2026

Large vision-language models (VLMs) are increasingly deployed in safety-critical settings, yet existing visual jailbreak research has focused almost exclusively on autoregressive architectures, leaving an important emerging family unstudied: multimodal discrete diffusion vision-language models (dVLMs). We identify a vulnerability that is specific to the diffusion generation process: because the visual embedding conditions every reverse denoising step rather than acting as a one-time prefix, adversarial visual semantics are not injected once but repeatedly propagated and amplified across the generation trajectory, a phenomenon we term cross-step conditional propagation. We provide empirical evidence that this mechanism is absent in autoregressive VLMs through stage-sensitivity analysis, prompt-level switch rates, and pairwise denoising-bin disagreement metrics, all confirmed statistically by bootstrap resampling. Motivated by this finding, we propose DIVA (Discrete-diffusion Vision-language model Attack), a white-box visual jailbreak framework that exploits dVLM-specific vulnerabilities via cross-modal intent obfuscation and diffusion-aware multi-timestep adversarial optimization. Across three dVLMs (LLaDA-V, MMaDA, and LLaDA2.0-Uni), DIVA reaches 58.8%, 67.7%, and 69.1% HADES ASR under the Beaver reward-model metric, substantially outperforming visual jailbreak baselines designed for autoregressive models. Our code are available at https://github.com/loststars2002/DIVA.