Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models Abrar Alotaibia,b,∗ , Moataz Ahmeda,c a Information and Computer Science Department, King Fahd University of Petroleum & Minerals, Dhahran, 31261, Saudi Arabia b College of Computer Science and Information Technology, Imam Abdulrahman Bin Faisal University, Dammam, 31441, Saudi Arabia
arXiv:2606.26566v1 [cs.CR] 25 Jun 2026
c SDAIA-KFUPM Joint Research Center for Artificial Intelligence, King Fahd University of Petroleum & Minerals, Dhahran, 31261, Saudi Arabia
ARTICLE INFO
ABSTRACT
Keywords: Large Language Models Red Teaming Diffusion Models Adversarial Attacks Jailbreaking AI Safety
Adversarial evaluation of AI systems has matured along four largely disconnected research tracks: diffusion-based attacks on text and large language models (LLMs), diffusion-based attacks on image classifiers, jailbreak pipelines against vision-language models, and diffusionbased input purification defenses. Each track has developed its own vocabulary, threat models, and benchmarks, with denoising diffusion models emerging as a shared generative mechanism whose recipes are now being actively ported between communities. This survey performs an information-fusion exercise at the meta-research level: we integrate these four tracks into a single conceptual framework with a unified taxonomy, evaluation criteria, and research agenda, with primary focus on the LLM-side slice. We catalog fifty published papers across four scope areas (text/LLM, image classifier, vision-language model, defense), plus four diffusionLLM-as-victim entries and ten non-diffusion baselines that any new diffusion-based attack must be compared against. We propose a six-class taxonomy of diffusion roles in adversarial pipelines, augmented by a threat-model axis that records attacker knowledge, query budget, and target accessibility, and we apply a five-dimension evaluation framework (attack success rate, transferability, query budget, perplexity, defense-evasion) uniformly across modalities. The review adopts a dual attacker-defender perspective: alongside the attack catalog we cover four diffusion-based defenses that constitute the natural evaluation backdrop for any new attack. We provide a critical analysis that identifies five recurring weaknesses of the current LLM-side literature, and we close with a research agenda of open questions and concrete experimental designs. The companion catalog and the underlying spreadsheet are released alongside the paper. We are explicit that this is a narrative review with quality assessment, not a PRISMA-compliant systematic review, and we discuss the implications of this choice for replication.
1. Introduction The deployment of large language models (LLMs) in healthcare, finance, education, and national-security adjacent applications has made the assessment of their safety properties a first-order concern [1, 24, 64]. Red teaming, the structured practice of probing a system with adversarial inputs to uncover vulnerabilities, has emerged as the dominant paradigm for this assessment [15, 53]. Existing red teaming methods for LLMs span a range of techniques, including discrete-token optimization of adversarial suffixes [83], genetic-algorithm refinement of fluent jailbreaks [38], attacker-LLM iterative rewriting in black-box settings [4], and autoregressive amortized attack generators [52]. A complementary technological track has reshaped generative modeling over the past five years. Denoising diffusion models, which formulate generation as iterative noise removal, have become the state of the art for image synthesis [20, 58, 62], and they are now being extended to discrete and text modalities through structured discrete-diffusion processes [2, 41, 60] and large-scale masked diffusion language models [48]. The intersection of these two trajectories, diffusion models used as adversarial generators against LLMs, is much less developed than the broader LLM red teaming literature. Recent surveys of LLM red teaming [10, 24, 34, 76] catalog hundreds of attacks, but diffusion-based attacks on text receive at most a sentence of mention. Conversely, surveys of diffusion models concentrate on image generation and rarely discuss adversarial usage. The result is that ∗ Corresponding author
[email protected] (A. Alotaibi); [email protected] (M. Ahmed)
ORCID (s): 0000-0003-1168-8050 (A. Alotaibi); 0000-0003-0042-8819 (M. Ahmed)
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 1 of 30
Adversarial Diffusion Across Modalities
researchers entering this space have no consolidated reference describing what has been tried, what has worked, what has failed, and where the gaps lie. This review aims to fill that gap. We focus on the use of diffusion models as the generative mechanism in adversarial pipelines that target machine-learning systems, with a particular emphasis on the LLM-side literature. We additionally cover the much larger image-domain literature because it provides the methodological vocabulary that text-side authors are now porting, and we cover diffusion-based defenses for text models because no diffusion-attack paper can be evaluated without them. The central observation is that the LLM-side literature is small but methodologically diverse: only four published papers operate in this regime as of writing, yet they cover four distinct attack philosophies and are appearing at an accelerating pace. The image-side literature, by contrast, is mature and contains specific recipes (DDIM-inversion plus latent perturbation; classifier-score guidance; segment-wise back-propagation through purifiers) that can be transplanted to the text setting. The motivation for this work is threefold. First, the practical motivation is that as LLMs are deployed in higherstakes settings, defenders need to understand the full landscape of attack mechanisms, including those that have not yet matured but plausibly will. Second, the methodological motivation is that diffusion-based generators offer specific properties (bidirectional conditioning, principled sampling diversity, joint modeling of input and output) that the dominant autoregressive attackers do not, and these properties suggest several attack designs that have not been published. Third, the disciplinary motivation is that the literature in this space sits across at least four communities (NLP safety, adversarial robustness in vision, multimodal LLM safety, generative modeling), and a unified treatment helps reduce duplicated effort across these communities. In doing so, the present review is itself an exercise in information fusion: we integrate four previously-disconnected literatures, each with its own vocabulary, threat models, and benchmarks, into a single conceptual framework. This cross-stream synthesis is a natural fit for the kind of multisource, multi-process integration that the field of information fusion has long been concerned with. The contributions of this review are as follows. • Propose a taxonomy of diffusion roles in adversarial pipelines. We introduce a six-class taxonomy of how diffusion is used in an attack (trained generator; frozen with latent perturbation; frozen with score or classifier guidance; off-the-shelf inference; pipeline-only renderer; victim diffusion model), augmented by a threat-model axis (attacker knowledge, query access, target accessibility). The taxonomy distinguishes papers that exploit diffusion’s gradients from those that use it as a black-box rendering step. • Develop a unified five-dimension evaluation framework. We introduce a five-criterion evaluation framework (attack success rate, transferability, query budget, perplexity, defense-evasion) and apply it uniformly across text, image-classifier, and vision-language-model attacks (Section 6). The framework pulls together reported figures from cataloged methods on shared benchmarks and exposes the closed-frontier-model gap that diffusion-based attacks have not yet closed. • Conduct a cross-modality fusion of fifty papers across four streams. We catalog fifty published papers spanning four previously-disconnected research streams (text/LLM red teaming, image-classifier adversarial machine learning, vision-language-model jailbreaking, and diffusion-based defenses), alongside four diffusion-LLM-asvictim entries and ten non-diffusion baselines. Each paper is recorded with its diffusion role, formulation, training method, datasets, metrics, target models, threat model, and code availability. The catalog and its underlying spreadsheet are released alongside the manuscript and are the source of all cross-cutting tables in this paper. • Investigate the dual attacker-defender landscape. Alongside the attack catalog, we cover four diffusion-based defenses (three text-classifier defenses and one multimodal-LLM defense) that constitute the natural evaluation backdrop for any new diffusion-based attack. We identify five recurring weaknesses of the current text-side attack literature and substantiate the analysis with the quantitative comparison built from our evaluation framework. • Identify open research questions with concrete experimental designs. We close with a set of open research questions grouped by methodological scope, framed as opportunities for the community rather than as a punch list of specific contributions. We acknowledge that some of these questions may already be under unpublished investigation at the time of reading. The rest of this article is organized as follows. Section 2 describes the review method. Section 3 provides terminological background and compares this review to existing surveys. Section 4 presents the taxonomy of diffusionbased attacks and discusses each branch in detail. Section 5 covers diffusion-based defenses for text models. Section 6 A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 2 of 30
Adversarial Diffusion Across Modalities
synthesizes reported empirical results across the cataloged methods using our five-dimension evaluation framework. Section 7 summarizes evaluation methods and benchmarks. Section 8 returns to the research questions and answers each one drawing on the catalog. Section 9 states the limitations and threats to validity of the review. Section 10 addresses implications and forward research directions. Section 11 concludes.
2. Review Method Our review method follows the structured process used in the broader red teaming literature [24], comprising search-strategy design, study selection, quality assessment, and data synthesis. We are explicit at the outset that this is a narrative review with quality assessment rather than a PRISMA-compliant systematic review [51]: the authors performed the complete screening pipeline (identification, title-and-abstract screening, full-text eligibility review, quality assessment, and final inclusion decisions) by hand over the course of the review, and we additionally report a supplementary post-hoc agreement check between two independent LLM agents on the inclusion rule (Section 2.3). We did not pre-register the protocol or conduct independent dual-author blinded screening of the full pool with formal inter-rater agreement; the choice reflects the small size of the directly-on-target corpus (the LLM-side cluster contains four papers) and the fast pace of the field, which together would make formal systematic-review machinery disproportionate to the available evidence. The complete screening log, including titles, screening decisions, and exclusion reasons for every record considered, is available in the companion repository for this review: https: //github.com/AbrarAlotaibi/diffusion-redteam-llm-survey.
2.1. Research Questions The review is guided by the following research questions, which are deliberately narrower in scope than questions used by general red teaming surveys because the topic itself is narrower. • RQ1. What is the current state of research on the use of diffusion models for adversarial attacks on machinelearning systems, with particular emphasis on LLMs? • RQ2. What taxonomy can be used to classify the role of diffusion models in adversarial pipelines? • RQ3. What formulations, training methods, and optimization strategies have been used to produce adversarial outputs through diffusion? • RQ4. What datasets, metrics, and target models are used in the evaluation of diffusion-based attacks? • RQ5. What diffusion-based defenses have been proposed for text models, and how do they relate to the attack literature? • RQ6. What gaps and unaddressed questions emerge from the current literature, and which of these gaps are most tractable for follow-on research?
2.2. Search Strategy We conducted searches across arXiv, Google Scholar, OpenReview, the ACL Anthology, the IEEE Xplore Digital Library, and the ACM Digital Library, supplemented by the proceedings of the major machine-learning venues (NeurIPS, ICML, ICLR), computer-vision venues (CVPR, ICCV, ECCV), natural-language-processing venues (ACL, EMNLP, NAACL), and computer-security venues (USENIX Security, IEEE S&P, ACM CCS, NDSS). Queries combined the keywords “diffusion model” or “score-based” with the keywords “adversarial,” “jailbreak,” “red teaming,” “attack,” and “adversarial example,” optionally restricted by modality (“text”, “vision-language model”, “image classifier”). References and citation chains of identified papers were then traversed recursively to surface adjacent work that did not appear in the keyword search.
2.3. Study Selection and Quality Assessment The initial search returned 154 candidate records after cross-database de-duplication. We performed title-andabstract screening on the full pool, which reduced it to 94 records that plausibly used diffusion in an adversarial pipeline; we then conducted full-text eligibility review on those 94 records, which reduced the corpus to the 50 papers retained in the catalog of this review (comprising four diffusion-attack papers on text/LLMs, eighteen on image classifiers, A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 3 of 30
Adversarial Diffusion Across Modalities Table 1 Quality-assessment checklist used during paper screening. S. No. Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8
Quality assessment question Is the diffusion role precisely defined (trained, frozen, score-guided, pipeline-only)? Is the formulation (continuous, discrete, latent, embedding-space) clearly stated? Are the evaluation datasets and metrics fully reported? Are baseline comparisons against non-diffusion adversarial attacks provided? Does the study contribute to academic understanding of diffusion as an adversarial mechanism? Is the venue or citation visibility consistent with substantive peer review? Is target-model coverage sufficient (open-source, closed-source, defended)? Is code or a reproducible artifact released?
ten on vision-language models, four on diffusion-LLM-as-victim, four diffusion-based defenses, and ten non-diffusion baselines). The remaining 44 records that passed title-and-abstract screening but were excluded at full-text review are documented with exclusion reasons in our screening log, released as part of the companion repository (Section 2.4). The principal exclusion rule was that diffusion be a constitutive component of an adversarial pipeline, either as the generator of the adversarial input, the victim of the attack, or an explicit defense built on a diffusion-style denoising process. Papers that mentioned diffusion only in passing, used diffusion only for benign purposes (e.g., image generation for non-adversarial dataset construction), or whose use of the term “diffusion” was metaphorical (e.g., information diffusion in social networks) were excluded. Quality assessment of retained papers used the checklist in Table 1, which adapts the criteria of the prior LLM red teaming review [24] to the diffusion-attack setting. The full pipeline: search, identification, title-and-abstract screening, full-text eligibility review, quality assessment against the checklist, and final inclusion decisions, was performed by the authors, with the first author conducting the bulk of the screening work under the supervision of the second author. Disagreements at the full-text stage were resolved through discussion to consensus. After the authors’ screening pipeline was complete, we additionally ran a supplementary post-hoc agreement check using two independent large-language-model agents to estimate how unambiguously the inclusion rule can be applied by a careful but uninformed reader. The two agents re-screened all 154 candidate records using only each record’s title and a short summary, with distinct prompting strategies designed so that disagreements would reflect genuine rule ambiguity rather than within-model consistency: Agent A applied the rule as a strict literal checklist with defaultto-exclude on ambiguity, while Agent B applied the rule with reasoning-first interpretation and default-to-include on ambiguity within the diffusion-plus-adversarial-plus-LLM/CV/VLM intersection. Cohen’s 𝜅 between the two agents was 0.781, indicating substantial agreement under the criteria of Landis and Koch [28]; observed agreement was 89.6% on a chance-corrected baseline of 52.5%. The two agents agreed with the authors’ final catalog on all 50 inclusions and on 88 of 104 exclusions; the 16 boundary cases on which the two agents disagreed (late-find adjacent work such as RedDiffuser and VERA-V, defense variants such as DiffCAP, face-attack variants, and patch-defense work) represent the legitimate degrees of freedom in the catalog scope. We emphasize that this LLM-agent check is a supplementary transparency probe on the precision of the inclusion rule and is not equivalent to formal inter-rater agreement between independent human reviewers, which we did not conduct; the search, screening, quality assessment, and the final fiftypaper catalog are the authors’ work. The LLM-agent prompts and re-screening decisions are released in the companion repository alongside the screening log.
2.4. Data Synthesis For each retained paper we extracted the following information: title, authors, venue, year, arXiv identifier or DOI, scope area, diffusion role, diffusion type and space (continuous, discrete, latent, embedding, pixel, h-space, etc.), training or optimization method, dataset(s), metrics, target model(s), code availability, key contribution, and limitation. The extracted data are recorded in a relational catalog and released alongside this paper in a public GitHub repository (https://github.com/AbrarAlotaibi/diffusion-redteam-llm-survey), which contains the screening log, the per-paper metadata catalog, and the inclusion/exclusion decisions. All tables in this paper are generated from this catalog.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 4 of 30
Adversarial Diffusion Across Modalities
2.5. Scope The scope of this review is the use of diffusion models as the generative mechanism in adversarial pipelines that target machine-learning systems, with the primary focus on LLMs. The image-domain literature (eighteen papers in our catalog) is included as methodological background because it predates and informs the LLM-side work. The visionlanguage-model literature (ten papers) is included because the LLMs in those settings are downstream consumers of diffusion-generated adversarial images. The dLLM-as-victim literature (four papers) is adjacent rather than in-scope, but is included because hybrid attacker designs may exploit those findings. Diffusion-based defenses (four papers: three text-classifier defenses and one multimodal-LLM defense) are included because they constitute the natural evaluation backdrop for any new diffusion-based attack. Non-diffusion baselines (ten papers) are included because every diffusionbased attack must be compared against them. Defenses for image models (DiffPure and follow-ups) are referenced where they bear on the attack literature but are not enumerated, because they fall outside the LLM-centered scope.
3. Background Before turning to the cataloged works themselves we provide two pieces of background. The first is the technical vocabulary of the diffusion-attack literature, which is non-trivial because the area draws from at least two distinct communities (denoising diffusion modeling on one hand, adversarial machine learning on the other) and the resulting terminology can be ambiguous. For example, the term “guidance” is used in the diffusion literature to mean classifier or classifier-free guidance applied to the score during sampling, whereas in the LLM safety literature it sometimes refers to instruction-following guidance or alignment guidance, with no direct connection to a score function. We collect the precise senses used in this paper in Section 3.1. Readers familiar with one community but not the other may wish to skim Table 2 before reading Section 4. The second piece of background is the set of prior review articles closest to the present work. Section 3.2 compares this review to those surveys and identifies the specific gap that the present work addresses.
3.1. Terminology We provide brief definitions of the most frequently used terms in this review in Table 2. The definitions emphasize how each term is used in the diffusion-attack literature specifically, which can differ from generic usage.
3.2. Related Reviews A number of recent surveys cover LLM safety and red teaming, but to the best of our knowledge none provides a focused treatment of diffusion-based adversarial generation. Table 3 situates the present review against eight recent works. Jabbar et al. [24] provide the most directly comparable prior survey, covering prompt-based attacks, data manipulation, model exploitation, information extraction, and model degradation. Their treatment of diffusion-based attack generation is limited to a single paragraph noting its existence, and the LLM-side text-diffusion attacks (DiffusionAttacker, DART) had not yet appeared at the time their survey was submitted. Lin et al. [34] provide a complementary perspective from the generative-models side; their taxonomy categorizes attacks by exploited capability and includes some VLM jailbreak entries that we discuss here, but does not separate diffusion-based attacks as a methodological family. Yi et al. [76] survey LLM jailbreak attacks and defenses but focus on prompt-engineering and gradient-based suffix attacks. Cui et al. [10] introduce a module-oriented risk taxonomy for LLM systems, and Huang et al. [22] survey safety and trustworthiness of LLMs through the lens of verification and validation, with diffusion-based attacks again receiving limited treatment. None of these reviews provides cross-modality coverage of diffusion-based attacks alongside LLM-specific text-diffusion work, which is the gap that the present review addresses.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 5 of 30
Adversarial Diffusion Across Modalities Table 2 Terminology used throughout this review. Term
Definition
Diffusion model
A generative model that learns to invert a forward noising process. The forward process gradually corrupts data with noise; the reverse process iteratively denoises samples from a noise distribution to the data distribution [20, 62]. A deterministic inversion procedure for a pretrained denoising diffusion implicit model (DDIM) that maps a clean sample to its corresponding latent. DDIM inversion enables targeted editing or perturbation of a specific input by manipulating its inverted latent and re-denoising [61]. A diffusion model whose forward and reverse processes operate in the latent space of a pretrained autoencoder rather than on raw pixels. Latent diffusion underlies Stable Diffusion and is the basis for most VLM-side adversarial work [58]. Inference-time modification of the reverse process by adding a gradient term derived from a classifier. Used in the original guided-diffusion line [14, 47] and adapted to inject adversarial signal at every denoising step [6, 11, 21]. A diffusion process defined directly on discrete categorical data, such as token sequences. Examples include D3PM [2], masked discrete diffusion (MDLM) [60], and score-entropy discrete diffusion (SEDD) [41]. A large language model whose generation mechanism is non-autoregressive and based on iterative denoising or remasking, e.g., LLaDA [48]. Distinct from autoregressive LLMs in that prediction order is not strictly left-to-right. An input crafted to cause a target model to behave in an unintended way. In the LLM setting this is typically a prompt that elicits content the model is aligned to refuse. An attack that bypasses a model’s safety training, causing it to comply with a request it would otherwise refuse [71]. The fraction of attempted attacks that succeed by some pre-specified judge, typically a keyword check, a learned classifier, or a strong-judge LLM such as Llama-Guard [23]. The degree to which an attack crafted against one target model also succeeds against other target models.
DDIM inversion
Latent diffusion
Score-based / classifier guidance Discrete diffusion
Diffusion LLM (dLLM)
Adversarial example Jailbreak Attack Success Rate (ASR) Transferability
Table 3 Comparison of this review with related surveys on LLM and adversarial-attack literature. ✓: covered, ⊙: partially covered, blank: not covered. Diffusion as generator
Text / LLM
Jabbar et al., 2025 Lin et al., 2025 Yi et al., 2024 Cui et al., 2024 Huang et al., 2024 Liu et al., 2024d Perez et al., 2022 Ganguli et al., 2022
⊙ ⊙
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
This review
✓
Reference
Image classifier
✓
VLM / multimodal
⊙
⊙ ✓ ⊙ ⊙ ⊙
✓
✓
⊙
dLLM as victim
Diffusion defense
⊙ ⊙
✓
✓
Eval. & benchmarks ✓ ⊙ ✓ ⊙ ✓ ⊙ ⊙ ✓ ✓
4. Diffusion-Based Adversarial Attack Taxonomy We organize the literature first by target modality (text/LLM, image classifier, vision-language model) and within each modality by the role that the diffusion model plays in the adversarial pipeline. The fifty cataloged papers fall into five methodological families (A–E) plus a baseline set (F): four diffusion-attack papers on text/LLMs (Family A, Section 4.1); four diffusion-LLM-as-victim papers (Family B, Section 4.4, adjacent rather than primary); eighteen on
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 6 of 30
Adversarial Diffusion Across Modalities
image classifiers (Family D, Section 4.2); ten on vision-language models (Family E, Section 4.3); ten non-diffusion baselines (Family F, Section 4.5); and four diffusion-based defenses (Family C, Section 5). The role-within-modality view makes the internal structure of each attack-modality visible (Figure 1). Family A divides into a trained-generator regime (three papers) and an off-the-shelf inference regime (one paper). Family D spans four distinct diffusion roles: latent perturbation, score guidance, patch/physical, and purifier evasion. Family E spreads across four further roles, including the only diffusion-as-victim paper in the catalog. Trained generator
Off-the-shelf inference
DiffusionAttacker; DART; Qiu et al.
Lüdke et al.
Latent perturbation
Score guidance
Patch / physical
Purifier evasion
DiffAttack; ACA; Adv-Diffusion; DiffProtect; DiffAM
AdvDiff; AdvDiffuser; Diff-PGD; ScoreAdv; SemDiff; NatADiff; APA
NaturalPatch; AdvLogo; DiffPatch / BadPatch; LSDM
Kang et al. (DiffAttack vs DiffPure)
Score-guided
Pipeline / renderer
Diffusion-style pretrain
Diffusion as victim
AdvDiffVLM; Xu et al. (cross-attention)
HADES; MM-SafetyBench; IDEATOR; Visual-RolePlay; AttackVLM; InstructTA
AnyAttack
AdvI2I (I2I diffusion)
Text / LLM 4 papers Sec. 4.1
Image classifier 18 papers Sec. 4.2
VLM 10 papers Sec. 4.3
Figure 1: Taxonomy of cataloged diffusion attacks: target modality (rows) and diffusion role within each modality (columns). Families B, C, and F are treated separately in Sections 4.4, 5, and 4.5. Arranged by year (Figure 2), the catalog tells a different story. Family D is the established cluster, accumulating steadily from 2023 through the May 2026 cutoff. Families A and B emerged entirely in 2024–2025; the focal subjects of this survey are therefore also its newest entries. Twenty-two of the fifty papers (44%) provide a public code release. Both figures are generated from the Catalog sheet of the companion repository (Section 2.4). D. Vision
7
5
F. Baselines
7
2
E. VLM 1
B. dLLM victim
1
5
2
C. Defenses
1
6
3
2 4
A. Text/LLM
3
1 0
2
4
6
8
10
12
14
16
18
Cataloged papers 2023
2024
2025 (May 2026 cutoff)
Figure 2: Cataloged papers by family and year. Color encodes year of publication; family ordering follows the survey’s focus rather than the alphabet. A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 7 of 30
Adversarial Diffusion Across Modalities
4.1. Diffusion Attacks on Text and Large Language Models This is the smallest and most directly relevant cluster, comprising four papers. Before turning to each in detail, it is worth pausing on a question that the cluster as a whole answers in four genuinely different ways: where in the adversarial pipeline does the diffusion process actually live? Figure 3 arranges the four papers side-by-side along precisely this axis. DART
DiffusionAttacker (Wang et al., EMNLP 2025) Continuous latent 𝑧𝑡 LM_head Gumbel 𝑧0 𝑧𝑇
(Nöther et al., AAAI 2025) Embedding space (T5) 𝑥ref +𝛿
logits
denoise
decode
adv tokens
𝜖 𝑥ref
GPT-4 judge
Victim LLM
Victim LLM
Diffusion in continuous latent 𝑧𝑡 ; Gumbel-Softmax bridges to differentiable discrete tokens
Diffusion in embedding space; 𝜖-ball enforces proximity to reference prompt
Lüdke et al.
Qiu et al.
(arXiv 2025, LLaDA-8B)
(SPIE ICCAID 2023) Diffusion w/ dual-objective training
Joint 𝑞(𝐱, 𝐲) via pretrained DLLM sample Tell me how to
,
here
is
the step by step . . .
↺ 2000 random restarts
semantic sim(𝑥, 𝑥′ )
... original text 𝑥
𝐲: Sure
Tox. classif.
ASR signal (proximity-bounded)
attack loss → ∇ Gumbel
𝐱: [M] [M] [M] [M] [M]
adv prompt
(fixed)
Diffusion model
adv text 𝑥′
surrogate classifier (adv loss)
no training black-box transfer dual loss
Victim LLM
JBB + SR
Diffusion in masked token grid; inpaint 𝐱∼𝑞(𝐱|𝐲); pretrained DLLM, no training, restart-based
Target classif.
ASR
Diffusion trained with dual objectives: semantic + adversarial; black-box transfer to target classifier
Figure 3: Mechanistic comparison of the four Family A papers. Section 4.1 describes each panel in detail. DiffusionAttacker (top-left panel) places the diffusion process in a continuous latent space: the generator denoises a noise vector 𝑧𝑇 into 𝑧0 over several steps, the LM_head maps the resulting latent into a logit distribution over the vocabulary, and Gumbel-Softmax samples discrete tokens in a way that remains differentiable, so the attack loss can flow back through the sampler at training time. DART (top-right panel) instead operates in the embedding space of a T5 backbone: a reference prompt’s embedding 𝑥ref is perturbed within a hard 𝜖-ball, and the resulting embedding 𝑥ref +𝛿 is decoded back to natural language. The dashed circle is the central commitment of the paper, not decoration. Lüdke et al. (bottom-left panel) work directly in masked-token space and dispense with training entirely: the harmful response 𝐲 is held fixed, the prompt 𝐱 starts fully masked, and a pretrained masked diffusion language model samples 𝐱 conditioned on 𝐲 across roughly two thousand random restarts. The panel has no feedback arrow because there is no training to feed back into. Qiu et al. (bottom-right panel) trains a diffusion model with two objectives simultaneously, a semantic-preservation term and an adversarial loss against a surrogate classifier, and relies on black-box transfer to attack the actual target classifier, which the diffusion model never sees during training. The contrast the figure makes visible is that the four papers do not share a single methodology. They share a highlevel commitment to using diffusion somewhere in the adversarial pipeline, but below that they pursue four genuinely different mechanisms: continuous latent denoising with differentiable sampling, embedding-space perturbation under A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 8 of 30
Adversarial Diffusion Across Modalities
a proximity constraint, inference-time inpainting on a pretrained masked DLLM, and dual-objective embeddingspace training for transfer attack. This heterogeneity is worth keeping in mind when reading the cluster critique in Section 4.1.5: many of the weaknesses we identify are weaknesses of specific mechanisms, not of the cluster as a whole. We now take each paper in turn.
4.1.1. DiffusionAttacker DiffusionAttacker [65] reformulates jailbreaking as sequence-to-sequence rewriting. The attacker is a continuous text-diffusion generator that conditions on a source harmful instruction and produces a rewritten prompt through iterative denoising in a continuous latent space; the attack loss, computed against a target LLM, is backpropagated through the sampler via Gumbel-Softmax relaxation, which makes the otherwise non-differentiable discrete-token sampling step at the end of the pipeline differentiable. The paper’s positioning claim is that the seq2seq formulation overcomes a structural limitation of autoregressive attackers such as AdvPrompter [52]: an autoregressive attacker can only append tokens and cannot revise what it has already emitted, whereas a seq2seq diffuser can re-edit any position during denoising. Experiments run on AdvBench and HarmBench against four open-weight aligned LLMs. The reported white-box attack success rates, given as the prefix-match / GPT-judge pair ASRprefix /ASRGPT , reach 90/74% on Llama-3-8B, 93/79% on Mistral-7B, 91/77% on Vicuna-7B, and 88/71% on Alpaca-7B+Safe-RLHF. The paper also reports transfer to closed frontier models, though through a particular framing: rather than apply the trained diffusion attacker directly, the authors use DiffusionAttacker as a rewriter that feeds existing black-box methods. Under that framing, transfer numbers are 56/49% on GPT-4o and 33/21% on Claude-3.5; Gemini is not evaluated. The contribution is real but bounded. The paper demonstrates that a trained seq2seq diffusion attacker is feasible, and the Gumbel-Softmax differentiation through the sampler is a useful methodological addition to the discrete-attack literature. The white-box dependency at training time is substantial, however: the attack loss is backpropagated through each target LLM’s own parameters, so the white-box ASR reported above is partly a statement about each target’s gradient surface, and the substantial dropoff from white-box (90/74% on Llama-3-8B) to black-box-transfer numbers (56/49% on GPT-4o, 33/21% on Claude-3.5) is consistent with this reading. A second concern is structural to the diversity metric: stochastic diffusion samplers are by construction more diverse than greedy autoregressive decoders, so the reported diversity gain over AdvPrompter is partly an artifact of decoding strategy, and whether the additional diversity translates into harm a defender would care about is a separate question. 4.1.2. DART DART [50] poses red teaming as constrained search. Every discovered prompt must lie within an L2 ball of a reference prompt in embedding space, anchoring the attack to a specific topic, writing style, or category of harmful behavior. The mechanism is a learned perturbation model trained with diffusion-style noising: it produces bounded perturbations of reference embeddings that maximize a learned harmfulness reward, and the perturbed embedding is decoded back to text via a fixed decoder. The proximity constraint differentiates DART from gibberish-suffix attacks such as GCG [83] and from genetic-algorithm refinements such as AutoDAN [38], neither of which guarantees semantic proximity to a reference. The reported targets are three aligned LLMs of increasing safety (gpt2-alpaca, Vicuna-7B, and Llama-2-7B-chathf), and the headline result is a Pareto frontier of (cosine-similarity-to-reference, ASR) that dominates each comparison baseline (unmodified prompts, RL fine-tuning, zero-shot prompting, few-shot prompting, and FLIRT [45]) under tight proximity budgets (𝜖 = 0.1 and 𝜖 = 0.5). FLIRT does achieve higher unconstrained toxicity than DART, but only by drifting away from the reference; once a proximity budget is imposed, DART discovers more toxic prompts within the budget than any baseline. The authors further show that established autoregressive architectures perform poorly under the proximity constraint, supporting the case for a generator that can move in arbitrary directions in embedding space rather than only forward. Of the four Family A papers, DART is the methodologically most novel: it reframes the problem (anchored audit of a topic or harmful-behavior class) rather than trying to outperform GCG on the conventional ASR-on-AdvBench benchmark. The principal caveat is terminological: DART’s use of the word “diffusion” refers to a learned noise model trained with diffusion-style objectives, not to a full multi-step denoising-diffusion sampler with an iterative reverse process. This does not detract from the contribution but shapes how the work should be situated: DART belongs to the broader family of learned-perturbation attackers that take inspiration from diffusion training, rather than to the class
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 9 of 30
Adversarial Diffusion Across Modalities
of true denoising-diffusion attackers. A second caveat, shared with DiffusionAttacker, is that transfer to frontier closed models is not reported.
4.1.3. Diffusion LLMs as Natural Adversaries Lüdke et al. [42] use pretrained diffusion LLMs as off-the-shelf adversarial generators against any target LLM. The key observation is that masked diffusion language models such as LLaDA [48] jointly model prompt-response pairs, 𝑝(prompt, response). Fixing the response to a desired harmful completion and inpainting the prompt under this joint distribution therefore yields adversarial prompts in a fully training-free manner. The procedure is conceptually simple: choose a target completion, instantiate the dLLM, mask the prompt portion, and run a conditional inpainting pass with a small number of parallel samples. A probabilistic analysis in the paper shows that under a fidelity assumption on the dLLM, namely that it accurately models 𝑝(prompt ∣ response) in the relevant region of the joint distribution, a small number of conditional samples suffices to recover high-reward prompts. Empirically, the reported ASR figures span a wide range. With 2,000 random restarts per target and no per-target training, the attack achieves 100% on Phi-4-Mini, Qwen-2.5-7B, and Llama-3-8B; 91% on LAT-hardened Llama-3-8B; 93% on Circuit Breakers; 99% on Gemma-3-1B; and 53% on ChatGPT-5 over 100 attack attempts. The authors also report that the generated prompts are low-perplexity (and so plausibly evade perplexity-based filters) and diverse across restarts. All evaluation is on JailbreakBench / StrongREJECT. This is the first paper to operationalize a true masked-diffusion sampler as a zero-cost attacker against autoregressive targets, and it is the cleanest realization of the “diffusion as natural adversary” idea: no per-instance optimization, no attack-specific training, and no white-box access to the target. The principal limitation is that the fidelity assumption is doing real work. If the pretrained dLLM has not been exposed to the specific harmful intents of interest during pretraining, which is plausible because pretraining data are typically filtered to remove harmful content, then 𝑝(prompt ∣ response) for those completions may be unreliable. The paper is recent (October 2025) and at the time of writing the authors had not released code, which limits independent replication. The practical implication for follow-on work is clear: any new diffusion-based attacker on LLMs must explicitly differentiate from response-conditional inpainting on a pretrained dLLM, because this baseline is now nearly free. 4.1.4. Diffusion-Based Adversarial Attack on NLP Classifiers Qiu et al. [55] is the earliest entry in this cluster, predating the LLM-jailbreak wave by roughly a year. The targets are conventional text-classification models (sentiment, topic, and related discriminative tasks) rather than chat LLMs. The attacker is an embedding-space diffusion model trained jointly with a substitute classifier, and the training objective combines two terms: a semantic-preservation term that keeps the perturbed embedding decoding back to text close in meaning to the input, and an adversarial term that drives the substitute classifier toward a wrong label. The blackbox transfer assumption is standard: a victim classifier of similar architecture but different weights will be fooled by adversarial examples crafted against the substitute. The paper reports that the proposed method successfully generates adversarial texts that fool text-classification targets, but the publicly available abstract does not give a specific ASR figure or improvement-over-baseline number. The paper appears in a comparatively low-visibility venue (the SPIE ICCAID 2023 proceedings), which limits the methodological detail accessible without institutional access. We include Qiu et al. as the historical reference point for “diffusion as adversarial text generator,” and because the text-classifier attack thread, as opposed to the LLM-jailbreak thread, remains essentially uncultivated. A clean modern follow-up using a true discrete-diffusion sampler against text-classification targets has not been published, and we flag it as one of the more tractable opportunities in Section 10. 4.1.5. Cluster Critique Read together, the four papers expose several recurring weaknesses. The first is a pervasive white-box dependency: three of the four train against white-box gradients of the target model. Direct training-free attacks on closed frontier models are reported only by Lüdke et al. [42], and even there the assumption that pretrained dLLMs have learned a good 𝑝(prompt ∣ response) for harmful completions is an empirical question that bears further scrutiny. DiffusionAttacker does report transfer to GPT-4o (56/49% ASRprefix /ASRGPT ) and Claude-3.5 (33/21%), but these numbers reflect the use of DiffusionAttacker as a rewriter for existing black-box methods rather than direct application of the trained diffusion sampler to the closed target. Second, no paper combines a true discrete diffusion sampler (D3PM, SEDD, MDLM) with an explicit harmfulness reward and a HarmBench-scale evaluation; each picks one or two of these components but not all three. A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 10 of 30
Adversarial Diffusion Across Modalities
Third, defense-evasion is under-evaluated. The papers claim low perplexity for generated prompts but none benchmarks the attacks against modern input filters such as Llama-Guard [23] or SmoothLLM [57], and reported low-perplexity numbers are necessary but not sufficient evidence of filter evasion. Fourth, multi-turn attacks are absent. All four papers produce single-shot adversarial prompts, even though diffusion’s natural strength, joint modeling of long sequences with bidirectional conditioning, is precisely what one would want for adversarial multi-turn dialogue. Fifth, constrained or topic-specific red teaming is represented by a single paper [50]. Combining DART’s proximity constraint with a true discrete-diffusion sampler is an obvious unfilled cell of the methodological matrix. Table 4 summarizes the four Family A papers. Table 4 Diffusion-based adversarial attacks on text and language models (Family A). Threat: WB train indicates white-box gradients used during training; BB indicates black-box attack or transfer; GB indicates grey-box access (surrogate or encoder-only). ✓: public code released. Reference
Venue / yr
Diffusion role
Target
Threat
Dataset / key reported finding
Code
Wang et al. [65]
EMNLP 2025
Trained generator (seq2seq text diffusion)
Llama-3, Vicuna, Mistral, Alpaca+SafeRLHF; transfer to GPT-4o, Claude-3.5
WB train; BB transfer
×
Nöther et al. [50]
AAAI 2025
Trained perturbation (diffusion-style noising)
gpt2-alpaca, Vicuna-7B, Llama2-7B-chat-hf
BB
Lüdke et al. [42]
arXiv 2025
Off-the-shelf inference (pretrained dLLM as 𝑝(prompt ∣ response))
Phi-4-Mini, Qwen-2.5-7B, Llama-3-8B (incl. LAT, Circuit Breakers), Gemma-3-1B, ChatGPT-5
BB
Qiu et al. [55]
SPIE 2024
Trained generator (embedding diffusion + substitute classifier)
Text classifiers (sentiment, topic)
GB
AdvBench, HarmBench. ASRprefix /ASRGPT 90/74 on Llama-3-8B, 93/79 Mistral-7B, 91/77 Vicuna-7B, 88/71 Alpaca-7B+Safe-RLHF. BB transfer (as rewriter): 56/49 GPT-4o, 33/21 Claude-3.5. Reference-prompt sets. Pareto frontier of (cosine-sim, ASR) dominates baselines (unmodified, RL FT, zero/few-shot, FLIRT) under 𝜖=0.1 and 𝜖=0.5. JailbreakBench / StrongREJECT (2,000 restarts). 100% on Phi-4-Mini, Qwen-2.5-7B, Llama-3-8B; 91% LAT Llama-3-8B; 93% Circuit Breakers; 99% Gemma-3-1B; 53% ChatGPT-5 (100 attempts). Standard text-classification benchmarks. First demonstration of diffusion-based adversarial text against NLP classifiers; specific ASR not reported in abstract.
×
×
×
4.2. Diffusion Attacks on Image Classifiers The image-domain literature is substantially larger than the text-domain literature and provides the methodological vocabulary that text-side authors are now porting. We organize it into four families.
4.2.1. Latent-Space Optimization through DDIM Inversion Chen et al. [5] introduce DiffAttack, the first paper of any kind to use a diffusion model for adversarial example crafting. The recipe is to DDIM-invert a clean image to its latent, and then back-propagate a classifier loss through the reverse stochastic differential equation (SDE) to update the latent. Two regularization terms, one that deviates cross-attention from the clean prediction and one that preserves self-attention, balance attack effectiveness against perceptual structure. Chen et al. [8] extend this with manifold-constrained projected gradient descent (PGD) on Stable A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 11 of 30
Adversarial Diffusion Across Modalities
Diffusion latents and report substantial transferability gains over prior unrestricted-adversarial-example methods. Liu et al. [36] and Sun et al. [63] apply the same recipe to face recognition with identity-preserving inpainting and makeup transfer, respectively. The text analogue of DDIM-inversion is invertible embedding-space diffusion: encode a clean prompt to embeddings, run a discrete-diffusion forward to a noisy latent, then optimize a judge loss while denoising back. DiffusionAttacker is the closest analogue, but it treats the diffuser as a parametric attacker rather than as a frozen prior.
4.2.2. Score / Classifier Guidance during Reverse Sampling Dai et al. [11] introduce AdvDiff, which injects an adversarial guidance term directly into the reverse SDE: the class-likelihood guidance term during reverse sampling and a noise-sampling adversarial guidance term jointly produce realistic samples whose adversariality is internalized in the score. Chen et al. [6] perturb the predicted clean sample at each denoising step with class activation map (CAM) masking to preserve salient regions, achieving near-100% ASR against RobustBench leaders on CIFAR-10, CelebA, and ImageNet. Xue et al. [74] wrap standard PGD with a per-step diffusion projection that re-pulls perturbed images onto the natural-image manifold. Huang and Tang [21] reweight the denoising posterior with a classifier-score adversarial term at every DDIM step in a fully training-free manner. Collins et al. [9] target the decision-boundary intersection of the true and adversarial classes, producing samples that resemble naturally occurring mistakes. Dai et al. [12] optimize multiple semantic attributes in the deep semantic latent space (h-space) of a pretrained diffusion model, and Jiang et al. [25] bring Direct Preference Optimization (DPO) machinery to adversarial diffusion through a two-stage preference-alignment framework that decouples conflicting preferences. The text analogue is a harmfulness-classifier guidance term during the reverse process of a discrete diffusion sampler. No published paper has implemented this recipe directly for text. 4.2.3. Diffusion as a Generator of Physical or Patch Attacks Chen et al. [7], Miao et al. [46], Wang et al. [70] (renamed BadPatch in the most recent revision), and Wang et al. [68] use latent diffusion to generate adversarial patches and global perturbations against object detectors (YOLO family, Faster R-CNN, DETR). The recipes vary: latent perturbation under detector loss with expectation over transformations (EOT) for printability [7]; Fourier-domain perturbation of latent and unconditional embeddings at the last diffusion timestep [46]; null-text inversion with masked latent attack to preserve user-customizable styles [70]; and per-step latent perturbation conditioned on the input image for global non-patch detector evasion [68]. The text analogue, by analogy, is wrapping a harmful query inside an in-context-learning template, a roleplay frame, or a persona; some VLMside papers (HADES, Visual-RolePlay) realize this analogue partially through diffusion-rendered scene or character imagery. 4.2.4. Diffusion-Purification Evasion DiffPure [49], a diffusion-based input purifier that runs a short forward-noising-then-denoising pass with a pretrained diffusion model to project adversarial inputs back toward the natural-image manifold, has become the canonical diffusion-based defense in the image domain. Kang et al. [27] (note: a different DiffAttack than the one of 5) and the broader adaptive-attack-on-DiffPure line demonstrate that diffusion-based defenses can be broken by gradientaware adaptive attacks that back-propagate through the full denoising chain, with segment-wise back-propagation used to bound memory. The text analogue is straightforward and unaddressed: no published adaptive attack has yet broken DiffuseDef [33] or MaskPure [17], the two main diffusion-based text purifiers, nor CoDefend [82], the corresponding multimodal-side defense. We return to this opportunity in Section 10. 4.2.5. Other Image-Side Work Two cataloged papers fit the four families above but extend rather than redefine them. Liu et al. [37] use a diffusion autoencoder to generate semantically meaningful expression-level perturbations for face-recognition privacy protection, sitting at the intersection of latent-space optimization and the face-attack subcluster. Li et al. [30] extend the original DiffAttack with bi-level routing attention and focal-loss reweighting for small features, an incremental variant of the latent-space-optimization family. We cite these works for catalog completeness but do not regard either as defining a new methodological family. Table 5 summarizes the eighteen image-classifier papers discussed in this subsection.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 12 of 30
Adversarial Diffusion Across Modalities Table 5 Diffusion-based adversarial attacks on image classifiers, face-recognition models, and object detectors (Family D). Threat column: WB white-box, GB grey-box (surrogate or encoder-only access). ✓: public code released. Reference
Venue / yr
Diffusion role
Target
Threat Dataset / key reported finding
Code
Chen et al. [5]
TPAMI 2024
ResNet, ViT, Swin, ConvNeXt
WB
ImageNet. First diffusion-based AE crafting; high transferability across CNNs and ViTs.
✓
Chen et al. [8]
NeurIPS 2023
Frozen, latent perturbation (DDIMinversion) Frozen, latent PGD (Stable Diffusion latent)
GB
AAAI 2024
Frozen, latent inpainting (identitypreserving)
ImageNet. +13–50% ASR over prior unrestricted-AE methods on undefended; +17–48% on defended. FFHQ, CelebA-HQ. Identity-preserving face-recognition attack with strong cross-backbone transfer.
✓
Liu et al. [36]
Liu et al. [37]
arXiv 2023 CVPR 2024
CelebA-HQ, FFHQ. Expression-level perturbations more natural than pixel noise. CelebA-HQ, FFHQ. Adversarial makeup transfer combining CLIP and FR losses.
✓
Sun et al. [63]
Dai et al. [11]
ECCV 2024
Diffusion autoencoder (semantic latent) Frozen, conditional latent diffusion (makeup style) Frozen, score guidance
ImageNet classifiers, including defended ArcFace, CosFace, FaceNet, IRSE, MobileFace ArcFace and similar FR backbones ArcFace, IRSE, MobileFace
WB
MNIST, ImageNet. Class-likelihood + noise-sampling adversarial guidance internalized in the score.
✓
Chen et al. [6]
ICCV 2023
WB
CIFAR-10, CelebA, ImageNet. LPIPS ∼6× lower vs GA-Attack; FID 2–3× lower; near-100% ASR.
✓
Xue et al. [74]
NeurIPS 2023
Huang and Tang [21]
arXiv 2025
Dai et al. [12]
arXiv 2025
Frozen, semantic-latent (h-space) search
Collins et al. [9]
arXiv 2025
Classifier-guided + time-travel sampling
ResNet-50, WideResNet, Inceptionv3 RobustBench top defenses (Salman’20, Wang’23) ResNet, ViT, DiffPuredefended ResNet, ViT, ArcFace; ten target models Standard classifiers + CLIP zero-shot ResNet, ViT, ConvNeXt
Jiang et al. [25]
arXiv 2025
Preference-finetuned diffusion (DPO-style)
ResNet, ViT, robust models
WB
Frozen, score guidance (𝑥0 -prediction perturb.) Frozen, score guidance + diffusion projection Frozen, posterior reweighting
GB
GB GB
✓
×
WB
ImageNet. PGD wrapped with per-step diffusion projection re-pulls perturbations onto the natural-image manifold. WB/BBImageNet, CelebA. SOTA ASR with image quality preserved; robust under DiffPure / NRP / JPEG defenses.
✓
GB
CelebA-HQ, AFHQ, ImageNet. Multi-attribute joint optimization in the deep semantic latent space.
×
GB
ImageNet (and ImageNet-A-style natural-AE distribution). Generated samples resemble naturally occurring mistakes. ImageNet. Two-stage preference-alignment framework decoupling visual quality and attack effectiveness.
×
×
×
continued on next page
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 13 of 30
Adversarial Diffusion Across Modalities Table 5 – continued from previous page Reference
Venue / yr
Diffusion role
Target
Threat Dataset / key reported finding
Code
Chen et al. [7]
arXiv 2023
Frozen, latent diffusion + EOT
WB
Object-detection benchmarks. Printable, semi-natural adversarial patches via diffusion.
×
Miao et al. [46]
arXiv 2024
Frozen, latent + Fourier perturbation
WB
Detection benchmarks. Logo-style patches mimicking brand artwork.
✓
Wang et al. [70]
arXiv 2024
WB
Neurocomputing 2025
AdvT-shirt-1K (released). Customizable T-shirt-style adversarial patches. COCO/VOC. Average detection mAP -1.52% with image-quality +1.71% over baselines.
✓
Wang et al. [68]
Frozen, null-text inversion + masked latent Frozen, per-step latent perturbation
Li et al. [30]
Applied Intelligence 2025 NeurIPS 2024
YOLO v2/v3/v5, Faster R-CNN YOLO v2/v3/v4/v4tiny/v5, Faster R-CNN, SSD Person detectors (YOLOv5/v7) YOLOv5, Faster R-CNN, DETR ResNet, ViT, Swin
ImageNet-compatible. Bi-level routing attention + focal-loss reweighting for small features.
×
CIFAR-10, ImageNet. -20% robust accuracy on CIFAR-10 (𝜖 = 8∕255); -10% on ImageNet (𝜖 = 4∕255).
×
Kang et al. [27]
Frozen, latent perturbation (extension of DiffAttack) Adaptive attack through diffusion purifier
GB
GB
DiffPureWB defended ResNet/WRN; score-based purifiers
×
4.3. Diffusion Attacks on Vision-Language Models The VLM literature is the second-largest cluster (ten papers in our catalog) but is dominated by pipeline-only uses of diffusion. We separate the cluster by diffusion role.
4.3.1. Score-Guided Diffusion Attacks on VLMs Guo et al. [19] introduce AdvDiffVLM, the first true score-guided diffusion attack against commercial VLMs. The approach uses Adaptive Ensemble Gradient Estimation to modify the score during reverse sampling and CAM-guided masks to disperse adversarial signal spatially. The targets include several open-weight VLMs as well as commercial systems including GPT-4V. Xu et al. [73] perturb the cross-attention activations of Stable Diffusion during sampling and report strong transferability across CLIP, ALBEF, TCL, and BLIP for retrieval and visual question answering (VQA) tasks; their adversarial generation is on a vision-language pretraining axis rather than a chat-VLM jailbreak axis. 4.3.2. Pipeline-Only Diffusion Attacks on VLMs A larger group of papers uses diffusion as a black-box content renderer inside a larger attack pipeline. Li et al. [31] introduce HADES, which hides harmful intent in typography, amplifies it with a Stable-Diffusion-rendered scene, and adds a pixel-space adversarial overlay; the gradient flows only through the overlay, not through the diffusion sampler. Liu et al. [39] build MM-SafetyBench, a benchmark that uses GPT-4 keyword extraction with Stable Diffusion rendering and typographic overlays to construct 5,040 image-text pairs probing thirteen unsafe scenarios. Wang et al. [66] introduce IDEATOR, a black-box jailbreak loop in which a vision-language model proposes attack ideas and a text-to-image diffusion model renders them. Ma et al. [43] (Visual-RolePlay) and Zhao et al. [81] use diffusion to render personas or target images that guide pixel-space adversarial generation against VLMs. Wang et al. [69] use a similar pipeline for instruction-tuned targeted attack. None of these papers differentiates through the diffusion sampler.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 14 of 30
Adversarial Diffusion Across Modalities
4.3.3. Diffusion-Style Universal Generators Zhang et al. [79] train a foundation-model-style additive-noise generator on LAION-400M with self-supervised contrastive pretraining, transferring across five open-source vision-language models and four commercial systems. The generator is not a pure diffusion sampler but uses diffusion-style large-scale pretraining as the basis for universal attacks. 4.3.4. Attacks on Image-to-Image Diffusion Models Zeng et al. [78] attack the safety of image-to-image diffusion pipelines by training a generator that perturbs the conditioning image so that the downstream pipeline produces not-safe-for-work (NSFW) content even with benign text prompts. This work is adjacent rather than central to the LLM-jailbreak focus of this review, but is included because it represents the symmetric problem of diffusion-as-victim on the multimodal axis. 4.3.5. VLM Cluster Critique The most striking observation about the VLM cluster is how rarely diffusion’s gradients are actually exploited. Only AdvDiffVLM [19] and the cross-attention perturbation work of Xu et al. [73] truly differentiate through (or guide the score of) a diffusion sampler. The strongest pure-jailbreak papers in this space (Visual Adversarial Examples [54], BAP [77], UMK [67]) are pixel-space PGD. The strongest cross-VLM-transfer paper (IDEATOR [66]) treats diffusion as a black-box renderer. Combining a true score-guided diffusion attack with a HarmBench-style multimodal safety evaluation is an open opportunity. Closed-VLM ASR remains a binding constraint across the cluster. Table 6 summarizes the ten VLM-cluster papers, the adjacent attack on image-to-image diffusion safety, and the multimodal-side defense referenced above. Table 6 Diffusion-based adversarial attacks on vision-language models (Family E), with one adjacent attack on image-to-image diffusion (Zeng et al. [78]) and one multimodal diffusion defense (Zhu et al. [82]) included for context. Legend as in Table 5. Reference
Venue / yr
Diffusion role
Target
Threat Dataset / key reported finding
Code
Guo et al. [19]
TIFS 2024
Frozen, score guidance (AEGE + CAM mask)
GPT-4V, Gemini, Copilot, ERNIE, MiniGPT-4, LLaVA, BLIP-2
✓
Xu et al. [73]
ACM MM 2024
CLIP, ALBEF, TCL, BLIP
Zhang et al. [79]
CVPR 2025
Frozen, cross-attention perturbation in SD Diffusion-style large-scale pretraining
Li et al. [31]
ECCV 2024 (Oral)
LLaVA-1.5, MiniGPT-4, InstructBLIP, Gemini Pro Vision, GPT-4V
Liu et al. [39]
ECCV 2024
Pipeline (typography + SD scene + adversarial overlay) Pipeline (SD render + typography) for benchmark
GB/ ImageNet-derived caption pairs. BBopen 5–10× speed-up over transfer baselines; first true score-guided diffusion attack on commercial VLMs. GB MSCOCO, Flickr30K. Strong transferability for retrieval/VQA via SD cross-attention activation perturbation. BB LAION-400M (pretraining); COCO eval. Foundation-model-style additive-noise generator transfers across commercial VLMs. WB HADES (750 prompts; 5 (over- categories). 90.26% ASR on lay) LLaVA-1.5; 71.60% on Gemini Pro Vision. BB
✓
CLIP, BLIP, BLIP-2, InstructBLIP, MiniGPT-4, plus Gemini, Claude, Copilot, GPT
LLaVA, MiniGPT-4, InstructBLIP, mPLUG-Owl, Qwen-VL, GPT-4V family
MM-SafetyBench (5,040 image-text pairs, 13 unsafe scenarios). De-facto VLM safety benchmark.
×
✓
✓
continued on next page
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 15 of 30
Adversarial Diffusion Across Modalities Table 6 – continued from previous page Reference
Venue / yr
Diffusion role
Target
Threat Dataset / key reported finding
Code
Wang et al. [66]
ICCV 2025
Pipeline (VLM ideation + diffusion render)
BB
NeurIPS 2023
Wang et al. [69]
arXiv 2023
Ma et al. [43]
arXiv 2024
Pipeline (T2I diffusion proxy + CLIP/BLIP grad) Pipeline (T2I proxy targets + LLM-generated instructions) Pipeline (T2I-rendered character)
VLJailbreakBench (3,654). 94% MiniGPT-4 (avg 5.34 queries); 46.31% GPT-4o; 19.65% Claude-3.5. GB/BB ImageNet, COCO. Targeted black-box VLM attack guided by diffusion-synthesized target images. GB MSCOCO, custom instructions. Instruction-tuning broadens transferability across diverse instructions. BB AdvBench-style harmful queries. Universal social-engineering jailbreak via diffusion-rendered personas.
✓
Zhao et al. [81]
MiniGPT-4, LLaVA, InstructBLIP, Chameleon, GPT-4o, Claude-3.5, Gemini MiniGPT-4, LLaVA, UniDiffuser, BLIP-2, Img2Prompt
Zeng et al. [78]
ICML 2025
Target: image-to-image diffusion is the victim
WB
I2P-style NSFW concept set. Bypasses Safe Latent Diffusion and adaptive defenses; subtle conditioning-image perturbations.
✓
Zhu et al. [82]
arXiv 2025
VLM-side defense (image purifier + prompt prefix)
—
Image-captioning and VQA benchmarks. Black-box-friendly defense; substantial robustness gains and transferability to unseen attacks.
×
MiniGPT-4, InstructBLIP, LLaVA LLaVA-1.6, Qwen-VL-Chat, OmniLMM, InternVL-1.5, Gemini-1.0 Pro Vision I2I latent-diffusion pipelines (SDEdit, InstructPix2Pix)
MLLMs (image captioning, VQA)
✓
✓
✓
4.4. Diffusion Large Language Models as Victims Although orthogonal to the use of diffusion as the attacker, four recent papers study what happens when diffusion LLMs are themselves the victims of an attack designed for the architecture. Wen et al. [72] introduce DIJA, which exploits the bidirectional context modeling and parallel decoding of masked diffusion LLMs through interleaved mask-text prompts. Zhang et al. [80] report that autoregressive jailbreak attacks transfer poorly to diffusion LLMs and propose attacks specifically designed for the parallel-decoding mechanism, achieving high ASR on MMaDA-class models. Li et al. [32] characterize how diffusion LLMs lose intrinsic safety when embedded in agent or structured-decoding contexts and propose a training-free defense based on stochastic remasking and block-level audit. Yamabe and Sakuma [75] show that injecting a single affirmative token at an intermediate denoising step can steer the entire generation toward harmful content, exposing a priming vulnerability specific to the iterative-denoising mechanism. These four papers are not about using diffusion to attack other LLMs, and so are out of the primary scope of this review. We include them because they identify decode-mechanic asymmetries that, in principle, could be exploited to design hybrid attackers in which a diffusion LLM serves as the generator and the asymmetric mechanic informs the attack design. Table 7 summarizes the four Family B papers discussed in this subsection.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 16 of 30
Adversarial Diffusion Across Modalities Table 7 Diffusion language models as victims of architecture-specific attacks (Family B). Threat: GF† denotes generation-flow access, in which the attacker manipulates the intermediate decoding state of the dLLM victim; this category is not directly comparable to WB/GB/BB on autoregressive targets. ✓: public code released. Reference
Venue / yr
Diffusion role
Target
Threat
Dataset / key reported finding
Code
Wen et al. [72]
ICLR 2026
dLLM as victim (interleaved mask-text prompts)
Dream-Instruct, LLaDA, MMaDA
GF
✓
Zhang et al. [80]
arXiv 2025
MMaDA-Mix, Dream, LLaDA
GF†
Li et al. [32]
ICLR 2026
Diffusion LLMs
—
Yamabe and Sakuma [75]
ICLR 2026
dLLM as victim (Multi-Point Attention Attack) dLLM-side defense (stochastic remasking) dLLM as victim (priming with affirmative tokens)
Diffusion LLMs
GF†
JailbreakBench, StrongREJECT. Up to 100% keyword ASR on Dream-Instruct; +78.5% over ReNeLLM in evaluator-based ASR. Standard jailbreak benchmarks. 97% ASR on MMaDA-Mix; AR jailbreaks transfer poorly to dLLMs. Six jailbreak attack families. Average ASR reduced from 47.9% to 14.7% with utility preserved. Standard jailbreak benchmarks. Single affirmative token at an intermediate denoising step steers entire generation.
†
✓
✓
✓
4.5. Non-Diffusion Baselines For completeness and to anchor evaluation discussion, Table 8 lists the major non-diffusion attacks against which any new diffusion-based attack should be compared. These attacks define the state of the art for adversarial-prompt search and serve as the baselines used in DiffusionAttacker, DART, and Lüdke et al. Table 8 Non-diffusion adversarial baselines used for comparison in the diffusion-attack literature. Method
Mechanism
Reference
GCG AutoDAN PAIR AdvPrompter Visual AE JailbreakInPieces FigStep BAP UMK Chameleon AE
Greedy Coordinate Gradient on adversarial suffix; white-box. Hierarchical genetic algorithm on fluent jailbreaks. Black-box attacker LLM iteratively refines prompts. Trains autoregressive attacker to emit adversarial suffixes. Pixel-space PGD on universal jailbreak image for VLMs. Compositional embedding-space attack on CLIP encoder. Typographic visual prompt jailbreak. Joint pixel-PGD and LLM-driven text refinement. Universal master-key co-optimization of image prefix and text suffix. Gradient through joint embedding for early-fusion VLMs.
Zou et al. [83] Liu et al. [38] Chao et al. [4] Paulus et al. [52] Qi et al. [54] Shayegani et al. [59] Gong et al. [18] Ying et al. [77] Wang et al. [67] Rando et al. [56]
5. Diffusion-Based Defenses for Text and Multimodal Models A small but methodologically important cluster of work uses diffusion-style processes to defend text models and multimodal models against adversarial attacks. We discuss four papers below: three target text classifiers, and one targets multimodal large language models. Collectively they form the natural evaluation backdrop for any new diffusion-based attack on the corresponding modality. This section completes the dual attacker-defender perspective adopted throughout the review. The defense literature is currently asymmetric with the attack literature: while attacks proliferate, defenses are few and none has yet been audited by an adaptive attacker that explicitly back-propagates through the purifier in the way Kang et al. [27] does on the image side. We treat this asymmetry as itself a finding (Section 8.5) and develop the corresponding adaptive-attack A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 17 of 30
Adversarial Diffusion Across Modalities
research direction in Section 10.2. In what follows, the four defenses are presented in the order in which they would form a natural target list for an adaptive-attack audit.
5.1. Mask-and-Fill Purification Li et al. [29] propose the foundational text-purification approach, which masks and refills tokens of an input text using a masked language model. The procedure is diffusion-adjacent: it implements a single-step discrete corruptionand-restoration mechanism analogous to the forward and reverse processes of a discrete diffusion model, but without an explicit multi-step iterative denoising chain. The defense improves robust accuracy under TextFooler [26], BERTAttack, and DeepWordBug on standard classification benchmarks (AG News, IMDb, Yelp, SST-2). Although not a true diffusion model, the work is the conceptual antecedent of the diffusion-based defenses that followed.
5.2. DiffuseDef Li et al. [33] introduce DiffuseDef, which inserts an embedding-space diffusion denoiser between the encoder and the classifier of a text-classification pipeline. At inference, the adversarial hidden state is combined with sampled noise and then iteratively denoised, and the denoising outputs are ensembled to produce a robust text representation. The defense is plug-and-play and can be attached to any encoder. The reported gains are state-of-the-art robust accuracy under common black-box and white-box attacks. DiffuseDef is the most explicit realization of a true diffusion-based defense for text and is the primary baseline that any diffusion-based text attack should be evaluated against.
5.3. MaskPure Gietz and Kalita [17] introduce MaskPure, a lightweight stochastic purification defense inspired by diffusion processes. Input tokens are randomly masked and refilled via a masked language model, and the procedure is repeated stochastically. The defense matches or exceeds contemporary baselines without requiring adversarial classifier training, and is computationally cheaper than full diffusion-style denoising. Together with DiffuseDef, MaskPure constitutes a second tractable target for an adaptive-attack audit (see Section 10).
5.4. Diffusion LLM Side: DiffuGuard On the diffusion-LLM-victim side, Li et al. [32] propose DiffuGuard, a training-free defense that combines stochastic annealing remasking with block-level audit and repair, mitigating the greedy-remasking bias and denoisingpath-dependence vulnerabilities of diffusion LLMs. Although the target is a different architecture, DiffuGuard shares the same defensive philosophy as DiffuseDef and MaskPure: stochastic intervention in the denoising trajectory.
5.5. Multimodal Side: CoDefend Zhu et al. [82] introduce CoDefend, the first diffusion-based defense in our catalog that targets multimodal large language models (MLLMs) rather than text classifiers. The procedure is collaborative across modalities. An image purifier built on a supervised diffusion-style denoiser takes adversarial images together with denoising instructions as input and learns to remove adversarial perturbations and restore clean inputs, while a prompt-prefix generator is jointly optimized to harden the textual side against transfer effects. The defense is black-box-friendly with respect to the protected MLLM, requires only a small set of adversarial samples for training, and the authors report substantial robustness gains plus transferability to unseen attacks across image-captioning and visual question answering (VQA) tasks. CoDefend is the natural multimodal complement to DiffuseDef and MaskPure: it carries the same stochasticintervention philosophy from the text-classifier setting into the VLM setting, and it is the most direct candidate against which any new diffusion-based VLM jailbreak should be evaluated.
6. Cross-Family Quantitative Comparison via a Five-Dimension Evaluation Framework The per-cluster discussions in Section 4 reported each paper’s results inside the family that the paper belongs to. This section steps outside that family-by-family structure and asks a different question: when the reported numbers are placed side-by-side across families, what does the attack landscape actually look like in 2024–2025? The exercise is harder than it should be, because the cataloged papers do not use a single benchmark or a single definition of attack success rate, and the form in which each paper reports its results varies even within a single family. We are explicit about both limitations below.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 18 of 30
Adversarial Diffusion Across Modalities
To support cross-paper comparison, we adopt throughout this review a five-dimension evaluation framework consisting of (i) attack success rate (ASR), reported under the source paper’s own definition (keyword-based, classifierbased, or judge-based); (ii) transferability, reported as a pairwise success-rate gradient across target models, with particular attention to the open-weight versus frontier-closed gap; (iii) query budget, reported as the number of model calls or restarts per successful attack; (iv) perplexity, reported as a proxy for input-filter evasion under perplexitybased guardrails; and (v) defense-evasion, reported as ASR retained against an explicit purifier or input filter such as DiffPure, DiffuseDef, MaskPure, CoDefend, Llama-Guard, or SmoothLLM. We apply this framework uniformly across the cataloged attacks where the source paper reports the relevant figure, and leave the cell blank where it does not. The framework is referenced in the RQ4 discussion (Section 8.4) and underpins the cluster-critique findings (Sections 4.1.5 and 4.3.5) and the open-questions agenda (Section 10.2). Table 9 consolidates the most directly comparable numbers across the principal Family A papers and a representative slice of Family E (VLM jailbreak) papers along the five framework dimensions. We use only figures explicitly reported by the authors of the respective papers and verified against the arXiv abstract, accepted-paper version, or main results section. Where a paper does not report a benchmark we leave the cell blank, and we do not impute. Cells reporting ASR follow each source paper’s own definition (keyword-based, classifier-based, or judge-based), which is not standardized across the field and which we discuss further in Section 7. Table 9 Reported ASR and related figures for principal diffusion-based attacks, organized along the five-dimension evaluation framework defined in this section. Numbers are taken verbatim from the source paper’s abstract or main results section. Empty cells denote benchmarks not reported in the source paper. Reference
Benchmark
Target model
ASR (%)
Wang et al. [65]
AdvBench, HarmBench
Red-teaming dataset; alpaca-gpt4
Lüdke et al. [42]
JailbreakBench (StrongREJECT)
Phi-4-Mini, Qwen-2.5-7B, Llama-3-8B, LAT-Llama-3-8B, Circuit Breakers, Gemma-3-1B, ChatGPT-5
not reported 90/74, 93/79, 91/77, 88/71 (WB ASRprefix /ASRGPT ); 56/49 GPT-4o, 33/21 Claude-3.5 (as rewriter) not reported dominates Pareto frontier (ASR vs cosine-sim) vs Unmodified, RL, Zero/Few-Shot, FLIRT at 𝜖=0.1 and 𝜖=0.5 2,000 restarts 100, 100, 100, (100 for 91, 93, 99, 53 ChatGPT-5) (range 53–100 across 7 targets)
seq2seq diffusion attacker with Gumbel-Softmax
Nöther et al. [50]
Llama-3-8B / Mistral-7B / Vicuna-7B / Alpaca+Safe-RLHF (transfer to GPT-4o, Claude-3.5) gpt2-alpaca, Vicuna-7B, Llama2-7B-chat-hf
Wen et al. [72]
JailbreakBench, StrongREJECT
Dream-Instruct (dLLM)
Zhang et al. [80]
Standard jailbreak benchmarks
MMaDA-Mix (dLLM)
up to 100 (keyword-based ASR) 97
not reported
+78.5% over ReNeLLM (judge-based) autoregressive jailbreaks transfer poorly
Li et al. [31]
HADES (750 prompts)
LLaVA-1.5
90.26
not reported
Li et al. [31]
HADES (750 prompts) VLJailbreakBench (3,654) VLJailbreakBench
Gemini Pro Vision
71.60
not reported
MiniGPT-4
94
LLaVA
82
avg. 5.34 queries avg. 5.34 queries
Wang et al. [66] Wang et al. [66]
Query budget
not reported
Notes
no single ASR by design; see Figure 3 of source paper
responseconditional inpainting on pretrained dLLM
SD scene + typography + overlay same setup VLM-driven jailbreak loop transfer attack continued on next page
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 19 of 30
Adversarial Diffusion Across Modalities Table 9 – continued from previous page Reference
Benchmark
Target model
ASR (%)
Query budget
Notes
Wang et al. [66]
VLJailbreakBench
InstructBLIP
88
transfer attack
Wang et al. [66]
VLJailbreakBench
Chameleon
75
Wang et al. [66]
VLJailbreakBench
GPT-4o
46.31
Wang et al. [66]
VLJailbreakBench
Claude-3.5-Sonnet
19.65
Wang et al. [67]
AdvBench (universal)
MiniGPT-4
96
avg. 5.34 queries avg. 5.34 queries avg. 5.34 queries avg. 5.34 queries not reported
Ying et al. [77]
AdvBench / HarmBench-style
Multiple VLMs
Rando et al. [56]
AdvBench-style
Chameleon
+29.03 over prior baselines (relative) 72.5
not reported not reported
transfer attack frontier closed-VLM frontier closed-VLM white-box image+text co-opt. joint pixel-PGD + LLM CoT early-fusion gradient
Two patterns deserve to be named. The first concerns the Family A papers and is the source of most of the visual heterogeneity in the table: of the four cataloged papers, only Qiu et al. truly does not report extractable ASR figures (we discussed why in Section 4.1.4). The other three do report numbers, but each in a different form. DiffusionAttacker reports paired prefix-match and GPT-judge ASRs across four open-weight targets, plus a separate black-box-transfer pair on two frontier closed models, used as a rewriter rather than a direct attacker. Lüdke et al. report per-target percentages across seven targets spanning open-weight, safety-hardened, and one closed model. DART reports a Pareto frontier of (cosine-similarity, ASR) rather than any single point, because the paper’s central methodological argument is that ASR is only meaningful when paired with a proximity measurement. The result is that apples-to-apples comparison across Family A is harder than it should be at this stage of the field, and we read it as a signal that reporting conventions for diffusion-based text attacks have not yet stabilized. The second pattern is more important. The strongest cross-VLM-transfer attacker in the catalog, IDEATOR, reports a clean gradient across target models: 94% on MiniGPT-4, 82% on LLaVA, 88% on InstructBLIP, 75% on Chameleon, then 46.31% on GPT-4o and 19.65% on Claude-3.5-Sonnet. The first four numbers come from open-weight targets; the last two come from frontier closed models. The closed models are roughly a factor of two to four harder to jailbreak under the same attacker, with the same query budget, on the same benchmark. This is the empirical anchor for the recurring weakness we flagged in Section 4.1.5: published diffusion-based attacks have not yet been put through a HarmBench-scale evaluation against the frontier closed models that defenders actually need to defend. A methodological note on what we did and did not do for this section. For papers whose abstracts do not give a single canonical ASR but whose main results section does, we extracted the figures from the main results section and verified them against the arXiv version where applicable. For papers that report Pareto-frontier or distributional results rather than point estimates (DART), we did not collapse the distribution to a single number, because doing so would misrepresent the source paper’s claim. Readers who want point estimates from these papers should consult the source figures directly; the per-paper references in Section 4.1 point to the specific figure and table identifiers.
7. Evaluation Methods and Benchmarks Across the catalog, evaluation conventions converge on a small number of datasets, metrics, and benchmarking practices. We summarize these conventions below.
7.1. Datasets Table 10 lists the most frequently used datasets across the cataloged papers, together with the count of cataloged papers that use each. ImageNet is the most-used dataset in the catalog, appearing in thirteen papers, all of them on the image-classifier side. AdvBench is the most-used text-side dataset, appearing in nine papers. The text-side benchmarks (AdvBench, HarmBench, JailbreakBench) are used by the Family A papers and by the VLM-jailbreak papers in our Family E. Face-recognition datasets (CelebA, FFHQ) are used by the face-attack subcluster. CIFAR-10 is used in the diffusion-purification-evasion subcluster.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 20 of 30
Adversarial Diffusion Across Modalities Table 10 Dataset usage across the cataloged papers. Counts reflect the number of cataloged papers in which each dataset appears as a primary evaluation set. Dataset
Predominant scope
ImageNet AdvBench CelebA COCO / MS-COCO HarmBench FFHQ JailbreakBench CIFAR-10 LAION-400M MM-SafetyBench HADES SafeBench RealToxicityPrompts
Image classifier LLM jailbreak (text) Face attack VLM, detector LLM jailbreak (text) Face attack LLM jailbreak (text) Image classifier VLM pretraining (attack) VLM safety VLM jailbreak VLM jailbreak LLM toxicity
Count 13 9 5 5 3 3 2 2 1 1 1 1 1
Reference Deng et al. [13] Zou et al. [83] Public face dataset Lin et al. [35] Mazeika et al. [44] Public face dataset Chao et al. [3] Public image dataset Public image dataset Liu et al. [39] Li et al. [31] Gong et al. [18] Gehman et al. [16]
7.2. Metrics The principal metric across the catalog is ASR, used in every paper, and it is the first dimension of the fivedimension evaluation framework introduced in Section 6. Definitions of ASR vary: keyword-based (e.g., presence of refusal phrases), classifier-based (e.g., toxicity scores from a learned classifier), and judge-based (e.g., StrongREJECT, Llama-Guard, GPT-4 as judge). Naturalness metrics include Frechet Inception Distance (FID), Learned Perceptual Image Patch Similarity (LPIPS), and Structural Similarity Index (SSIM) on the image side, and perplexity, BLEU, ROUGE, and BERTScore on the text side. Perplexity also serves as the fourth framework dimension and is the standard proxy for input-filter evasion. Transferability is reported as a pairwise success-rate matrix across target models and corresponds to the second framework dimension; the third dimension, query budget (number of model calls), is reported by black-box attacks. Diversity is reported as cluster counts or Self-BLEU on the text side. The cataloged papers do not converge on a single naturalness metric for text, which is consistent with the broader observation that no perplexity threshold has emerged as a deployment-level filter standard.
7.3. Benchmarking Practices The text-side literature benefits from standardized benchmarks. AdvBench provides 5,000 pairs of harmful behaviors and target strings; HarmBench standardizes evaluation of automated red teaming with a learned classifier; JailbreakBench provides a curated set of harmful prompts with a strong-judge protocol. The image-classifier literature has no equivalent single benchmark and instead uses dataset-specific transferability protocols (e.g., NIPS17 1k subset for ImageNet transferability). The VLM-side literature is intermediate: MM-SafetyBench, HADES, VLJailbreakBench, and SafeBench each cover distinct slices of the safety space, but no single benchmark dominates. No benchmark has been built specifically for diffusion-generated adversarial inputs, which we identify as a near-term opportunity (Section 10).
8. Analysis and Discussion This section returns to the six research questions stated in Section 2.1 and answers each one directly, drawing on the catalog material developed in Sections 4 through 7. We answer the questions in order. Where an answer is short because the catalog speaks for itself, we keep it short rather than pad it; where an answer requires nuance, we develop it in proportion to the underlying evidence.
8.1. RQ1: Current State of Diffusion-Based Adversarial Attacks on ML Systems The current state of the field is small, recent, and methodologically diverse on the LLM side, and substantially larger and more mature on the image-classifier side. The catalog contains four diffusion-attack papers on text/LLMs, four diffusion-LLM-as-victim papers, eighteen on image classifiers, ten on vision-language models, four diffusionbased defenses, and ten non-diffusion baselines. The LLM-side cluster (Family A) is the focal subject of this A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 21 of 30
Adversarial Diffusion Across Modalities
review and also its newest cluster: all four papers appeared in 2024 or 2025, and they cover four genuinely distinct attack philosophies (continuous-latent denoising with differentiable sampling [65], embedding-space perturbation under proximity constraint [50], inference-time inpainting on a pretrained masked dLLM [42], and dual-objective embedding-space training for transfer [55]). The image-side cluster (Family D) is mature and contains specific methodological recipes, namely DDIM-inversion plus latent perturbation, classifier-score guidance, and segment-wise back-propagation through purifiers, that have not yet been ported to the text setting. The dLLM-as-victim literature (Family B) is adjacent rather than primary but is growing rapidly, with four papers all appearing in 2025–2026, and we include it because hybrid attacker designs may exploit those findings. The defense side (Family C) is small, comprising three text-classifier defenses and one multimodal-LLM defense, and none has yet been broken by an adaptive diffusionbased attack in the published literature.
8.2. RQ2: Taxonomy of Diffusion Roles in Adversarial Pipelines We propose a six-class taxonomy of how diffusion is used in an adversarial pipeline: (i) trained generator, in which the diffusion model is trained end-to-end with an attack objective [50, 55, 65]; (ii) frozen pretrained sampler with latent perturbation, in which DDIM inversion plus latent-space gradient is used to attack a classifier downstream [5, 8, 36, 63]; (iii) frozen pretrained sampler with score or classifier guidance, in which an adversarial gradient term is injected into the reverse SDE at each denoising step [6, 9, 11, 12, 19, 21, 25, 74]; (iv) off-the-shelf inference, in which a pretrained diffusion language model is used without any training and without any optimization [42]; (v) pipeline-only renderer, in which diffusion produces images or scenes that are then attacked through a separate channel, with no gradient flowing through the diffusion sampler [31, 39, 43, 66, 69, 81]; and (vi) victim diffusion model, in which the diffusion model is the target of the attack rather than a component of the attacker [32, 72, 75, 78, 80]. We augment this taxonomy with a threat-model axis (white-box, grey-box, black-box, generation-flow) and a query-budget axis. The taxonomy distinguishes papers that exploit diffusion’s gradients (roles ii and iii) from those that use it as a black-box rendering step (role v), which is the methodologically significant cut.
8.3. RQ3: Formulations, Training Methods, and Optimization Strategies The cataloged papers converge on a small number of formulations and optimization techniques. On the formulation side, continuous-latent diffusion (operating on real-valued embeddings) is the dominant choice for text [50, 65] because it provides differentiable surfaces over which an attack loss can be optimized, while latent diffusion (operating in the latent space of a pretrained autoencoder) dominates the image-side literature because it inherits the strong sample quality of Stable Diffusion. Discrete diffusion (operating directly on token sequences) is conspicuously underused: no Family A paper uses a true discrete-diffusion sampler such as D3PM, SEDD, or MDLM with an adversarial training objective, and we flag this as the most tractable unfilled cell of the matrix in Section 10.2. On the training side, the catalog has accumulated a small toolkit for managing the high compute cost of backpropagation through the full reverse trajectory: segment-wise back-propagation [27] bounds memory by chunking the denoising chain; 𝑥0 -prediction surrogates [6] avoid full-trajectory gradients by attacking the predicted clean sample at each step; time-travel sampling [9] revisits earlier denoising states to refine the attack; and Gumbel-Softmax relaxation [65] makes the discrete-token sampling step at the end of a text-diffusion pipeline differentiable. Reinforcement learning, specifically PPO with a toxicity reward, provides an alternative when end-to-end differentiability is unavailable [50]. Finally, off-the-shelf inference without any training is a genuinely distinct strategy that was first operationalized at scale by Lüdke et al. [42] and that any new diffusion-based attacker on LLMs must now differentiate from, because the baseline is nearly free.
8.4. RQ4: Datasets, Metrics, and Target Models The catalog converges on a small number of benchmarks. On the text side, AdvBench (used in nine papers), HarmBench (three), and JailbreakBench (two) are the standardized choices, all supplemented by paper-specific reference-prompt sets where the attack requires a specific input distribution. On the image side, ImageNet (thirteen papers) dominates, with face-recognition datasets (CelebA in five, FFHQ in three) used by the face-attack subcluster and CIFAR-10 used in the purification-evasion subcluster. On the VLM side, MM-SafetyBench, HADES, VLJailbreakBench, and SafeBench each cover distinct slices of the safety space; no single VLM benchmark dominates. The principal metric across the catalog is ASR, used in every paper, though its operationalization is heterogeneous (keyword-based, classifier-based, or judge-based), which we identify as a recurring weakness of the field (Section 8.6). Within our five-dimension evaluation framework (Section 6), ASR is the most consistently reported dimension across A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 22 of 30
Adversarial Diffusion Across Modalities
the catalog, transferability and query budget are reported only by black-box attacks, and perplexity and defense-evasion are reported only sporadically. Naturalness is reported via FID and LPIPS on the image side and via perplexity on the text side, although no deployment-level perplexity threshold has emerged as a standard. Target-model coverage leans heavily on open-weight models. The targets that appear in five or more cataloged papers, in descending order of frequency, are GPT-4 (13), MiniGPT-4 (12), BLIP variants (11), LLaVA (10), ResNet (8), InstructBLIP (8), and ViT (7). Frontier closed models appear in 5 papers for Claude and 4 for Gemini, and the reported ASR on these models is consistently lower (Section 6). This asymmetry, namely that diffusion-based attacks are systematically evaluated on the easier targets, is the empirical anchor for one of the recurring weaknesses we identify under RQ6.
8.5. RQ5: Diffusion-Based Defenses for Text Models Four diffusion-based defenses are now in the catalog: three target text classifiers (Text Adversarial Purification [29], DiffuseDef [33], MaskPure [17]) and one targets multimodal large language models (CoDefend [82]). All four share a common philosophy of stochastic intervention in the denoising trajectory: input tokens or embeddings are corrupted with noise or masking and then refilled or denoised, with the stochasticity expected to disrupt adversarial perturbations while preserving benign content. None of the four has yet been broken by an adaptive diffusion-based attack in the published literature, which is the single most direct gap exposed by this review and which we develop into a concrete research direction in Section 10.2. The relationship between the defense literature and the attack literature is currently asymmetric. The image-side attack literature has produced segment-wise back-propagation attacks [27] that explicitly target the DiffPure defense; the text-side attack literature has produced no comparable adaptive attack against DiffuseDef or MaskPure, and the multimodal side has none against CoDefend. The defense papers therefore stand unaudited in the sense that matters most, which is whether their reported robustness gains survive an attacker who knows the defense mechanism and back-propagates through it.
8.6. RQ6: Gaps and Unaddressed Questions The catalog exposes five recurring gaps in the LLM-side literature, which we developed in detail in Section 4.1.5 and summarize here in the form RQ6 asks for. First, white-box dependency: three of the four Family A papers train against white-box gradients of the target model, leaving direct training-free attack on closed frontier models thinly populated. Second, underuse of discrete diffusion: no Family A paper combines a true discrete-diffusion sampler with an explicit harmfulness reward and a HarmBench-scale evaluation. Third, defense evasion under-evaluation: no paper benchmarks against modern input filters such as Llama-Guard [23] or SmoothLLM [57], and reported lowperplexity numbers are necessary but not sufficient evidence of filter evasion. Fourth, single-turn restriction: all four Family A papers produce single-shot adversarial prompts, even though diffusion’s natural strength (joint modeling with bidirectional conditioning) is precisely what one would want for multi-turn dialogue attacks. Fifth, constrained or topic-specific red teaming is represented by a single paper (DART), and combining DART’s proximity constraint with a true discrete-diffusion sampler is an obvious unfilled cell of the methodological matrix. Of these five gaps, we judge the most tractable to be the third (defense evasion under-evaluation), because the defenses are public, the adaptive-attack recipe is known from the image side, and the exercise produces a concrete, falsifiable empirical claim. Section 10.2 develops each of the five into a concrete research direction with an associated experimental design.
8.7. Cross-Cutting Observations Two cross-cutting observations emerge from the RQ-by-RQ analysis that do not fit any single research question. The first is that the field has bifurcated into two reframings of the adversarial-diffusion problem. The first reframing, perturb-an-input via DDIM-inversion plus latent gradient, preserves a one-to-one correspondence between input and adversarial output and is the closest analogue to classical adversarial attacks. The second, guide-from-noise via classifier or score guidance, creates novel adversarial samples and is the closer analogue to red-team prompt synthesis. The two reframings have different threat models, different compute costs, and different naturalness profiles, and we believe the field would benefit from treating them as methodologically distinct rather than as variants of a single recipe. The second cross-cutting observation is that the dLLM-as-victim literature (Family B) and the dLLM-as-attacker literature (Lüdke et al. [42] within Family A) are studying the same class of models from opposite sides, but the
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 23 of 30
Adversarial Diffusion Across Modalities
two literatures have not yet been cross-referenced in a single attacker design. A hybrid attacker that exploits decodemechanic asymmetries identified in Family B [72, 75, 80] to inform an attacker built on the dLLM-as-natural-adversary framing of Lüdke et al. [42] is a research direction we have not seen articulated in the published literature, and we develop it further in Section 10.2.
9. Limitations and Threats to Validity We structure the limitations of this review under the four standard threat-to-validity categories used in empirical software engineering and secondary-study methodology: internal validity (whether the review process itself produced reliable conclusions), external validity (whether the conclusions generalize beyond the cataloged corpus), construct validity (whether the constructs we used to classify and compare papers actually measure what we claim they measure), and conclusion validity (whether the empirical claims drawn from the catalog are warranted by the underlying evidence). For each, we identify the specific threats most relevant to the present review and the mitigations we applied.
Internal validity. The principal internal threat is that this is a narrative review with quality assessment rather than a PRISMA-compliant systematic review. The authors performed the complete screening pipeline by hand without pre-registration of the protocol and without independent dual-author blinded screening of the full candidate pool. We mitigated this in three ways. First, we made the choice explicit at the outset (Section 2) rather than implying systematicreview machinery the work does not employ. Second, we report a supplementary post-hoc agreement check between two independent LLM agents on the inclusion rule, yielding Cohen’s 𝜅 = 0.781 on the 154-record candidate pool; this is a transparency probe on the precision of the inclusion rule, not a substitute for formal inter-rater agreement, and we say so. Third, the complete screening log, including the 44 records excluded at full-text review with their exclusion reasons, is released in the companion repository, so a reader who disagrees with any single inclusion or exclusion can trace and challenge it. A secondary internal threat is that author lists, venues, and identifiers were verified against arXiv abstract pages and publisher pages but not against the printed journal proofs for every entry; for a small number of journal entries (the Springer Applied Intelligence and ScienceDirect Neurocomputing papers), full author lists were not cleanly available from public listings and we used best-available subset listings flagged with “et al.”
External validity. The principal external threat is that our coverage is bounded by the search cutoff (May 2026), and the LLM-side cluster is small enough (four papers) that a single high-impact paper appearing after the cutoff could meaningfully shift the centre of gravity of the analysis. We believe the taxonomy and the recurring-weakness analysis are robust against incremental additions, but new methodological families, for example flow-matching attacks, could require taxonomic revision. A second external threat is that the target-model coverage in the catalog leans heavily on open-weight models (GPT-4 in 13 papers, MiniGPT-4 in 12, LLaVA in 10), with frontier closed models underrepresented (Claude in 5 papers, Gemini in 4); conclusions about closed-model robustness therefore generalize less reliably than conclusions about open-weight robustness. We are explicit about this asymmetry in Section 6 when discussing the closed-VLM gap. A third external threat is geographic and venue concentration: the catalog draws heavily from NeurIPS, ICML, ICLR, CVPR, and arXiv, and is comparatively light on security venues (USENIX Security, IEEE S&P, CCS, NDSS), which means practitioner-oriented attack work that appears at security venues without an arXiv version may be under-sampled.
Construct validity. The principal construct threat concerns the taxonomy itself. Our six-class taxonomy of diffusion roles is methodological rather than capability-based, and it was developed iteratively against the catalog as the catalog grew, which means it fits the current literature well by construction. Whether it remains the right taxonomy for the next fifty papers is an open question. Some papers fit multiple categories (DiffPatch uses both null-text inversion and latent perturbation), and some recent papers (APA) introduce training paradigms such as preference alignment that are not native to any single category; we classified each paper by its dominant role and noted alternatives in the catalog, but this is a judgment call that another reviewer might make differently. A second construct threat concerns the threat-model axis. We use the standard white-box / grey-box / black-box trichotomy plus a generation-flow category for dLLM-victim attacks, but the boundary between grey-box and black-box depends on what surrogate or encoder-only access counts as “access,” and the boundary between white-box-at-training-time and black-box-at-inference (relevant for DiffusionAttacker as rewriter) does not have a single accepted convention in the field. We adopt the convention used by each source paper and flag it in the threat column. A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 24 of 30
Adversarial Diffusion Across Modalities
Conclusion validity. The principal conclusion threat is that ASR is not standardized across the cataloged papers. Three definitions coexist (keyword-based, classifier-based, judge-based), each with different sensitivity to refusal phrasing, paraphrase, and reward-hacking, and a number that is high under one definition can be substantially lower under another. We have not reweighted reported ASRs to a common definition because doing so would require rerunning each attack and would exceed the scope of a review. We mitigate this by reporting each paper’s ASR under its own definition, flagging the definition where the source paper states it, and limiting cross-paper claims to patterns visible across multiple papers and definitions (such as the closed-model gap in Section 6, which holds under both judge-based and classifier-based ASRs). A second conclusion threat concerns papers that report Pareto frontiers or per-target distributions rather than point estimates (DART, Lüdke et al., DiffusionAttacker): we did not collapse those distributions to a single number in Table 9, because doing so would misrepresent the source paper’s claim, but this means some table cells are heterogeneous in shape and a reader looking for a single comparable number will not find one in every row.
Scope clarification. For completeness, we note that the review focuses on the LLM-centric use of diffusion in adversarial pipelines. Adjacent literatures, including diffusion-based watermarking, diffusion-based data poisoning, and diffusion-based deepfake generation, are not covered. Image-side defenses (DiffPure and follow-ups) are referenced but not enumerated because they fall outside the LLM-centered scope. The dLLM-as-victim literature is included as adjacent rather than as a primary focus, which is a choice with its own trade-offs: it makes the survey more forwardlooking but means we treat four genuinely distinct attacks (Family B) at a lighter level of methodological detail than the four Family A attacks. This is a scope choice rather than a validity threat in the conventional sense, which is why we break it out as a separate paragraph.
10. Implications and Future Research Directions Section 8 characterized the state of the field; this section describes the implications of that state and the open research directions it suggests. We organize the section in four parts. First, we synthesize the central findings of the review and indicate which are most consequential for follow-on work. Second, we collect the open research questions raised by the analysis into thematic groups and frame them as opportunities for the community rather than as a prescriptive list of contributions. Third, we discuss the impact of the review on the broader LLM red teaming community. Fourth, we address the ethical implications of consolidating an attack-oriented literature into a single reference, including the choices we have made in this paper to mitigate dual-use risks.
10.1. Synthesis of Key Findings The principal finding of this review is that the LLM-side literature on diffusion-based attacks is small, recent, and methodologically diverse. Four published papers cover four distinct attack philosophies: amortized inference via offthe-shelf diffusion LLMs [42]; trained sequence-to-sequence diffusion attackers [65]; constrained-search perturbation models [50]; and substitute-classifier-guided embedding diffusion against text classifiers [55]. The image-side literature provides specific recipes (DDIM-inversion plus latent perturbation, classifier-score guidance, segment-wise backpropagation through purifiers) that have not yet been transplanted to the text setting. The vision-language-model literature is dominated by pipeline-only uses of diffusion and could benefit from the score-guided approaches developed on the image side.
10.2. Open Research Questions We organize the open questions raised by our analysis into three thematic groups. We frame these as questions for the research community rather than as a list of publishable contributions, and we note that some of these questions may already be the subject of unpublished or in-progress work at the time of reading.
Questions about defenses and adaptive evaluation. The most direct gap exposed by the catalog is that the diffusion-based purification defenses have not yet been audited by an adaptive attack that explicitly back-propagates through the purifier in the way Kang et al. [27] does on the image side. Three text-side defenses are open in this respect (DiffuseDef [33], MaskPure [17], and the foundational mask-and-fill purifier of Li et al. [29]), and the multimodalside defense CoDefend [82] is similarly unaudited. A useful research question is whether the segment-wise-backpropagation recipe transfers to text and to multimodal pipelines, and how robust accuracy of the defended models holds up under that audit. A related question is whether the foundational mask-and-fill purifier of Li et al. [29], which lacks A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 25 of 30
Adversarial Diffusion Across Modalities
an explicit multi-step diffusion process, is qualitatively easier or harder to break than the multi-step variants. CoDefend is particularly interesting because its joint image-purifier-and-prompt-prefix design suggests that an effective adaptive attack must perturb both modalities simultaneously, which is a non-trivial extension of the text-only adaptive-attack recipe.
Questions about generator design. A second cluster of questions concerns the design of the diffusion generator itself. No published paper combines a true discrete-diffusion sampler (D3PM, SEDD, or MDLM [2, 41, 60]) with an explicit harmfulness reward and a HarmBench-scale evaluation. The text analogue of Dai et al. [11]’s score-guided image attack, namely a score-guided discrete-diffusion attack on text classifiers compared against TextFooler [26] and BERT-Attack baselines, has not been published. Similarly, the proximity-constrained formulation of DART [50] could be reimplemented on top of a real masked-diffusion sampler to ask whether the proximity benefits of DART hold under a stronger generator. A further question is whether the diffusion-LLM-as-natural-adversary framing of Lüdke et al. [42] can be strengthened by reinforcement-learning fine-tuning of the dLLM with a harmfulness reward under fluency constraints, addressing the fidelity-assumption concern raised in Section 4.1.3.
Questions about transferability, evaluation, and downstream effect. A third cluster concerns evaluation. The transferability of outputs from DiffusionAttacker, DART, and Lüdke et al. [42] against frontier closed LLMs (GPT-4, Claude, Gemini) at realistic query budgets has not been systematically reported. Such a study would directly inform the practical relevance of the field. Whether perplexity-controlled diffusion attacks can pass through deploymentgrade input filters such as Llama-Guard [23] or SmoothLLM [57] is also unaddressed. Finally, the multi-turn setting is uncultivated: diffusion’s bidirectional conditioning is structurally well-suited to generating coherent adversarial dialogues with both user and assistant turns, and the absence of published work in this direction is striking. A more speculative direction concerns hybrid attackers that exploit decode-mechanic asymmetries identified in the diffusion-LLM-victim literature [72, 75, 80]. If those asymmetries partially explain a diffusion LLM’s distribution over harmful prompts, an attacker that explicitly conditions on those mechanics could outperform a generic dLLMas-natural-adversary baseline. We flag this as a research question, with the caveat that it presupposes an empirical link between victim-side and attacker-side behavior that has not been established in the published literature. A second speculative direction is joint multimodal red teaming via diffusion: combining AdvDiffVLM-style score guidance on the image side with a discrete-diffusion text attacker on the prompt side and optimizing a joint VLMjailbreak loss. No paper in the catalog has attempted this composition, and we view it as the natural bi-modal extension of the Family A line.
10.3. Impact Statement This review consolidates a fragmented literature into a single reference, supporting both attackers and defenders in the LLM red teaming community. By making the methodological vocabulary of the image-side literature accessible to text-side researchers, we lower the barrier to porting recipes that are likely to yield publishable contributions. By identifying defense-evaluation gaps (no published adaptive attack on DiffuseDef, MaskPure, or CoDefend), we provide defenders with a tractable benchmark against which to harden their systems. By cataloging the rapidly growing diffusion-LLM-as-victim literature alongside the diffusion-as-attacker literature, we make explicit a hybrid-attacker direction that has not been previously articulated. As the broader LLM safety literature continues to mature, we anticipate that diffusion-based attacks will move from a curiosity to a standard component of the red teaming toolbox, and we hope this review contributes to that trajectory in a constructive direction.
10.4. Ethical Considerations and Responsible Disclosure A review article that catalogs adversarial attacks on safety-aligned language models has dual-use implications, and we treat this explicitly rather than implicitly. Our position is that consolidating the existing literature into a single reference is net beneficial because the work surveyed is already public, and a clearer map of the area helps defenders, evaluators, and policymakers more than it helps adversaries who are willing to read several dozen papers in any case. Two specific choices reflect this position. First, we describe attack mechanisms at the level of methodological design rather than reproducing harmful prompts, model outputs, or attack code; the companion catalog likewise records mechanism summaries rather than payloads. Second, the open-research-question framing in Section 10.2 prioritizes evaluation gaps and defense-side questions before generator-design questions, on the view that improving evaluation rigor and breaking diffusion-based defenses are higher-leverage than producing a stronger generator. The cataloged A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 26 of 30
Adversarial Diffusion Across Modalities
papers themselves vary in their disclosure practices: some release code openly, some embargo, and some include explicit responsible-disclosure statements. We do not take a position here on which practice is correct, but we note that the field would benefit from a more uniform norm. We also note that any researcher building on the open questions in Section 10.2 should consider engaging with model providers ahead of public release, particularly for attacks that demonstrate non-trivial transfer to deployed closed-source systems.
11. Conclusion This review surveyed fifty published papers on the use of diffusion models in adversarial pipelines targeting machine-learning systems, with the primary focus on LLMs. We introduced a six-class taxonomy of diffusion roles that distinguishes trained generators from frozen pretrained samplers, score-guided attacks from latent-perturbation attacks, and pipeline-only uses from genuine gradient-based exploitation. We developed a five-dimension evaluation framework (ASR, transferability, query budget, perplexity, defense-evasion) and applied it uniformly across the cataloged attacks to surface the closed-frontier-model gap and the defense-audit gap. We critiqued the LLM-side literature along five axes (white-box dependency, missing frontier-model evaluation, underuse of discrete-diffusion samplers, weak defenseevasion evaluation, and absence of multi-turn formulations) and proposed concrete research directions in each axis. We covered the larger image-classifier and vision-language-model literatures as methodological background and the diffusion-LLM-victim literature as a source of hybrid-attacker design ideas. We summarized evaluation conventions across the catalog, identified the most-used datasets and metrics, and noted the absence of a benchmark specifically for diffusion-generated adversarial inputs. The principal conclusion is that the use of diffusion as a generator of adversarial text against LLMs is a young area with a small number of strong representative papers and substantial methodological room for follow-on work. Researchers entering the area can proceed along multiple complementary directions, with a research agenda that runs from defense audit through generator design to multimodal extension. We hope this review provides a useful map for that work, and a useful exercise in cross-stream information fusion for the broader community concerned with the synergism among the many disciplines contributing to adversarial machine learning.
CRediT authorship contribution statement Abrar Alotaibi: Conceptualization, Methodology, Investigation, Data Curation, Writing – Original Draft, Visualization. Moataz Ahmed: Writing – Review & Editing, Supervision, Project administration, Funding acquisition.
Acknowledgements The authors would like to acknowledge that this research is supported by a grant (No. CRPG-25-2057) under the Cybersecurity Research and Innovation Pioneers Initiative, provided by the National Cybersecurity Authority. The authors gratefully acknowledge the support received from the Saudi Data and AI Authority (SDAIA) and King Fahd University of Petroleum and Minerals (KFUPM) under the SDAIA-KFUPM Joint Research Center for Artificial Intelligence.
Data and Catalog Availability The complete search-and-screening artifact for this review is released as a public spreadsheet in the companion repository (https://github.com/AbrarAlotaibi/diffusion-redteam-llm-survey). The artifact covers every record considered, not only those retained: all 154 candidate records returned by the initial search, the titleand-abstract screening decision for each, the full-text eligibility decisions for the 94 records that advanced to that stage, and the exclusion reason for each of the 44 records excluded at full-text review. The final fifty-paper catalog of included works is recorded in the same spreadsheet alongside the four diffusion-LLM-victim entries and ten nondiffusion baselines retained for context; per-paper metadata covers scope, diffusion role, threat model, formulation, training method, datasets, metrics, target models, code link, key contribution, and principal limitation. The repository additionally includes the two LLM-agent re-screening runs used for the post-hoc agreement check reported in Section 2.3, together with the agent prompts and the per-record disagreement set on which Cohen’s 𝜅 = 0.781 was computed. A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 27 of 30
Adversarial Diffusion Across Modalities
Declaration of competing interests The authors declare no competing financial or non-financial interests.
References [1] Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al., 2023. GPT-4 technical report. doi:10.48550/arXiv.2303.08774. [2] Austin, J., Johnson, D., Ho, J., Tarlow, D., van den Berg, R., 2021. Structured denoising diffusion models in discrete state-spaces, in: Advances in Neural Information Processing Systems. doi:10.48550/arXiv.2107.03006. [3] Chao, P., Debenedetti, E., Robey, A., Andriushchenko, M., Croce, F., Sehwag, V., Dobriban, E., Flammarion, N., Pappas, G.J., Tramèr, F., Hassani, H., Wong, E., 2024. JailbreakBench: An open robustness benchmark for jailbreaking large language models. arXiv preprint arXiv:2404.01318 doi:10.48550/arXiv.2404.01318. [4] Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G.J., Wong, E., 2023. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419 doi:10.48550/arXiv.2310.08419. [5] Chen, J., Chen, H., Chen, K., Zhang, Y., Zou, Z., Shi, Z., 2024. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence doi:10.1109/TPAMI.2024.3372023. [6] Chen, X., Gao, X., Zhao, J., Ye, K., Xu, C.Z., 2023a. AdvDiffuser: Natural adversarial example synthesis with diffusion models, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). [7] Chen, X., Liu, F., Jiang, D., Yan, K., 2023b. Natural adversarial patch generation method based on latent diffusion model. arXiv preprint arXiv:2312.16401 doi:10.48550/arXiv.2312.16401. [8] Chen, Z., Li, B., Wu, S., Ding, S., Zhang, W., 2023c. Content-based unrestricted adversarial attack, in: Advances in Neural Information Processing Systems. doi:10.48550/arXiv.2305.10665. [9] Collins, M., Vice, J., French, T., Mian, A., 2025. NatADiff: Adversarial boundary guidance for natural adversarial diffusion. arXiv preprint arXiv:2505.20934 doi:10.48550/arXiv.2505.20934. [10] Cui, T., Wang, Y., Fu, C., Xiao, Y., Li, S., Deng, X., Liu, Y., Zhang, Q., Qiu, Z., Li, P., Tan, Z., Xiong, J., Kong, X., Wen, Z., Xu, K., Li, Q., 2024. Risk taxonomy, mitigation, and assessment benchmarks of large language model systems. arXiv preprint arXiv:2401.05778 doi:10.48550/arXiv.2401.05778. [11] Dai, X., Liang, K., Xiao, B., 2024. AdvDiff: Generating unrestricted adversarial examples using diffusion models, in: European Conference on Computer Vision (ECCV). doi:10.48550/arXiv.2307.12499. [12] Dai, Z., Liu, S., He, R., Wu, J., Lu, N., Fan, W., Li, Q., Tang, K., 2025. SemDiff: Generating natural unrestricted adversarial examples via semantic attributes optimization in diffusion models. arXiv preprint arXiv:2504.11923 doi:10.48550/arXiv.2504.11923. [13] Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., Fei-Fei, L., 2009. ImageNet: A large-scale hierarchical image database, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). [14] Dhariwal, P., Nichol, A.Q., 2021. Diffusion models beat GANs on image synthesis, in: Advances in Neural Information Processing Systems. doi:10.48550/arXiv.2105.05233. [15] Ganguli, D., Lovitt, L., Kernion, J., Askell, A., Bai, Y., Kadavath, S., Mann, B., Perez, E., Schiefer, N., Ndousse, K., et al., 2022. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned, in: arXiv preprint arXiv:2209.07858. doi:10.48550/arXiv.2209.07858. [16] Gehman, S., Gururangan, S., Sap, M., Choi, Y., Smith, N.A., 2020. RealToxicityPrompts: Evaluating neural toxic degeneration in language models, in: Findings of the Association for Computational Linguistics: EMNLP. doi:10.18653/v1/2020.findings-emnlp.301. [17] Gietz, H., Kalita, J., 2024. MaskPure: Improving defense against text adversaries with stochastic purification, in: Natural Language Processing and Information Systems (NLDB). doi:10.1007/978-3-031-70239-6_26. [18] Gong, Y., Ran, D., Liu, J., Wang, C., Cong, T., Wang, A., Duan, S., Wang, X., 2025. FigStep: Jailbreaking large vision-language models via typographic visual prompts, in: Proceedings of the AAAI Conference on Artificial Intelligence. doi:10.48550/arXiv.2311.05608. [19] Guo, Q., Pang, S., Jia, X., Liu, Y., Guo, Q., 2024. Efficient generation of targeted and transferable adversarial examples for vision-language models via diffusion models. IEEE Transactions on Information Forensics and Security doi:10.1109/TIFS.2024.3518072. [20] Ho, J., Jain, A., Abbeel, P., 2020. Denoising diffusion probabilistic models, in: Advances in Neural Information Processing Systems. doi:10.48550/arXiv.2006.11239. [21] Huang, C., Tang, H., 2025. ScoreAdv: Score-based targeted generation of natural adversarial examples via diffusion models. arXiv preprint arXiv:2507.06078 doi:10.48550/arXiv.2507.06078. [22] Huang, X., Ruan, W., Huang, W., Jin, G., Dong, Y., Wu, C., Bensalem, S., Mu, R., Qi, Y., Zhao, X., Cai, K., Zhang, Y., Wu, S., Xu, P., Wu, D., Freitas, A., Mustafa, M.A., 2024. A survey of safety and trustworthiness of large language models through the lens of verification and validation. Artificial Intelligence Review doi:10.1007/s10462-024-10884-2. [23] Inan, H., Upasani, K., Chi, J., Rungta, R., Iyer, K., Mao, Y., Tontchev, M., Hu, Q., Fuller, B., Testuggine, D., Khabsa, M., 2023. Llama guard: LLM-based input-output safeguard for human-AI conversations. arXiv preprint arXiv:2312.06674 doi:10.48550/arXiv.2312.06674. [24] Jabbar, M.S., Al-Azani, S., Alotaibi, A., Ahmed, M., 2025. Red teaming large language models: A comprehensive review and critical analysis. Preprint submitted to Elsevier . [25] Jiang, K., Chen, Z., Guo, H., Li, J., Fu, J., Guo, P., Tang, H., Li, B., Zhang, W., 2025. Enhancing diffusion-based unrestricted adversarial attacks via adversary preferences alignment. arXiv preprint arXiv:2506.01511 doi:10.48550/arXiv.2506.01511. [26] Jin, D., Jin, Z., Zhou, J.T., Szolovits, P., 2020. Is BERT really robust? a strong baseline for natural language attack on text classification and entailment (TextFooler). Proceedings of the AAAI Conference on Artificial Intelligence doi:10.1609/aaai.v34i05.6311.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 28 of 30
Adversarial Diffusion Across Modalities [27] Kang, M., Song, D., Li, B., 2024. DiffAttack: Evasion attacks against diffusion-based adversarial purification, in: Advances in Neural Information Processing Systems. doi:10.48550/arXiv.2311.16124. [28] Landis, J.R., Koch, G.G., 1977. The measurement of observer agreement for categorical data. Biometrics 33, 159–174. [29] Li, L., Song, D., Qiu, X., 2023. Text adversarial purification as defense against adversarial attacks, in: Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (ACL), pp. 338–350. doi:10.18653/v1/2023.acl-long.20. [30] Li, L., Zhang, X., Wang, J., et al., 2025a. DiffAttack-X: An effective transferable adversarial attack based on diffusion models. Applied Intelligence 55, 1062. doi:10.1007/s10489-025-06957-6. [31] Li, Y., Guo, H., Zhou, K., Zhao, W.X., Wen, J.R., 2024. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models, in: European Conference on Computer Vision (ECCV). doi:10.48550/arXiv.2403.09792. [32] Li, Z., Nie, Z., Zhou, Z., Liu, Y., Zhang, Y., Cheng, Y., Wen, Q., Wang, K., Guo, Y., Zhang, J., 2026. DiffuGuard: How intrinsic safety is lost and found in diffusion large language models, in: International Conference on Learning Representations (ICLR). doi:10.48550/arXiv. 2509.24296. [33] Li, Z., Zhou, H., Rei, M., Specia, L., 2025b. DiffuseDef: Improved robustness to adversarial attacks via iterative denoising, in: Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL). doi:10.48550/arXiv.2407.00248. [34] Lin, L., Mu, H., Zhai, Z., Wang, M., Wang, Y., Wang, R., Gao, J., Zhang, Y., Che, W., Baldwin, T., Han, X., Li, H., 2025. Against the achilles’ heel: A survey on red teaming for generative models. Journal of Artificial Intelligence Research doi:10.48550/arXiv.2404.00629. [35] Lin, T.Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., Zitnick, C.L., 2014. Microsoft COCO: Common objects in context, in: European Conference on Computer Vision (ECCV). [36] Liu, D., Wang, X., Peng, C., Wang, N., Hu, R., Gao, X., 2024a. Adv-diffusion: Imperceptible adversarial face identity attack via latent diffusion model, in: Proceedings of the AAAI Conference on Artificial Intelligence. doi:10.1609/aaai.v38i4.28067. [37] Liu, J., Lau, C.P., Chellappa, R., 2023. DiffProtect: Generate adversarial examples with diffusion models for facial privacy protection. arXiv preprint arXiv:2305.13625 doi:10.48550/arXiv.2305.13625. [38] Liu, X., Xu, N., Chen, M., Xiao, C., 2024b. AutoDAN: Generating stealthy jailbreak prompts on aligned large language models, in: International Conference on Learning Representations (ICLR). doi:10.48550/arXiv.2310.04451. [39] Liu, X., Zhu, Y., Gu, J., Lan, Y., Yang, C., Qiao, Y., 2024c. MM-SafetyBench: A benchmark for safety evaluation of multimodal large language models, in: European Conference on Computer Vision (ECCV). doi:10.48550/arXiv.2311.17600. [40] Liu, Y., Deng, G., Xu, Z., Li, Y., Zheng, Y., Zhang, Y., Zhao, L., Zhang, T., Wang, K., Liu, Y., 2024d. Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv preprint arXiv:2305.13860 doi:10.48550/arXiv.2305.13860. [41] Lou, A., Meng, C., Ermon, S., 2024. Discrete diffusion modeling by estimating the ratios of the data distribution (SEDD), in: International Conference on Machine Learning (ICML). doi:10.48550/arXiv.2310.16834. [42] Lüdke, D., Wollschläger, T., Ungermann, P., Günnemann, S., Schwinn, L., 2025. Diffusion LLMs are natural adversaries for any LLM. arXiv preprint arXiv:2511.00203 doi:10.48550/arXiv.2511.00203. [43] Ma, S., Luo, W., Wang, Y., Liu, X., Chen, M., Li, B., Xiao, C., 2024. Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character. arXiv preprint arXiv:2405.20773 doi:10.48550/arXiv.2405.20773. [44] Mazeika, M., Phan, L., Yin, X., Zou, A., Wang, Z., Mu, N., Sakhaee, E., Li, N., Basart, S., Li, B., Forsyth, D., Hendrycks, D., 2024. HarmBench: A standardized evaluation framework for automated red teaming and robust refusal, in: International Conference on Machine Learning (ICML). doi:10.48550/arXiv.2402.04249. [45] Mehrabi, N., Goyal, P., Dupuy, C., Hu, Q., Ghosh, S., Zemel, R., Chang, K.W., Galstyan, A., Gupta, R., 2023. FLIRT: Feedback loop in-context red teaming. arXiv preprint arXiv:2308.04265 . [46] Miao, B., Li, C., Zhu, Y., Sun, W., Wang, Z., Wang, X., Xie, C., 2024. AdvLogo: Adversarial patch attack against object detectors based on diffusion models. arXiv preprint arXiv:2409.07002 doi:10.48550/arXiv.2409.07002. [47] Nichol, A.Q., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., McGrew, B., Sutskever, I., Chen, M., 2022. GLIDE: Towards photorealistic image generation and editing with text-guided diffusion models, in: International Conference on Machine Learning (ICML). doi:10.48550/ arXiv.2112.10741. [48] Nie, S., Zhu, F., You, Z., Zhang, X., Ou, J., Hu, J., Zhou, J., Lin, Y., Wen, J.R., Li, C., 2025. Large language diffusion models (LLaDA). arXiv preprint arXiv:2502.09992 doi:10.48550/arXiv.2502.09992. [49] Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., Anandkumar, A., 2022. Diffusion models for adversarial purification, in: Proceedings of the 39th International Conference on Machine Learning (ICML). [50] Nöther, J., Singla, A., Radanović, G., 2025. Text-diffusion red-teaming of large language models: Unveiling harmful behaviors with proximity constraints, in: Proceedings of the AAAI Conference on Artificial Intelligence. doi:10.48550/arXiv.2501.08246. [51] Page, M.J., McKenzie, J.E., Bossuyt, P.M., Boutron, I., Hoffmann, T.C., Mulrow, C.D., Shamseer, L., Tetzlaff, J.M., Akl, E.A., Brennan, S.E., et al., 2021. The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. BMJ 372. doi:10.1136/bmj.n71. [52] Paulus, A., Zharmagambetov, A., Guo, C., Amos, B., Tian, Y., 2024. AdvPrompter: Fast adaptive adversarial prompting for LLMs. arXiv preprint arXiv:2404.16873 doi:10.48550/arXiv.2404.16873. [53] Perez, E., Huang, S., Song, F., Cai, T., Ring, R., Aslanides, J., Glaese, A., McAleese, N., Irving, G., 2022. Red teaming language models with language models. arXiv preprint arXiv:2202.03286 doi:10.48550/arXiv.2202.03286. [54] Qi, X., Huang, K., Panda, A., Henderson, P., Wang, M., Mittal, P., 2024. Visual adversarial examples jailbreak aligned large language models, in: Proceedings of the AAAI Conference on Artificial Intelligence. doi:10.48550/arXiv.2306.13213. [55] Qiu, S., Gou, M., Liang, T., 2024. Diffusion model for adversarial attack against NLP models, in: Proceedings of the SPIE Vol. 13105 (ICCAID 2023). doi:10.1117/12.3026312. [56] Rando, J., Korevaar, H., Brinkman, E., Evtimov, I., Tramèr, F., 2024. Gradient-based jailbreak images for multimodal fusion models. arXiv preprint arXiv:2410.03489 doi:10.48550/arXiv.2410.03489.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 29 of 30
Adversarial Diffusion Across Modalities [57] Robey, A., Wong, E., Hassani, H., Pappas, G.J., 2023. SmoothLLM: Defending large language models against jailbreaking attacks, in: arXiv preprint arXiv:2310.03684. doi:10.48550/arXiv.2310.03684. [58] Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B., 2022. High-resolution image synthesis with latent diffusion models, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). doi:10.48550/arXiv.2112.10752. [59] Shayegani, E., Dong, Y., Abu-Ghazaleh, N., 2024. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models, in: International Conference on Learning Representations (ICLR). doi:10.48550/arXiv.2307.14539. [60] Shi, J., Han, K., Wang, Z., Doucet, A., Titsias, M., 2024. Simplified and generalized masked diffusion for discrete data (MDLM). arXiv preprint arXiv:2406.04329 doi:10.48550/arXiv.2406.04329. [61] Song, J., Meng, C., Ermon, S., 2021a. Denoising diffusion implicit models, in: International Conference on Learning Representations (ICLR). doi:10.48550/arXiv.2010.02502. [62] Song, Y., Sohl-Dickstein, J., Kingma, D.P., Kumar, A., Ermon, S., Poole, B., 2021b. Score-based generative modeling through stochastic differential equations, in: International Conference on Learning Representations (ICLR). doi:10.48550/arXiv.2011.13456. [63] Sun, Y., Yu, L., Xie, H., Li, J., Zhang, Y., 2024. DiffAM: Diffusion-based adversarial makeup transfer for facial privacy protection, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). doi:10.48550/arXiv.2405.09882. [64] Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al., 2023. LLaMA 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 doi:10.48550/arXiv.2307.09288. [65] Wang, H., Li, H., Zhu, J., Wang, X., Pan, C., Huang, M., Sha, L., 2024a. DiffusionAttacker: Diffusion-driven prompt manipulation for LLM jailbreak. arXiv preprint arXiv:2412.17522 doi:10.48550/arXiv.2412.17522. [66] Wang, R., Li, J., Wang, Y., Wang, B., Wang, X., Teng, Y., Wang, Y., Ma, X., Jiang, Y.G., 2025a. IDEATOR: Jailbreaking and benchmarking large vision-language models using themselves, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). doi:10.48550/arXiv.2411.00827. [67] Wang, R., Ma, X., Zhou, H., Ji, C., Ye, G., Jiang, Y.G., 2024b. White-box multimodal jailbreaks against large vision-language models, in: Proceedings of the 32nd ACM International Conference on Multimedia (MM). doi:10.48550/arXiv.2405.17894. [68] Wang, W., Qi, H., Huang, Z., Yin, B., et al., 2025b. Latent-space diffusion models for stealthy and transferable adversarial attacks on object detection. Neurocomputing 656, 131456. doi:10.1016/j.neucom.2025.131456. [69] Wang, X., Ji, Z., Ma, P., Li, Z., Wang, S., 2023. InstructTA: Instruction-tuned targeted attack for large vision-language models. arXiv preprint arXiv:2312.01886 doi:10.48550/arXiv.2312.01886. [70] Wang, Z., Ma, X., Jiang, Y.G., 2024c. BadPatch: Diffusion-based generation of physical adversarial patches. arXiv preprint arXiv:2412.01440 doi:10.48550/arXiv.2412.01440. [71] Wei, A., Haghtalab, N., Steinhardt, J., 2023. Jailbroken: How does LLM safety training fail?, in: Advances in Neural Information Processing Systems. doi:10.48550/arXiv.2307.02483. [72] Wen, Z., Qu, J., Chen, Z., Lu, X., Liu, D., Liu, Z., Wu, R., Yang, Y., Jin, X., Xu, H., Liu, X., Li, W., Lu, C., Shao, J., He, C., Zhang, L., 2026. The devil behind the mask: An emergent safety vulnerability of diffusion LLMs, in: International Conference on Learning Representations (ICLR). doi:10.48550/arXiv.2507.11097. [73] Xu, W., Chen, K., Gao, Z., Wei, Z., Chen, J., Jiang, Y.G., 2024. Highly transferable diffusion-based unrestricted adversarial attack on pre-trained vision-language models, in: Proceedings of the 32nd ACM International Conference on Multimedia (MM). doi:10.1145/3664647.3681538. [74] Xue, H., Araujo, A., Hu, B., Chen, Y., 2023. Diff-PGD: Diffusion-based adversarial sample generation for improved stealthiness and controllability, in: Advances in Neural Information Processing Systems. doi:10.48550/arXiv.2305.16494. [75] Yamabe, S., Sakuma, J., 2026. Toward safer diffusion language models: Discovery and mitigation of priming vulnerability, in: International Conference on Learning Representations (ICLR). doi:10.48550/arXiv.2510.00565. [76] Yi, S., Liu, Y., Sun, Z., Cong, T., He, X., Song, J., Xu, K., Li, Q., 2024. Jailbreak attacks and defenses against large language models: A survey. arXiv preprint arXiv:2407.04295 doi:10.48550/arXiv.2407.04295. [77] Ying, Z., Liu, A., Zhang, T., Yu, Z., Liang, S., Liu, X., Tao, D., 2024. Jailbreak vision language models via bi-modal adversarial prompt, in: Advances in Neural Information Processing Systems. doi:10.48550/arXiv.2406.04031. [78] Zeng, Y., Cao, Y., Cao, B., Chang, Y., Chen, J., Lin, L., 2025. AdvI2I: Adversarial image attack on image-to-image diffusion models, in: International Conference on Machine Learning (ICML). doi:10.48550/arXiv.2410.21471. [79] Zhang, J., Ye, J., Ma, X., Li, Y., Yang, Y., Chen, Y., Sang, J., Yeung, D.Y., 2025a. AnyAttack: Towards large-scale self-supervised adversarial attacks on vision-language models, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). doi:10.48550/arXiv.2410.05346. [80] Zhang, Y., Xie, F., Zhou, Z., Li, Z., Chen, H., Wang, K., Guo, Y., 2025b. Jailbreaking large language diffusion models: Revealing hidden safety flaws in diffusion-based text generation. arXiv preprint arXiv:2507.19227 doi:10.48550/arXiv.2507.19227. [81] Zhao, Y., Pang, T., Du, C., Yang, X., Li, C., Cheung, N.M., Lin, M., 2023. On evaluating adversarial robustness of large vision-language models, in: Advances in Neural Information Processing Systems. doi:10.48550/arXiv.2305.16934. [82] Zhu, F., Liu, B., Hua, J., Zhong, S., 2025. CoDefend: Cross-modal collaborative defense via diffusion purification and prompt optimization. arXiv preprint arXiv:2510.11096 doi:10.48550/arXiv.2510.11096. [83] Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J.Z., Fredrikson, M., 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 doi:10.48550/arXiv.2307.15043.
A. Alotaibi and M. Ahmed: Preprint submitted to Elsevier
Page 30 of 30