0-Uni), DIVA reaches 58.8{\%}, 67.7{\%}, and 69.1{\%} HADES ASR under the Beaver reward-model metric, substantially outperforming visual jailbreak baselines designed for autoregressive models. Our code are available at https://github.com/loststars2002/DIVA."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="song-etal-2026-diva">
<titleInfo>
<title>DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models</title>
</titleInfo>
<name type="personal">
<namePart type="given">Guorui</namePart>
<namePart type="family">Song</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Runqing</namePart>
<namePart type="family">Tang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jingye</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Luyuan</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Feice</namePart>
<namePart type="family">Huang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Cong</namePart>
<namePart type="family">Ray</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Guocun</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Dake</namePart>
<namePart type="family">Zhong</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Choo</namePart>
<namePart type="given">Sin</namePart>
<namePart type="family">Wai</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Bingquan</namePart>
<namePart type="family">Dai</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Chuming</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tongxu</namePart>
<namePart type="family">Lin</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Wanyu</namePart>
<namePart type="family">Guo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Haoqian</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>Large vision-language models (VLMs) are increasingly deployed in safety-critical settings, yet existing visual jailbreak research has focused almost exclusively on autoregressive architectures, leaving an important emerging family unstudied: multimodal discrete diffusion vision-language models (dVLMs). We identify a vulnerability that is specific to the diffusion generation process: because the visual embedding conditions every reverse denoising step rather than acting as a one-time prefix, adversarial visual semantics are not injected once but repeatedly propagated and amplified across the generation trajectory, a phenomenon we term cross-step conditional propagation. We provide empirical evidence that this mechanism is absent in autoregressive VLMs through stage-sensitivity analysis, prompt-level switch rates, and pairwise denoising-bin disagreement metrics, all confirmed statistically by bootstrap resampling. Motivated by this finding, we propose DIVA (Discrete-diffusion Vision-language model Attack), a white-box visual jailbreak framework that exploits dVLM-specific vulnerabilities via cross-modal intent obfuscation and diffusion-aware multi-timestep adversarial optimization. Across three dVLMs (LLaDA-V, MMaDA, and LLaDA2.0-Uni), DIVA reaches 58.8%, 67.7%, and 69.1% HADES ASR under the Beaver reward-model metric, substantially outperforming visual jailbreak baselines designed for autoregressive models. Our code are available at https://github.com/loststars2002/DIVA.</abstract>
<identifier type="citekey">song-etal-2026-diva</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.2295/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>52202</start>
<end>52220</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models
%A Song, Guorui
%A Tang, Runqing
%A Zhang, Jingye
%A Zhang, Luyuan
%A Huang, Feice
%A Ray, Cong
%A Wang, Guocun
%A Zhong, Dake
%A Wai, Choo Sin
%A Dai, Bingquan
%A Wang, Chuming
%A Lin, Tongxu
%A Guo, Wanyu
%A Wang, Haoqian
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F song-etal-2026-diva
%X Large vision-language models (VLMs) are increasingly deployed in safety-critical settings, yet existing visual jailbreak research has focused almost exclusively on autoregressive architectures, leaving an important emerging family unstudied: multimodal discrete diffusion vision-language models (dVLMs). We identify a vulnerability that is specific to the diffusion generation process: because the visual embedding conditions every reverse denoising step rather than acting as a one-time prefix, adversarial visual semantics are not injected once but repeatedly propagated and amplified across the generation trajectory, a phenomenon we term cross-step conditional propagation. We provide empirical evidence that this mechanism is absent in autoregressive VLMs through stage-sensitivity analysis, prompt-level switch rates, and pairwise denoising-bin disagreement metrics, all confirmed statistically by bootstrap resampling. Motivated by this finding, we propose DIVA (Discrete-diffusion Vision-language model Attack), a white-box visual jailbreak framework that exploits dVLM-specific vulnerabilities via cross-modal intent obfuscation and diffusion-aware multi-timestep adversarial optimization. Across three dVLMs (LLaDA-V, MMaDA, and LLaDA2.0-Uni), DIVA reaches 58.8%, 67.7%, and 69.1% HADES ASR under the Beaver reward-model metric, substantially outperforming visual jailbreak baselines designed for autoregressive models. Our code are available at https://github.com/loststars2002/DIVA.
%U https://aclanthology.org/2026.emnlp-main.2295/
%P 52202-52220
Markdown (Informal)
[DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models](https://aclanthology.org/2026.emnlp-main.2295/) (Song et al., EMNLP 2026)
ACL
- Guorui Song, Runqing Tang, Jingye Zhang, Luyuan Zhang, Feice Huang, Cong Ray, Guocun Wang, Dake Zhong, Choo Sin Wai, Bingquan Dai, Chuming Wang, Tongxu Lin, Wanyu Guo, and Haoqian Wang. 2026. DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 52202–52220, Budapest, Hungary. Association for Computational Linguistics.