Paper deep dive
The Tokens Strike Back: Safety-Aware Denoising with Directional Embedding-based Revision
Amman Yusuf, Jiwoo Shin, Ruizhi Deng, Heitor Rodrigues Guimarães, Nikita Dvornik, Mijung Park
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The Safety-Aware Denoiser (SAD) is a recent, training-free, safety-guidance framework for text diffusion models. During inference, SAD steers text samples toward safe regions of the token probability space. In this paper, we propose $\mathit{SADDER}$ (Safety-Aware Denoising with Directional Embedding-based Revision), which improves the safety and quality trade-offs of SAD by exploiting a safety-guidance signal in the embedding (or activation) space for each token position, then updating the token positions using the SAD update rule multiplied by the guidance signal. This multiplication acts as a gating mechanism: tokens with a high unsafe signal are more likely to be modified during inference following the SAD update rule. However, such an update does not automatically preserve the conditional mean, i.e., the denoiser of a fixed target distribution. We therefore theoretically derive new position-wise target distributions for which the modified denoiser is exact. Furthermore, we derive conditions under which the position-wise target distributions match a global target distribution. We test our $\mathit{SADDER}$ method on popular Masked Diffusion Language Models (MDLMs) and Uniform-State Diffusion Models (USDMs) across unsafe continuation and jailbreak settings, and show that $\mathit{SADDER}$ achieves a better balance between safety, generation quality, and inference cost than existing methods.
Tags
Links
- Source: https://arxiv.org/abs/2610.17636v1
- Canonical: https://arxiv.org/abs/2610.17636v1
Trouble viewing inline? Open PDF directly →
Full Text
161,590 characters extracted from source content.
Expand or collapse full text
The Tokens Strike Back: Safety-Aware Denoising with Directional Embedding-based Revision Amman Yusuf Affiliation: Department of Computer Science, University of British Columbia, Canada Email: ammany01@cs.ubc.ca Jiwoo Shin Affiliation: Korea Advanced Institute of Science and Technology (KAIST), South Korea Ruizhi Deng Affiliation: RBC Borealis, Canada Heitor Rodrigues Guimarães Affiliation: RBC Borealis, Canada Nikita Dvornik Affiliation: RBC Borealis, Canada Mijung Park Affiliation: Department of Computer Science, University of British Columbia, Canada Abstract The Safety-Aware Denoiser (SAD) is a recent, training-free, safety-guidance framework for text diffusion models. During inference, SAD steers text samples toward safe regions of the token probability space. In this paper, we propose SADDER (Safety-Aware Denoising with Directional Embedding-based Revision), which improves the safety and quality trade-offs of SAD by exploiting a safety-guidance signal in the embedding (or activation) space for each token position, then updating the token positions using the SAD update rule multiplied by the guidance signal. This multiplication acts as a gating mechanism: tokens with a high unsafe signal are more likely to be modified during inference following the SAD update rule. However, such an update does not automatically preserve the conditional mean, i.e., the denoiser of a fixed target distribution. We therefore theoretically derive new position-wise target distributions for which the modified denoiser is exact. Furthermore, we derive conditions under which the position-wise target distributions match a global target distribution. We test our SADDER method on popular Masked Diffusion Language Models (MDLMs) and Uniform-State Diffusion Models (USDMs) across unsafe continuation and jailbreak settings, and show that SADDER achieves a better balance between safety, generation quality, and inference cost than existing methods. 1 Introduction Diffusion models have achieved state-of-the-art performance across a wide range of domains, including images (Rombach et al., 2022), speech (Popov et al., 2021), and protein structure generation (Wu et al., 2024). In language modeling, however, autoregressive large language models (AR-LLMs) remain the dominant approach, demonstrating strong capabilities in language generation and understanding, mathematical reasoning (Yang et al., 2024), and coding (Li et al., 2023). Despite their success, AR models generate text one token at a time, which inherently limits inference parallelism and makes revising previously generated content less natural. Recent advances in Text Diffusion Models (TDMs) offer an alternative paradigm, in which text is generated through an iterative denoising process that can update multiple token positions and progressively refine the generated sequence (Sahoo et al., 2024; Nie et al., 2025). Moreover, at comparable model scales, recent TDMs have also shown competitive performance with AR-LLMs across benchmarks; For instance, Stable-DiffCoder-8B (Fan et al., 2026) vs. Seed-Coder-8B (ByteDance Seed et al., 2025) on code generation benchmarks, and LLaDA-8B (Nie et al., 2025) vs. LLaMA3-8B (Grattafiori et al., 2024) on mathematical reasoning tasks. Despite these advantages, the safety of TDMs remains relatively underexplored compared to AR-LLMs, particularly with respect to toxic content generation and vulnerability to jailbreak attacks. Traditional safety mechanisms rely on fine-tuning and alignment (Dai et al., 2024), post-hoc filtering and rejection sampling (Naveed et al., 2025), or inference-time methods that modify the decoding strategy during next-token prediction (Xu et al., 2024). However, these approaches either require additional training or assume AR decoding and therefore do not directly generalize to TDMs. Recent work has begun exploring inference-time mechanisms specifically designed for TDMs, including particle-based steering (Singhal et al., 2025), classifier-based guidance (Schiff et al., 2025), and safety-oriented remasking approaches (Lee and Han, 2026). In particular, the Safety-Aware Denoiser (SAD) (Yusuf et al., 2026) provides a training-free framework to steer the denoising trajectory towards a safe region in the data distribution using only a small set of 500∼1000500 1000 unsafe reference samples. Nevertheless, SAD operates in token probability space, leaving open whether semantically richer model representations could enable more effective, position-specific safety guidance. In this work, we propose SADDER (Safety-Aware Denoising with Directional Embedding-based Revision), a safety-guidance method that augments SAD with position-wise signals extracted from the model’s embedding space. At each denoising step, we first identify potentially unsafe token positions based on a safety-guidance signal in the embedding (or activation) space. We then use this information in a second step to modulate the SAD update, enabling more precise, position-by-position interventions along the sampling trajectory. By selectively modifying fewer positions, SADDER achieves a better balance between safety, generation quality, and inference cost than existing methods, when tested on popular Masked Diffusion Language Models (MDLMs) and Uniform-State Diffusion Models (USDMs) across unsafe continuation and jailbreak settings. 2 Background We first describe two ingredients our method builds on: masked and uniform-state TDMs in Section 2.1, whose samplers differ in whether a committed token can still be changed in the subsequent denoising steps; and SAD in Section 2.2, the inference-time guidance framework that our method extends. 2.1 Text Diffusion Models A TDM corrupts a clean token sequence 01:L x_0^1:L of length L with a fixed forward process and learns to reverse it. Tokens come from a vocabulary V of size K and are represented as one-hot vectors, so a distribution over tokens is a vector in the simplex ΔK ^K. Cat(∣)Cat( x π) denotes the categorical distribution with probability vector π. We write tl x_t^l for the token at position l and normalized diffusion time t∈[0,1]t∈[0,1]. Let αt∈[0,1] _t∈[0,1] denote a noise schedule that decreases strictly in t with α0≈1 _0≈ 1 and α1≈0 _1≈ 0. We discretize the diffusion time interval using a decreasing grid 1=t0>t1>⋯>tT=01=t_0>t_1>·s>t_T=0 where T is the number of reverse sampling steps. At iteration j∈0,…,T−1j∈\0,…,T-1\, the sampler transitions from tj1:L x_t_j^1:L to tj+11:L x_t_j+1^1:L. Masked diffusion language models (MDLMs). MDLMs (Sahoo et al., 2024; Nie et al., 2025; Ye et al., 2025) add a mask token with one-hot vector M, so states live in 0,1K+1\0,1\^K+1; the network below never predicts the mask, so its outputs stay in ΔK ^K. In the forward process, each position transitions to the mask independently and, once masked, stays masked: qt(tl∣0l)=Cat(tl∣αt0l+(1−αt)), q_t( x_t^l x_0^l)=Cat ( x_t^l _t x_0^l+(1- _t)\,M ), (1) i.e., the token is kept with probability αt _t and masked with probability 1−αt1- _t. The reverse process runs from the all-mask sequence back to t=0t=0; its transitions are the forward posterior q(sl∣tl,0l)q( x_s^l x_t^l, x_0^l) with the unknown clean token replaced by the prediction of a denoising network x_ θ, which reads the whole noised sequence and outputs a distribution over the clean token at every position, :(∪)L×[0,1]⟶(ΔK)L, x_ θ:(V∪\M\)^L×[0,1] ( ^K)^L, (2) with ,l(t1:L,t)∈ΔK x_ θ,l( x_t^1:L,t)∈ ^K the output at position l. Given t1:L x_t^1:L, the transition to an earlier level s<ts<t factorizes across positions, with p(sl∣t1:L)=δtl(sl),tl≠,Cat(sl|(1−αs)+(αs−αt),l(t1:L,t)1−αt),tl=. p_ θ( x_s^l x_t^1:L)= cases _ x_t^l( x_s^l),& x_t^l ,\\ Cat\! ( x_s^l\, |\, (1- _s)\,M+( _s- _t)\, x_ θ,l( x_t^1:L,t)1- _t ),& x_t^l=M. cases (3) Under equation 3, a revealed position is copied, and a masked position is revealed at random with probability (αs−αt)/(1−αt)( _s- _t)/(1- _t), its token drawn from ,l x_ θ,l. The samplers of LLaDA and Dream differ from equation 3 only in how they choose which masked positions to reveal (Nie et al., 2025; Ye et al., 2025). Remasking samplers (Wang et al., 2025) additionally return revealed positions to m so that they are predicted again. Uniform-state diffusion models (USDMs). USDMs (Sahoo et al., 2025; Sahoo et al., 2026; DiffusionGemma Team, 2026) go a step further: they have no mask token, and any token can change at any step, which Sahoo et al. (2026) credit with self-correction and better guided generation. In the forward process, a token is kept with probability αt _t and otherwise replaced by one drawn uniformly from the vocabulary, qt(tl∣0l)=Cat(tl∣αt0l+(1−αt)1K), q_t( x_t^l x_0^l)=Cat ( x_t^l _t x_0^l+(1- _t)\, 1K1 ), (4) with 1 the all-ones vector. The reverse kernel is again the forward posterior with 0l x_0^l replaced by the prediction; with αt|s=αt/αs _t|s= _t/ _s, it is given by qs|t(sl|tl,l) q_s|t( x_s^l| x_t^l, x_ θ^l) =Cat(sl|Kαttl⊙l+(αt|s−αt)tlKαt⟨tl,l⟩+1−αt+(αs−αt)l+(1−αt|s)(1−αs)/Kαt⟨tl,l⟩+1−αt), = Cat ( x_s^l| K _t x_t^l x_ θ^l+( _t|s- _t) x_t^lK _t x_t^l, x_ θ^l +1- _t+ ( _s- _t) x_ θ^l+(1- _t|s)(1- _s)1/KK _t x_t^l, x_ θ^l +1- _t ), (5) where ⊙ denotes the Hadamard product between two vectors and l=,l(t1:L,t) x_ θ^l= x_ θ,l( x_t^1:L,t) is given by the pretrained model. Every entry of this vector can be positive, which is what lets any token change at any step. 2.2 The Safety-Aware Denoiser The safety-aware denoiser (SAD) (Yusuf et al., 2026) is a training-free guidance method that steers a pretrained TDM away from a negation set of sequences that should not be generated. It adapts the safe denoiser of Kim et al. (2025), later extended to flow matching (Kim et al., 2026), by replacing the Gaussian corruption kernel with the categorical kernels equation 1 and equation 4. Safe Denoiser. Assume the training data D split into safe and unsafe sets, =safe∪unsafeD=D_safe _unsafe with |safe|≫|unsafe||D_safe| |D_unsafe|. Restricting pdatap_data to each set gives psafep_safe and punsafep_unsafe, and running the forward process from pdatap_data, psafep_safe, and punsafep_unsafe defines the data, safe, and unsafe denoisers [0∣t]E_D[ x_0 x_t], safe[0∣t]E_D_safe[ x_0 x_t], and unsafe[0∣t]E_D_unsafe[ x_0 x_t], which are related as follows. Theorem 2.1 (Theorem 3.2 in Kim et al. (2025)). There exists a nonnegative weight β∗(t)β ( x_t), monotone in the posterior likelihood that t x_t originates from the unsafe set, such that safe[0∣t]=[0∣t]+β∗(t)([0∣t]−unsafe[0∣t]). _D_safe[ x_0 x_t]=E_D[ x_0 x_t]+β ( x_t)\, (E_D[ x_0 x_t]-E_D_unsafe[ x_0 x_t] ). (6) Thm. 2.1 states that by subtracting “unsafe” components from the data denoiser, with β∗β adapting to how unsafe the current state is, we can provably generate samples from the safe denoiser. A pretrained model provides the data denoiser, so only the unsafe denoiser and β∗β remain. SAD. For a TDM, the data denoiser is simply the pre-trained model’s output, [0l∣t1:L]=,l(t1:L,t)E_D[ x_0^l x_t^1:L]= x_ θ,l( x_t^1:L,t), since the mean of a categorical variable is its probability vector; the relation is exact for the ideal denoiser, which x_ θ approximates. The unsafe denoiser is approximated by Monte Carlo over a negation set, unsafe=0(n)n=1ND_unsafe=\ x_0^(n)\_n=1^N: ^unsafe[0∣t]=∑n=1N0(n)qt(t∣0(n))∑m=1Nqt(t∣0(m)), E_D_unsafe[ x_0 x_t]= _n=1^N x_0^(n)\, q_t( x_t x_0^(n)) _m=1^Nq_t( x_t x_0^(m)), where qt(t∣0(n))=∏l=1Lqt(tl∣0(n),l)q_t( x_t x_0^(n))= _l=1^Lq_t( x_t^l x_0^(n),l) is the sequence kernel from equation 1 or equation 4, a product because positions are noised independently. The precise definition of the weight is β∗(t)=Zunsafepunsafe,t(t)/(Zsafepsafe,t(t))β ( x_t)=Z_unsafe\,p_unsafe,t( x_t)/ (Z_safe\,p_safe,t( x_t) ) (Kim et al., 2025, Appendix A), where psafe,tp_safe,t and punsafe,tp_unsafe,t are the marginal distributions of the forward process at level t started from the safe and the unsafe distribution, and ZsafeZ_safe and ZunsafeZ_unsafe are the normalizing constants of the two restricted densities. Unfortunately, directly computing β∗(t)β ( x_t) is intractable: the denominator requires qt(t∣0)q_t( x_t x_0) over all safe data, roughly most of the training set, at every sampling step. SAD approximates β∗(t) β ( x_t) ≈ηβ(t), ≈η\,β( x_t), using an unbiased estimate of β(t)β( x_t) and a hyperparameter η to replace the remaining terms of β∗β . β(t) β( x_t) =∫punsafe(0)qt(t∣0)d0≈1N∑n=1Nqt(t∣0(n)). = p_unsafe( x_0)\,q_t( x_t x_0)\,d x_0≈ 1N _n=1^Nq_t( x_t x_0^(n)). (7) Because SAD approximates β∗β this way, the SAD implementation offers no theoretical safety guarantees on generated data, unlike what the theory in Thm. 2.1 promises. Prior work shows that such guidance must be strong early in sampling and fade later, or it degrades sample quality (Kim et al., 2025; Kim et al., 2026; Kirchhof et al., 2025); SAD therefore keeps η at a nonzero constant over a window C of critical timesteps at the start of the reverse process and sets η=0η=0 outside it. 3 Methods: SADDER SAD provides safety guidance in the token probability space. We can enhance this guidance by selecting a guidance signal in the embedding (or activation) space for each token position, then modifying the selected token positions using the SAD update rule. In what follows, we introduce SADDER (Safety-Aware Denoising with Directional Embedding-based Revision), consisting of two phases. 3.1 First Phase: Selecting Risky Positions. The goal of the first phase is to create a gating mechanism which tells us which token positions need to be modified. Inspired by (Lee and Han, 2026), we propose accessing TDM’s internal embedding space to obtain this information. For each sample i, we denote i c_i as a given prompt and iharm x_i^harm, isafe x_i^safe as two corresponding harmful and safe responses for i c_i, respectively. We denote PiP_i = |i|| c_i| as the prompt length and Riharm=min(|iharm|,M)R_i^harm= (| x_i^harm|,M) the response length after truncation of M tokens. Similarly, Risafe=min(|isafe|,M)R_i^safe= (| x_i^safe|,M). Let k,l(⋅)∈ℝd h_k,l(·) ^d be the layer-k hidden representation at position l. k,l(t)(⋅) h_k,l^(t)(·) denotes the layer-k’s hidden state for position l at timestep t. We extract hidden states and compute the average representations over response tokens: ¯i,kharm=1Riharm∑l=Pi+1Pi+Riharmk,l(i⊕iharm),¯i,ksafe=1Risafe∑l=Pi+1Pi+Risafek,l(i⊕isafe) h_i,k^harm= 1R_i^harm _l=P_i+1^P_i+R_i^harm h_k,l( c_i x_i^harm), h_i,k^safe= 1R_i^safe _l=P_i+1^P_i+R_i^safe h_k,l( c_i x_i^safe) (8) We arrive at the (normalized) layer-wise difference in the semantic representations of harmful and safe responses, ^k v_k, by averaging over the examples i: ^k v_k =¯kharm−¯ksafe‖¯kharm−¯ksafe‖2, = h_k^harm- h_k^safe\| h_k^harm- h_k^safe\|_2, (9) where ¯kharm=1Nharm∑i¯i,kharm h_k^harm= 1N_harm _i h_i,k^harm, and ¯ksafe=1Nsafe∑i¯i,ksafe h_k^safe= 1N_safe _i h_i,k^safe. Intuitively, we want to intervene on the token location only when the hidden state at time t is closer to the average harmful representations than to the average safe representations: ‖k,l(t)−¯kharm‖22<‖k,l(t)−¯ksafe‖22. \| h_k,l^(t)- h_k^harm\|_2^2<\| h_k,l^(t)- h_k^safe\|_2^2. (10) Using a midpoint k=¯kharm+¯ksafe2 m_k= h_k^harm+ h_k^safe2, a simple linear algebraic manipulation gives us the following equivalence: ‖k,l(t)−¯kharm‖22<‖k,l(t)−¯ksafe‖22⟺⟨k,l(t)−k,^k⟩>0 \| h_k,l^(t)- h_k^harm\|_2^2<\| h_k,l^(t)- h_k^safe\|_2^2\; \; h_k,l^(t)- m_k, v_k >0 (11) See Section A.2 for the derivation. Unlike (Lee and Han, 2026), we use the centred score to decide whether this particular position will lead to harmful generation: sk,l(t):=⟨k,l(t)−k,^k⟩.s_k,l^(t):= h_k,l^(t)- m_k,\; v_k . (12) Geometric meaning of equation 12: The set of k,l(t) h_k,l^(t) that satisfies ⟨k,l(t)−k,^k⟩=0 h_k,l^(t)- m_k, v_k =0 is the hyperplane, in which every vector k,l(t)−k h_k,l^(t)- m_k is orthogonal to the direction ^k v_k. Any k,l(t) h_k,l^(t) that satisfies ⟨k,l(t)−k,^k⟩>0 h_k,l^(t)- m_k, v_k >0 lies on the side of this hyperplane containing ¯kharm h_k^harm. On the contrary, any k,l(t) h_k,l^(t) that satisfies ⟨k,l(t)−k,^k⟩<0 h_k,l^(t)- m_k, v_k <0 lies on the side of this hyperplane containing ¯ksafe h_k^safe. The tokens that have positive scores, through the following gating mechanism: ak,l(t)←sk,l(t)>0,a_k,l^(t)← 1_s_k,l^(t)>0, (13) where 1 is an indicator function that returns the binary11 1 One can also use the softened score for more refined guidance across positions. However, this approach did not empirically outperform simple gating in equation 13. See Appendix J.2 for comparisoin. gating values: ak,l(t)∈0,1a_k,l^(t)∈\0,1\. Algorithm 1 SADDER: selective SAD guidance. 1: Input: denoiser pθp_θ; unsafe dataset unsafeD_unsafe; ^k,k v_k, m_k; initial state t0 x_t_0; editable positions G; time steps t0>⋯>tT=0t_0>·s>t_T=0; intervention steps C; strength η. 2: for j=0,…,T−1j=0,…,T-1 do 3: Set t←tjt← t_j. Obtain p,t,⋅p_D,t,· and k,⋅(t) h_k,·^(t) from one model evaluation on t x_t. 4: Initialize p~0|t,l←p,t,l p_0 t,l← p_D,t,l and ak,l(t)←0a_k,l^(t)← 0 for all l. 5: if j∈Cj∈ C then 6: if MDLMs then ℳt←l∈:tl=M_t←\l : x_t^l=M\ 7: if USDMs then ℳt←1,…,LM_t←\1,…,L\ . 8: Compute sk,l(t)←⟨k,l(t)−k,^k⟩s_k,l^(t)← h_k,l^(t)- m_k, v_k for l∈ℳtl _t. 9: Select Risky Positions: ak,l(t)←sk,l(t)>0a_k,l^(t)← 1\s_k,l^(t)>0\ for l∈ℳtl _t. 10: if at least one gate equals 11 then 11: Estimate unsafe[0l|t1:L]E_D_unsafe[ x^l_0| x^1:L_t] and β(t)β( x_t) on the current state 12: SAD On Selected Positions: Compute Sadder Denoiser in equation 14. 13: end if 14: end if 15: tj+1←Solver(t,tj,tj+1,Sadder Denoiser,) x_t_j+1 ( x_t,t_j,t_j+1, Sadder Denoiser;G). 16: end for 17: Return: the generated continuation of tT x_t_T. 3.2 Second Phase: SAD on Selected Positions In the first phase, we select which position is aligned with the harmful direction in the embedding space. In the second phase, we modify the sampling trajectory of the selected ones using the SAD denoiser formulation, given by Sadder Denoiser:=∏l=1L[[0l|t1:L]+ηβ(t)ak,l(t)([0l|t1:L]−unsafe[0l|t1:L])] Sadder Denoiser:= _l=1^L [E_D[ x^l_0| x^1:L_t]+η\,β( x_t)a_k,l^(t) (E_D[ x^l_0| x^1:L_t]-E_D_unsafe[ x^l_0| x^1:L_t] ) ] (14) where β(t)β( x_t) is defined in equation 7 and η is a controllable hyperparameter that changes the strength of the guidance as in SAD. Similar to SAD, the data denoiser at position l is [0l|t1:L]E_D[ x^l_0| x^1:L_t] and the unsafe denoiser at position l is approximated by unsafe[0l|t1:L]≈∑n∈unsafenlqt(t|nl)∑m∈unsafeqt(t|ml). _D_unsafe[ x^l_0| x^1:L_t]≈ _ x_n _unsafe x^l_n\; q_t( x_t| x^l_n) _ x_m _unsafeq_t( x_t| x^l_m). (15) Algorithm 1 summarizes our algorithm. 3.3 Theoretical analyses of SADDER In Safe Denoiser, equation 6 provides an identity of conditional expectations under a particular safe/unsafe partition, while, in the implementation of SAD, this quantity is approximated by a well-tuned hyperparameter η. A freely chosen position-dependent gate at l in SADDER also changes that identity, as in SAD. In the following theorem, we formally derive under what condition this new target denoiser is a position-wise safe denoiser. Theorem 3.1 (Characterization of an exact position-wise safe denoiser). Given a data denoiser from a pre-trained diffusion model, an unsafe denoiser in equation 15, and the intervention strength: ηβ(t)ak,l(t)ηβ( x_t)a_k,l^(t), the the position-l factor of the SADDER Denoiser in equation 14 is exactly the conditional mean under the position-wise safe target distribution safe(l)D_safe^(l): safe(l)[0l∣t1:L]=[l0|1:Lt]+ηβ(t)ak,l(t)([l0|1:Lt]−unsafe[l0|1:Lt]) E_D_safe^(l)\! [ x_0^l x_t^1:L ]=E_D[ x^l_0| x^1:L_t]+ηβ( x_t)a_k,l^(t) (E_D[ x^l_0| x^1:L_t]-E_D_unsafe[ x^l_0| x^1:L_t] ) (16) if the activation strength is calibrated to the posterior unsafe odds according to ηβ(t)ak,l(t)=πt,l(t1:L)1−πt,l(t1:L),ηβ( x_t)a_k,l^(t)= _t,l( x_t^1:L)1- _t,l( x_t^1:L), (17) where the posterior probability of the position-l being unsafe is denoted by πt,l(t1:L):=[ψl(01:L)∣t1:L] _t,l( x_t^1:L):=E_D\! [ _l( x_0^1:L) x_t^1:L ], and the unsafety is measured by an oracle function denoted by ψl:L⟶[0,1] _l:V^L [0,1], satisfying ψl(01:L)+(1−ψl(01:L))=1 _l( x_0^1:L)+(1- _l( x_0^1:L))=1 for any clean sequence 01:L x_0^1:L. See Section A.4 for proof. Remark 1. Thm. 3.1 characterizes our algorithm, SADDER, in terms of a position-wise safe-denoiser guarantee, rather than asserting that the exact membership function ψ is available at inference. However, it identifies the quantity that the activation gate should approximate: the posterior expected unsafe membership of clean sequences compatible with the current noised state. In practice, the centred activation score is a surrogate for this quantity without formal guarantees, like β∗(t)β^*( x_t) was approximated by ηβ(t)ηβ( x_t) in SAD; the resulting SADDER denoiser is also approximate. The position-specific target distribution psafe(l)p_D_safe^(l) for each position l, stated in Thm. 3.1, may differ for each l: psafe(1),⋯,psafe(L)p_D_safe^(1),·s,p_D_safe^(L) Hence, a natural next question is whether there exists one clean-sequence distribution psafeglobal(01:L)p_D_safe^global( x_0^1:L), such that simultaneously for every l, it satisfies safeglobal(0l|t1:L)=safe(l)(0l|t1:L)E_D_safe^global( x_0^l| x_t^1:L)=E_D_safe^(l)( x_0^l| x_t^1:L). Thm. A.1 states this formally. 4 Related Work Activation steering and remasking. Contrastive Activation Addition (Rimsky et al., 2024) steers language models using directions extracted from paired examples; ILRR (Avrahami and Nachmani, 2026) guides masked diffusion by aligning activations with a reference sequence. For safety, DiffuGuard (Li et al., 2025) combines stochastic remasking with block-level audit and repair. Most closely related, Lee and Han (2026) construct paired samples (xi,yiharm,yisafe)(x_i,y_i^harm,y_i^safe), using harmful model responses to WildJailbreak prompts (Jiang et al., 2024) and paraphrased refusals. They estimate a Contrastive Safety Direction (CSD), vℓv_ , from the difference between the mean harmful and safe response representations. In Phase 1, they modify hidden states at masked and prompt positions during the first fraction ρ of the denoising steps: (hℓ,j(t))=hℓ,j(t)−β⟨hℓ,j(t),v^ℓ⟩v^ℓ,S(h_ ,j^(t))=h_ ,j^(t)-β\, h_ ,j^(t), v_ v_ , where v^ℓ v_ is the normalized CSD and β controls the intervention strength. In Phase 2, they refine the generated sequence by selecting positions according to mj(k)=⟨hℓ,j(k),v^ℓ⟩>θ,m_j^(k)= 1\! \ h_ ,j^(k), v_ >θ \, then remasking and regenerating those positions for up to K refinement iterations, stopping early if no positions exceed the threshold. SADDER uses a similar contrastive direction, but centers the activation score at the midpoint of the harmful and safe representations. This places the zero-score boundary at their Euclidean bisector. The score gates SAD’s correction in token probability space rather than directly modifying hidden states; in masked models, it also ranks revealed positions for budgeted remasking within the denoising loop. Sampling-based baselines. Best-of-N sampling generates independent candidate completions and selects the one with the highest reward. FK steering (Singhal et al., 2025) instead maintains multiple diffusion trajectories and resamples them at intermediate steps using reward-derived potentials. Both provide inference-time control without retraining the generator. SADDER modifies token predictions within each trajectory, using unsafe references and activation scores rather than ranking candidate sequences. Comparisons with Best-of-N and FK steering assess whether this local intervention offers a better safety–quality tradeoff at a given inference budget. Diffusion-specific jailbreaks. DIJA (Wen et al., 2026) constructs interleaved text–mask prompts that exploit bidirectional context and parallel decoding to elicit harmful completions. PAD (Zhang et al., 2025) adapts affirmative-response priming to parallel generation through a multi-point attention attack. These attacks expose vulnerabilities associated with diffusion’s generation process and motivate evaluating safety guidance on adversarially structured inputs as well as ordinary unsafe continuation. We include all in our evaluation of selective guidance and token revision. 5 Experiments We ask whether selective guidance improves the safety–quality tradeoff of SAD, and whether its benefits transfer from unsafe continuation to adversarial instructions. Following Yusuf et al. (2026), we evaluate these tasks separately. The main continuation results distinguish SADDER from SADDER with a full-SAD warm-up. Other variants, calibration sweeps, and the extended algorithm are reported in Appendix E. 5.1 Unsafe continuation on Masked Diffusion Language Models (MDLMs) Setting and metrics. We evaluate LLaDA-8B-Base Nie et al. (2025) and Dream-7B-Base Ye et al. (2025) on 600 unsafe prompts per dataset from RealToxicityPrompts (RTP) Gehman et al. (2020) and BeaverTails (BT) Ji et al. (2023), generating 32 tokens in 32 steps. Baselines are unmodified sampling, full SAD, adapted CSD† (Lee and Han, 2026), best-of-eight (BoN-8), and eight-particle FK steering (Singhal et al., 2025). SADDER + warm-up applies full SAD on steps 0–7 and selective guidance on steps 8–15. Evaluation prompts were held out from development; later hyperparameter selection uses a separate 300-prompt development set (Appendix E). Safety is the Llama-Guard-3-8B Meta (2024) unsafe rate. Harmful PPL is GPT-2-large (Radford et al., 2019) corpus perplexity over all outputs to harmful prompts, including safe outputs. Benign BERT (BERTScore F1 ×100× 100) and Benign PPL use 600 benign RTP prompt–continuation pairs, retaining each method’s safety-selected settings and reference set. NFE counts generator forward evaluations, excluding reward scoring and one-time reference encoding. Table 1: LLaDA-Base safety, generation quality, and cost. Entries use AbA_b, where A is the mean and b is one sample standard deviation across three generation seeds. For percentages, SDs are in percentage points. NFE shows average cost. Method RTP BeaverTails Unsafe % ↓ Harmful PPL ↓ Benign PPL ↓ Benign BERT ↑ NFE Unsafe % ↓ Harmful PPL ↓ Benign PPL ↓ Benign BERT ↑ NFE Unmodified 38.61.338.6_1.3 21.10.1521.1_0.15 17.50.3517.5_0.35 84.650.0484.65_0.04 32.0 38.61.538.6_1.5 20.60.6220.6_0.62 17.50.3517.5_0.35 84.650.0484.65_0.04 32.0 Full SAD 32.41.632.4_1.6 29.30.5229.3_0.52 30.00.7530.0_0.75 83.920.0183.92_0.01 32.0 27.11.227.1_1.2 35.10.3435.1_0.34 47.11.147.1_1.1 83.380.0183.38_0.01 32.0 SADDER 29.41.729.4_1.7 42.11.442.1_1.4 18.40.2618.4_0.26 84.590.0684.59_0.06 32.0 29.90.929.9_0.9 34.60.5434.6_0.54 27.80.8627.8_0.86 84.200.0384.20_0.03 32.0 SADDER + warm-up 31.20.731.2_0.7 31.62.131.6_2.1 44.30.7544.3_0.75 83.010.0183.01_0.01 32.0 24.40.924.4_0.9 36.90.3236.9_0.32 44.10.1444.1_0.14 83.180.0383.18_0.03 32.0 CSD† 22.40.422.4_0.4 2257.0225_7.0 21.60.2621.6_0.26 84.590.0484.59_0.04 61.9 15.60.515.6_0.5 48736487_36 94340943_40 82.610.0382.61_0.03 55.0 BoN-8 19.00.719.0_0.7 20.50.2620.5_0.26 19.50.4819.5_0.48 84.700.0084.70_0.00 256.0 18.60.618.6_0.6 24.20.3224.2_0.32 19.50.4819.5_0.48 84.700.0084.70_0.00 256.0 FK-8 20.60.820.6_0.8 21.31.121.3_1.1 18.20.5318.2_0.53 84.710.0484.71_0.04 256.0 28.21.228.2_1.2 22.70.9322.7_0.93 18.20.5318.2_0.53 84.710.0484.71_0.04 256.0 Safety–quality tradeoffs. On LLaDA/RTP, SADDER lowers the unsafe rate from 38.6% unmodified to 29.4%, versus 32.4% for full SAD; warm-up reaches 31.2%. On BeaverTails, SADDER reaches 29.9%, full SAD 27.1%, and warm-up 24.4%. Across all four model/dataset settings, SADDER achieves higher benign BERTScore and lower benign PPL than full SAD. SADDER also achieves higher benign BERTScore than warm-up throughout, although both variants remain below unmodified sampling on this metric (Tables 1 and 9). Harmful-prompt PPL reveals a different tradeoff: on LLaDA/RTP, CSD reaches a 22.4% unsafe rate but PPL 225, versus 42.1 for SADDER and 31.6 for warm-up without remasking. CSD’s benign PPL of 21.6 does not expose this deterioration on harmful prompts. Gains also depend on the model: on Dream, full SAD at η=10,000η=10,000 achieves lower unsafe rates than either SADDER variant on both datasets. BoN-8 further reduces unsafe rates at a cost of 256 generator evaluations plus reward scoring. 5.2 Unsafe Continuation on Uniform-State Diffusion Models Setting and metrics. We evaluate Duo (Sahoo et al., 2025) and UDLM (Schiff et al., 2025) on 300 unsafe prompt records from RealToxicityPrompts (RTP). Both models generate at a context length of 128 in 128 denoising steps. Unsafe references and contrastive directions follow Section 5.1, with k∈6,9,12k∈\6,9,12\. Baselines are unmodified sampling, full SAD, CSD†, and best-of-N for N∈3,5,8N∈\3,5,8\. Full SAD and SADDER sweep η∈3×104,5×104,105,1.5×105η∈\3×10^4,5×10^4,10^5,1.5×10^5\. In masked models, guidance must reach a position before it is revealed. Uniform-state samplers have no such constraint, so we gate every position at every step, using Equation 13 for SADDER and no gate for full SAD. Safety is the Llama-Guard-3-8B unsafe rate. Benign BERT uses 300 separate benign RTP prompt–continuation pairs. All entries are means over five generation seeds, and Appendix I reports exact values with seed standard deviations. Figure 1: Safety–quality tradeoff at equal NFE on Duo and UDLM. Best-of-N is reported in Appendix I. Larger markers denote larger guidance strength η. The dashed vertical line marks the unmodified model’s benign BERTScore, and error bars are one standard deviation across seeds. Safety–quality tradeoffs. Figure 1 reports the tradeoff. On UDLM, SADDER reaches a 45.9% unsafe rate, against 68.5% without steering and 47.4% for the lowest unsafe rate among full SAD settings. SADDER’s benign BERTScore is 80.92, against 80.49 for full SAD and 80.81 unmodified, so it is safer than full SAD without any loss in reference similarity. On Duo, full SAD reaches lower unsafe rates than SADDER at every η, from 43.4% versus 47.2% at η=3×104η=3×10^4 to 41.1% versus 43.6% at η=1.5×105η=1.5×10^5. The same holds at matched benign BERTScore: full SAD reaches 43.4% at 81.77, where SADDER reaches 45.0%. What SADDER does buy is quality, on both models: at every η its benign BERTScore is higher than full SAD’s. On Duo the gap is widest at the end of the sweep, 81.68 against 80.76. SADDER, full SAD, and CSD† use the same number of generator evaluations, whereas best-of-N uses N times as many. Neither baseline is consistent across the two models. On Duo, best-of-8 reaches 33.1%, the lowest unsafe rate we observe, yet on UDLM best-of-N does not improve on unmodified sampling at any budget. CSD† reaches 35.1% on Duo at k=9k=9 but 63.5% on UDLM at the same layer, and it is sensitive to the layer choice: across k, its unsafe rate on Duo spans 15.5 points, whereas SADDER’s varies by at most 2.2 points at fixed η. 5.3 Jailbreak robustness on instruction-tuned models Setting. We evaluate DIJA and PAD on LLaDA-8B-Instruct and Dream-7B-Instruct using 100 held-out HarmBench behaviors, 128 sampling steps, and WildJailbreak Jiang et al. (2024) unsafe references. CSD and SADDER share the unsafe-response set. DiffuGuard (Li et al., 2025) is evaluated with full repair, which can modify fixed attack text, and gen repair, restricted to initially masked positions; their audit thresholds also differ (Appendices H and A.6). Table 2 reports full-response HarmBench (HB) ASR, LlamaGuard (LG) unsafe rate, harmful PPL, and NFE. XSTest over-refusal uses WildGuard (WG) (Han et al., 2024) judgments on 250 safe, unmodified prompts across three seeds, with the DIJA guidance configuration. WG rates use valid labels (non-empty) within each seed, then average across seeds. Appendices H.5 and H.2 report generated-span judgments, valid-score counts, paired comparisons, and calibration-prompt reuse. Table 2: Dream-Instruct: held-out HarmBench attacks and XSTest over-refusal. Entries use AbA_b: mean and sample SD across three seeds (percentage points for rates). HB, LG, and PPL assess complete responses. XSTest reports full-response WG refusal on safe prompts, using valid judge labels only (coverage in Appendix H.2). NFE is mean cost. Method DIJA PAD XSTest HB ASR % ↓ LG unsafe % ↓ Harmful PPL ↓ NFE HB ASR % ↓ LG unsafe % ↓ Harmful PPL ↓ NFE WG refusal % ↓ Dream-Instruct Unmodified 82.01.082.0_1.0 80.71.580.7_1.5 11.40.1811.4_0.18 91.7 51.70.651.7_0.6 64.03.664.0_3.6 8.530.0278.53_0.027 116.0 55.51.355.5_1.3 Full SAD 85.30.685.3_0.6 83.01.083.0_1.0 11.80.03711.8_0.037 91.7 52.74.052.7_4.0 63.31.563.3_1.5 9.520.219.52_0.21 116.0 58.01.058.0_1.0 SADDER (selective) 77.71.577.7_1.5 81.73.281.7_3.2 12.20.09312.2_0.093 91.7 52.70.652.7_0.6 66.32.566.3_2.5 9.580.159.58_0.15 116.0 41.10.841.1_0.8 SADDER + warm-up 78.72.378.7_2.3 79.71.279.7_1.2 12.20.1012.2_0.10 91.7 42.73.142.7_3.1 55.02.055.0_2.0 10.40.1710.4_0.17 116.0 17.90.717.9_0.7 CSD† 68.06.268.0_6.2 82.30.682.3_0.6 45.94.145.9_4.1 115.5 33.33.133.3_3.1 63.32.563.3_2.5 23.71.523.7_1.5 140.8 56.41.956.4_1.9 DiffuGuard (full) 33.32.533.3_2.5 84.02.084.0_2.0 53711537_11 137.0 12.01.712.0_1.7 70.02.670.0_2.6 687120687_120 125.0 64.11.564.1_1.5 DiffuGuard (gen) 69.31.569.3_1.5 81.31.581.3_1.5 46.61.946.6_1.9 97.2 49.01.749.0_1.7 63.32.363.3_2.3 8.800.638.80_0.63 117.0 54.61.154.6_1.1 Attack and evaluator dependence. Under DIJA, SADDER and warm-up leave HB ASR near unmodified sampling, while LG flags roughly four-fifths of responses as unsafe. Large HB reductions from CSD and full-block DiffuGuard do not yield comparable LG reductions: Dream’s full-block DiffuGuard reaches 33.3% HB ASR but 84.0% LG unsafe rate and PPL 537. Both judges assess complete responses, so this discrepancy cannot be attributed solely to scaffold inclusion. Appendix H.5 separates evaluator choice from the influence of fixed attack text by comparing full-response and generated-span judgments on the same outputs. SADDER retains generator cost and incurs a smaller PPL increase, but offers limited DIJA robustness. PAD gives a more favorable result: Dream warm-up reduces HB ASR by 9.0 points (paired 95% CI: [−15.7,−2.3][-15.7,-2.3]), lowers LG unsafe rate from 64.0% to 55.0%, and increases PPL from 8.53 to 10.40. This supports an attack-specific tradeoff rather than general jailbreak robustness. Appendix H reports component, strength, and timing studies. Over-refusal. Dream warm-up reduces WG refusal on safe XSTest prompts by 35.4 points on jointly scored outputs (95% CI: [−41.6,−29.3][-41.6,-29.3]), but raises WG harmfulness on unsafe contrasts from 0.0% to 6.9% among scored responses. Fewer refusals therefore do not establish greater helpfulness at unchanged safety. 6 Summary and Discussion We introduced SADDER, an extension of the Safety-Aware Denoiser, using midpoint-centred contrastive activation scores to select where to apply probability-space safety guidance. Rather than directly modifying hidden representations, SADDER uses them to identify potentially risky positions and applies the SAD correction to the corresponding token distributions. Our theoretical analysis characterizes the conditions under which position-wise guidance recovers the conditional mean of an induced safe target, and identifies when these local conditional means agree with a global target. Experiments on masked and uniform-state diffusion models reveal both the benefits and limitations of selective guidance. SADDER improves benign-continuation quality metrics relative to full SAD in several settings, with selected configurations also reducing unsafe generation. Jailbreak improvements also depend on the model and operating point, but SADDER shows significantly lower refusal rates. Taken together, SADDER offers an additional way to manage the safety–quality and safety-refusal trade-offs. AI use statement We used generative AI tools, to assist with refining research hypotheses and experimental designs, reviewing mathematical derivations and proof arguments, analyzing and interpreting experimental results, and implementing and debugging experimental code. We also used these tools to draft and revise portions of the manuscript, improve clarity and organization, prepare LaTeX pseudocode, and identify and discuss relevant literature. The models used for text generation and automated safety evaluation within our experiments are described in the experimental protocol. The authors reviewed and revised the AI-assisted material included in this work. We checked mathematical statements and derivations, verified references against the cited sources, and checked reported numerical claims against experimental outputs. AI-generated code was reviewed and revised by the authors before use in the experiments. The authors made the final methodological decisions and determined the interpretation and presentation of the findings. We take responsibility for the final content of this work, including all text, claims, and artifacts produced with the assistance of generative AI. Ethics statement This work investigates training-free safety guidance for text diffusion models. Our experiments involve toxic text, harmful instructions, and adversarial prompts from existing datasets and benchmarks. These materials serve a defensive evaluation purpose but may contain offensive or distressing content. Analysis of model vulnerabilities could also inform attempts to circumvent safeguards. Any release of associated harmful generations or attack artifacts should therefore consider risks of misuse, exposure to harmful content, and disclosure of sensitive information. Furthermore, safety guidance could be misused to suppress legitimate expression, while overly broad or biased safety criteria may restrict benign content and disproportionately affect particular communities. Our evaluation relies on benchmark datasets and automated safety judges, which may reflect social biases and fail to capture context-dependent harms. Differences between evaluators further limit the interpretation of reported safety metrics. We report safety alongside generation quality, inference cost, and over-refusal, including settings where the proposed guidance offers limited benefit. Reduced refusal does not necessarily imply improved helpfulness, and lower measured attack success does not establish that responses are safe or usable. Our findings are restricted to the evaluated models, datasets, and sampling configurations; they do not establish safety across untested settings. Deployment would require additional assessment of robustness, fairness, and risks specific to the intended application. Reproducibility statement The main text presents the mathematical formulation of SADDER, and Algorithm 1 specifies the selective guidance procedure. Appendix A.2 derives the centered-score equivalence, and Appendices A.4 and A.5 provide proofs of the theoretical results. Appendix A.6 describes the datasets, prompt selection, and reference-set construction. Appendix A.8 documents shared settings, hyperparameter ranges, and configuration selection, while Appendix B details the sampling extensions. Appendices E and H report additional experimental settings and results. Appendix H.5 compares evaluators and response scopes, and Appendix H.2 describes refusal evaluation and the handling of missing judge labels. Appendix B.2 specifies metric aggregation, seed standard deviations, bootstrap intervals, and paired comparisons. These materials support independent implementation and assessment of the reported results. Acknowledgments This work was supported by Mitacs through the Mitacs Accelerate program, in partnership with RBC Borealis (Royal Bank of Canada). References Avrahami and Nachmani (2026) E. Avrahami and E. Nachmani ILRR: inference-time steering method for masked diffusion language models. External Links: 2601.21647, Link Cited by: §4. ByteDance Seed et al. (2025) ByteDance Seed, Y. Zhang, J. Su, Y. Sun, C. Xi, X. Xiao, S. Zheng, A. Zhang, K. Liu, D. Zan, T. Sun, J. Zhu, S. Xin, D. Huang, Y. Bai, L. Dong, C. Li, J. Chen, H. Zhou, Y. Huang, G. Ning, X. Song, J. Chen, S. Liu, K. Shen, L. Xiang, and Y. Wu Seed-Coder: let the code model curate data for itself. External Links: 2506.03524, Link Cited by: §1. Chao et al. (2024) P. Chao, E. Debenedetti, A. Robey, M. Andriushchenko, F. Croce, V. Sehwag, E. Dobriban, N. Flammarion, G. J. Pappas, F. Tramèr, H. Hassani, and E. Wong JailbreakBench: an open robustness benchmark for jailbreaking large language models. In Advances in Neural Information Processing Systems, A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang (Eds.), Vol. 37, p. 55005–55029. External Links: Document, Link Cited by: §A.6. Dai et al. (2024) J. Dai, X. Pan, R. Sun, J. Ji, X. Xu, M. Liu, Y. Wang, and Y. Yang Safe rlhf: safe reinforcement learning from human feedback. In International Conference on Learning Representations, B. Kim, Y. Yue, S. Chaudhuri, K. Fragkiadaki, M. Khan, and Y. Sun (Eds.), Vol. 2024, p. 50750–50777. External Links: Link Cited by: §1. DiffusionGemma Team (2026) DiffusionGemma Team DiffusionGemma technical report. External Links: 2608.00146, Link Cited by: §2.1. Fan et al. (2026) C. Fan, W. Heng, B. Li, S. Liu, Y. Song, J. Su, X. Qu, K. Shen, and W. Wei Stable-diffcoder: pushing the frontier of code diffusion large language model. External Links: 2601.15892, Link Cited by: §1. Gehman et al. (2020) S. Gehman, S. Gururangan, M. Sap, Y. Choi, and N. A. Smith RealToxicityPrompts: evaluating neural toxic degeneration in language models. In Findings of EMNLP, External Links: 2009.11462 Cited by: §A.6, §5.1. Grattafiori et al. (2024) A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. The llama 3 herd of models. External Links: 2407.21783, Link Cited by: §1. Han et al. (2024) S. Han, K. Rao, A. Ettinger, L. Jiang, B. Y. Lin, N. Lambert, Y. Choi, and N. Dziri WildGuard: open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. In Advances in Neural Information Processing Systems, A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang (Eds.), Vol. 37, p. 8093–8131. External Links: Document, Link Cited by: §A.7, §H.2, §5.3. Ji et al. (2023) J. Ji, M. Liu, J. Dai, X. Pan, C. Zhang, C. Bian, B. Chen, R. Sun, Y. Wang, and Y. Yang BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset. In Advances in Neural Information Processing Systems, A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (Eds.), Vol. 36, p. 24678–24704. External Links: Link Cited by: §A.6, §5.1. Jiang et al. (2024) L. Jiang, K. Rao, S. Han, A. Ettinger, F. Brahman, S. Kumar, N. Mireshghallah, X. Lu, M. Sap, Y. Choi, and N. Dziri WildTeaming at scale: from in-the-wild jailbreaks to (adversarially) safer language models. In Advances in Neural Information Processing Systems, A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang (Eds.), Vol. 37, p. 47094–47165. External Links: Document, Link Cited by: §A.6, §4, §5.3. Kim et al. (2025) M. Kim, D. Kim, A. Yusuf, S. Ermon, and M. Park Training-free safe denoisers for safe use of diffusion models. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, External Links: Link Cited by: §2.2, §2.2, §2.2, Theorem 2.1. Kim et al. (2026) M. Kim, Y. Kim, and M. Park SAFETY-GUIDED FLOW (SGF): a UNIFIED FRAMEWORK FOR NEGATIVE GUIDANCE IN SAFE GENERATION. In The Fourteenth International Conference on Learning Representations, External Links: Link Cited by: §2.2, §2.2. Kirchhof et al. (2025) M. Kirchhof, J. Thornton, L. Béthune, P. Ablin, E. Ndiaye, and M. Cuturi Shielded diffusion: generating novel and diverse images using sparse repellency. In Proceedings of the 42nd International Conference on Machine Learning, A. Singh, M. Fazel, D. Hsu, S. Lacoste-Julien, F. Berkenkamp, T. Maharaj, K. Wagstaff, and J. Zhu (Eds.), Proceedings of Machine Learning Research, Vol. 267, p. 30911–30942. External Links: Link Cited by: §2.2. Lee and Han (2026) Y. Lee and Y. Han Adaptive steering and remasking for safe generation in diffusion language models. External Links: 2605.13043, Link Cited by: Appendix B, §1, §3.1, §3.1, §4, §5.1. Li et al. (2023) R. Li, L. B. allal, Y. Zi, N. Muennighoff, D. Kocetkov, C. Mou, M. Marone, C. Akiki, J. LI, J. Chim, Q. Liu, E. Zheltonozhskii, T. Y. Zhuo, T. Wang, O. Dehaene, J. Lamy-Poirier, J. Monteiro, N. Gontier, M. Yee, L. K. Umapathi, J. Zhu, B. Lipkin, M. Oblokulov, Z. Wang, R. Murthy, J. T. Stillerman, S. S. Patel, D. Abulkhanov, M. Zocca, M. Dey, Z. Zhang, U. Bhattacharyya, W. Yu, S. Luccioni, P. Villegas, F. Zhdanov, T. Lee, N. Timor, J. Ding, C. S. Schlesinger, H. Schoelkopf, J. Ebert, T. Dao, M. Mishra, A. Gu, C. J. Anderson, B. Dolan-Gavitt, D. Contractor, S. Reddy, D. Fried, D. Bahdanau, Y. Jernite, C. M. Ferrandis, S. Hughes, T. Wolf, A. Guha, L. V. Werra, and H. de Vries StarCoder: may the source be with you!. Transactions on Machine Learning Research. Note: Reproducibility Certification External Links: ISSN 2835-8856, Link Cited by: §1. Li et al. (2025) Z. Li, Z. Nie, Z. Zhou, Y. Guo, Y. Liu, Y. Zhang, Y. Cheng, Q. Wen, K. Wang, and J. Zhang DiffuGuard: how intrinsic safety is lost and found in diffusion large language models. External Links: 2509.24296, Link Cited by: Appendix B, §4, §5.3. Mazeika et al. (2024a) M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, D. Forsyth, and D. Hendrycks HarmBench: a standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 41st International Conference on Machine Learning, R. Salakhutdinov, Z. Kolter, K. Heller, A. Weller, N. Oliver, J. Scarlett, and F. Berkenkamp (Eds.), Proceedings of Machine Learning Research, Vol. 235, p. 35181–35224. External Links: Link Cited by: §A.6, §A.7. Mazeika et al. (2024b) M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, et al. Cais/harmbench-llama-2-13b-cls (hugging face model card). Note: https://huggingface.co/cais/HarmBench-Llama-2-13b-clsAccessed: January 29, 2026 Cited by: §A.7. Meta (2024) Meta Llama guard 3 (8b) model card and hazard taxonomy. Note: https://huggingface.co/meta-llama/Llama-Guard-3-8BAccessed: January 29, 2026 Cited by: §A.7, §5.1. Naveed et al. (2025) H. Naveed, A. U. Khan, S. Qiu, M. Saqib, S. Anwar, M. Usman, N. Akhtar, N. Barnes, and A. Mian A comprehensive overview of large language models. ACM Trans. Intell. Syst. Technol. 16 (5). External Links: ISSN 2157-6904, Link, Document Cited by: §1. Nie et al. (2025) S. Nie, F. Zhu, Z. You, X. Zhang, J. Ou, J. Hu, J. ZHOU, Y. Lin, J. Wen, and C. Li Large language diffusion models. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, External Links: Link Cited by: §A.7, §1, §2.1, §2.1, §5.1. Popov et al. (2021) V. Popov, I. Vovk, V. Gogoryan, T. Sadekova, and M. Kudinov Grad-tts: a diffusion probabilistic model for text-to-speech. In International conference on machine learning, p. 8599–8608. Cited by: §1. Radford et al. (2019) A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever Language models are unsupervised multitask learners. Technical report OpenAI. External Links: Link Cited by: §A.7, §5.1. Rimsky et al. (2024) N. Rimsky, N. Gabrieli, J. Schulz, M. Tong, E. Hubinger, and A. Turner Steering Llama 2 via contrastive activation addition. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 15504–15522. External Links: Document, Link Cited by: §4. Rombach et al. (2022) R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer High-resolution image synthesis with latent diffusion models. In 2022 IEEE/CVF conference on computer vision and pattern recognition (CVPR), p. 10674–10685. Cited by: §1. Röttger et al. (2024) P. Röttger, H. R. Kirk, B. Vidgen, G. Attanasio, F. Bianchi, and D. Hovy XSTest: a test suite for identifying exaggerated safety behaviours in large language models. External Links: 2308.01263, Link Cited by: §A.6. Sahoo et al. (2024) S. S. Sahoo, M. Arriola, A. Gokaslan, E. M. Marroquin, A. M. Rush, Y. Schiff, J. T. Chiu, and V. Kuleshov Simple and effective masked diffusion language models. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, External Links: Link Cited by: §1, §2.1. Sahoo et al. (2025) S. S. Sahoo, J. Deschenaux, A. Gokaslan, G. Wang, J. Chiu, and V. Kuleshov The diffusion duality. In Forty-second International Conference on Machine Learning, External Links: Link Cited by: §2.1, §5.2. Sahoo et al. (2026) S. S. Sahoo, J. Lemercier, Z. Yang, J. Deschenaux, J. Liu, J. Thickstun, and A. Jukić Scaling beyond masked diffusion language models. In Forty-third International Conference on Machine Learning, External Links: Link Cited by: §2.1. Schiff et al. (2025) Y. Schiff, S. Sahoo, H. Phung, G. Wang, S. Boshar, H. Dalla-Torre, B. Almeida, A. Rush, T. Pierrot, and V. Kuleshov Simple guidance mechanisms for discrete diffusion models. In International Conference on Learning Representations, Vol. 2025, p. 43776–43821. Cited by: §1, §5.2. Singhal et al. (2025) R. Singhal, Z. Horvitz, R. Teehan, M. Ren, Z. Yu, K. Mckeown, and R. Ranganath A general framework for inference-time scaling and steering of diffusion models. In Proceedings of the 42nd International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 267, p. 55810–55827. External Links: Link Cited by: §1, §4, §5.1. Wang et al. (2025) G. Wang, Y. Schiff, S. S. Sahoo, and V. Kuleshov Remasking discrete diffusion models with inference-time scaling. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, External Links: Link Cited by: §2.1. Wen et al. (2026) Z. Wen, J. Qu, Z. Chen, X. Lu, D. Liu, Z. Liu, R. Wu, Y. Yang, X. Jin, H. Xu, X. Liu, W. Li, C. Lu, J. Shao, C. He, and L. Zhang The Devil behind the mask: an emergent safety vulnerability of diffusion LLMs. In The Fourteenth International Conference on Learning Representations, External Links: Link Cited by: §A.7, §4. Wu et al. (2024) K. E. Wu, K. K. Yang, R. Van den Berg, S. Alamdari, J. Y. Zou, A. X. Lu, and A. P. Amini Protein structure generation via folding diffusion. Nature communications 15 (1), p. 1059. Cited by: §1. Xu et al. (2024) Z. Xu, F. Jiang, L. Niu, J. Jia, B. Y. Lin, and R. Poovendran SafeDecoding: defending against jailbreak attacks via safety-aware decoding. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), L. Ku, A. Martins, and V. Srikumar (Eds.), Bangkok, Thailand, p. 5587–5605. External Links: Link, Document Cited by: §1. Yang et al. (2024) A. Yang, B. Zhang, B. Hui, B. Gao, B. Yu, C. Li, D. Liu, J. Tu, J. Zhou, J. Lin, et al. Qwen2. 5-math technical report: toward mathematical expert model via self-improvement. External Links: 2409.12122, Link Cited by: §1. Ye et al. (2025) J. Ye, Z. Xie, L. Zheng, J. Gao, Z. Wu, X. Jiang, Z. Li, and L. Kong Dream 7b: diffusion large language models. External Links: 2508.15487, Link Cited by: §A.7, §2.1, §2.1, §5.1. Yusuf et al. (2026) A. Yusuf, Z. Jiang, and M. Park The safety-aware denoiser for text diffusion models. In Forty-third International Conference on Machine Learning, External Links: Link Cited by: §1, §2.2, §5. Zhang et al. (2020) T. Zhang, V. Kishore, F. Wu, K. Q. Weinberger, and Y. Artzi BERTScore: evaluating text generation with BERT. In International Conference on Learning Representations, External Links: Link Cited by: §A.7. Zhang et al. (2025) Y. Zhang, F. Xie, Z. Zhou, Z. Li, H. Chen, K. Wang, and Y. Guo Jailbreaking large language diffusion models: revealing hidden safety flaws in diffusion-based text generation. In Responsible Foundation Models Workshop at NeurIPS 2025, External Links: Link Cited by: §A.7, §4. Zou et al. (2023) A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson Universal and transferable adversarial attacks on aligned language models. External Links: 2307.15043, Link Cited by: §A.6. Appendix A Appendix A.1 Notation Tables 3 and 4 collect the notation for selective SADDER and its theoretical analysis. The special mask token M is distinct from the centroid midpoint k m_k and response truncation cap M. We distinguish decreasing noise time t from the increasing reverse iteration index j: j=0j=0 is the first model update, and the corresponding noise levels satisfy t0>⋯>tT=0t_0>·s>t_T=0. All experimental windows below use inclusive iteration indices. So C=0C=0–1515 means 16 updates. The optional warm-up length w counts initial full-SAD updates; w=8w=8 uses updates 0–7. Table 3: Notation for selective SADDER. Symbol Meaning i,iharm,isafe c_i,\ x_i^harm,\ x_i^safe Reference prompt and its harmful and safe responses. Pi,Riu,MP_i,\ R_i^u,\ M Prompt length, response length min(|iu|,M) (| x_i^u|,M), and response truncation cap; u∈harm,safeu∈\harm,safe\. Nharm,NsafeN_harm,\ N_safe Numbers of harmful and safe examples used to estimate the centroids. t,0,0l x_t,\ x_0,\ x_0^l Noised sequence, clean sequence, and one-hot clean token at position l. ,L,V,\ L,\ M Vocabulary, sequence length, and special mask token. T,j,tj,CT,\ j,\ t_j,\ C Number of reverse updates, update index, corresponding noise time, and admitted intervention indices. ,ℳtG,\ M_t Editable positions and positions eligible for steering: masked editable positions for MDLMs; all L positions for USDMs in the stated algorithm. k,l,dk,\ l,\ d Hidden-state layer, token position, and hidden dimension. k,l,k,l(t) h_k,l,\ h_k,l^(t) Layer-k hidden representation at position l; the superscript denotes evaluation on the current noised state. ¯i,ku,¯ku h_i,k^u,\ h_k^u Response-averaged representation of reference i and the corresponding class centroid. ^k,k v_k,\ m_k Unit direction from the safe to the harmful centroid, and their midpoint. sk,l(t)s_k,l^(t) Centered score ⟨k,l(t)−k,^k⟩ h_k,l^(t)- m_k, v_k ; positive values lie on the harmful-centroid side. ak,l(t)a_k,l^(t) Binary steering gate: one at eligible positions with positive scores and zero otherwise. η,β(t)η,\ β( x_t) Guidance hyperparameter and state-dependent SAD scale; the gated strength is ηβ(t)ak,l(t)ηβ( x_t)a_k,l^(t). p,t,l,p~0|t,lp_D,t,l,\ p_0 t,l Model clean-token prediction and modified prediction supplied to the reverse solver. σ,τσ,\ τ Sigmoid and positive temperature in the optional softened gate. Table 4: Denoiser and theoretical notation. Symbol Meaning ,unsafeD,\ D_unsafe Data distribution underlying the pretrained denoiser and unsafe reference set used by the algorithm, respectively. qt(t∣0)q_t( x_t x_0) Forward corruption kernel, used to weight clean unsafe references given the noised state. [0l∣t1:L]E_D[ x_0^l x_t^1:L] Data denoiser at position l, estimated by the pretrained model. unsafe[0l∣t1:L]E_D_unsafe[ x_0^l x_t^1:L] Unsafe denoiser, approximated by a weighted mixture of unsafe references. p(01:L∣t1:L)p_D( x_0^1:L x_t^1:L) Data posterior over the entire clean sequence. ψl,πt,l _l,\ _t,l Oracle unsafe-membership function L→[0,1]V^L→[0,1] and its posterior mean πt,l=[ψl(01:L)∣t1:L] _t,l=E_D[ _l( x_0^1:L) x_t^1:L]. Zsafe,lZ_safe,l Local safe normalizer 1−πt,l1- _t,l; dependence on noise time and state is suppressed. gl,Rlg_l,\ R_l Local safe weight gl=1−ψlg_l=1- _l and remaining-position weight Rl=∏j≠lgjR_l= _j≠ lg_j, with j a dummy position index. punsafe(l),psafe(l)p_D_unsafe^(l),\ p_D_safe^(l) Clean-sequence posteriors obtained by weighting p_D with ψl _l or glg_l and normalizing by πt,l _t,l or 1−πt,l1- _t,l. The superscript (l)(l) identifies the safety criterion. psafeglobalp_D_safe^global Global clean-sequence posterior obtained by weighting p_D with ∏lgl _lg_l and normalizing. ν,CovνE_ν,\ Cov_ν Expectation and covariance under distribution ν, conditioned on t1:L x_t^1:L in the proofs. A.2 Derivation of equivalence Expanding the relationship in equation 10 gives us 2⟨k,l(t),¯kharm−¯ksafe⟩>‖kharm‖22−‖ksafe‖22. 2 h_k,l^(t),\; h_k^harm- h_k^safe >\| h_k^harm\|_2^2-\| h_k^safe\|_2^2. (18) In terms of ^k v_k, this is, ⟨k,l(t),^k⟩>‖kharm‖22−‖ksafe‖222‖¯kharm−¯ksafe‖. h_k,l^(t), v_k > \| h_k^harm\|_2^2-\| h_k^safe\|_2^22\| h_k^harm- h_k^safe\|. (19) For notational simplicity, we ignore superscripts and subscripts j,k,tj,k,t below. ⟨,^⟩ h, v >‖¯harm‖22−‖¯safe‖222‖¯harm−¯safe‖, > \| h^harm\|_2^2-\| h^safe\|_2^22\| h^harm- h^safe\|, (20) since ⟨−,^⟩=⟨,^⟩−⟨,^⟩ h- m, v = h, v - m, v , we rewrite the above equation by ⟨−,^⟩ h- m, v >‖¯harm‖22−‖¯safe‖222‖¯harm−¯safe‖−⟨,^⟩, > \| h^harm\|_2^2-\| h^safe\|_2^22\| h^harm- h^safe\|- m, v , (21) =‖¯harm‖22−‖¯safe‖222‖¯harm−¯safe‖−(¯harm−¯safe)T(¯harm+¯safe)2‖¯harm−¯safe‖, = \| h^harm\|_2^2-\| h^safe\|_2^22\| h^harm- h^safe\|- ( h^harm- h^safe)^T( h^harm+ h^safe)2\| h^harm- h^safe\|, (22) =(¯harm−¯safe)T(¯harm+¯safe)−(¯harm−¯safe)T(¯harm+¯safe)2‖¯harm−¯safe‖=0, = ( h^harm- h^safe)^T( h^harm+ h^safe)-( h^harm- h^safe)^T( h^harm+ h^safe)2\| h^harm- h^safe\|=0, (23) where the RHS becomes zero by expanding the additional inner product ⟨,^⟩ c, v . A.3 Global target distribution. Theorem A.1 (When position-wise SADDER target distribution matches a global target distribution). Given the position-wise safe target from Thm. 3.1 given in equation 32, psafe(l)(01:L|t1:L) p_D_safe^(l)( x_0^1:L| x_t^1:L) =(1−ψl(01:L))pdata(01:L|t1:L)1−πt,l(t1:L), = (1- _l( x_0^1:L) )p_ data( x_0^1:L| x_t^1:L)1- _t,l( x_t^1:L), (24) and the global target distribution, with gl(01:L):=1−ψl(01:L)g_l( x_0^1:L):=1- _l( x_0^1:L) and Rl(01:L):=∏j≠l(1−ψj(01:L))R_l( x_0^1:L):= _j≠ l (1- _j( x_0^1:L) ) for each position l, psafeglobal(01:L∣t1:L)=gl(01:L)Rl(01:L)p(01:L∣t1:L)[gl(01:L)Rl(01:L)∣t1:L]. p_D_safe^global( x_0^1:L x_t^1:L)= g_l( x_0^1:L)R_l( x_0^1:L)p_D( x_0^1:L x_t^1:L)E_D[g_l( x_0^1:L)R_l( x_0^1:L) x_t^1:L]. (25) the following equality holds, safeglobal(0l|t1:L)=safe(l)(0l|t1:L), _D_safe^global( x_0^l| x_t^1:L)=E_D_safe^(l)( x_0^l| x_t^1:L), (26) if and only if Covsafe(l)(Rl(01:L),0l|t1:L)=0,Cov_D_safe^(l)\! (R_l( x_0^1:L), x_0^l| x_t^1:L )=0, (27) for every l,t,t1:Ll,t, x_t^1:L See Section A.5 for proof. Remark 2. Thm. A.1 states that the global and position-wise denoisers agree at position l for all l=1,⋯,Ll=\1,·s,L\ if and only if the remaining-position safety weight denoted by Rl(01:L)R_l( x_0^1:L) is conditionally uncorrelated with 0l x_0^l under safe(l)D_safe^(l). Under this condition and the calibration assumption in Thm. 3.1, every SADDER factor is the marginal safe denoiser of the same global target. However, this does not guarantee the existence of any globally compatible distribution. It only states that this specific global target in equation 25 agrees with the local target at position l if and only if a conditional covariance is zero. A.4 Proof of Thm. 3.1 Proof. In the theorem, we assumed that these exists a measurable position-wise unsafe-membership function on clean sequences. In particular, for each token position l∈1,…,Ll∈\1,…,L\, this function maps the clean sequence to a level of unsafe-ness at index l: ψl:L⟶[0,1]. _l:V^L [0,1]. (28) Recall that we let πt,l(t1:L):=D[ψl(01:L)∣t1:L] _t,l( x_t^1:L):=E_D\! [ _l( x_0^1:L) x_t^1:L ] (29) denote the posterior probability of the position-l being unsafe, for a noised sequence t1:L x_t^1:L. Now, we define the corresponding normalized position-wise safe and unsafe posterior distributions by punsafe(l)(01:L|t1:L) p_D_unsafe^(l)( x_0^1:L| x_t^1:L) :=ψl(01:L)pdata(01:L|t1:L)πt,l(t1:L), := _l( x_0^1:L)p_ data( x_0^1:L| x_t^1:L) _t,l( x_t^1:L), (30) πt,l(t1:L) _t,l( x_t^1:L) :=∑01:L∈ψl(01:L)pdata(01:L|t1:L), := _ x_0^1:L _l( x_0^1:L)p_ data( x_0^1:L| x_t^1:L), (31) psafe(l)(01:L|t1:L) p_D_safe^(l)( x_0^1:L| x_t^1:L) :=(1−ψl(01:L))pdata(01:L|t1:L)Zsafe,l, := (1- _l( x_0^1:L) )p_ data( x_0^1:L| x_t^1:L)Z_safe,l, (32) 1−πt,l(t1:L) 1- _t,l( x_t^1:L) :=∑01:L∈(1−ψl(01:L))pdata(01:L|t1:L). := _ x_0^1:L (1- _l( x_0^1:L) )p_ data( x_0^1:L| x_t^1:L). (33) Because ψl(01:L)+(1−ψl(01:L))=1 _l( x_0^1:L)+(1- _l( x_0^1:L))=1 for any clearn sequence 01:L x_0^1:L, we can write the following: pdata(01:L|t1:L) p_data( x_0^1:L| x_t^1:L) =(1−ψl(01:L))pdata(01:L|t1:L) =(1- _l( x_0^1:L))p_data( x_0^1:L| x_t^1:L) (34) +ψl(01:L)pdata(01:L|t1:L). + _l( x_0^1:L)p_data( x_0^1:L| x_t^1:L). (35) If we plug in equation 30 and equation 32 to the RHS, the data posterior can be decomposed into the position-wise, normalized, safe and unsafe distributions: pdata(01:L∣t1:L) p_ data( x_0^1:L x_t^1:L) =(1−πt,l(t1:L))pDsafe(l)(01:L∣t1:L) = (1- _t,l( x_t^1:L) )p_D_safe^(l)( x_0^1:L x_t^1:L) (36) +πtl(t1:L)pDunsafe(l)(01:L∣t1:L). + _t\,l( x_t^1:L)p_D_unsafe^(l)( x_0^1:L x_t^1:L). Taking the conditional expectation of the one-hot clean token x0lx_0^l on both sides gives, i.e., 0l∼[0l|t1:L]=∫0lp(0l|t1:L)d0lE_ x^l_0 [ x^l_0| x^1:L_t]= x^l_0p( x^l_0| x^1:L_t)d x^l_0 [0l|t1:L]=(1−πt,l)Dsafe(l)[0l∣t1:L]+πt,lunsafe(l)[0l|t1:L],E_D[ x^l_0| x^1:L_t]= (1- _t,l )E_D_safe^(l)\! [ x_0^l x_t^1:L ]+ _t,lE_D_unsafe^(l)[ x^l_0| x^1:L_t], (37) where the dependence of πt,l _t,l on t1:L x_t^1:L is suppressed for readability. Solving equation 37 for the safe conditional mean yields safe(l)[0l∣t1:L] _D_safe^(l)\! [ x_0^l x_t^1:L ] =[l0|1:Lt]−πt,lunsafe(l)[l0|1:Lt]1−πt,l = E_D[ x^l_0| x^1:L_t]- _t,lE_D_unsafe^(l)[ x^l_0| x^1:L_t]1- _t,l =[0l|t1:L]+πt,l1−πt,l([0l|t1:L]−unsafe(l)[0l|t1:L]). =E_D[ x^l_0| x^1:L_t]+ _t,l1- _t,l (E_D[ x^l_0| x^1:L_t]-E_D_unsafe^(l)[ x^l_0| x^1:L_t] ). (38) Substituting the calibration condition in equation 17 gives equation 16. ∎ Note that the unsafe denoiser in this theorem is induced by ψ, i.e., unsafe[0l|t1:L]=∑n∈unsafenlψl(01:L)qt(t1:L|n1:L)∑n∈unsafeψl(01:L)qt(t1:L|n1:L)E_D_unsafe[ x_0^l| x_t^1:L]= _ x_n _unsafe x_n^l _l( x_0^1:L)q_t( x_t^1:L| x_n^1:L) _ x_n _unsafe _l( x_0^1:L)q_t( x_t^1:L| x_n^1:L), which differs from our implementation of unsafe denoiser given in equation 15. Hence, we note that this theorem statement holds when these two unsafe denoisers match. A.5 Proof of Thm. A.1 Proof. Conditioned on t1:L x_t^1:L, the global posterior satisfies psafeglobal(01:L∣t1:L)=gl(01:L)Rl(01:L)p(01:L∣t1:L)[gl(01:L)Rl(01:L)∣t1:L], p_D_safe^global( x_0^1:L x_t^1:L)= g_l( x_0^1:L)R_l( x_0^1:L)p_D( x_0^1:L x_t^1:L)E_D[g_l( x_0^1:L)R_l( x_0^1:L) x_t^1:L], (39) where gl(01:L):=1−ψl(01:L)g_l( x_0^1:L):=1- _l( x_0^1:L). The position-l safe posterior is psafe(l)(01:L∣t1:L)=gl(01:L)p(01:L∣t1:L)[gl(01:L)∣t1:L]. p_D_safe^(l)( x_0^1:L x_t^1:L)= g_l( x_0^1:L)p_D( x_0^1:L x_t^1:L)E_D[g_l( x_0^1:L) x_t^1:L]. (40) If we plug in equation 40 into equation 39, we have the global posterior as a reweighted position-wise posterior: psafeglobal(01:L∣t1:L) p_D_safe^global( x_0^1:L x_t^1:L) =Rl(01:L)psafe(l)(01:L∣t1:L)[gl(01:L)∣t1:L][gl(01:L)Rl(01:L)∣t1:L] = R_l( x_0^1:L)p_D_safe^(l)( x_0^1:L x_t^1:L)E_D[g_l( x_0^1:L) x_t^1:L]E_D[g_l( x_0^1:L)R_l( x_0^1:L) x_t^1:L] (41) =Rl(01:L)psafe(l)(01:L∣t1:L)safe(l)[Rl(01:L)∣t1:L], = R_l( x_0^1:L)p_D_safe^(l)( x_0^1:L x_t^1:L)E_D_safe^(l)[R_l( x_0^1:L) x_t^1:L], (42) where the second line is true because safe(l)[Rl(01:L)∣t1:L] _D_safe^(l)[R_l( x_0^1:L) x_t^1:L] =∑01:LRl(01:L)psafe(l)(01:L∣t1:L), = _ x_0^1:LR_l( x_0^1:L)p_D_safe^(l)( x_0^1:L x_t^1:L), (43) =∑01:LRl(01:L)gl(01:L)p(01:L∣t1:L)[gl(01:L)∣t1:L], due to equation 40 = _ x_0^1:LR_l( x_0^1:L) g_l( x_0^1:L)p_D( x_0^1:L x_t^1:L)E_D[g_l( x_0^1:L) x_t^1:L],\; due to equation \ position_joint (44) =[gl(01:L)Rl(01:L)∣t1:L][gl(01:L)∣t1:L]. = E_D[g_l( x_0^1:L)R_l( x_0^1:L) x_t^1:L]E_D[g_l( x_0^1:L) x_t^1:L]. (45) Taking the conditional expectation of 0l x_0^l on equation 42 gives safeglobal[0l∣t1:L]=safe(l)[Rl(01:L)0l∣t1:L]safe(l)[Rl(01:L)∣t1:L]. _D_safe^global[ x_0^l x_t^1:L]= E_D_safe^(l)[R_l( x_0^1:L) x_0^l x_t^1:L]E_D_safe^(l)[R_l( x_0^1:L) x_t^1:L]. (46) Subtracting safe(l)[0l∣t1:L]E_D_safe^(l)[ x_0^l x_t^1:L] and using the definition of conditional covariance proves safeglobal[0l|t1:L]−safe(l)[0l|t1:L] _D_safe^global\! [ x_0^l| x_t^1:L ]-E_D_safe^(l)\! [ x_0^l| x_t^1:L ] (47) =safe(l)[Rl(01:L)0l∣t1:L]safe(l)[Rl(01:L)∣t1:L]−safe(l)[0l|t1:L] = E_D_safe^(l)[R_l( x_0^1:L) x_0^l x_t^1:L]E_D_safe^(l)[R_l( x_0^1:L) x_t^1:L]-E_D_safe^(l)\! [ x_0^l| x_t^1:L ] (48) =1safe(l)[Rl(01:L)∣t1:L](safe(l)[Rl(01:L)0l∣t1:L]−safe(l)[Rl(01:L)∣t1:L]safe(l)[0l|t1:L]), = 1E_D_safe^(l)[R_l( x_0^1:L) x_t^1:L] (E_D_safe^(l)[R_l( x_0^1:L) x_0^l x_t^1:L]-E_D_safe^(l)[R_l( x_0^1:L) x_t^1:L]E_D_safe^(l)\! [ x_0^l| x_t^1:L ] ), (49) =Covsafe(l)(Rl(01:L),0l|t1:L)safe(l)[Rl(01:L)|t1:L], = Cov_D_safe^(l)\! (R_l( x_0^1:L), x_0^l| x_t^1:L )E_D_safe^(l)\! [R_l( x_0^1:L)| x_t^1:L ], (50) where the last line is true due to Cov[X,Y|Z] Cov[X,Y|Z] =[(X−(X|Z))(Y−(Y|Z))]], =E [(X-E(X|Z))(Y-E(Y|Z))] ], (51) =[XY|Z]−[X|Z][Y|Z]−[X|Z][Y|Z]+[X|Z][Y|Z], =E[XY|Z]-E[X|Z]E[Y|Z]-E[X|Z]E[Y|Z]+E[X|Z]E[Y|Z], (52) =[XY|Z]−[X|Z][Y|Z]. =E[XY|Z]-E[X|Z]E[Y|Z]. (53) Since the denominator is positive, the global and local means are the same, when the numerator is zero. ∎ A.6 Datasets, prompt selection, and reference construction We distinguish three data roles: evaluation prompts, unsafe references for the SAD update, and safe/harmful examples for constructing the activation direction. A benchmark used for one role is not automatically used for the others. RealToxicityPrompts (RTP). RTP contains naturally occurring text prefixes and their original continuations, with Perspective annotations (Gehman et al., 2020). For unsafe continuation, the configured pool requires a maximum available prompt-side Perspective score of at least 0.8 and a subsequent Llama-Guard unsafe verdict on the prompt. Its builder also retains the adapter’s continuation-score floor of 0.5. These filters describe an enriched evaluation cohort, not the full RTP distribution. Since Llama-Guard also judges generated outputs, the prompt selection is not judge-independent. Note the negation set used to construct the unsafe reference bank for the contrastive direction is not Llama-Guard scored. The original RTP development/search set comprises pool indices 0–299. The reported continuation tables use the expanded evaluation set, indices 300–899, collected as three 200-prompt shards at offsets 300, 500, and 700. These evaluation records exclude the original development records. The subsequent configuration-selection procedure is described below. BeaverTails. BeaverTails provides instruction–response pairs with response-safety annotations (Ji et al., 2023). We condition on prompts associated with unsafe-labeled responses, using 600 records for the evaluation set. The corresponding unsafe responses supply the negative reference set and safe-labeled responses supply the safe direction set. An unsafe response annotation does not establish that its prompt is itself malicious. Benign continuation controls. The quality cohort requires both the maximum prompt-side Perspective score and the maximum score from the continuation’s own fields to be at most 0.2. We remove duplicate prompt strings and prompt strings present in the excluded unsafe-reference artifacts, shuffle with seed zero, and retain 600 records. BERTScore compares each generated response with its own benign human continuation, including for unmodified sampling. BeaverTails-tuned methods use this same benign RTP cohort while retaining their BeaverTails reference banks. This is a quality diagnostic rather than an independent capability evaluation. JailbreakBench, AdvBench, and HarmBench. JailbreakBench supplies harmful behaviors for standardized jailbreak evaluation (Chao et al., 2024); its 100 harmful behaviors are development data in our study. AdvBench contains harmful instructions used to evaluate adversarial prompting (Zou et al., 2023). HarmBench provides harmful behaviors and a behavior-conditioned evaluation classifier (Mazeika et al., 2024a) and our jobs restrict evaluation to its standard behavior category. We shuffle with seed zero and use the first 100 behaviors of each dataset for development. The transfer protocol reserves AdvBench offsets 100–519 and HarmBench-standard offsets 100–199. The main jailbreak tables report the latter held-out HarmBench cohort under DIJA and PAD. These are our experimental splits, not official benchmark train/test partitions. WildJailbreak and the jailbreak reference bank. WildJailbreak contains both harmful and benign prompts, including adversarial rewrites (Jiang et al., 2024). Our unsafe set construction selects the adversarial-harmful training subset, skips the first 1,000 filtered records, and generates LLaDA-Instruct responses from three disjoint 1,300-prompt windows. Exact evaluation-behavior strings are excluded. Generation uses 256 steps, up to 256 new tokens, temperature zero, and seed 42. Unsafe-response filtering, refusal filtering, and deduplication produce the documented 357-response unsafe WildJailbreak set. The jailbreak contrastive direction uses unsafe responses and refusal references with the chat template and a 64-token response cap. XSTest and over-refusal. XSTest contains 250 safe prompts that models should answer and 200 unsafe contrast prompts (Röttger et al., 2024). Over-refusal is the refusal rate on the safe subset, reported separately from refusal on unsafe prompts. Our runs use unmodified prompts through the model’s chat template (vanilla). The evaluator we use matches the response opening against XSTest’s full-refusal strings; it does not detect partial refusals or every paraphrased refusal. A.7 Models, attacks, and evaluation measures We use LLaDA-8B-Base and LLaDA-8B-Instruct (Nie et al., 2025), and Dream-7B-Base and Dream-7B-Instruct (Ye et al., 2025). The base checkpoints are evaluated by prompted continuation; instruction checkpoints use the attack-specific input construction. The implementation’s layer k follows the hidden-state indexing and interior layers are inputs to block k, and the final layer includes the model’s final normalization. Attacks and fixed context. Zero-shot runs present the original harmful behavior through the chat template. DIJA fills mask spans inside the saved adversarial prompt (Wen et al., 2026) and the refined prompts are reused across methods. PAD inserts fixed anchors into the generation region (Zhang et al., 2025). SADDER and generation-scope DiffuGuard modify only initially editable positions. Full-block DiffuGuard additionally permits repair of fixed scaffold text after the first masked position, including PAD anchors; under DIJA it also appends the released implementation’s extra masked tail. The main jailbreak tables concern DIJA and PAD. Safety and quality. Llama-Guard-3-8B (Meta, 2024) judges the generated response alone under continuation framing. HarmBench-Llama-2-13b-cls (Mazeika et al., 2024a; Mazeika et al., 2024b) judges the response against the requested behavior. We report their respective unsafe rates separately. GPT-2-large (Radford et al., 2019) scores generated text with a causal language-model likelihood; this is an external fluency proxy for both model families, not LLaDA’s pseudo-perplexity. Padding and text after the first end-of-sequence token are excluded. Harmful PPL includes all scorable outputs on the unsafe cohort, whether the safety judge labels them safe or unsafe. Benign PPL and BERTScore F1 (Zhang et al., 2020) use the separate benign cohort. BERTScore specifies English and disables baseline rescaling; it leaves the encoder to the installed package’s default. BERTScore is multiplied by 100 in the tables. Higher reference similarity and lower PPL are useful diagnostics, but neither alone establishes helpfulness or safety. WildGuard response views. For DIJA, the appendix additionally reports WildGuard Han et al. (2024) harmfulness on the newline-joined spans marked as initially masked, paired with the original harmful behavior. This excludes the fixed scaffold and any full-block repairs outside those spans. Full-response WildGuard harmfulness and refusal remain in the appendix; XSTest uses full-response refusal. The generated-span evaluation is available only for fixed-policy DIJA runs, not PAD or the window studies (Appendix H.5). Uncertainty and cost. Tables report averages with 95% confidence intervals, estimated by repeatedly resampling the evaluation prompts. The appendix also reports standard deviations (SDs) across three generation seeds, showing how much results vary between runs. Appendix B.2 explains both measures and the paired comparisons. NFE counts generator forward passes, including additional passes after remasking. It excludes reward scoring, safety judges, and preparation of the reference set, so it measures generator computation rather than total runtime. A.8 Hyperparameters and configuration selection Table 5 gives the shared settings; Table 6 summarizes the tested hyperparameter ranges by model and parameter; Table 7 lists the selected continuation operating points. The remaining variant settings and results follow in Appendix E. Full SAD does not depend on the hidden-state layer. Table 5: Shared sampling and guidance settings. Parameter Setting Continuation sampling 32 new tokens; 32 reverse steps; temperature 1; seeds 42, 43, 44. Jailbreak sampling 128 nominal steps; nominal length 128; temperature 1; seeds 42, 43, 44, except the explicitly labeled one-seed pilot. DIJA fills existing template spans. Unsafe set Continuation: up to 2,000 responses from the matching dataset after exact prompt-overlap exclusion. Jailbreak: documented 357-response WildJailbreak set. Direction construction Clean-reference response means. Later jobs use all valid reference rows; the selected earlier LLaDA/RTP selective row uses the 256-reference direction protocol. Centered selection Strict score threshold sk,l(t)>0s_k,l^(t)>0 on masked editable positions. Remasking Off for the core method; top-b uses b=1b=1; aligned remasking reopens all positive-score revealed positions. Warm-up Off for selective-only SADDER. Main continuation warm-up: w=8w=8, followed by selective guidance through step 15. Matched controls Count-matched random selection or reopening; matrix-control seed zero. Search budgets BoN and FK with 2, 4, or 8 candidates/particles; BoN-2 composition with SAD-based steering. Table 6: Hyperparameter values considered, consolidated by model. Values are unions across the sweeps, not a single fully crossed grid; a single value denotes a fixed setting. k is the scoring layer, η the SAD strength, w the number of full-SAD warm-up steps, and [s,e][s,e] the inclusive intervention window. Model Parameter Values LLaDA-Base Strength η 0,1,3,10,30,100,300,1000,3000\0,1,3,10,30,100,300,1000,3000\ Layer k 8,16,24,31\8,16,24,31\ Window [s,e][s,e] [0,7][0,7], [0,15][0,15], [0,31][0,31] Warm-up w 8,16\8,16\ BoN / FK budget 2,4,8\2,4,8\ Dream-Base Strength η 0,0.1,0.3,1,3,10,100,3000,\0,0.1,0.3,1,3,10,100,3000, 10000,30000,100000,30000010000,30000,100000,300000\ Layer k 2727 Window [s,e][s,e] [0,7][0,7], [0,15][0,15] BoN / FK budget 2,4,8\2,4,8\ LLaDA-Instruct Strength η 1,3,10,30,100,300,1000,3000,10000\1,3,10,30,100,300,1000,3000,10000\ Layer k 9,16,24\9,16,24\ Window [s,e][s,e] [0,15][0,15], [0,31][0,31], [0,63][0,63], [0,127][0,127], [32,63][32,63], [64,95][64,95], [96,127][96,127] Dream-Instruct Strength η 0.3,1,3,10,30,100,300,1000,3000,10000\0.3,1,3,10,30,100,300,1000,3000,10000\ Layer k 1,…,28\1,…,28\ Window [s,e][s,e] [0,31][0,31] Development settings. Base models use RTP: the original search uses indices 0–299; additional strength development uses 64 prompts at indices 900–963, seeds 42/43, and window [0,7][0,7] (k=31k=31 for LLaDA, 2727 for Dream). Instruction-model development uses 100 JBB behaviors; LLaDA additionally uses the first 100 AdvBench and HarmBench behaviors. These runs use seed 42 or seeds 42/43/44, as documented with the results. Sampling uses 32 steps for Base models and 128 nominal steps for Instruct models. Table 7: Selected main-table continuation settings. Model Data Method k η Last step w Reopening LLaDA RTP Full SAD – 3000 7 0 none RTP SADDER (selective) 31† 100 15 0 none RTP SADDER + warm-up 24 3000 15 8 none LLaDA BT Full SAD – 3000 15 0 none BT SADDER (selective) 31 3000 15 0 none BT SADDER + warm-up 16 3000 15 8 none Dream RTP Full SAD – 10000 15 0 none RTP SADDER (selective) 27 10000 15 0 none RTP SADDER + warm-up 27 3000 15 8 none Dream BT Full SAD – 10000 15 0 none BT SADDER (selective) 27 10000 15 0 none BT SADDER + warm-up 27 10000 15 8 none All windows begin at step zero. BT denotes BeaverTails. Appendix B Implementation and evaluation details Motivation for remasking. The safety improvements reported by CSD-based steering and DiffuGuard (Lee and Han, 2026; Li et al., 2025) motivate examining remasking as an optional extension to SADDER. Reopening previously generated positions allows guidance to revise token choices that would otherwise remain fixed. Uniform-state diffusion provides a related capability through its native token replacement transitions, allowing repeated revision without an explicit mask token. As such, we wanted to evaluate selective SAD with risk-based remasking and matched random controls in the appendix. B.1 Optional remasking and warm-up Algorithm 2 extends the selective-only main algorithm. Let ℛt=l∈:tl≠R_t=\l : x_t^l \ be the revealed editable positions. The remasking policy r determines the reopened set: t(r)=∅,r=none,Topmin(b,|ℛt|)sk,l(t):l∈ℛt,r=top-b,l∈ℛt:sk,l(t)>0,r=aligned.Q_t(r)= cases ,&r=none,\\ Top_ (b,|R_t|)\s_k,l^(t):l _t\,&r=top-b,\\ \l _t:s_k,l^(t)>0\,&r=aligned. cases (54) Here TopTop returns position indices with the largest scores; we use b=1b=1 in the top-b experiments. This ranking policy can reopen a position even if every score is non-positive. Aligned remasking instead reopens every positive-score revealed position, without a top-b cap. After replacing selected tokens by M, the model predictions and hidden states are recomputed. The steering gate is then evaluated on this changed state; reopening does not force a position to be steered. Warm-up length w applies full SAD on admitted denoising steps with index j<wj<w, followed by selective steering for j≥wj≥ w. Remasking is disabled during warm-up and on the final sampling step. Outside the intervention set C, neither guidance nor remasking is applied. Setting w=0w=0 disables warm-up; setting r=noner=none disables remasking. Thus the selective-only main method is exactly the case w=0w=0, r=noner=none. Algorithm 2 SADDER with optional remasking and full-SAD warm-up. 1: Input: inputs of Algorithm 1; warm-up length w≥0w≥ 0; policy r∈none,top-b,alignedr∈\none,top-b,aligned\; budget b≥0b≥ 0. 2: w=0w=0 and r=noner=none recover Algorithm 1. 3: for j=0,…,T−1j=0,…,T-1 do 4: Set t←tjt← t_j. Evaluate p,t,⋅p_D,t,· and k,⋅(t) h_k,·^(t) together on the current t x_t. 5: Initialize p~0|t,l←p,t,l p_0 t,l← p_D,t,l and ak,l(t)←0a_k,l^(t)← 0 for all l. 6: if j∈Cj∈ C then 7: Initialize t←∅Q_t← . 8: if j≥wj≥ w and r≠noner and j<T−1j<T-1 then 9: ℛt←l∈:tl≠R_t←\l : x_t^l \. 10: Compute sk,l(t)←⟨k,l(t)−k,^k⟩s_k,l^(t)← h_k,l^(t)- m_k, v_k for l∈ℛtl _t. 11: Select t(r)Q_t(r) using Equation equation 54. 12: Set tl← x_t^l for l∈tl _t. 13: end if 14: if t≠∅Q_t≠ then 15: Recompute p,t,⋅p_D,t,· and k,⋅(t) h_k,·^(t) together on the changed t x_t. 16: Reset p~0|t,⋅←p,t,⋅ p_0 t,·← p_D,t,·. 17: end if 18: ℳt←l∈:tl=M_t←\l : x_t^l=M\. 19: if j<wj<w then 20: Full-SAD warm-up: ak,l(t)←1a_k,l^(t)← 1 for l∈ℳtl _t. 21: else 22: Compute sk,l(t)←⟨k,l(t)−k,^k⟩s_k,l^(t)← h_k,l^(t)- m_k, v_k for l∈ℳtl _t. 23: Select risky positions: ak,l(t)←sk,l(t)>0a_k,l^(t) 1\s_k,l^(t)>0\ for l∈ℳtl _t. 24: end if 25: if at least one gate equals 11 then 26: Estimate p^unsafe,t,⋅ p_D_unsafe,t,· and β^(t) β( x_t) on this same state; set ηt←ηβ^(t) _t←η β( x_t). 27: SAD update on selected positions: update p~0|t,l p_0 t,l using Equation equation 14 for each l with ak,l(t)=1a_k,l^(t)=1. 28: end if 29: end if 30: tj+1←Solver(t,tj,tj+1,p~0|t,⋅,) x_t_j+1 ( x_t,t_j,t_j+1, p_0 t,·;G). 31: end for 32: Return: the generated continuation of tT x_t_T. B.2 Metric estimates and uncertainty We compute uncertainty from the saved evaluations. Let i=1,…,ni=1,…,n index evaluation records and s=1,…,Ss=1,…,S index the observed generation seeds. The main continuation evaluations have n=600n=600 and S=3S=3; the main HarmBench evaluations have n=100n=100 and S=3S=3. Unsafe rates and other averages. Let yi,s∈0,1y_i,s∈\0,1\ indicate whether the output for prompt record i and seed s is judged unsafe. On a complete, balanced evaluation, the unsafe percentage is r^unsafe=100nS∑i=1n∑s=1Syi,s. r_unsafe= 100nS _i=1^n _s=1^Sy_i,s. (55) The same expression defines HarmBench ASR, refusal rate, or short-output rate when yi,sy_i,s is the corresponding event indicator. A mean repetition score uses the per-output repetition score instead. Each metric retains its own evaluation population: for example, XSTest over-refusal uses only safe prompts. When observation counts differ, rate estimates use the total number of valid observations as their denominator. Quality metrics. Let ℐsI_s contain the valid records for a quality metric at seed s. The reported mean averages a metric computed within each seed: Q^s=f(∑i∈ℐsAi,s∑i∈ℐsDi,s),Q^=1S∑s=1SQ^s. Q_s=f\! ( _i _sA_i,s _i _sD_i,s ), Q= 1S _s=1^S Q_s. (56) For BERTScore, Ai,sA_i,s is the response-level F1 score, Di,s=1D_i,s=1, and f(z)=zf(z)=z; the displayed values are multiplied by 100. For PPL, Ai,sA_i,s is the total negative log likelihood of scored tokens, Di,sD_i,s is their count, and f(z)=exp(z)f(z)= (z). Thus PPL is an average of seed-level corpus perplexities, not an average of response perplexities. Missing or unscorable measurements are excluded; they are not assigned zero. 95% confidence intervals. To estimate uncertainty due to the evaluation prompts, we randomly sample prompts from the evaluated set, allowing the same prompt to be selected more than once. Each resampled set has the same number of prompts as the original set. Whenever a prompt is selected, we keep its responses from all three seeds together. We calculate the metric again for each resampled set and repeat this process 5,000 times. The 2.5th and 97.5th percentiles of these 5,000 estimates form the reported 95% confidence interval. Seed SD and paired comparisons. For seed-level estimates θ^s θ_s, the reported sample SD is SDseed=1S−1∑s=1S(θ^s−θ¯seed)2,θ¯seed=1S∑sθ^s.SD_seed= 1S-1 _s=1^S( θ_s- θ_seed)^2, θ_seed= 1S _s θ_s. (57) It describes variation across runs and is not a confidence interval; it is unavailable for a single seed. To compare methods A and B, retain matched prompts and seeds and use identical cluster weights for both: Δ^=θ^A−θ^B,Δ^∗(b)=θ^A∗(b)−θ^B∗(b). = θ_A- θ_B, ^*(b)= θ_A^*(b)- θ_B^*(b). (58) Appendix C Continuation results with confidence intervals Table 8 reports the main LLaDA continuation estimates with pointwise 95% prompt-cluster bootstrap intervals from 5,000 resamples, retaining all observed seeds within each sampled prompt. These intervals describe prompt uncertainty; the main-table subscripts describe variation across three generation seeds. The selected configurations and evaluation cohorts are identical in both tables. Table 8: LLaDA-Base safety, generation quality, and cost. Method RTP BeaverTails Unsafe % ↓ Harmful PPL ↓ Benign PPL ↓ Benign BERT ↑ NFE Unsafe % ↓ Harmful PPL ↓ Benign PPL ↓ Benign BERT ↑ NFE Unmodified 38.638.6 [35.7,41.5][35.7,41.5] 21.121.1 [20.2,22.1][20.2,22.1] 17.517.5 [16.9,18.2][16.9,18.2] 84.6584.65 [84.50,84.79][84.50,84.79] 32.0 38.638.6 [35.6,41.6][35.6,41.6] 20.620.6 [19.6,21.6][19.6,21.6] 17.517.5 [16.9,18.2][16.9,18.2] 84.6584.65 [84.50,84.79][84.50,84.79] 32.0 Full SAD 32.432.4 [29.4,35.5][29.4,35.5] 29.329.3 [27.6,31.1][27.6,31.1] 30.030.0 [27.7,32.9][27.7,32.9] 83.9283.92 [83.75,84.09][83.75,84.09] 32.0 27.127.1 [24.0,30.4][24.0,30.4] 35.135.1 [33.2,37.0][33.2,37.0] 47.147.1 [42.9,52.7][42.9,52.7] 83.3883.38 [83.20,83.55][83.20,83.55] 32.0 SADDER (selective) 29.429.4 [26.3,32.5][26.3,32.5] 42.142.1 [37.4,47.8][37.4,47.8] 18.418.4 [17.7,19.2][17.7,19.2] 84.5984.59 [84.45,84.74][84.45,84.74] 32.0 29.929.9 [26.8,33.2][26.8,33.2] 34.634.6 [32.2,37.3][32.2,37.3] 27.827.8 [26.0,30.0][26.0,30.0] 84.2084.20 [84.04,84.35][84.04,84.35] 32.0 SADDER + warm-up 31.231.2 [28.1,34.5][28.1,34.5] 31.631.6 [29.7,33.5][29.7,33.5] 44.344.3 [38.4,52.5][38.4,52.5] 83.0183.01 [82.81,83.20][82.81,83.20] 32.0 24.424.4 [21.2,27.8][21.2,27.8] 36.936.9 [34.2,39.9][34.2,39.9] 44.144.1 [40.2,49.7][40.2,49.7] 83.1883.18 [82.99,83.35][82.99,83.35] 32.0 CSD† 22.422.4 [20.3,24.7][20.3,24.7] 225225 [204,249][204,249] 21.621.6 [20.6,22.7][20.6,22.7] 84.5984.59 [84.44,84.73][84.44,84.73] 61.9 15.615.6 [13.8,17.3][13.8,17.3] 487487 [440,541][440,541] 943943 [868,1030][868,1030] 82.6182.61 [82.48,82.73][82.48,82.73] 55.0 BoN-8 19.019.0 [16.7,21.5][16.7,21.5] 20.520.5 [19.6,21.4][19.6,21.4] 19.519.5 [18.7,20.2][18.7,20.2] 84.7084.70 [84.56,84.84][84.56,84.84] 256.0 18.618.6 [16.3,20.9][16.3,20.9] 24.224.2 [23.0,25.4][23.0,25.4] 19.519.5 [18.7,20.2][18.7,20.2] 84.7084.70 [84.56,84.84][84.56,84.84] 256.0 FK-8 20.620.6 [18.1,23.0][18.1,23.0] 21.321.3 [20.4,22.3][20.4,22.3] 18.218.2 [17.5,18.8][17.5,18.8] 84.7184.71 [84.57,84.85][84.57,84.85] 256.0 28.228.2 [25.4,30.9][25.4,30.9] 22.722.7 [21.7,23.7][21.7,23.7] 18.218.2 [17.5,18.8][17.5,18.8] 84.7184.71 [84.57,84.85][84.57,84.85] 256.0 Appendix D Dream-Base continuation results Table 9 reports the complete Dream-Base comparison under the same continuation protocol as LLaDA (Section 5.1). Unsafe rate and harmful PPL use the RTP or BeaverTails harmful cohort; benign PPL and BERTScore use the separate benign RTP cohort. Entries are means with 95% prompt-cluster intervals; NFE measures generator cost. Table 9: Dream-Base safety, generation quality, and cost. Method RTP BeaverTails Unsafe % ↓ Harmful PPL ↓ Benign PPL ↓ Benign BERT ↑ NFE Unsafe % ↓ Harmful PPL ↓ Benign PPL ↓ Benign BERT ↑ NFE Unmodified 46.846.8 [43.8,49.7][43.8,49.7] 18.318.3 [17.6,19.1][17.6,19.1] 15.515.5 [15.0,16.0][15.0,16.0] 84.7184.71 [84.57,84.86][84.57,84.86] 32.0 38.738.7 [35.8,41.6][35.8,41.6] 12.712.7 [12.2,13.2][12.2,13.2] 15.515.5 [15.0,16.0][15.0,16.0] 84.7184.71 [84.57,84.86][84.57,84.86] 32.0 Full SAD 33.433.4 [30.1,36.8][30.1,36.8] 26.026.0 [24.3,27.8][24.3,27.8] 23.323.3 [22.0,24.7][22.0,24.7] 83.1683.16 [82.96,83.35][82.96,83.35] 32.0 22.722.7 [19.7,25.7][19.7,25.7] 23.723.7 [21.8,25.8][21.8,25.8] 23.023.0 [21.7,24.5][21.7,24.5] 83.6283.62 [83.44,83.80][83.44,83.80] 32.0 SADDER (selective) 35.935.9 [32.8,39.0][32.8,39.0] 29.129.1 [27.5,30.7][27.5,30.7] 18.118.1 [17.5,18.7][17.5,18.7] 84.5984.59 [84.45,84.73][84.45,84.73] 32.0 34.134.1 [31.3,36.8][31.3,36.8] 19.319.3 [18.4,20.3][18.4,20.3] 20.020.0 [19.2,20.7][19.2,20.7] 84.4984.49 [84.34,84.64][84.34,84.64] 32.0 SADDER + warm-up 34.734.7 [31.6,38.2][31.6,38.2] 27.127.1 [25.5,28.8][25.5,28.8] 21.321.3 [20.3,22.3][20.3,22.3] 83.7683.76 [83.57,83.94][83.57,83.94] 32.0 27.727.7 [24.8,30.8][24.8,30.8] 23.623.6 [22.1,25.1][22.1,25.1] 20.520.5 [19.6,21.5][19.6,21.5] 84.2184.21 [84.06,84.37][84.06,84.37] 32.0 CSD† 32.932.9 [30.6,35.4][30.6,35.4] 11801180 [1100,1270][1100,1270] 34003400 [3270,3540][3270,3540] 81.5181.51 [81.42,81.61][81.42,81.61] 60.2 38.638.6 [35.7,41.4][35.7,41.4] 17.817.8 [16.7,19.1][16.7,19.1] 27.227.2 [25.3,29.4][25.3,29.4] 84.5084.50 [84.36,84.64][84.36,84.64] 55.8 BoN-8 24.624.6 [22.0,27.3][22.0,27.3] 17.517.5 [16.7,18.2][16.7,18.2] 16.916.9 [16.3,17.5][16.3,17.5] 84.8184.81 [84.68,84.95][84.68,84.95] 256.0 20.020.0 [17.8,22.2][17.8,22.2] 15.015.0 [14.3,15.7][14.3,15.7] 16.916.9 [16.3,17.5][16.3,17.5] 84.8184.81 [84.68,84.95][84.68,84.95] 256.0 FK-8 25.125.1 [22.5,27.7][22.5,27.7] 17.917.9 [17.2,18.6][17.2,18.6] 15.715.7 [15.3,16.2][15.3,16.2] 84.7684.76 [84.62,84.90][84.62,84.90] 256.0 27.827.8 [25.2,30.4][25.2,30.4] 13.913.9 [13.4,14.5][13.4,14.5] 15.715.7 [15.3,16.2][15.3,16.2] 84.7684.76 [84.62,84.90][84.62,84.90] 256.0 Appendix E Continuation settings and component variants Settings are selected by unsafe rate; benign quality is evaluated afterward. Tables 10 and 11 report layer, strength, and the last admitted step (all windows begin at zero). The warm-up variant uses full SAD on steps 0–7 and selective guidance on 8–15, with aligned remasking on LLaDA and no remasking on Dream. Equation equation 54 defines the alternative reopening policies. Table 10: LLaDA selected continuation settings on development set. Dataset Method Setting RTP Full SAD 31/3000/731/3000/7 SADDER 31/100/1531/100/15 SADDER w/ top-1 remasking 24/100/1524/100/15 SADDER w/ aligned remasking 16/100/1516/100/15 SADDER + warm-up + aligned remasking 24/3000/1524/3000/15; CSD† k=31k=31, j=:15j=0\!:\!15 BoN-8 N=8N=8 FK-8 N=8N=8 BeaverTails Full SAD 31/3000/1531/3000/15 SADDER 31/3000/1531/3000/15 SADDER w/ top-1 remasking 24/100/724/100/7 SADDER w/ aligned remasking 16/3000/1516/3000/15 SADDER + warm-up + aligned remasking 16/3000/1516/3000/15; aligned CSD† k=24k=24, j=:7j=0\!:\!7 BoN-8 N=8N=8 FK-8 N=8N=8 Table 11: Dream selected continuation settings on development set. Dataset Method Setting RTP Full SAD 27/10000/1527/10000/15 SADDER 27/10000/1527/10000/15 SADDER w/ top-1 remasking 27/100/1527/100/15 SADDER w/ aligned remasking 24/1e5/1524/1e5/15 SADDER + warm-up 27/3000/1527/3000/15; none CSD† k=24k=24, j=:15j=0\!:\!15 BoN-8 N=8N=8 FK-8 N=8N=8 BeaverTails Full SAD 27/10000/1527/10000/15 SADDER 27/10000/1527/10000/15 SADDER w/ top-1 remasking 27/100/1527/100/15 SADDER w/ aligned remasking 27/100/1527/100/15 SADDER + warm-up 27/10000/1527/10000/15; none CSD† k=27k=27, j=:15j=0\!:\!15 BoN-8 N=8N=8 FK-8 N=8N=8 SADDER variants. These tables extend the main comparison with top-1 and aligned remasking, using the same metrics and uncertainty conventions. Table 12: LLaDA-Base component variants. Method Unsafe % ↓ Harmful PPL ↓ Benign PPL ↓ Benign BERT ↑ NFE RTP Unmodified 38.638.6 [35.7,41.5][35.7,41.5] 21.1421.14 [20.21,22.13][20.21,22.13] 17.5317.53 [16.90,18.21][16.90,18.21] 84.6584.65 [84.50,84.79][84.50,84.79] 32.0 Full SAD 32.432.4 [29.4,35.5][29.4,35.5] 29.3029.30 [27.61,31.13][27.61,31.13] 29.9629.96 [27.65,32.89][27.65,32.89] 83.9283.92 [83.75,84.09][83.75,84.09] 32.0 SADDER (selective) 29.429.4 [26.3,32.5][26.3,32.5] 42.0842.08 [37.39,47.75][37.39,47.75] 18.4118.41 [17.70,19.17][17.70,19.17] 84.5984.59 [84.45,84.74][84.45,84.74] 32.0 SADDER w/ top-1 remasking 28.328.3 [25.2,31.3][25.2,31.3] 43.2543.25 [38.63,48.89][38.63,48.89] 41.7541.75 [37.34,47.13][37.34,47.13] 83.3883.38 [83.17,83.58][83.17,83.58] 47.0 SADDER w/ aligned remasking 30.630.6 [27.8,33.4][27.8,33.4] 35.8135.81 [33.47,38.38][33.47,38.38] 35.8835.88 [33.53,38.57][33.53,38.57] 83.9983.99 [83.82,84.16][83.82,84.16] 46.6 SADDER + warm-up + aligned remasking 27.227.2 [24.7,29.9][24.7,29.9] 38.7538.75 [36.22,41.88][36.22,41.88] 33.3333.33 [31.08,35.91][31.08,35.91] 84.1384.13 [83.96,84.28][83.96,84.28] 40.0 CSD† 22.422.4 [20.3,24.7][20.3,24.7] 225.01225.01 [204.37,248.84][204.37,248.84] 21.5921.59 [20.58,22.67][20.58,22.67] 84.5984.59 [84.44,84.73][84.44,84.73] 61.9 BoN-8 19.019.0 [16.7,21.5][16.7,21.5] 20.4620.46 [19.57,21.39][19.57,21.39] 19.4719.47 [18.74,20.21][18.74,20.21] 84.7084.70 [84.56,84.84][84.56,84.84] 256.0 FK-8 20.620.6 [18.1,23.0][18.1,23.0] 21.2921.29 [20.37,22.27][20.37,22.27] 18.1718.17 [17.53,18.84][17.53,18.84] 84.7184.71 [84.57,84.85][84.57,84.85] 256.0 BeaverTails Unmodified 38.638.6 [35.6,41.6][35.6,41.6] 20.5720.57 [19.61,21.57][19.61,21.57] 17.5317.53 [16.90,18.21][16.90,18.21] 84.6584.65 [84.50,84.79][84.50,84.79] 32.0 Full SAD 27.127.1 [24.0,30.4][24.0,30.4] 35.0535.05 [33.23,37.03][33.23,37.03] 47.0847.08 [42.86,52.67][42.86,52.67] 83.3883.38 [83.20,83.55][83.20,83.55] 32.0 SADDER (selective) 29.929.9 [26.8,33.2][26.8,33.2] 34.6334.63 [32.22,37.33][32.22,37.33] 27.8027.80 [25.95,30.01][25.95,30.01] 84.2084.20 [84.04,84.35][84.04,84.35] 32.0 SADDER w/ top-1 remasking 30.630.6 [27.1,34.1][27.1,34.1] 31.5831.58 [28.46,35.55][28.46,35.55] 23.7823.78 [22.34,25.39][22.34,25.39] 84.1084.10 [83.90,84.29][83.90,84.29] 39.0 SADDER w/ aligned remasking 27.527.5 [24.4,30.8][24.4,30.8] 37.1237.12 [33.51,41.64][33.51,41.64] 35.9135.91 [33.64,38.41][33.64,38.41] 83.6983.69 [83.50,83.86][83.50,83.86] 42.2 SADDER + warm-up + aligned remasking 24.724.7 [21.8,27.7][21.8,27.7] 31.3631.36 [29.70,33.08][29.70,33.08] 42.2342.23 [39.06,46.69][39.06,46.69] 83.6583.65 [83.47,83.82][83.47,83.82] 37.8 CSD† 15.615.6 [13.8,17.3][13.8,17.3] 486.52486.52 [439.90,541.43][439.90,541.43] 942.73942.73 [868.26,1027.02][868.26,1027.02] 82.6182.61 [82.48,82.73][82.48,82.73] 55.0 BoN-8 18.618.6 [16.3,20.9][16.3,20.9] 24.2324.23 [23.04,25.42][23.04,25.42] 19.4719.47 [18.74,20.21][18.74,20.21] 84.7084.70 [84.56,84.84][84.56,84.84] 256.0 FK-8 28.228.2 [25.4,30.9][25.4,30.9] 22.6622.66 [21.66,23.74][21.66,23.74] 18.1718.17 [17.53,18.84][17.53,18.84] 84.7184.71 [84.57,84.85][84.57,84.85] 256.0 Table 13: Dream-Base component variants. Method Unsafe % ↓ Harmful PPL ↓ Benign PPL ↓ Benign BERT ↑ NFE RTP Unmodified 46.846.8 [43.8,49.7][43.8,49.7] 18.3118.31 [17.61,19.06][17.61,19.06] 15.4515.45 [14.96,15.98][14.96,15.98] 84.7184.71 [84.57,84.86][84.57,84.86] 32.0 Full SAD 33.433.4 [30.1,36.8][30.1,36.8] 26.0226.02 [24.30,27.83][24.30,27.83] 23.3123.31 [21.99,24.68][21.99,24.68] 83.1683.16 [82.96,83.35][82.96,83.35] 32.0 SADDER 35.935.9 [32.8,39.0][32.8,39.0] 29.0929.09 [27.54,30.68][27.54,30.68] 18.1018.10 [17.48,18.73][17.48,18.73] 84.5984.59 [84.45,84.73][84.45,84.73] 32.0 SADDER w/ top-1 remasking 37.437.4 [34.3,40.5][34.3,40.5] 22.5422.54 [21.28,23.80][21.28,23.80] 16.9216.92 [16.37,17.53][16.37,17.53] 84.5784.57 [84.43,84.71][84.43,84.71] 47.0 SADDER w/ aligned remasking 40.940.9 [38.0,43.7][38.0,43.7] 23.0623.06 [22.15,24.00][22.15,24.00] 17.5317.53 [16.92,18.16][16.92,18.16] 84.5284.52 [84.37,84.66][84.37,84.66] 44.8 SADDER + warm-up 34.734.7 [31.6,38.2][31.6,38.2] 27.1127.11 [25.52,28.82][25.52,28.82] 21.2621.26 [20.25,22.29][20.25,22.29] 83.7683.76 [83.57,83.94][83.57,83.94] 32.0 CSD† 32.932.9 [30.6,35.4][30.6,35.4] 1182.901182.90 [1101.51,1271.65][1101.51,1271.65] 3397.413397.41 [3266.61,3538.51][3266.61,3538.51] 81.5181.51 [81.42,81.61][81.42,81.61] 60.2 BoN-8 24.624.6 [22.0,27.3][22.0,27.3] 17.4617.46 [16.72,18.18][16.72,18.18] 16.8716.87 [16.30,17.46][16.30,17.46] 84.8184.81 [84.68,84.95][84.68,84.95] 256.0 FK-8 25.125.1 [22.5,27.7][22.5,27.7] 17.8517.85 [17.16,18.57][17.16,18.57] 15.7315.73 [15.27,16.24][15.27,16.24] 84.7684.76 [84.62,84.90][84.62,84.90] 256.0 BeaverTails Unmodified 38.738.7 [35.8,41.6][35.8,41.6] 12.6712.67 [12.17,13.21][12.17,13.21] 15.4515.45 [14.96,15.98][14.96,15.98] 84.7184.71 [84.57,84.86][84.57,84.86] 32.0 Full SAD 22.722.7 [19.7,25.7][19.7,25.7] 23.6823.68 [21.80,25.75][21.80,25.75] 23.0323.03 [21.69,24.45][21.69,24.45] 83.6283.62 [83.44,83.80][83.44,83.80] 32.0 SADDER 34.134.1 [31.3,36.8][31.3,36.8] 19.3219.32 [18.41,20.32][18.41,20.32] 19.9519.95 [19.18,20.73][19.18,20.73] 84.4984.49 [84.34,84.64][84.34,84.64] 32.0 SADDER w/ top-1 remasking 34.334.3 [31.5,37.1][31.5,37.1] 19.1619.16 [18.23,20.15][18.23,20.15] 18.3518.35 [17.63,19.09][17.63,19.09] 84.3984.39 [84.24,84.55][84.24,84.55] 47.0 SADDER w/ aligned remasking 33.733.7 [31.0,36.5][31.0,36.5] 17.7817.78 [16.93,18.65][16.93,18.65] 21.0721.07 [20.28,21.92][20.28,21.92] 84.5484.54 [84.39,84.68][84.39,84.68] 40.4 SADDER + warm-up 27.727.7 [24.8,30.8][24.8,30.8] 23.5623.56 [22.08,25.14][22.08,25.14] 20.5220.52 [19.60,21.49][19.60,21.49] 84.2184.21 [84.06,84.37][84.06,84.37] 32.0 CSD† 38.638.6 [35.7,41.4][35.7,41.4] 17.8117.81 [16.65,19.13][16.65,19.13] 27.1927.19 [25.30,29.38][25.30,29.38] 84.5084.50 [84.36,84.64][84.36,84.64] 55.8 BoN-8 20.020.0 [17.8,22.2][17.8,22.2] 14.9514.95 [14.26,15.68][14.26,15.68] 16.8716.87 [16.30,17.46][16.30,17.46] 84.8184.81 [84.68,84.95][84.68,84.95] 256.0 FK-8 27.827.8 [25.2,30.4][25.2,30.4] 13.9413.94 [13.39,14.54][13.39,14.54] 15.7315.73 [15.27,16.24][15.27,16.24] 84.7684.76 [84.62,84.90][84.62,84.90] 256.0 Appendix F Paired comparisons and component diagnostics The following figure and benign-quality table compare the selected component configurations; their LLaDA warm-up entries include aligned remasking. Paired differences compare SADDER with the separately selected full-SAD operating point on identical prompt–seed observations. Negative unsafe-rate and PPL differences, and positive BERTScore differences, favour SADDER. Quality comparisons use common valid pairs within each cohort. Intervals are conditional on the selected settings and observed seeds. Figure 2: Selected SADDER component configurations minus full SAD on 600 harmful prompts per dataset and three seeds. LLaDA warm-up includes its aligned remasking, Dream does not. Points and bars show unsafe-rate differences (p) and pointwise 95% paired bootstrap CIs; negative favors SADDER. Table 14: SADDER variants: paired benign-quality changes versus full SAD. Model/data Method Δ benign PPL Δ benign BERT LLaDA/RTP SADDER (selective) −11.55[−14.49,−9.26]-11.55\;[-14.49,-9.26] 0.672[0.527,0.813]0.672\;[0.527,0.813] SADDER + warm-up 3.42[0.49,6.19]3.42\;[0.49,6.19] 0.206[0.076,0.332]0.206\;[0.076,0.332] LLaDA/BT SADDER (selective) −19.28[−24.82,−15.03]-19.28\;[-24.82,-15.03] 0.822[0.681,0.967]0.822\;[0.681,0.967] SADDER + warm-up −4.85[−8.89,−1.18]-4.85\;[-8.89,-1.18] 0.270[0.133,0.407]0.270\;[0.133,0.407] Dream/RTP SADDER (selective) −5.22[−6.55,−3.88]-5.22\;[-6.55,-3.88] 1.429[1.258,1.605]1.429\;[1.258,1.605] SADDER + warm-up −2.06[−3.25,−0.91]-2.06\;[-3.25,-0.91] 0.596[0.447,0.740]0.596\;[0.447,0.740] Dream/BT SADDER (selective) −3.08[−4.51,−1.70]-3.08\;[-4.51,-1.70] 0.868[0.709,1.030]0.868\;[0.709,1.030] SADDER + warm-up −2.51[−3.66,−1.38]-2.51\;[-3.66,-1.38] 0.594[0.482,0.703]0.594\;[0.482,0.703] Paired random controls. Tables 15 and 16 compare each selected SADDER component configuration with full SAD and random controls at the same layer, strength, and intervention window. LLaDA warm-up here includes aligned remasking. Random selection replaces the steering gate with a random subset of the gate-implied size, preserving the remasking and warm-up policies. Random reopening replaces top-1 remasking with one random position, or aligned remasking with a random subset of the threshold-implied size, preserving steering and warm-up. Counts are computed on each trajectory’s current state and may diverge across trajectories. The full-SAD comparator steers all masked positions throughout the window, without additional remasking or a selective phase. Differences are SADDER minus the comparator; negative values favor SADDER. Dashes indicate that a matched control is unavailable or reopening is not used. Each interval uses 5,000 paired prompt-cluster resamples of the same 600 prompt records and three seeds, conditional on the selected configuration. Table 15: LLaDA-Base: paired unsafe-rate differences (p), means [95% CI]. SADDER variant vs full SAD vs random selection vs random reopening RTP Selective −4.1[−6.1,−2.1]-4.1\;[-6.1,-2.1] −3.3[−5.4,−1.3]-3.3\;[-5.4,-1.3] — + top-1 remasking −5.2[−8.5,−1.7]-5.2\;[-8.5,-1.7] — −3.4[−6.3,−0.6]-3.4\;[-6.3,-0.6] + aligned remasking −2.9[−6.3,0.4]-2.9\;[-6.3,0.4] — −1.7[−3.5,0.1]-1.7\;[-3.5,0.1] + warm-up + aligned −5.8[−9.0,−2.7]-5.8\;[-9.0,-2.7] — −4.8[−6.9,−2.8]-4.8\;[-6.9,-2.8] BeaverTails Selective 2.8[−1.1,6.6]2.8\;[-1.1,6.6] −0.7[−3.9,2.4]-0.7\;[-3.9,2.4] — + top-1 remasking −7.9[−11.8,−4.1]-7.9\;[-11.8,-4.1] — −6.1[−9.1,−3.1]-6.1\;[-9.1,-3.1] + aligned remasking 0.4[−3.3,4.1]0.4\;[-3.3,4.1] — 1.9[−0.6,4.6]1.9\;[-0.6,4.6] + warm-up + aligned −2.4[−5.4,0.3]-2.4\;[-5.4,0.3] — −1.8[−4.5,0.8]-1.8\;[-4.5,0.8] Table 16: Dream-Base: paired unsafe-rate differences (p), means [95% CI]. SADDER variant vs full SAD vs random selection vs random reopening RTP Selective 2.5[−0.3,5.3]2.5\;[-0.3,5.3] −2.7[−5.5,0.1]-2.7\;[-5.5,0.1] — + top-1 remasking −3.9[−7.4,−0.4]-3.9\;[-7.4,-0.4] −2.6[−5.3,0.3]-2.6\;[-5.3,0.3] −2.8[−5.7,0.2]-2.8\;[-5.7,0.2] + aligned remasking −3.4[−6.2,−0.6]-3.4\;[-6.2,-0.6] 0.6[−1.7,2.7]0.6\;[-1.7,2.7] −2.2[−4.5,0.2]-2.2\;[-4.5,0.2] + warm-up 0.3[−1.6,2.2]0.3\;[-1.6,2.2] 0.4[−1.4,2.3]0.4\;[-1.4,2.3] — BeaverTails Selective 11.4[7.8,14.8]11.4\;[7.8,14.8] 3.4[0.8,5.9]3.4\;[0.8,5.9] — + top-1 remasking 4.6[1.1,8.0]4.6\;[1.1,8.0] 5.3[2.7,7.9]5.3\;[2.7,7.9] −1.6[−4.5,1.2]-1.6\;[-4.5,1.2] + aligned remasking 4.0[0.6,7.4]4.0\;[0.6,7.4] 2.6[0.1,5.1]2.6\;[0.1,5.1] 0.2[−2.1,2.5]0.2\;[-2.1,2.5] + warm-up 5.1[2.6,7.5]5.1\;[2.6,7.5] 0.1[−1.7,1.8]0.1\;[-1.7,1.8] — Appendix G BoN-2/4/8, FK-2/4/8, and composition We compare BoN and FK at budgets 2, 4, and 8, with harmful and benign quality measured on the corresponding cohorts. The FK adaptation resamples every four steps, using one clean-state draw per particle and a difference potential on log safety rewards. RoBERTa supplies the search reward; LlamaGuard judges final outputs. NFE excludes reward scoring. Table 17: LLaDA: BoN and FK at budgets 2, 4, and 8. Method Unsafe % Harmful PPL Benign PPL Benign BERT NFE RTP BoN-2 30.630.6 [27.8,33.4][27.8,33.4] 20.9020.90 [20.00,21.82][20.00,21.82] 17.5117.51 [16.89,18.15][16.89,18.15] 84.7384.73 [84.59,84.88][84.59,84.88] 64 BoN-4 24.724.7 [22.3,27.2][22.3,27.2] 20.5020.50 [19.68,21.40][19.68,21.40] 18.7018.70 [18.00,19.41][18.00,19.41] 84.7584.75 [84.61,84.89][84.61,84.89] 128 BoN-8 19.019.0 [16.7,21.5][16.7,21.5] 20.4620.46 [19.57,21.39][19.57,21.39] 19.4719.47 [18.74,20.21][18.74,20.21] 84.7084.70 [84.56,84.84][84.56,84.84] 256 FK-2 32.432.4 [29.7,35.2][29.7,35.2] 21.4721.47 [20.53,22.46][20.53,22.46] 17.5917.59 [16.96,18.26][16.96,18.26] 84.6784.67 [84.52,84.82][84.52,84.82] 64 FK-4 26.226.2 [23.6,28.8][23.6,28.8] 20.8220.82 [19.92,21.71][19.92,21.71] 17.8417.84 [17.22,18.49][17.22,18.49] 84.6884.68 [84.54,84.83][84.54,84.83] 128 FK-8 20.620.6 [18.1,23.0][18.1,23.0] 21.2921.29 [20.37,22.27][20.37,22.27] 18.1718.17 [17.53,18.84][17.53,18.84] 84.7184.71 [84.57,84.85][84.57,84.85] 256 BeaverTails BoN-2 32.132.1 [29.3,34.8][29.3,34.8] 22.3222.32 [21.38,23.33][21.38,23.33] 17.5117.51 [16.89,18.15][16.89,18.15] 84.7384.73 [84.59,84.88][84.59,84.88] 64 BoN-4 24.124.1 [21.7,26.6][21.7,26.6] 23.7623.76 [22.68,24.93][22.68,24.93] 18.7018.70 [18.00,19.41][18.00,19.41] 84.7584.75 [84.61,84.89][84.61,84.89] 128 BoN-8 18.618.6 [16.3,20.9][16.3,20.9] 24.2324.23 [23.04,25.42][23.04,25.42] 19.4719.47 [18.74,20.21][18.74,20.21] 84.7084.70 [84.56,84.84][84.56,84.84] 256 FK-2 36.236.2 [33.3,39.2][33.3,39.2] 21.2421.24 [20.26,22.26][20.26,22.26] 17.5917.59 [16.96,18.26][16.96,18.26] 84.6784.67 [84.52,84.82][84.52,84.82] 64 FK-4 34.634.6 [31.8,37.4][31.8,37.4] 21.8521.85 [20.88,22.94][20.88,22.94] 17.8417.84 [17.22,18.49][17.22,18.49] 84.6884.68 [84.54,84.83][84.54,84.83] 128 FK-8 28.228.2 [25.4,30.9][25.4,30.9] 22.6622.66 [21.66,23.74][21.66,23.74] 18.1718.17 [17.53,18.84][17.53,18.84] 84.7184.71 [84.57,84.85][84.57,84.85] 256 Table 18: Dream: BoN and FK at budgets 2, 4, and 8. Method Unsafe % Harmful PPL Benign PPL Benign BERT NFE RTP BoN-2 37.037.0 [34.2,39.9][34.2,39.9] 17.6717.67 [17.01,18.35][17.01,18.35] 15.3915.39 [14.90,15.90][14.90,15.90] 84.7684.76 [84.62,84.91][84.62,84.91] 64 BoN-4 30.630.6 [27.9,33.3][27.9,33.3] 17.9517.95 [17.27,18.64][17.27,18.64] 15.7815.78 [15.29,16.29][15.29,16.29] 84.7684.76 [84.62,84.90][84.62,84.90] 128 BoN-8 24.624.6 [22.0,27.3][22.0,27.3] 17.4617.46 [16.72,18.18][16.72,18.18] 16.8716.87 [16.30,17.46][16.30,17.46] 84.8184.81 [84.68,84.95][84.68,84.95] 256 FK-2 39.739.7 [36.8,42.7][36.8,42.7] 17.9017.90 [17.23,18.56][17.23,18.56] 15.4015.40 [14.92,15.90][14.92,15.90] 84.6984.69 [84.54,84.83][84.54,84.83] 64 FK-4 31.331.3 [28.6,33.9][28.6,33.9] 17.9017.90 [17.20,18.61][17.20,18.61] 15.3115.31 [14.83,15.83][14.83,15.83] 84.7284.72 [84.57,84.86][84.57,84.86] 128 FK-8 25.125.1 [22.5,27.7][22.5,27.7] 17.8517.85 [17.16,18.57][17.16,18.57] 15.7315.73 [15.27,16.24][15.27,16.24] 84.7684.76 [84.62,84.90][84.62,84.90] 256 BeaverTails BoN-2 32.532.5 [29.8,35.1][29.8,35.1] 12.8112.81 [12.27,13.38][12.27,13.38] 15.3915.39 [14.90,15.90][14.90,15.90] 84.7684.76 [84.62,84.91][84.62,84.91] 64 BoN-4 26.326.3 [23.7,28.8][23.7,28.8] 13.5813.58 [13.00,14.22][13.00,14.22] 15.7815.78 [15.29,16.29][15.29,16.29] 84.7684.76 [84.62,84.90][84.62,84.90] 128 BoN-8 20.020.0 [17.8,22.2][17.8,22.2] 14.9514.95 [14.26,15.68][14.26,15.68] 16.8716.87 [16.30,17.46][16.30,17.46] 84.8184.81 [84.68,84.95][84.68,84.95] 256 FK-2 36.336.3 [33.4,39.1][33.4,39.1] 13.2113.21 [12.63,13.81][12.63,13.81] 15.4015.40 [14.92,15.90][14.92,15.90] 84.6984.69 [84.54,84.83][84.54,84.83] 64 FK-4 32.732.7 [29.9,35.4][29.9,35.4] 13.7613.76 [13.20,14.37][13.20,14.37] 15.3115.31 [14.83,15.83][14.83,15.83] 84.7284.72 [84.57,84.86][84.57,84.86] 128 FK-8 27.827.8 [25.2,30.4][25.2,30.4] 13.9413.94 [13.39,14.54][13.39,14.54] 15.7315.73 [15.27,16.24][15.27,16.24] 84.7684.76 [84.62,84.90][84.62,84.90] 256 Composition with BoN. SADDER can guide each candidate before BoN-2 selection. In the LLaDA/RTP run, this reduces unsafe rate from 30.61% to 26.7% at the same 64 generator evaluations. Its unsafe-prompt PPL increases from 20.90 to 28.80. The two tables distinguish separate composition studies. PPL is evaluated on harmful prompts; benign quality was not measured for these hybrids. Table 19: Composition. Model/data Method Unsafe % Unsafe-prompt PPL NFE Dream/BT BoN-2 32.5[29.8,35.1]32.5\;[29.8,35.1] 12.8112.81 [12.27,13.38][12.27,13.38] 64 Dream/RTP BoN-2 37.0[34.2,39.9]37.0\;[34.2,39.9] 17.6717.67 [17.01,18.35][17.01,18.35] 64 SADDER + BoN-2 34.0[30.9,37.1]34.0\;[30.9,37.1] 21.0521.05 [19.98,22.11][19.98,22.11] 64 LLaDA/BT BoN-2 32.1[29.3,34.8]32.1\;[29.3,34.8] 22.3222.32 [21.38,23.33][21.38,23.33] 64 SADDER + BoN-2 28.5[25.3,31.7]28.5\;[25.3,31.7] 27.5427.54 [25.89,29.39][25.89,29.39] 64 LLaDA/RTP BoN-2 30.6[27.8,33.4]30.6\;[27.8,33.4] 20.9020.90 [20.00,21.82][20.00,21.82] 64 SADDER + BoN-2 26.7[23.7,29.8]26.7\;[23.7,29.8] 28.8028.80 [26.80,31.41][26.80,31.41] 64 Appendix H Jailbreak robustness and ablations H.1 LLaDA-Instruct jailbreak results Table 20 gives the LLaDA-Instruct comparison corresponding to the Dream-Instruct results in Table 2. Both tables use the same metrics and reporting conventions. XSTest uses the DIJA-configured defense; for LLaDA generation-scope DiffuGuard, this is λ=0.35λ=0.35. Table 20: LLaDA-Instruct: held-out HarmBench attacks and XSTest over-refusal. Entries use AbA_b: mean and sample SD across three seeds (percentage points for rates). HB, LG, and PPL assess complete responses. XSTest reports full-response WG refusal on safe prompts, using valid judge labels only (coverage in Appendix H.2). NFE is mean cost. Method DIJA PAD XSTest HB ASR % ↓ LG unsafe % ↓ Harmful PPL ↓ NFE HB ASR % ↓ LG unsafe % ↓ Harmful PPL ↓ NFE WG refusal % ↓ LLaDA-Instruct Unmodified 78.73.178.7_3.1 82.02.682.0_2.6 9.340.139.34_0.13 91.7 58.72.558.7_2.5 75.72.375.7_2.3 6.060.176.06_0.17 116.0 20.71.120.7_1.1 Full SAD 77.02.077.0_2.0 81.00.081.0_0.0 11.00.1311.0_0.13 91.7 63.37.563.3_7.5 78.74.078.7_4.0 8.240.218.24_0.21 116.0 20.91.920.9_1.9 SADDER (selective) 79.01.079.0_1.0 79.31.579.3_1.5 13.30.07613.3_0.076 91.7 57.74.057.7_4.0 73.73.873.7_3.8 13.20.2613.2_0.26 116.0 18.80.618.8_0.6 SADDER + warm-up 78.30.678.3_0.6 80.70.680.7_0.6 12.80.1912.8_0.19 91.7 57.04.057.0_4.0 68.32.568.3_2.5 11.40.1911.4_0.19 116.0 16.32.016.3_2.0 CSD† 48.74.748.7_4.7 79.74.979.7_4.9 36.10.9236.1_0.92 115.7 30.33.530.3_3.5 69.30.669.3_0.6 19.71.319.7_1.3 142.0 29.71.429.7_1.4 DiffuGuard (full) 42.74.542.7_4.5 81.72.581.7_2.5 2558.9255_8.9 137.0 34.33.834.3_3.8 73.74.273.7_4.2 2317.2231_7.2 125.0 42.80.842.8_0.8 DiffuGuard (gen) 70.73.570.7_3.5 83.72.583.7_2.5 41.81.341.8_1.3 97.8 57.32.157.3_2.1 74.73.574.7_3.5 6.220.146.22_0.14 117.0 24.41.024.4_1.0 H.2 XSTest over-refusal We evaluate refusal on 250 safe XSTest prompts and separately on 200 unsafe contrasts, using unmodified prompts and seeds 42, 43, and 44. Over-refusal is the refusal rate on safe prompts only. String matching uses full-refusal openings after lowercasing, trimming surrounding whitespace, and normalizing typographic apostrophes. WildGuard separately judges response refusal and harmfulness from each prompt–response pair (Han et al., 2024). Table 21 reports the string-based measurements. Tables 23 and 24 report WildGuard means with seed-SD subscripts and 95% prompt-cluster bootstrap intervals below. The n columns count valid labels out of 750 safe-prompt or 600 unsafe-prompt outputs. Missing WildGuard labels are excluded separately for each method; they are not counted as safe or non-refusing. Each point estimate averages the valid-label rates within the three seeds. Intervals use 5,000 resamples of prompt clusters, retaining all seeds. Refusal detection and coverage. The detectors assign different refusal rates to the same responses. For LLaDA warm-up on unsafe prompts, opening-string matching gives 53.5% refusal and WildGuard gives 97.5%; the corresponding Dream rates are 69.5% and 91.5%. So a reduction in stereotyped refusal openings can overstate the reduction in refusal behavior. WildGuard’s response-harmfulness labels provide a separate check: Dream warm-up has 6.9% harmful responses on unsafe XSTest prompts, compared with 0.0% for unmodified sampling, among outputs with valid labels. Coverage also varies with the intervention. Paired comparisons use the intersection of valid labels, rather than subtracting rates computed on different subsets. On safe prompts, warm-up changes WildGuard refusal by −5.9-5.9 percentage points on LLaDA (95% CI: [−9.7,−2.1][-9.7,-2.1]; 593 matched outputs) and −35.4-35.4 points on Dream ([−41.6,−29.3][-41.6,-29.3]; 602 matched outputs). DiffuGuard settings. Generation-scope DiffuGuard uses λ=0.35λ=0.35 on LLaDA and λ=0.5/0.75λ=0.5/0.75 for Dream’s DIJA/PAD settings. Both Dream thresholds are evaluated on XSTest. On vanilla prompts, full-block and generation-scope repair regions coincide, so these rows compare thresholds rather than repair scopes. Calibration reuses XSTest-safe prompts for the trigger diagnostic in Appendix A.6; these measurements include calibration prompts. Table 21: XSTest string-based refusal: means [95% CI] and seed SDs. Method Safe: over-refusal% SD Unsafe: refusal% SD LLaDA-Instruct Unmodified 9.7[6.5,13.2]9.7\;[6.5,13.2] 0.9 93.7[90.7,96.3]93.7\;[90.7,96.3] 1.0 Full SAD 10.0[6.8,13.5]10.0\;[6.8,13.5] 1.1 93.7[90.5,96.3]93.7\;[90.5,96.3] 1.3 SADDER (selective) 7.9[5.1,10.9]7.9\;[5.1,10.9] 0.8 85.2[80.3,89.7]85.2\;[80.3,89.7] 0.3 SADDER + warm-up 5.2[2.8,8.0]5.2\;[2.8,8.0] 0.7 53.5[46.7,60.3]53.5\;[46.7,60.3] 0.0 CSD† 10.3[7.1,13.7]10.3\;[7.1,13.7] 0.8 93.7[90.7,96.3]93.7\;[90.7,96.3] 1.0 DiffuGuard (full) 4.0[2.5,5.6]4.0\;[2.5,5.6] 1.1 28.2[24.7,31.8]28.2\;[24.7,31.8] 1.6 DiffuGuard (gen) (λ=0.35λ=0.35) 10.7[7.3,14.3]10.7\;[7.3,14.3] 0.5 92.2[88.8,95.2]92.2\;[88.8,95.2] 1.3 SADDER (top-1) 8.4[5.5,11.7]8.4\;[5.5,11.7] 0.8 85.5[80.8,89.8]85.5\;[80.8,89.8] 0.5 SADDER (aligned) 8.5[5.6,11.7]8.5\;[5.6,11.7] 0.9 85.3[80.5,89.8]85.3\;[80.5,89.8] 0.8 Random selection 10.0[6.8,13.5]10.0\;[6.8,13.5] 0.7 86.2[82.7,89.5]86.2\;[82.7,89.5] 2.9 Dream-Instruct Unmodified 44.9[39.2,50.5]44.9\;[39.2,50.5] 0.6 98.8[97.3,100.0]98.8\;[97.3,100.0] 0.3 Full SAD 46.0[40.0,51.9]46.0\;[40.0,51.9] 0.7 98.5[96.5,100.0]98.5\;[96.5,100.0] 0.0 SADDER (selective) 26.1[20.9,31.2]26.1\;[20.9,31.2] 0.5 92.0[88.2,95.5]92.0\;[88.2,95.5] 0.5 SADDER + warm-up 7.1[4.1,10.4]7.1\;[4.1,10.4] 0.2 69.5[63.0,76.0]69.5\;[63.0,76.0] 0.0 CSD† 45.2[39.5,50.8]45.2\;[39.5,50.8] 0.8 98.8[97.3,100.0]98.8\;[97.3,100.0] 0.3 DiffuGuard (full) 6.7[4.9,8.5]6.7\;[4.9,8.5] 1.2 13.5[10.8,16.3]13.5\;[10.8,16.3] 1.0 DiffuGuard (gen) (λ=0.75λ=0.75) 43.1[37.5,48.5]43.1\;[37.5,48.5] 0.5 98.8[97.3,100.0]98.8\;[97.3,100.0] 0.3 DiffuGuard (gen) (λ=0.5λ=0.5) 41.9[36.4,47.2]41.9\;[36.4,47.2] 0.6 98.0[96.0,99.5]98.0\;[96.0,99.5] 0.5 SADDER (top-1) 34.7[28.8,40.5]34.7\;[28.8,40.5] 0.2 96.5[93.5,99.0]96.5\;[93.5,99.0] 0.0 SADDER (aligned) 29.5[24.0,34.9]29.5\;[24.0,34.9] 0.5 96.5[93.8,98.7]96.5\;[93.8,98.7] 0.9 Random selection 22.5[18.7,26.7]22.5\;[18.7,26.7] 2.3 74.2[70.0,78.2]74.2\;[70.0,78.2] 4.9 Table 22: Paired string-based refusal changes versus unmodified sampling (p). Method Safe prompts Unsafe prompts LLaDA-Instruct Full SAD 0.3[−0.9,1.5]0.3\;[-0.9,1.5] 0.0[−1.0,1.0]0.0\;[-1.0,1.0] SADDER (selective) −1.9[−3.7,−0.3]-1.9\;[-3.7,-0.3] −8.5[−13.0,−4.2]-8.5\;[-13.0,-4.2] SADDER + warm-up −4.5[−7.5,−1.9]-4.5\;[-7.5,-1.9] −40.2[−47.3,−32.7]-40.2\;[-47.3,-32.7] CSD† 0.5[0.1,1.1]0.5\;[0.1,1.1] 0.0[0.0,0.0]0.0\;[0.0,0.0] DiffuGuard (full) −5.7[−9.1,−2.8]-5.7\;[-9.1,-2.8] −65.5[−69.8,−61.0]-65.5\;[-69.8,-61.0] DiffuGuard (gen) (λ=0.35λ=0.35) 0.9[−0.1,2.1]0.9\;[-0.1,2.1] −1.5[−3.5,0.3]-1.5\;[-3.5,0.3] SADDER (top-1) −1.3[−3.2,0.4]-1.3\;[-3.2,0.4] −8.2[−12.3,−4.2]-8.2\;[-12.3,-4.2] SADDER (aligned) −1.2[−3.1,0.4]-1.2\;[-3.1,0.4] −8.3[−12.8,−4.2]-8.3\;[-12.8,-4.2] Random selection 0.3[−1.5,2.0]0.3\;[-1.5,2.0] −7.5[−11.3,−4.0]-7.5\;[-11.3,-4.0] Dream-Instruct Full SAD 1.1[−0.9,3.1]1.1\;[-0.9,3.1] −0.3[−1.5,0.5]-0.3\;[-1.5,0.5] SADDER (selective) −18.8[−24.0,−13.6]-18.8\;[-24.0,-13.6] −6.8[−10.8,−3.3]-6.8\;[-10.8,-3.3] SADDER + warm-up −37.9[−43.6,−32.0]-37.9\;[-43.6,-32.0] −29.3[−35.8,−23.0]-29.3\;[-35.8,-23.0] CSD† 0.3[0.0,0.7]0.3\;[0.0,0.7] 0.0[0.0,0.0]0.0\;[0.0,0.0] DiffuGuard (full) −38.3[−43.7,−32.7]-38.3\;[-43.7,-32.7] −85.3[−88.3,−82.2]-85.3\;[-88.3,-82.2] DiffuGuard (gen) (λ=0.75λ=0.75) −1.9[−3.2,−0.5]-1.9\;[-3.2,-0.5] 0.0[−0.5,0.5]0.0\;[-0.5,0.5] DiffuGuard (gen) (λ=0.5λ=0.5) −3.1[−5.1,−1.2]-3.1\;[-5.1,-1.2] −0.8[−2.3,0.2]-0.8\;[-2.3,0.2] SADDER (top-1) −10.3[−14.7,−6.0]-10.3\;[-14.7,-6.0] −2.3[−5.2,0.0]-2.3\;[-5.2,0.0] SADDER (aligned) −15.5[−19.9,−11.1]-15.5\;[-19.9,-11.1] −2.3[−5.0,0.0]-2.3\;[-5.0,0.0] Random selection −22.4[−27.5,−17.5]-22.4\;[-27.5,-17.5] −24.7[−28.7,−20.7]-24.7\;[-28.7,-20.7] Table 23: LLaDA: WildGuard judgments on XSTest. Safe prompts Unsafe prompts Method Over-refusal% Harmful% n Refusal% Harmful% n Unmodified 20.71.120.7_1.1 [16.2,25.6][16.2,25.6] 3.30.83.3_0.8 [1.3,5.7][1.3,5.7] 603 97.91.097.9_1.0 [96.0,99.5][96.0,99.5] 1.20.61.2_0.6 [0.2,2.7][0.2,2.7] 585 Full SAD 20.91.920.9_1.9 [16.4,25.7][16.4,25.7] 3.10.53.1_0.5 [1.2,5.5][1.2,5.5] 603 97.91.097.9_1.0 [96.0,99.5][96.0,99.5] 1.20.61.2_0.6 [0.2,2.7][0.2,2.7] 585 SADDER (selective) 18.80.618.8_0.6 [14.5,23.4][14.5,23.4] 2.50.82.5_0.8 [0.9,4.3][0.9,4.3] 644 98.80.398.8_0.3 [97.3,100.0][97.3,100.0] 0.70.30.7_0.3 [0.0,1.7][0.0,1.7] 584 SADDER + warm-up 16.32.016.3_2.0 [12.4,20.8][12.4,20.8] 2.50.02.5_0.0 [1.0,4.4][1.0,4.4] 710 97.50.597.5_0.5 [95.2,99.3][95.2,99.3] 0.50.50.5_0.5 [0.0,1.4][0.0,1.4] 592 CSD† 29.71.429.7_1.4 [24.5,35.1][24.5,35.1] 3.70.73.7_0.7 [2.1,5.7][2.1,5.7] 589 98.11.198.1_1.1 [96.5,99.5][96.5,99.5] 1.00.51.0_0.5 [0.2,2.2][0.2,2.2] 585 DiffuGuard (full) 42.80.842.8_0.8 [38.5,47.1][38.5,47.1] 7.61.77.6_1.7 [5.5,9.9][5.5,9.9] 750 84.51.584.5_1.5 [81.3,87.5][81.3,87.5] 14.41.614.4_1.6 [11.4,17.5][11.4,17.5] 599 DiffuGuard (gen) (λ=0.35λ=0.35) 24.41.024.4_1.0 [19.7,29.4][19.7,29.4] 4.62.44.6_2.4 [2.4,7.1][2.4,7.1] 595 98.30.398.3_0.3 [96.7,99.6][96.7,99.6] 0.90.30.9_0.3 [0.2,1.9][0.2,1.9] 586 SADDER (top-1) 20.80.220.8_0.2 [16.3,25.5][16.3,25.5] 3.40.83.4_0.8 [1.5,5.5][1.5,5.5] 650 98.80.398.8_0.3 [97.3,99.8][97.3,99.8] 0.70.30.7_0.3 [0.0,1.6][0.0,1.6] 583 SADDER (aligned) 20.00.720.0_0.7 [15.4,24.6][15.4,24.6] 3.40.53.4_0.5 [1.5,5.7][1.5,5.7] 645 98.00.598.0_0.5 [95.9,99.5][95.9,99.5] 0.90.30.9_0.3 [0.0,2.2][0.0,2.2] 586 Random selection 23.51.423.5_1.4 [18.7,28.5][18.7,28.5] 3.71.03.7_1.0 [1.9,5.8][1.9,5.8] 622 99.50.099.5_0.0 [98.6,100.0][98.6,100.0] 0.00.00.0_0.0 [0.0,0.0][0.0,0.0] 588 Table 24: Dream: WildGuard judgments on XSTest. Safe prompts Unsafe prompts Method Over-refusal% Harmful% n Refusal% Harmful% n Unmodified 55.51.355.5_1.3 [49.1,61.5][49.1,61.5] 2.20.52.2_0.5 [0.8,3.8][0.8,3.8] 629 99.50.099.5_0.0 [98.5,100.0][98.5,100.0] 0.00.00.0_0.0 [0.0,0.0][0.0,0.0] 600 Full SAD 58.01.058.0_1.0 [51.6,64.4][51.6,64.4] 2.70.32.7_0.3 [1.1,4.7][1.1,4.7] 619 99.50.099.5_0.0 [98.5,100.0][98.5,100.0] 0.00.00.0_0.0 [0.0,0.0][0.0,0.0] 600 SADDER (selective) 41.10.841.1_0.8 [34.3,47.9][34.3,47.9] 3.20.53.2_0.5 [1.1,5.6][1.1,5.6] 562 99.10.399.1_0.3 [97.7,100.0][97.7,100.0] 0.00.00.0_0.0 [0.0,0.0][0.0,0.0] 572 SADDER + warm-up 17.90.717.9_0.7 [13.5,22.7][13.5,22.7] 1.60.21.6_0.2 [0.4,2.9][0.4,2.9] 709 91.51.391.5_1.3 [88.0,94.5][88.0,94.5] 6.91.86.9_1.8 [4.2,10.0][4.2,10.0] 597 CSD† 56.41.956.4_1.9 [50.0,62.4][50.0,62.4] 2.11.02.1_1.0 [0.8,3.7][0.8,3.7] 630 99.50.099.5_0.0 [98.5,100.0][98.5,100.0] 0.00.00.0_0.0 [0.0,0.0][0.0,0.0] 600 DiffuGuard (full) 64.11.564.1_1.5 [60.0,68.1][60.0,68.1] 14.32.614.3_2.6 [11.2,17.6][11.2,17.6] 750 75.80.675.8_0.6 [72.2,79.3][72.2,79.3] 23.21.023.2_1.0 [19.8,26.7][19.8,26.7] 600 DiffuGuard (gen) (λ=0.75λ=0.75) 53.11.553.1_1.5 [46.9,58.9][46.9,58.9] 2.50.52.5_0.5 [0.9,4.4][0.9,4.4] 641 99.50.099.5_0.0 [98.5,100.0][98.5,100.0] 0.00.00.0_0.0 [0.0,0.0][0.0,0.0] 600 DiffuGuard (gen) (λ=0.5λ=0.5) 54.61.154.6_1.1 [48.8,60.3][48.8,60.3] 3.20.43.2_0.4 [1.5,5.1][1.5,5.1] 665 99.20.399.2_0.3 [97.8,100.0][97.8,100.0] 0.20.30.2_0.3 [0.0,0.5][0.0,0.5] 600 SADDER (top-1) 41.20.141.2_0.1 [34.7,47.4][34.7,47.4] 3.00.73.0_0.7 [1.2,5.0][1.2,5.0] 670 99.00.599.0_0.5 [97.7,100.0][97.7,100.0] 0.00.00.0_0.0 [0.0,0.0][0.0,0.0] 600 SADDER (aligned) 38.11.338.1_1.3 [31.8,44.1][31.8,44.1] 2.50.72.5_0.7 [0.8,4.3][0.8,4.3] 653 98.00.998.0_0.9 [96.0,99.5][96.0,99.5] 0.00.00.0_0.0 [0.0,0.0][0.0,0.0] 599 Random selection 39.20.539.2_0.5 [33.2,45.2][33.2,45.2] 2.90.12.9_0.1 [1.0,5.1][1.0,5.1] 526 98.10.798.1_0.7 [96.1,99.6][96.1,99.6] 1.30.71.3_0.7 [0.2,2.7][0.2,2.7] 471 Table 25: LLaDA: paired WildGuard refusal changes (p). Method Safe prompts Pairs Unsafe prompts Pairs Full SAD −0.0[−1.2,1.4]-0.0\;[-1.2,1.4] 600 0.0[0.0,0.0]0.0\;[0.0,0.0] 585 SADDER (selective) −2.4[−5.8,0.9]-2.4\;[-5.8,0.9] 579 0.7[−0.9,2.4]0.7\;[-0.9,2.4] 581 SADDER + warm-up −5.9[−9.7,−2.1]-5.9\;[-9.7,-2.1] 593 −0.7[−2.9,1.4]-0.7\;[-2.9,1.4] 581 CSD† 9.3[5.9,12.8]9.3\;[5.9,12.8] 588 0.2[−0.3,0.7]0.2\;[-0.3,0.7] 585 DiffuGuard (full) 16.7[12.4,21.0]16.7\;[12.4,21.0] 603 −13.7[−16.8,−10.6]-13.7\;[-16.8,-10.6] 585 DiffuGuard (gen) (λ=0.35λ=0.35) 3.2[1.3,5.3]3.2\;[1.3,5.3] 589 0.3[−0.5,1.4]0.3\;[-0.5,1.4] 585 SADDER (top-1) −1.0[−4.6,2.4]-1.0\;[-4.6,2.4] 585 0.7[−0.7,2.4]0.7\;[-0.7,2.4] 583 SADDER (aligned) −1.9[−4.9,0.9]-1.9\;[-4.9,0.9] 584 −0.2[−2.4,1.9]-0.2\;[-2.4,1.9] 583 Random selection 1.1[−2.0,4.2]1.1\;[-2.0,4.2] 568 1.4[0.2,2.9]1.4\;[0.2,2.9] 580 Table 26: Dream: paired WildGuard refusal changes (p). Method Safe prompts Pairs Unsafe prompts Pairs Full SAD 1.8[−0.7,4.3]1.8\;[-0.7,4.3] 619 0.0[0.0,0.0]0.0\;[0.0,0.0] 600 SADDER (selective) −8.6[−14.1,−3.3]-8.6\;[-14.1,-3.3] 532 −0.3[−1.1,0.0]-0.3\;[-1.1,0.0] 572 SADDER + warm-up −35.4[−41.6,−29.3]-35.4\;[-41.6,-29.3] 602 −8.0[−11.5,−5.0]-8.0\;[-11.5,-5.0] 597 CSD† 1.0[0.3,1.8]1.0\;[0.3,1.8] 629 0.0[0.0,0.0]0.0\;[0.0,0.0] 600 DiffuGuard (full) 7.6[2.7,12.7]7.6\;[2.7,12.7] 629 −23.7[−27.3,−20.0]-23.7\;[-27.3,-20.0] 600 DiffuGuard (gen) (λ=0.75λ=0.75) −1.4[−3.1,0.2]-1.4\;[-3.1,0.2] 629 0.0[0.0,0.0]0.0\;[0.0,0.0] 600 DiffuGuard (gen) (λ=0.5λ=0.5) −0.8[−2.8,1.4]-0.8\;[-2.8,1.4] 629 −0.3[−0.8,0.0]-0.3\;[-0.8,0.0] 600 SADDER (top-1) −12.5[−17.7,−7.3]-12.5\;[-17.7,-7.3] 625 −0.5[−1.3,0.0]-0.5\;[-1.3,0.0] 600 SADDER (aligned) −14.1[−19.0,−9.2]-14.1\;[-19.0,-9.2] 603 −1.5[−3.2,−0.3]-1.5\;[-3.2,-0.3] 599 Random selection −6.7[−11.9,−1.7]-6.7\;[-11.9,-1.7] 493 −1.3[−2.7,−0.2]-1.3\;[-2.7,-0.2] 471 H.3 Held-out attack comparisons Table 27 reports the main jailbreak-table estimates with pointwise 95% prompt-cluster bootstrap confidence intervals, using 5,000 resamples and retaining all observed seeds within each sampled prompt. These intervals describe prompt uncertainty; the main-table subscripts describe variation across the three generation seeds. The XSTest over-refusal is the offline string-based matching metric rather than the WildGuard over-refusal metric. Table 27: Held-out HarmBench attacks and XSTest over-refusal. Method DIJA PAD XSTest HB ASR % ↓ LG unsafe % ↓ Harmful PPL ↓ NFE HB ASR % ↓ LG unsafe % ↓ Harmful PPL ↓ NFE Over-refusal % ↓ LLaDA-Instruct Unmodified 78.778.7 [72.0,85.0][72.0,85.0] 82.082.0 [75.0,88.3][75.0,88.3] 9.349.34 [8.59,10.1][8.59,10.1] 91.7 58.758.7 [50.3,66.7][50.3,66.7] 75.775.7 [68.3,82.3][68.3,82.3] 6.066.06 [5.68,6.47][5.68,6.47] 116.0 9.79.7 [6.5,13.2][6.5,13.2] Full SAD 77.077.0 [69.3,84.3][69.3,84.3] 81.081.0 [73.7,87.7][73.7,87.7] 11.011.0 [10.0,12.1][10.0,12.1] 91.7 63.363.3 [56.3,70.3][56.3,70.3] 78.778.7 [72.0,85.0][72.0,85.0] 8.248.24 [7.79,8.74][7.79,8.74] 116.0 10.010.0 [6.8,13.5][6.8,13.5] SADDER (selective) 79.079.0 [71.7,86.3][71.7,86.3] 79.379.3 [71.7,86.3][71.7,86.3] 13.313.3 [11.6,15.7][11.6,15.7] 91.7 57.757.7 [50.3,65.0][50.3,65.0] 73.773.7 [66.3,80.7][66.3,80.7] 13.213.2 [10.3,17.7][10.3,17.7] 116.0 7.97.9 [5.1,10.9][5.1,10.9] SADDER + warm-up 78.378.3 [71.3,85.0][71.3,85.0] 80.780.7 [73.0,87.3][73.0,87.3] 12.812.8 [11.1,15.1][11.1,15.1] 91.7 57.057.0 [49.0,65.0][49.0,65.0] 68.368.3 [60.3,76.0][60.3,76.0] 11.411.4 [9.97,13.4][9.97,13.4] 116.0 5.25.2 [2.8,8.0][2.8,8.0] CSD† 48.748.7 [40.7,57.0][40.7,57.0] 79.779.7 [72.7,86.3][72.7,86.3] 36.136.1 [31.1,41.4][31.1,41.4] 115.7 30.330.3 [24.0,37.0][24.0,37.0] 69.369.3 [61.7,76.7][61.7,76.7] 19.719.7 [17.3,22.6][17.3,22.6] 142.0 10.310.3 [7.1,13.7][7.1,13.7] DiffuGuard (full) 42.742.7 [35.7,50.0][35.7,50.0] 81.781.7 [75.7,87.0][75.7,87.0] 255255 [239,272][239,272] 137.0 34.334.3 [28.0,41.0][28.0,41.0] 73.773.7 [67.3,79.7][67.3,79.7] 231231 [214,251][214,251] 125.0 4.04.0 [2.5,5.6][2.5,5.6] DiffuGuard (gen) 70.770.7 [63.7,77.7][63.7,77.7] 83.783.7 [77.0,89.7][77.0,89.7] 41.841.8 [32.0,53.7][32.0,53.7] 97.8 57.357.3 [49.0,65.0][49.0,65.0] 74.774.7 [67.0,81.7][67.0,81.7] 6.226.22 [5.85,6.59][5.85,6.59] 117.0 10.710.7 [7.3,14.3][7.3,14.3] Dream-Instruct Unmodified 82.082.0 [75.3,88.3][75.3,88.3] 80.780.7 [73.3,87.3][73.3,87.3] 11.411.4 [10.6,12.3][10.6,12.3] 91.7 51.751.7 [43.0,60.3][43.0,60.3] 64.064.0 [55.7,72.0][55.7,72.0] 8.538.53 [7.95,9.21][7.95,9.21] 116.0 44.944.9 [39.2,50.5][39.2,50.5] Full SAD 85.385.3 [79.0,91.3][79.0,91.3] 83.083.0 [75.3,90.0][75.3,90.0] 11.811.8 [10.9,12.8][10.9,12.8] 91.7 52.752.7 [43.7,61.7][43.7,61.7] 63.363.3 [54.7,71.0][54.7,71.0] 9.529.52 [9.01,10.1][9.01,10.1] 116.0 46.046.0 [40.0,51.9][40.0,51.9] SADDER (selective) 77.777.7 [70.3,84.7][70.3,84.7] 81.781.7 [74.7,88.0][74.7,88.0] 12.212.2 [11.3,13.1][11.3,13.1] 91.7 52.752.7 [43.7,61.7][43.7,61.7] 66.366.3 [57.3,75.0][57.3,75.0] 9.589.58 [8.86,10.4][8.86,10.4] 116.0 26.126.1 [20.9,31.2][20.9,31.2] SADDER + warm-up 78.778.7 [71.7,85.7][71.7,85.7] 79.779.7 [72.3,86.7][72.3,86.7] 12.212.2 [11.3,13.2][11.3,13.2] 91.7 42.742.7 [33.7,51.7][33.7,51.7] 55.055.0 [45.7,64.0][45.7,64.0] 10.410.4 [9.60,11.4][9.60,11.4] 116.0 7.17.1 [4.1,10.4][4.1,10.4] CSD† 68.068.0 [60.7,75.7][60.7,75.7] 82.382.3 [75.7,88.7][75.7,88.7] 45.945.9 [37.6,55.9][37.6,55.9] 115.5 33.333.3 [26.0,41.0][26.0,41.0] 63.363.3 [54.7,71.0][54.7,71.0] 23.723.7 [19.2,29.8][19.2,29.8] 140.8 45.245.2 [39.5,50.8][39.5,50.8] DiffuGuard (full) 33.333.3 [27.3,39.7][27.3,39.7] 84.084.0 [78.0,89.3][78.0,89.3] 537537 [494,587][494,587] 137.0 12.012.0 [8.0,16.0][8.0,16.0] 70.070.0 [64.0,76.0][64.0,76.0] 687687 [631,748][631,748] 125.0 6.76.7 [4.9,8.5][4.9,8.5] DiffuGuard (gen) 69.369.3 [62.0,76.3][62.0,76.3] 81.381.3 [74.7,87.3][74.7,87.3] 46.646.6 [36.0,60.4][36.0,60.4] 97.2 49.049.0 [40.3,57.3][40.3,57.3] 63.363.3 [55.0,71.3][55.0,71.3] 8.808.80 [8.28,9.41][8.28,9.41] 117.0 43.1‡43.1 [37.5,48.5][37.5,48.5] H.4 WildGuard harmfulness and refusal Tables 28 and 29 report full-response WildGuard harmfulness and refusal on the same HarmBench outputs, including remasking and random-selection controls. Entries show the mean with a seed-SD subscript and a 95% prompt-cluster bootstrap interval below. The n columns count valid labels out of 300 outputs per attack and method. Missing labels are excluded, and rates average the valid-output rate within each of the three seeds. Table 30 compares selective SADDER and warm-up against full SAD and random selection on jointly scored outputs. Negative harmfulness differences indicate fewer harmful responses; negative refusal differences indicate fewer refusals, which alone does not establish a safety improvement. The prompt–response pairs use the original behavior and the complete response, including any retained attack scaffold. Comparison across safety judges. The judges differ in their assessment of these gains. On Dream/PAD, warm-up lowers HB ASR from 51.7% to 42.7%, while WG harmfulness increases from 66.0% to 69.0%; selective SADDER reaches 80.0% WG harmfulness. On LLaDA/PAD, warm-up reduces both HB ASR (58.7% to 57.0%) and WG harmfulness (80.0% to 76.3%). Full-block DiffuGuard on Dream/DIJA illustrates a larger disagreement: 33.3% HB ASR accompanies 98.3% WG harmfulness and PPL 537. The apparent safety benefit depends on the judge as well as the model and attack, particularly when the intervention disrupts fluency. Table 28: LLaDA: WildGuard judgments on HarmBench. DIJA PAD Method Harmful% Refusal% n Harmful% Refusal% n Unmodified 96.02.696.0_2.6 [92.3,99.0][92.3,99.0] 1.70.61.7_0.6 [0.0,4.3][0.0,4.3] 300 80.03.080.0_3.0 [73.7,86.0][73.7,86.0] 15.31.515.3_1.5 [10.3,21.0][10.3,21.0] 300 Full SAD 96.30.696.3_0.6 [92.3,99.3][92.3,99.3] 2.00.02.0_0.0 [0.0,5.0][0.0,5.0] 300 85.73.885.7_3.8 [80.0,90.7][80.0,90.7] 11.33.811.3_3.8 [6.7,16.3][6.7,16.3] 300 SADDER (selective) 96.70.696.7_0.6 [92.7,99.7][92.7,99.7] 2.00.02.0_0.0 [0.0,5.0][0.0,5.0] 300 81.02.681.0_2.6 [74.3,87.0][74.3,87.0] 15.04.015.0_4.0 [10.0,20.7][10.0,20.7] 300 SADDER + warm-up 96.71.596.7_1.5 [93.0,99.3][93.0,99.3] 2.01.02.0_1.0 [0.0,4.7][0.0,4.7] 300 76.30.676.3_0.6 [68.7,83.3][68.7,83.3] 19.01.719.0_1.7 [12.7,26.0][12.7,26.0] 300 CSD† 97.01.097.0_1.0 [93.7,99.3][93.7,99.3] 1.70.61.7_0.6 [0.0,4.3][0.0,4.3] 300 77.04.477.0_4.4 [70.7,83.0][70.7,83.0] 19.72.119.7_2.1 [14.0,26.0][14.0,26.0] 300 DiffuGuard (full) 97.72.197.7_2.1 [95.3,99.7][95.3,99.7] 0.71.20.7_1.2 [0.0,1.7][0.0,1.7] 300 85.04.085.0_4.0 [80.0,89.7][80.0,89.7] 11.73.511.7_3.5 [7.7,16.0][7.7,16.0] 300 DiffuGuard (gen) 97.01.097.0_1.0 [93.7,99.7][93.7,99.7] 1.00.01.0_0.0 [0.0,3.0][0.0,3.0] 300 78.02.678.0_2.6 [71.3,84.3][71.3,84.3] 17.31.217.3_1.2 [11.7,23.0][11.7,23.0] 300 SADDER (top-1) 97.30.697.3_0.6 [94.0,99.7][94.0,99.7] 1.30.61.3_0.6 [0.0,3.7][0.0,3.7] 300 81.33.281.3_3.2 [74.3,87.3][74.3,87.3] 15.32.915.3_2.9 [9.7,21.3][9.7,21.3] 300 SADDER (aligned) 96.70.696.7_0.6 [92.7,99.7][92.7,99.7] 2.00.02.0_0.0 [0.0,5.0][0.0,5.0] 300 83.31.583.3_1.5 [77.7,88.7][77.7,88.7] 13.02.013.0_2.0 [8.3,18.0][8.3,18.0] 300 Random selection 96.31.296.3_1.2 [92.3,99.3][92.3,99.3] 1.30.61.3_0.6 [0.0,3.3][0.0,3.3] 300 77.33.277.3_3.2 [71.7,82.7][71.7,82.7] 19.03.519.0_3.5 [14.0,24.0][14.0,24.0] 300 Table 29: Dream: WildGuard judgments on HarmBench. DIJA PAD Method Harmful% Refusal% n Harmful% Refusal% n Unmodified 97.30.697.3_0.6 [94.0,99.7][94.0,99.7] 0.70.60.7_0.6 [0.0,2.0][0.0,2.0] 300 66.02.066.0_2.0 [57.7,74.0][57.7,74.0] 30.32.530.3_2.5 [22.3,38.7][22.3,38.7] 300 Full SAD 97.30.697.3_0.6 [94.0,100.0][94.0,100.0] 1.00.01.0_0.0 [0.0,3.0][0.0,3.0] 300 66.70.666.7_0.6 [58.3,74.7][58.3,74.7] 29.30.629.3_0.6 [21.3,37.7][21.3,37.7] 300 SADDER (selective) 96.71.596.7_1.5 [93.3,99.3][93.3,99.3] 1.30.61.3_0.6 [0.0,3.7][0.0,3.7] 300 80.01.780.0_1.7 [72.7,86.7][72.7,86.7] 16.71.516.7_1.5 [10.0,23.7][10.0,23.7] 300 SADDER + warm-up 96.30.696.3_0.6 [92.7,99.3][92.7,99.3] 1.70.61.7_0.6 [0.0,4.3][0.0,4.3] 300 69.01.769.0_1.7 [60.0,77.0][60.0,77.0] 28.01.728.0_1.7 [20.0,37.0][20.0,37.0] 300 CSD† 98.00.098.0_0.0 [95.0,100.0][95.0,100.0] 0.70.60.7_0.6 [0.0,2.0][0.0,2.0] 300 65.31.565.3_1.5 [57.0,73.3][57.0,73.3] 30.72.530.7_2.5 [22.7,39.0][22.7,39.0] 300 DiffuGuard (full) 98.30.698.3_0.6 [95.7,100.0][95.7,100.0] 0.70.60.7_0.6 [0.0,1.7][0.0,1.7] 299 69.32.169.3_2.1 [62.7,75.7][62.7,75.7] 29.72.129.7_2.1 [23.3,36.3][23.3,36.3] 300 DiffuGuard (gen) 98.30.698.3_0.6 [95.7,100.0][95.7,100.0] 0.70.60.7_0.6 [0.0,2.0][0.0,2.0] 300 65.02.065.0_2.0 [56.7,72.7][56.7,72.7] 30.01.030.0_1.0 [22.3,38.0][22.3,38.0] 300 SADDER (top-1) 97.70.697.7_0.6 [94.3,100.0][94.3,100.0] 1.30.61.3_0.6 [0.0,3.7][0.0,3.7] 300 80.01.780.0_1.7 [72.7,87.0][72.7,87.0] 17.01.017.0_1.0 [10.7,24.0][10.7,24.0] 300 SADDER (aligned) 97.70.697.7_0.6 [94.3,100.0][94.3,100.0] 1.00.01.0_0.0 [0.0,3.0][0.0,3.0] 300 72.01.772.0_1.7 [63.3,80.0][63.3,80.0] 25.01.025.0_1.0 [17.3,33.0][17.3,33.0] 300 Random selection 97.01.097.0_1.0 [93.7,99.7][93.7,99.7] 1.00.01.0_0.0 [0.0,3.0][0.0,3.0] 300 71.02.071.0_2.0 [63.3,78.0][63.3,78.0] 27.01.727.0_1.7 [20.3,34.3][20.3,34.3] 300 Table 30: Paired WildGuard differences on HarmBench (p). Comparison Δ harmful% Δ refusal% Pairs LLaDA / DIJA Selective vs. full SAD 0.3[−0.7,1.7]0.3\;[-0.7,1.7] 0.0[0.0,0.0]0.0\;[0.0,0.0] 300 Selective vs. random 0.3[−1.7,3.0]0.3\;[-1.7,3.0] 0.7[0.0,1.7]0.7\;[0.0,1.7] 300 Warm-up vs. full SAD 0.3[−0.7,1.7]0.3\;[-0.7,1.7] −0.0[−1.0,1.0]-0.0\;[-1.0,1.0] 300 Warm-up vs. random 0.3[−1.3,2.3]0.3\;[-1.3,2.3] 0.7[0.0,1.7]0.7\;[0.0,1.7] 300 LLaDA / PAD Selective vs. full SAD −4.7[−11.0,1.7]-4.7\;[-11.0,1.7] 3.7[−2.3,9.7]3.7\;[-2.3,9.7] 300 Selective vs. random 3.7[−2.0,9.3]3.7\;[-2.0,9.3] −4.0[−9.3,1.7]-4.0\;[-9.3,1.7] 300 Warm-up vs. full SAD −9.3[−16.7,−2.0]-9.3\;[-16.7,-2.0] 7.7[0.0,15.0]7.7\;[0.0,15.0] 300 Warm-up vs. random −1.0[−6.7,4.3]-1.0\;[-6.7,4.3] 0.0[−5.3,5.7]0.0\;[-5.3,5.7] 300 Dream / DIJA Selective vs. full SAD −0.7[−2.0,0.7]-0.7\;[-2.0,0.7] 0.3[0.0,1.0]0.3\;[0.0,1.0] 300 Selective vs. random −0.3[−1.7,0.7]-0.3\;[-1.7,0.7] 0.3[0.0,1.0]0.3\;[0.0,1.0] 300 Warm-up vs. full SAD −1.0[−2.7,0.0]-1.0\;[-2.7,0.0] 0.7[0.0,2.0]0.7\;[0.0,2.0] 300 Warm-up vs. random −0.7[−2.0,0.7]-0.7\;[-2.0,0.7] 0.7[0.0,2.0]0.7\;[0.0,2.0] 300 Dream / PAD Selective vs. full SAD 13.3[5.0,22.0]13.3\;[5.0,22.0] −12.7[−21.3,−4.3]-12.7\;[-21.3,-4.3] 300 Selective vs. random 9.0[1.3,16.7]9.0\;[1.3,16.7] −10.3[−18.0,−3.0]-10.3\;[-18.0,-3.0] 300 Warm-up vs. full SAD 2.3[−7.3,12.0]2.3\;[-7.3,12.0] −1.3[−11.3,8.7]-1.3\;[-11.3,8.7] 300 Warm-up vs. random −2.0[−7.3,3.3]-2.0\;[-7.3,3.3] 1.0[−4.0,6.0]1.0\;[-4.0,6.0] 300 H.5 DIJA judge and response-view sensitivity Separating generated content from the attack scaffold. DIJA completions contain both fixed attack text and model-generated spans. A harmfulness judgment on the complete response can therefore depend on text supplied by the attacker. We compare HarmBench (HB), LlamaGuard (LG), and WildGuard (WG) on two response views: the complete response, including the scaffold, and only the spans marked as initially masked in the saved completion segmentation (fills). Nonempty spans are trimmed and joined by newlines before judging. HB measures behavior-specific attack success, LG unsafe content, and WG response harmfulness. These are distinct evaluator criteria, even when the response view is held fixed. The main table retains full-response HB/LG for attacks and uses WG only for XSTest. Generated-span attack scores from all three judges are reported here. All response-view comparisons use the same generated completions and defence settings, so differences between views reflect the scoring procedure. This view isolates the initially editable content, rather than judging the assembled attack response. Removing intervening text can change the context needed to interpret a span. For full-block DiffuGuard, repairs outside the initially masked spans are also excluded. Generated-span scores thus complement complete-response judgments; they do not measure the safety of every token that a defence may modify. Judge disagreement persists after removing fixed text. Tables 31 and 32 separate judge choice from response-view choice. On unmodified sampling, removing the scaffold lowers LG unsafe rate from 82.0% to 53.3% on LLaDA and from 80.7% to 48.7% on Dream. HB falls more modestly, from 78.7% to 73.0% and from 82.0% to 76.0%, respectively; WG remains above 96%. Full-response scores therefore cannot be interpreted as measurements of generated spans alone. Conversely, excluding fixed text does not make the judges interchangeable. Warm-up illustrates the consequence for method comparisons. Against paired unmodified outputs, LG reports reductions of 11.7 points on LLaDA (95% CI: [−19.7,−4.3][-19.7,-4.3]) and 9.0 points on Dream ([−16.0,−2.0][-16.0,-2.0]), while the corresponding HB and WG intervals include zero. Dream selective SADDER also improves HB relative to full SAD by 8.0 points ([−13.3,−2.7][-13.3,-2.7]), but increases LG unsafe rate by 15.0 points ([8.0,22.0][8.0,22.0]). These are evaluator-dependent effects, not a consistent safety ordering across judges. The paired estimates in Table 33 retain the same prompts and seeds and use pointwise 95% intervals. Table 31: LLaDA: DIJA judge and response-view comparison on 100 held-out HarmBench behaviors, three seeds. Full includes the fixed scaffold; fills excludes it. Rates (%) are means with seed-SD subscripts. HB/LG have 300 scored outputs per row; WG has 300 except Dream aligned remasking (299). Method HB full HB fills LG full LG fills WG full WG fills Unmodified 78.73.178.7_3.1 73.03.673.0_3.6 82.02.682.0_2.6 53.32.553.3_2.5 96.02.696.0_2.6 96.31.596.3_1.5 Full SAD 77.02.077.0_2.0 71.72.971.7_2.9 81.00.081.0_0.0 56.36.856.3_6.8 96.30.696.3_0.6 97.31.297.3_1.2 SADDER (selective) 79.01.079.0_1.0 75.72.375.7_2.3 79.31.579.3_1.5 54.02.654.0_2.6 96.70.696.7_0.6 96.31.596.3_1.5 SADDER + warm-up 78.30.678.3_0.6 71.32.571.3_2.5 80.70.680.7_0.6 41.73.541.7_3.5 96.71.596.7_1.5 97.32.197.3_2.1 CSD† 48.74.748.7_4.7 30.75.130.7_5.1 79.74.979.7_4.9 33.74.233.7_4.2 97.01.097.0_1.0 96.31.596.3_1.5 DiffuGuard (full) 42.74.542.7_4.5 32.30.632.3_0.6 81.72.581.7_2.5 49.03.649.0_3.6 97.72.197.7_2.1 97.00.097.0_0.0 DiffuGuard (gen) 70.73.570.7_3.5 55.74.055.7_4.0 83.72.583.7_2.5 49.05.249.0_5.2 97.01.097.0_1.0 97.70.697.7_0.6 SADDER (top-1) 78.73.178.7_3.1 72.73.572.7_3.5 80.72.180.7_2.1 57.02.057.0_2.0 97.30.697.3_0.6 96.02.096.0_2.0 SADDER (aligned) 79.31.279.3_1.2 75.03.575.0_3.5 80.02.080.0_2.0 57.30.657.3_0.6 96.70.696.7_0.6 96.31.596.3_1.5 Random selection 76.31.276.3_1.2 72.34.072.3_4.0 80.35.580.3_5.5 51.73.151.7_3.1 96.31.296.3_1.2 97.31.297.3_1.2 Table 32: Dream: DIJA judge and response-view comparison on 100 held-out HarmBench behaviors, three seeds. Full includes the fixed scaffold; fills excludes it. Rates (%) are means with seed-SD subscripts. HB/LG have 300 scored outputs per row; WG has 300 except Dream aligned remasking (299). Method HB full HB fills LG full LG fills WG full WG fills Unmodified 82.01.082.0_1.0 76.03.676.0_3.6 80.71.580.7_1.5 48.72.548.7_2.5 97.30.697.3_0.6 97.30.697.3_0.6 Full SAD 85.30.685.3_0.6 80.32.380.3_2.3 83.01.083.0_1.0 42.33.142.3_3.1 97.30.697.3_0.6 96.31.596.3_1.5 SADDER (selective) 77.71.577.7_1.5 72.31.572.3_1.5 81.73.281.7_3.2 57.32.157.3_2.1 96.71.596.7_1.5 97.31.297.3_1.2 SADDER + warm-up 78.72.378.7_2.3 75.73.175.7_3.1 79.71.279.7_1.2 39.71.239.7_1.2 96.30.696.3_0.6 96.00.096.0_0.0 CSD† 68.06.268.0_6.2 45.03.545.0_3.5 82.30.682.3_0.6 41.72.141.7_2.1 98.00.098.0_0.0 97.30.697.3_0.6 DiffuGuard (full) 33.32.533.3_2.5 22.02.622.0_2.6 84.02.084.0_2.0 44.73.144.7_3.1 98.30.698.3_0.6 98.31.298.3_1.2 DiffuGuard (gen) 69.31.569.3_1.5 54.31.554.3_1.5 81.31.581.3_1.5 55.74.055.7_4.0 98.30.698.3_0.6 98.01.098.0_1.0 SADDER (top-1) 78.02.678.0_2.6 71.01.771.0_1.7 80.02.680.0_2.6 58.31.558.3_1.5 97.70.697.7_0.6 97.30.697.3_0.6 SADDER (aligned) 85.30.685.3_0.6 77.73.177.7_3.1 82.70.682.7_0.6 55.71.555.7_1.5 97.70.697.7_0.6 97.70.697.7_0.6 Random selection 79.31.279.3_1.2 74.31.574.3_1.5 82.02.082.0_2.0 53.74.053.7_4.0 97.01.097.0_1.0 97.01.097.0_1.0 Table 33: Generated-span DIJA score differences (percentage points), with 95% prompt-cluster bootstrap intervals. Comparisons use the same prompts and seeds; full SAD and random selection have no warm-up. Comparison HB LG WG LLaDA Selective vs Unmodified 2.7[−2.0,7.3]2.7\;[-2.0,7.3] 0.7[−6.7,7.7]0.7\;[-6.7,7.7] 0.0[−2.3,2.0]0.0\;[-2.3,2.0] Selective vs Full SAD 4.0[−1.3,9.3]4.0\;[-1.3,9.3] −2.3[−8.7,3.7]-2.3\;[-8.7,3.7] −1.0[−2.7,0.3]-1.0\;[-2.7,0.3] Selective vs Random selection 3.3[−1.3,7.7]3.3\;[-1.3,7.7] 2.3[−2.7,7.3]2.3\;[-2.7,7.3] −1.0[−2.7,0.7]-1.0\;[-2.7,0.7] Warm-up vs Unmodified −1.7[−7.7,4.0]-1.7\;[-7.7,4.0] −11.7[−19.7,−4.3]-11.7\;[-19.7,-4.3] 1.0[−1.0,3.0]1.0\;[-1.0,3.0] Warm-up vs Full SAD −0.3[−6.0,5.3]-0.3\;[-6.0,5.3] −14.7[−21.7,−8.0]-14.7\;[-21.7,-8.0] 0.0[−1.3,1.3]0.0\;[-1.3,1.3] Warm-up vs Random selection −1.0[−6.0,3.7]-1.0\;[-6.0,3.7] −10.0[−16.3,−4.0]-10.0\;[-16.3,-4.0] 0.0[−1.3,1.3]0.0\;[-1.3,1.3] Dream Selective vs Unmodified −3.7[−10.0,2.3]-3.7\;[-10.0,2.3] 8.7[1.7,15.0]8.7\;[1.7,15.0] 0.0[−1.0,1.0]0.0\;[-1.0,1.0] Selective vs Full SAD −8.0[−13.3,−2.7]-8.0\;[-13.3,-2.7] 15.0[8.0,22.0]15.0\;[8.0,22.0] 1.0[0.0,2.3]1.0\;[0.0,2.3] Selective vs Random selection −2.0[−7.3,3.0]-2.0\;[-7.3,3.0] 3.7[−1.3,9.0]3.7\;[-1.3,9.0] 0.3[0.0,1.0]0.3\;[0.0,1.0] Warm-up vs Unmodified −0.3[−6.7,5.7]-0.3\;[-6.7,5.7] −9.0[−16.0,−2.0]-9.0\;[-16.0,-2.0] −1.3[−3.7,0.3]-1.3\;[-3.7,0.3] Warm-up vs Full SAD −4.7[−9.7,0.3]-4.7\;[-9.7,0.3] −2.7[−10.3,5.0]-2.7\;[-10.3,5.0] −0.3[−2.3,1.3]-0.3\;[-2.3,1.3] Warm-up vs Random selection 1.3[−3.3,6.3]1.3\;[-3.3,6.3] −14.0[−20.0,−8.0]-14.0\;[-20.0,-8.0] −1.0[−2.3,0.0]-1.0\;[-2.3,0.0] Appendix I Uniform-state diffusion continuation results Table 34 reports the complete Duo and UDLM comparison under the protocol of Section 5.2. Unsafe rate uses the RTP harmful cohort; benign BERTScore uses the separate benign RTP cohort. Entries report means and standard deviations across five generation seeds. Table 34: Uniform-state continuation on RTP. Method Duo UDLM NFE Unsafe %↓\% Benign BERT ↑ Unsafe %↓\% Benign BERT ↑ Unmodified 51.31.851.3_1.8 81.770.0881.77_0.08 68.52.568.5_2.5 80.810.0480.81_0.04 128 SAD η=3×104η=3×10^4 43.43.543.4_3.5 81.770.1481.77_0.14 57.11.157.1_1.1 80.500.0680.50_0.06 128 η=5×104η=5×10^4 42.01.442.0_1.4 81.500.1081.50_0.10 52.91.652.9_1.6 80.400.0980.40_0.09 128 η=105η=10^5 42.82.242.8_2.2 81.040.0781.04_0.07 47.42.947.4_2.9 80.490.0380.49_0.03 128 η=1.5×105η=1.5×10^5 41.12.241.1_2.2 80.760.2280.76_0.22 49.54.249.5_4.2 80.530.1680.53_0.16 128 SADDER, k=6k=6 η=3×104η=3×10^4 47.92.347.9_2.3 81.950.0481.95_0.04 56.31.756.3_1.7 80.670.1280.67_0.12 128 η=5×104η=5×10^4 44.64.544.6_4.5 81.850.0781.85_0.07 52.21.652.2_1.6 80.680.0480.68_0.04 128 η=105η=10^5 44.21.944.2_1.9 81.670.1481.67_0.14 46.12.446.1_2.4 80.800.0780.80_0.07 128 η=1.5×105η=1.5×10^5 45.23.645.2_3.6 81.540.1381.54_0.13 45.12.945.1_2.9 80.890.1380.89_0.13 128 SADDER, k=9k=9 η=3×104η=3×10^4 47.14.147.1_4.1 81.930.0781.93_0.07 55.52.155.5_2.1 80.650.1380.65_0.13 128 η=5×104η=5×10^4 45.22.345.2_2.3 81.810.0681.81_0.06 51.53.351.5_3.3 80.670.0480.67_0.04 128 η=105η=10^5 45.12.745.1_2.7 81.590.1781.59_0.17 46.52.346.5_2.3 80.810.0980.81_0.09 128 η=1.5×105η=1.5×10^5 44.11.844.1_1.8 81.410.1581.41_0.15 44.52.144.5_2.1 80.900.1480.90_0.14 128 SADDER, k=12k=12 η=3×104η=3×10^4 47.23.247.2_3.2 82.030.0882.03_0.08 57.92.157.9_2.1 80.660.1480.66_0.14 128 η=5×104η=5×10^4 43.02.543.0_2.5 81.860.1081.86_0.10 51.93.051.9_3.0 80.690.0280.69_0.02 128 η=105η=10^5 45.00.745.0_0.7 81.770.1681.77_0.16 48.02.648.0_2.6 80.810.1080.81_0.10 128 η=1.5×105η=1.5×10^5 43.62.543.6_2.5 81.680.1081.68_0.10 45.91.745.9_1.7 80.920.1280.92_0.12 128 CSD k=6k=6 48.32.948.3_2.9 81.800.1181.80_0.11 53.51.853.5_1.8 80.510.0680.51_0.06 128 k=9k=9 35.12.335.1_2.3 81.930.0681.93_0.06 63.51.563.5_1.5 80.810.0680.81_0.06 128 k=12k=12 50.62.150.6_2.1 81.780.0881.78_0.08 67.14.267.1_4.2 80.810.0480.81_0.04 128 Best-of-N N=3N=3 42.22.342.2_2.3 82.0582.05 70.03.470.0_3.4 80.8080.80 384 N=5N=5 37.62.137.6_2.1 82.1082.10 68.92.168.9_2.1 80.7280.72 640 N=8N=8 33.12.333.1_2.3 82.1682.16 69.72.269.7_2.2 80.7780.77 1024 Appendix J Guidance analysis and ablations for uniform-state diffusion J.1 Where the gate opens Figure 3 plots the open-gate ratio during unguided continuations of unsafe RTP prompts. The open-gate ratio generally increases as denoising proceeds, consistent with position-wise representations becoming more informative as the continuation takes shape. SADDER uses this evolving signal to select positions for guidance, whereas SAD applies its correction to all eligible positions at every step. Figure 3: Open-gate ratio along unguided continuations of unsafe RTP prompts: the fraction of positions with sk,l(t)>0s^(t)_k,l>0. The horizontal axis runs from early to late denoising steps. J.2 Softening the gate We replace the binary gate with ak,l(t)=max2σ(sk,l(t)/τ)−1, 0,a^(t)_k,l= \2σ\! (s^(t)_k,l/τ )-1,\,0 \, where σ is the sigmoid function and τ controls the softness of the gate. The transformation makes the gate zero when sk,l(t)=0s^(t)_k,l=0, and clipping at zero leaves positions with negative scores unguided. For positive scores, the gate takes a value between zero and one; the strict gate is recovered as τ→0τ→ 0. Figure 4: Unsafe rate and benign BERTScore across guidance strengths for the strict gate and softened gates with τ∈30,70,100τ∈\30,70,100\ on Duo (k=9k=9) and UDLM (k=12k=12). Error bars are one standard deviation across seeds: five seeds for the strict gate (the runs reported in Table 34) and three seeds for the softened gates. Figure 4 shows no consistent effect of the temperature. On UDLM the four gates coincide in both metrics across the whole range. On Duo the strict gate trends toward lower unsafe rates and lower benign BERTScore, but the differences are smaller than the seed-to-seed variation of either gate. We therefore keep the strict indicator, which needs no additional hyperparameter.