Paper deep dive
Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis
Thong Bach, Dung Nguyen, Thao Minh Le, Truyen Tran
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 9/28/2026, 3:45:20 AM
Summary
This paper proposes an energy landscape framework to explain jailbreak success in diffusion-based large language models (dLLMs). It interprets safety alignment as creating an energy barrier between safe and harmful output basins. The authors derive three training-free detection signals based on this theory: a step-0 ratio measuring initial safety disposition, and two trajectory-velocity signals tracking kinetic energy expenditure during denoising. Evaluation on models like LLaDA and Dream shows these signals effectively detect various attacks (template, anchoring) by exploiting the energy cost required to cross the safety barrier.
Entities (14)
Relation Signals (8)
Masked Diffusion Models → minimize → Kinetic Energy
confidence 96% · masked diffusion models minimise kinetic energy during denoising
PAD → istypeof → Template Attack
confidence 95% · Template attacks modify the initial state: PAD [30] distributes structural connectors
DIJA → istypeof → Template Attack
confidence 95% · DIJA [23] interleaves harmful tokens with mask spans, both exploiting bidirectional attention.
Safety Alignment → shapes → Energy landscape
confidence 95% · interpreting safety alignment as shaping the denoising energy landscape: a well-aligned model routes harmful queries toward safe outputs through an energy barrier
Jailbreak Attacks → circumvent → Energy Barrier
confidence 94% · Current jailbreak attacks reduce to two strategies for circumventing this barrier: obscuring the query's safety disposition at initialisation, or intervening mid-trajectory
Step-0 Ratio → detects → Initial Safety Disposition
confidence 93% · a step-0 ratio that reads the initial safety disposition from the logit distribution before generation begins
Trajectory-Velocity Signals → track → Kinetic Energy
confidence 93% · two trajectory-velocity signals that track kinetic energy in complementary subspaces of the logit space
LLaDA-8B → →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Existing attacks and defenses for diffusion-based large language models (dLLMs) target specific vulnerabilities but lack a shared framework explaining why attacks succeed. We propose one by interpreting safety alignment as shaping the denoising energy landscape: a well-aligned model routes harmful queries toward safe outputs through an energy barrier that separates the two regions. Current jailbreak attacks reduce to two strategies for circumventing this barrier: obscuring the query's safety disposition at initialisation, or intervening mid-trajectory to force the denoising path across the energy barrier. From this perspective and the result that masked diffusion models minimise kinetic energy during denoising, we derive three complementary, training-free detection signals: a step-0 ratio that reads the initial safety disposition from the logit distribution before generation begins, and two trajectory-velocity signals that track kinetic energy in complementary subspaces of the logit space. An attack must either reveal its intent at initialisation or expend kinetic energy to cross the barrier in at least one monitored subspace, so the three signals cover each other's blind spots in the energy budget by construction. Evaluation across three dense dLLMs (LLaDA-8B, LLaDA-1.5, Dream-7B) and a sparse mixture-of-experts dLLM (LLaDA-MoE-7B) confirms this complementarity. In stress tests of known attacks, every configuration that evades detection also fails to produce harmful content, suggesting that the detection and barrier-crossing thresholds are hard to separate.
Tags
Links
- Source: https://arxiv.org/abs/2609.30841v1
- Canonical: https://arxiv.org/abs/2609.30841v1
Trouble viewing inline? Open PDF directly →
Full Text
113,014 characters extracted from source content.
Expand or collapse full text
Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis Thong Bach †thanks: t.bach@deakin.edu.au Affiliation: Applied Artificial Intelligence Initiative (A2I2), Deakin University Dung Nguyen Affiliation: Applied Artificial Intelligence Initiative (A2I2), Deakin University Thao Minh Le Affiliation: Pennsylvania State University Truyen Tran Affiliation: Applied Artificial Intelligence Initiative (A2I2), Deakin University Abstract Existing attacks and defenses for diffusion-based large language models (dLLMs) target specific vulnerabilities but lack a shared framework explaining why attacks succeed. We propose one by interpreting safety alignment as shaping the denoising energy landscape: a well-aligned model routes harmful queries toward safe outputs through an energy barrier that separates the two regions. Current jailbreak attacks reduce to two strategies for circumventing this barrier: obscuring the query’s safety disposition at initialisation, or intervening mid-trajectory to force the denoising path across the energy barrier. From this perspective and the result that masked diffusion models minimise kinetic energy during denoising, we derive three complementary, training-free detection signals: a step-0 ratio that reads the initial safety disposition from the logit distribution before generation begins, and two trajectory-velocity signals that track kinetic energy in complementary subspaces of the logit space. An attack must either reveal its intent at initialisation or expend kinetic energy to cross the barrier in at least one monitored subspace, so the three signals cover each other’s blind spots in the energy budget by construction. Evaluation across three dense dLLMs (LLaDA-8B, LLaDA-1.5, Dream-7B) and a sparse mixture-of-experts dLLM (LLaDA-MoE-7B) confirms this complementarity. In stress tests of known attacks, every configuration that evades detection also fails to produce harmful content, suggesting that the detection and barrier-crossing thresholds are hard to separate. 1 Introduction Safety research in dLLMs is nascent. A handful of models exist, primarily LLaDA and Dream variants (LLaDA [16], LLaDA-1.5 [31], Dream [27]), and a small but growing set of attacks has emerged. These attacks exploit two distinct surfaces of the denoising process. Template attacks modify the initial state: PAD [30] distributes structural connectors throughout the response region, and DIJA [23] interleaves harmful tokens with mask spans, both exploiting bidirectional attention. Anchoring attacks [25] instead intervene mid-trajectory, replacing model predictions with harmful tokens at an intermediate denoising step. On the defense side, DiffuGuard’s Safety Divergence (SD) detector [13] identifies template injection via representational divergence between the attack input and a clean baseline. Each contribution targets a specific vulnerability, but the literature lacks an analysis that explains why these attacks succeed, how they relate to one another, and what they reveal about the structure of safety in diffusion language models. Attacks built for autoregressive models, such as GCG [33], optimise against causal next-token decoding and do not transfer to diffusion without new work, so an account that also constrains attacks not yet designed is especially valuable here. We propose such an analysis through the lens of energy landscape dynamics [7], which proved that masked diffusion models minimise kinetic energy during denoising, following geodesics from the masked state to the output distribution. We interpret safety alignment as reshaping this landscape into basins separated by an energy barrier, and show that every known attack maps onto one of two strategies for circumventing it. Throughout, “energy,” “barrier,” and “basin” refer to per-token-factorised log-odds in a Fisher-metrised probability simplex (§3). Concretely, the quantity we read is the ratio of refusal-token mass to compliance-token mass in the model’s logit distribution, first at the fully masked state before any token is decoded, and then as it changes during denoising. The token sets are a measured property of the model rather than a design choice: a set derived automatically from held-out prompts, with no human selection, performs as well as a hand-written one (§3.1). Figure 2 previews the core finding by plotting the log of this ratio over the denoising steps: harmful queries remain in the safe basin as the model refuses, template attacks start near the barrier with obscured intent, and anchoring attacks show partial or failed recovery depending on the intervention timing. From this decomposition, we derive three training-free, logit-space detection signals, each monitoring a different component of the energy budget. Contributions. (1) An energy-based analysis of dLLM safety that unifies current attacks as strategies for circumventing the energy barrier separating safe from harmful outputs (§3). (2) Three complementary, training-free detection signals derived from the energy landscape: a step-0 ratio measuring the initial safety disposition (§3.1) and two trajectory-velocity signals measuring kinetic energy in complementary subspaces via a Fisher velocity decomposition; together they cover the full energy budget by construction (§3.2). (3) Evaluation across LLaDA-8B and Dream-7B using standard benchmarks (HarmBench, AdvBench, AlpacaEval, XSTest; §2), with further checks on LLaDA-1.5, a sparse mixture-of-experts dLLM, Chinese prompts, and generation and block lengths, including comparison with DiffuGuard-SD11 1 We compare against DiffuGuard’s Safety Divergence detection component [13]; generation-time defenses fall outside our detection-only scope. and parametric stress testing showing that no tested attack configuration evades all three signals while still inducing harmful generation (§4). 2 Background and Experimental Setup Masked diffusion language models. MDLMs generate text by reversing a forward masking process [21, 15, 9]. For t∈[0,1]t∈[0,1], each token is independently masked with probability t, and the reverse process recovers the data distribution by iteratively predicting masked tokens. The core component is a mask predictor pθ(⋅|xt)p_θ(·|x_t), a bidirectional Transformer that takes a partially masked sequence xtx_t and predicts all masked positions simultaneously. Training minimises the cross-entropy loss on masked tokens, upper-bounding the negative log-likelihood [16]. The bidirectional architecture enables flexible generation order but also creates the attack surface we analyse. MDMs as energy minimisation. Work by [7] proved that MDMs can be interpreted as minimising energy functionals over discrete probability flows, with kinetic energy Ek=∫01γ˙t−1∑xp˙t(x)2pt(x)t,E_k= _0^1 γ_t^-1 _x p_t(x)^2p_t(x)\,dt, (1) where ptp_t is the distribution at step t and γt _t an interpolation schedule. Minimising EkE_k means the denoising trajectory follows a geodesic from the masked state p0p_0 to the output distribution pTp_T. In §3 we extend this interpretation to safety. Experimental setup. Every quantitative result in the main text is computed with the following setup (full details in Appendix B). Models. Detection is evaluated on LLaDA-8B-Instruct [16] and Dream-v0-Instruct-7B [27]; LLaDA-1.5 [31] enters the step-0 analysis, and a sparse mixture-of-experts model, LLaDA-MoE-7B-A1B-Instruct [32], is evaluated in Appendix D.5. Generation uses greedy confidence-based remasking at temperature 0 with response length L=128L=128, one token per step. Data. Harmful prompts are the 400 standard HarmBench behaviors [14] and the 520 AdvBench behaviors [33]; benign prompts are 200 AlpacaEval instructions [12] and the 250 safe XSTest prompts [20]. Each model is run under seven conditions (clean, XSTest, harmful direct, PAD, anchoring at t=1t=1 and t=8t=8, DIJA), giving 5,050 prompt–condition pairs per model and 10,100 in total. Attacks. Each attack follows its original implementation: PAD inserts nc=2n_c=2 structural connectors at evenly spaced response positions [30]; anchoring replaces the model’s predictions at step tintert_inter with tokens of a harmful response and re-masks [25]; DIJA fills templates that interleave harmful tokens with mask spans [23]. Protocol. All three signals are read from the logits the model already computes, with no training. AUROC measures how well a signal ranks each attack condition above the benign pool (AlpacaEval ∪ XSTest). For threshold-level detection, each signal is thresholded at a benign quantile, and the OR-detector uses α/3α/3 per signal so that by the union bound its benign false-positive rate is at most α (Appendix F). 3 The Energy Landscape of Safety We interpret safety alignment as shaping the denoising energy landscape into basins of attraction separated by an energy barrier, and show that all known attacks map onto one of two strategies: obscuring the query’s safety disposition at initialisation, or intervening to force the trajectory across the barrier mid-denoising. The detection signals follow from this decomposition: §3.1 derives the step-0 ratio from basin structure, §3.2 derives two velocity signals from the kinetic energy cost of barrier crossing, and §3.3 tests the combined detector against every attack and against DiffuGuard-SD. 3.1 Basin Structure and the Step-0 Ratio Question: can the safety disposition of a query be read before any token is generated? How alignment shapes the energy landscape. Previous work [7] proved that the denoising trajectory in masked diffusion models minimises a kinetic energy functional EkE_k (Eq. (1), §2). This geodesic structure depends entirely on the model parameters θ, so alignment training reshapes it: Supervised Fine-Tuning (SFT) on safety data assigns high probability to refusal tokens at the fully masked state, and the energy-minimising path for harmful queries then routes entirely through safe outputs. We formalise this by partitioning the sequence space =∪ℋX=S into safe responses S (refusals, harmless completions) and harmful responses ℋH (compliant harmful content)22 2 When working at a single masked position (e.g., Eq. (6)) we reuse ,ℋS,H for the corresponding token-level sets, so ref⊆V_ref and comp⊆ℋV_comp . The safe basin contains harmless completions as well as refusals; the signals below weight refusals only because they are its most observable part, and our scope is detecting a query rather than shaping the response, so a flagged query can be regenerated or routed to a stronger filter rather than refused. Alignment funnels probability toward S, so the denoising trajectory of a harmful query carries little probability flow across the boundary between the two basins (Appendix A.1 makes this precise with a flow decomposition of EkE_k), and a jailbreak succeeds when it forces the trajectory across that boundary into ℋH. To monitor basin membership at each step, we define: Definition 1 (Safety Energy Gap). Given a harmful query q and denoising state xtx_t at step t, the Safety Energy Gap is the log-odds ratio between the probability that the final output x x lands in the safe basin S versus the harmful basin ℋH: ΔE(xt,q,t)=logp(x^∈∣q,xt)p(x^∈ℋ∣q,xt). E(x_t,q,t)= p( x q,x_t)p( x q,x_t). (2) where ΔE>0 E>0 indicates the safe basin, ΔE<0 E<0 the harmful basin, and ΔE=0 E=0 the basin boundary. Here x x denotes the (random) clean output produced by denoising, while xtx_t denotes the partially-masked state at step t; we reserve x0=([MASK])Lx_0=( [MASK])^L for the fully masked initial state (step 0, no decoding performed). Theorem 1 shows that driving ΔE E from positive to negative requires a minimum kinetic energy expenditure. The energy barrier is the minimum value of ΔE E along the unperturbed denoising trajectory (i.e., generation without attack intervention); a jailbreak succeeds when it drives ΔE E below zero at any step. From sequence-level to per-position gap. The sequence-level ΔE E (Eq. (2)) requires summing over exponentially many sequences and is intractable. Masked diffusion models are trained under per-token factorisation: the cross-entropy loss decomposes over positions, and the mask predictor outputs independent per-position distributions pθ(x^i∣xt)p_θ( x_i x_t). We therefore define a per-position surrogate over the set of masked positions Mt=i:xt,i=[MASK]M_t=\i:x_t,i= [MASK]\ that the model can natively compute. Definition 2 (Factorised Safety Energy Gap). The factorised Safety Energy Gap is the sum of per-position log-odds: ΔEF(xt,q,t):=∑i∈Mtlog∑v∈refpθ(v∣q,xt)i∑v∈comppθ(v∣q,xt)i⏟ΔEi(xt,q,t), E_F(x_t,q,t):= _i∈ M_t _v _refp_θ(v q,x_t)_i _v _compp_θ(v q,x_t)_i_ E_i(x_t,q,t), (3) where v denotes individual vocabulary tokens, refV_ref contains high-frequency refusal tokens (e.g., sorry, cannot, refuse; 36 tokens) and compV_comp contains compliance tokens (e.g., sure, here, step; 32 tokens). Full token lists are in Appendix B. ΔEi E_i is the per-position contribution. The sets need not be hand-written: ranking tokens by mean step-0 mass on held-out harmful and benign prompts and keeping the top ten per class, with no human selection, matches the curated sets within 0.050.05 AUROC on the LLaDA family and exceeds them on Dream-7B (Appendix D.2). Because the sum runs over masked positions, the raw value of ΔEF E_F grows with the number of positions still masked, and hence with the generation length L. Whenever values are compared across lengths we therefore report the per-token gap ΔEF/|Mt| E_F/|M_t|; at fixed L this rescaling leaves every AUROC in the paper unchanged (Appendix D.4). Proposition 1 (Properties of the factorised gap). ΔEF E_F satisfies three properties. (i) Additive decomposition: ΔEF E_F decomposes exactly as a sum of independent per-position terms. (i) Per-position attackability: an adversary who controls a single position j can drive ΔEF E_F below zero by injecting a token that makes ΔEj<−∑i≠jΔEi E_j<- _i≠ j E_i. (i) Approximation of the sequence-level gap: under per-token factorisation, ΔEF E_F differs from ΔE E by an additive term that is at most linear in |Mt||M_t| and vanishes as refV_ref and compV_comp capture the dominant modes of refusal and compliance (Eq. (21), Appendix A.3). Figure 1: Step-0 ratio separates harmful from benign queries. Distribution of R0R_0 values across three dLLM families, harmful direct queries (HarmBench, AdvBench) against benign queries (AlpacaEval, XSTest). Harmful queries produce consistently higher ratios than benign queries, confirming basin separation. The proof is in Appendix A.3. Property (i) creates the per-position attack surface exploited by template attacks: in a bidirectional transformer, an injected token τ shifts ΔE E at all remaining masked positions simultaneously (no causal masking), with the total shift scaling linearly in |Mt||M_t| (Lemma 1, Appendix A.4). This linear scaling explains why DIJA’s feedback loop strengthens as each newly committed harmful token shifts ΔE E at all remaining positions, and why anchoring at t=8t=8 (fewer positions masked but more tokens committed) creates a larger cumulative shift than at t=1t=1. The sequence-level energy correction of [24] would introduce non-decomposable interaction terms that close this per-position vulnerability, but current dLLMs do not use it. The step-0 ratio. At the fully masked initial state x0=([MASK])Lx_0=( [MASK])^L, where L is the response length, the model has not yet committed any token. All masked positions are identically conditioned on q, so the per-position log-ratios in Eq. (3) are exchangeable and the factorised Safety Energy Gap reduces to |M0||M_0| identical terms. Writing Pref(q)=∑v∈refpθ(v∣q,x0)P_ref(q)= _v _refp_θ(v q,x_0) and Pcomp(q)P_comp(q) likewise for compV_comp: ΔEF(x0,q,0)=|M0|log(Pref(q)/Pcomp(q)). E_F(x_0,q,0)=|M_0| (P_ref(q)/P_comp(q) ). (4) The per-position log-ratio is directly observable. We define the step-0 ratio: R0(q)=∑i∈M0Pref,i(q)/∑i∈M0Pcomp,i(q),R_0(q)= _i∈ M_0P_ref,i(q) / _i∈ M_0P_comp,i(q), (5) where Pref,iP_ref,i and Pcomp,iP_comp,i are the masses at position i. Proposition 2 (R0R_0 as sufficient statistic for initial safety disposition). Under per-token factorisation at the fully masked state x0=([MASK])Lx_0=( [MASK])^L: (i) Exactness: logR0(q)=ΔEF(x0,q,0)/|M0| R_0(q)= E_F(x_0,q,0)/|M_0|, i.e., the step-0 ratio is the per-position factorised Safety Energy Gap at initialisation. (i) Optimality: any statistic that separates S from ℋH using step-0 logits must be a monotone function of R0R_0 when restricted to ref∪compV_ref _comp. (i) Approximation bound: the error from projecting onto ref∪compV_ref _comp satisfies |logR0(q)−ΔEfull(x0,q,0)|M0||≤log11−ϵref(q)+log11−ϵcomp(q), | R_0(q)- E_full(x_0,q,0)|M_0| |≤ 11- _ref(q)+ 11- _comp(q), (6) where ϵref(q)=1−∑v∈refpθ(v∣q,x0)/∑v∈pθ(v∣q,x0) _ref(q)=1- _v _refp_θ(v q,x_0) / _v p_θ(v q,x_0) measures coverage loss (with S here interpreted at the token level; cf. §3.1), and ϵcomp(q) _comp(q) is defined symmetrically. The proof is in Appendix A.5. Part (i) shows R0R_0 computes a specific quantity (the per-position energy gap) rather than a loose keyword correlation; part (i) is a conditional optimality statement: R0R_0 is the most powerful test within the projection ref∪compV_ref _comp, not the most powerful step-0 detector overall. A learned classifier on the full step-0 logit distribution (or a richer vocabulary projection) could in principle outperform R0R_0; we adopt the projection because of its computational simplicity and interpretability, with part (i) quantifying the resulting information loss. Part (i) predicts when R0R_0 fails: if safety-relevant mass is diffuse across tokens outside refV_ref, the projection becomes lossy. We validate this across five vocabulary sets in Appendix D.2, confirming that as few as five well-chosen tokens suffice (AUROC 0.95) while synonym sets that miss the model’s high-mass tokens degrade to 0.80. Figure 1 shows that R0R_0 consistently separates harmful from benign queries across all three model families, with harmful queries producing R0R_0 values 5–11× higher than benign queries (AUROC 0.86–0.90 across LLaDA-8B, LLaDA-1.5, and Dream-7B). This separation holds regardless of training paradigm (native diffusion vs. AR-initialised), suggesting that alignment consistently shapes the energy landscape into well-separated basins. The blind spot: template attacks evade R0R_0. Table 1 reveals that template attacks (PAD, DIJA) produce near-chance detection (AUROC 0.15–0.49) because they alter x0x_0, injecting tokens that shift probability mass away from refusal indicators and obscure the query’s safety disposition at step 0. Anchoring attacks, by contrast, share the R0R_0 of harmful queries without template modification (i.e., direct harmful prompts) because they intervene only after step 0. This pattern exposes a fundamental limitation: R0R_0 monitors only which basin the trajectory starts in and is blind to what happens during generation. Detecting template attacks requires monitoring trajectory dynamics, which is the subject of the next section. Table 1: Step-0 ratio fails on template attacks. AUROC for R0R_0 detecting each attack (built on HarmBench and AdvBench prompts) vs. benign queries (AlpacaEval, XSTest). Template attacks (PAD, DIJA) produce near-chance detection because injected tokens obscure the query’s safety disposition at step 0. Attack LLaDA-8B LLaDA-1.5 Dream-7B Harmful direct 0.86 0.86 0.90 Anchoring t=8 0.86 0.86 0.90 PAD 0.42 0.49 0.37 DIJA 0.23 0.23 0.15 3.2 Barrier Crossing and Trajectory Velocity Question: when the initial state has been disguised, what must an attack still leave behind during denoising? Since template attacks evade R0R_0 by obscuring the initial state, detection must shift to what happens during denoising. The key observation is that a trajectory in its natural basin decelerates as it converges, whereas one forced across the barrier must sustain high velocity throughout — a cost template attacks cannot avoid. We now formalise this cost and derive two signals that track it. The kinetic energy cost of barrier crossing. The rate of change of the factorised gap ΔEF E_F along the trajectory decomposes positionally as: dtΔEF(xt,q,t)=∑i∈MtddtΔEi(xt,q,t), ddt E_F(x_t,q,t)= _i∈ M_t ddt E_i(x_t,q,t), (7) with ΔEi E_i the per-position log-ratio of Eq. (3). For a trajectory in its natural basin, each term changes slowly, so |dΔEF/dt||d E_F/dt| is small. For a trajectory forced across the barrier, the per-position log-ratios shift rapidly toward compV_comp, producing large |dΔEF/dt||d E_F/dt|. Theorem 1 (Kinetic energy cost of barrier crossing). Under the per-token factorisation pθ(x^∣xt)=∏ipθ(x^i∣xt)p_θ( x x_t)= _ip_θ( x_i x_t), suppose the factorised Safety Energy Gap crosses the safety barrier over interval [t1,t2][t_1,t_2], i.e., ΔEF(xt1,q,t1)≥+δ E_F(x_t_1,q,t_1)≥+δ and ΔEF(xt2,q,t2)≤−δ E_F(x_t_2,q,t_2)≤-δ for some δ>0δ>0. Let zti∈ℝ||z_t^i ^|V| denote the logit vector at masked position i at step t, and let (zti)=diag(pti)−pti(pti)⊤F(z_t^i)=diag(p_t^i)-p_t^i(p_t^i) , where pti=softmax(zti)p_t^i=softmax(z_t^i), be the Fisher information matrix at position i. Define the per-position gap functional ϕi(p)=log(∑v∈refpv/∑v∈comppv) _i(p)= ( _v _refp_v/ _v _compp_v) (i.e., the per-position gap ΔEi E_i from Eq. (3) written as a function of the probability vector) and let Gmax=maxi,t‖∇pϕi‖(zti)G_ = _i,t\| _p _i\|_F(z_t^i) (8) be the maximum Fisher-weighted gradient norm, where ‖∇pϕi‖ 2:=(∇pϕi)⊤(zti)(∇pϕi)\| _p _i\|_F^\,2:=( _p _i) F(z_t^i)( _p _i). Then the kinetic energy over [t1,t2][t_1,t_2] satisfies: ∫t1t2γ˙t−1∑i∈Mt(z˙ti)⊤(zti)z˙tit≥4δ2(t2−t1)⋅|M|max⋅Gmax2, _t_1^t_2 γ_t^-1 _i∈ M_t( z_t^i) F(z_t^i)\, z_t^i\,dt\;≥\; 4δ^2(t_2-t_1)·|M|_ · G_ ^2, (9) where |M|max=maxt∈[t1,t2]|Mt||M|_ = _t∈[t_1,t_2]|M_t| and we assume γ˙t≤1 γ_t≤ 1 (satisfied by standard schedules). The bound transfers to the sequence-level gap ΔE E up to the additive correction in Proposition 1(i), so a sequence-level barrier crossing implies the same kinetic energy lower bound whenever the projection error ηref,ηcomp _ref, _comp is small. The proof (Appendix A.2) chains three results from information geometry: (1) the mean value theorem gives a point where |dΔEF/dt|≥2δ/(t2−t1)|d E_F/dt|≥ 2δ/(t_2-t_1); (2) Cauchy–Schwarz in the Fisher inner product bounds the gap rate by the Fisher-weighted logit velocity; (3) the integral Cauchy–Schwarz inequality yields the stated bound. Three aspects of the bound are worth noting. First, it scales as δ2δ^2: a larger safety gap (better alignment) requires quadratically more kinetic energy to breach. Second, the 1/(t2−t1)1/(t_2-t_1) factor means crossing the barrier in fewer denoising steps requires proportionally more velocity per step, exactly the signal that the SED slope detects empirically. Third, the kinetic energy integrand (z˙ti)⊤(zti)z˙ti( z_t^i) F(z_t^i)\, z_t^i is the Fisher-weighted logit velocity: the Fisher information matrix of the categorical distribution is the Riemannian metric on the probability simplex, and the kinetic energy of [7] is the integral of this metric applied to the trajectory velocity. The bound is one-directional: barrier crossing requires elevated kinetic energy, but high velocity can also arise from difficult safe generation. In practice, attack and benign trajectories remain distinguishable (Table 2, §3.3). From kinetic energy to computable signals. Theorem 1 establishes that barrier crossing elevates the Fisher-weighted logit velocity (z˙ti)⊤(zti)z˙ti( z_t^i) F(z_t^i)\, z_t^i. A standard result from the exponential family structure of softmax connects this to a cheap observable: logit displacement tracks Kullback–Leibler (KL) divergence to second order via the Fisher information matrix (Lemma 2, Appendix A.6), and when logit norms vary slowly, cosine similarity provides a monotone proxy (Corollary 1, Appendix A.6). The slow-norm condition is the only approximation; we verify empirically (Appendix E, Table 12) that norm variation stays below 5% over the measurement window, confirming that angular displacement dominates. Subspace decomposition of Fisher velocity. The Fisher-weighted logit velocity in Theorem 1 operates over the full vocabulary V, but the proportionality constant linking cosine displacement to this velocity depends on the model’s Fisher spectrum, so a single cosine signal cannot be calibrated uniformly across architectures. We address this by decomposing the velocity into complementary subspaces. Let Vs=Vref∪VcompV_s=V_ref∪ V_comp denote the safety-relevant subspace and V⟂=∖VsV_ =V V_s its complement. The Fisher velocity at position i decomposes as: (z˙ti)⊤(zti)z˙ti=(z˙Vsi)⊤Vs(zti)z˙Vsi+(z˙V⟂i)⊤V⟂(zti)z˙V⟂i+cross-terms,( z_t^i) F(z_t^i)\, z_t^i\;=\;( z_V_s^i) F_V_s(z_t^i)\, z_V_s^i\;+\;( z_V_ ^i) F_V_ (z_t^i)\, z_V_ ^i\;+\;cross-terms, (10) where the cross-terms come from off-diagonal Fisher blocks. Since |V⟂|≈128k≫|Vs|≈70|V_ |≈ 128k |V_s|≈ 70 and the off-diagonal entries scale as pvpwp_vp_w for v∈Vs,w∈V⟂v∈ V_s,\,w∈ V_ , the full-space velocity is dominated by V⟂V_ and the cross-terms are negligible whenever safety-relevant tokens carry small total mass. Which subspace carries the attack signal depends on how the architecture concentrates safety structure: the Fisher discriminant J (Appendix D.1) is ≈33≈ 33 on the LLaDA family but J=139.73J=139.73 on Dream-7B, indicating that Dream’s AR-initialised prior concentrates safety structure sharply within VsV_s and makes attack disruption there detectable via ΔE E slope. This motivates two complementary proxies for the kinetic energy integrand, each capturing disruption in a different subspace. SED slope (velocity in V⟂V_ ). The Similarity to initial logits Evolution during Denoising is: SED(t)=1|Mt|∑i∈Mtzti⋅z0i‖zti‖⋅‖z0i‖,SED(t)= 1|M_t| _i∈ M_t z_t^i· z_0^i\|z_t^i\|·\|z_0^i\|, (11) tracking cumulative displacement from the initial state. Because |V⟂|≫|Vs||V_ | |V_s|, SED effectively captures the V⟂V_ component. We estimate trajectory velocity from the linear slope over the first half of denoising: s=slope(SED(0),SED(1),…,SED(⌊T/2⌋)),s=slope\! (SED(0),\,SED(1),\,…,\,SED\! ( T/2 ) ), (12) where a steeper (more negative) slope indicates higher kinetic energy expenditure. The first-half window is chosen because logit norm stability degrades in later steps (Appendix E), weakening the cosine-to-KL correspondence. ΔE E slope (velocity in VsV_s). The rate of change of ΔEF(t) E_F(t) (henceforth abbreviated ΔE(t) E(t) when no confusion arises) measures how fast probability mass shifts between refusal and compliance tokens, which is the VsV_s projection of the Fisher velocity. We operationalise this as: sΔE=slope(ΔEF(0),ΔEF(1),…,ΔEF(⌊T/4⌋)),s_ E=slope\! ( E_F(0),\, E_F(1),\,…,\, E_F\! ( T/4 ) ), (13) computed over the first 25% of denoising (ablated in Table 8, Appendix D.3). The shorter window reflects that attack-induced shifts in the 70-dimensional VsV_s subspace are sharp and early, whereas SED averages over ∼128 128k dimensions where the signal accumulates more gradually. A steeply negative sΔEs_ E indicates rapid descent into the harmful basin. Unlike SED slope, ΔE E slope requires no cosine approximation: the rate of change dΔEF/dtd E_F/dt appears directly in the kinetic energy bound (Eq. (7)). Together, the three signals decompose the energy budget: R0R_0 measures the initial safety disposition, the SED slope s measures trajectory velocity in V⟂V_ , and the ΔE E slope sΔEs_ E measures trajectory velocity in VsV_s. An attack must either reveal its intent at initialisation (detected by R0R_0) or cross the barrier by expending kinetic energy in at least one subspace (detected by s or sΔEs_ E). Empirical validation. On the LLaDA family, PAD and DIJA produce steep SED slopes (AUROC 0.84–0.90) and anchoring at t=8t=8 triggers the same signal (AUROC 0.85–0.95), consistent with Lemma 1; benign generation produces flat slopes (Appendix E.3). On Dream-7B, SED slope detects DIJA (0.92) but fails on PAD (0.52), while ΔE E slope captures precisely this gap (PAD AUROC 0.98 via sΔEs_ E), because PAD’s disruption concentrates in VsV_s rather than the full vocabulary. Figure 3 confirms this architecture-dependent subspace concentration: on LLaDA, PAD separates along the SED axis; on Dream, along ΔE E (Eq. (10)). Figure 2: Safety Energy Gap ΔE(t) E(t) trajectories during denoising. Each line shows the mean factorised gap (Eq. (3)) at each denoising step, averaged over 400 prompts per condition (harmful and attack conditions from HarmBench), plotted as the raw sum over masked positions at L=128L=128; the per-token form is used in Appendix D.4. The dashed line at ΔE=0 E=0 marks the energy barrier. Harmful direct queries (black) remain in the safe basin (ΔE>0 E>0) as the model refuses. Template attacks (PAD, DIJA) start near ΔE≈0 E≈ 0 and descend into the harmful basin. Anchoring at t=1t=1 shows partial recovery; at t=8t=8, recovery fails. Figure 3: Fisher velocity projects onto different subspaces across architectures. Each panel shows |SED slope||SED slope| (x-axis, ≈‖z˙V⟂‖F≈\| z_V_ \|_F) vs. |ΔE slope Q1|| E slope Q1| (y-axis, ≈‖z˙Vs‖F≈\| z_V_s\|_F) for benign (AlpacaEval, XSTest) and attack (PAD on HarmBench and AdvBench) prompts. On LLaDA-8B, PAD separates along x (SED, AUROC 0.90); on Dream-7B, along y (ΔE E, AUROC 0.98). The two slopes measure the same Fisher velocity in complementary subspaces. 3.3 Empirical Validation Question: do the three signals together cover every known attack, on architectures that concentrate safety differently? Attack taxonomy. Every known attack maps onto the energy decomposition in one of two ways (Table 2). Potential-energy attacks (harmful direct queries, anchoring) leave harmful intent visible at step 0 and are detected by R0R_0. Kinetic-energy attacks (PAD, DIJA, late anchoring) obscure or bypass the initial state and must force the trajectory across the barrier, producing elevated velocity in V⟂V_ (detected by SED slope on LLaDA) or VsV_s (detected by ΔE E slope on Dream). Late anchoring (t=8t=8) is detected by both R0R_0 (unmodified initial state) and the velocity signals (irrecoverable trajectory displacement). The key structural prediction is that simultaneous evasion of all three signals would require an attack whose kinetic cost falls below detection thresholds in both subspaces while still exceeding the barrier-crossing minimum from Theorem 1, a window that adaptive attack experiments (§4) show is empty on all models tested. Table 2: Attack signatures in the energy decomposition. AUROC of each signal, attack prompts built on HarmBench and AdvBench against benign AlpacaEval and XSTest prompts. Each attack either reveals harmful intent at initialisation (high R0R_0, detected before generation begins) or forces barrier crossing (steep slope in V⟂V_ or VsV_s), or both. Dream-7B PAD row illustrates the architecture-dependent subspace shift. Model Attack Intent Masked Traj. Forced R_0 SED slope E slope Detected by LLaDA-8B Harmful direct ✗ ✗ 0.94 0.43 0.30 R0R_0 PAD ✓ ✓ 0.45 0.90 0.39 SED (V⟂V_ ) DIJA ✓ ✓ 0.17 0.89 0.28 SED (V⟂V_ ) Anchoring t=1t=1 ✗ Mild 0.94 0.62 0.58 R0R_0 Anchoring t=8t=8 ✗ ✓ 0.94 0.91 0.92 Both Dream-7B PAD ✓ ✓ 0.39 0.52 0.98 ΔE E (VsV_s) Combined detection. The taxonomy suggests a simple OR rule: flag a query if R0>τR_0> _R, |s|>τs|s|> _s, or |sΔE|>τΔE|s_ E|> _ E. By Definitions 1–2, any successful attack must drive ΔEF(xt,q,t)<0 E_F(x_t,q,t)<0 at some step (with sequence-level ΔE E following via Proposition 1(i)), which requires either low potential energy at initialisation (ΔEF(x0,q,0)<0 E_F(x_0,q,0)<0, detected by R0R_0) or sufficient kinetic energy to cross the barrier (dΔEF/dtd E_F/dt sufficiently negative, detected by SED slope or ΔE E slope in at least one subspace). The OR rule therefore covers the entire energy budget by construction; threshold-calibrated operating points are in Appendix F. Table 3 reports AUROC for individual signals and their combination. On LLaDA-8B, R0R_0 + SED slope achieves AUROC 0.83–0.95 across attacks. Adding ΔE E slope becomes critical on Dream-7B: PAD detection rises from 0.41 (R0R_0 + SED) to 0.95 (all three). Under the three-signal combination, no attack falls below AUROC 0.83 on any model. Because each signal is calibrated at α/3α/3, the OR rule cannot raise the false-positive rate above α; its cost falls on recall instead, which is why threshold-level recall sits below these AUROCs for template attacks on LLaDA. Appendix F.3 compares four aggregation rules at the same guaranteed false-positive rate. The maximum of calibrated z-scores, the rule Theorem 1 prescribes because an attack must overspend in at least one subspace, matches or beats OR in every setting without training, and a logistic combination roughly doubles recall on the LLaDA template attacks where labelled calibration data exist. The same pattern holds on a sparse mixture-of-experts dLLM (Appendix D.5). Table 3: Combined detection AUROC. Attacks on HarmBench and AdvBench prompts against benign AlpacaEval and XSTest prompts. The three-signal combination resolves PAD on Dream where R0R_0 + SED slope fails. Model Attack R_0 SED E R_0+SED All three LLaDA-8B Harmful direct 0.94 0.43 0.30 0.83 0.83 PAD 0.45 0.90 0.39 0.88 0.87 Anchoring t=8t=8 0.94 0.91 0.92 0.95 0.96 DIJA 0.17 0.89 0.28 0.87 0.87 Dream-7B Harmful direct 0.96 0.67 0.25 0.86 0.86 PAD 0.39 0.52 0.98 0.41 0.95 Anchoring t=8t=8 0.96 0.67 0.97 0.88 0.96 DIJA 0.11 0.92 0.76 0.90 0.90 Relationship to DiffuGuard-SD. Figure 4 compares all detection signals across models and attacks. DiffuGuard’s Safety Divergence (SD) can be understood as a fourth observable of the energy landscape: it detects landscape deformation (whether x0x_0 was reshaped by template injection), achieving AUROC 1.00 for template attacks but ≈0.50≈ 0.50 for non-template threats. SD and our three signals are complementary: SD detects the mechanism of template attacks (state modification), while R0R_0, SED slope, and ΔE E slope detect their consequence (basin displacement or barrier crossing). A complete detection system would monitor all four. From detection to deployment. All three signals are read from logits the model already computes, so monitoring is training-free and adds negligible overhead. A flagged query can be refused, regenerated under a hardened schedule, or escalated to a heavier filter, so detection makes these costlier steps conditional and rare. Detection depends on the generation length L and block size B, which the deployer chooses (Appendix D.4): the LLaDA results in this paper hold at L=128L=128, and we recommend L≤128L≤ 128 with B≥L/2B≥ L/2 on LLaDA and L up to 256 on Dream. Figure 4: Detection AUROC across metrics, attacks, and models. Attack conditions built on HarmBench and AdvBench, benign pool AlpacaEval and XSTest. Green: AUROC ≥0.85≥ 0.85; red: ≤0.50≤ 0.50. The combined energy detector (bottom row) covers all tested attacks on both architectures; DiffuGuard-SD (the detection component of DiffuGuard) is complementary, achieving perfect detection on template attacks but failing on non-template threats. We do not benchmark the full DiffuGuard pipeline (SD + generation-time defenses), which falls outside our detection-only scope. 4 Parametric Stress Testing of Known Attacks We stress-test the complementarity claim from §3.3 against parametric variation of two known attack families: template titration (reducing PAD connector count) and anchoring timing variation (sweeping the intervention step). We evaluate on both LLaDA-8B and Dream-7B. Scope. The experiments below vary a single scalar parameter (ncn_c or tintert_inter) of existing attack templates to test whether the detection–attack coupling predicted by Theorem 1 holds in practice. Fully white-box adaptive attacks that optimise directly against the OR-detector (e.g., via gradient-based search over response-region tokens) are an important next step that we leave to future work. Theorem 1 does constrain such an attacker. The kinetic energy an attack must spend scales as δ2/((t2−t1)|M|maxGmax2)δ^2/((t_2-t_1)\,|M|_ \,G_ ^2), which leaves three levers. Stretching the crossing interval keeps the gap descending through the window the slope signals integrate, and deferring it past that window turns into late anchoring, which R0R_0 catches because the initial state is unmodified (tinter=32t_inter=32 below). Exploiting positions where GmaxG_ is large means working where refusal and compliance mass are both non-negligible, which is the region the ΔE E slope monitors. Reducing the effective barrier δ means starting near the barrier, which R0R_0 measures directly. The constraint therefore lies in the attacker’s objective rather than in any threshold choice: the energy an attack must spend is the quantity the detector measures. Whether this coupling survives a deliberate optimiser, either over response-region tokens or one that suppresses refV_ref mass while keeping harmful semantics, is the experiment that would most strengthen this line of work. The same constraint applies to attacks not yet designed: to succeed, an attack must drive the Safety Energy Gap below zero, which by Theorem 1 costs either low potential energy at initialisation or kinetic energy in at least one monitored subspace. PAD template titration. An adaptive attacker might reduce the number of injected connectors to lower trajectory disruption while retaining enough structure to steer generation. We sweep nc∈0,1,2,3,4,6n_c∈\0,1,2,3,4,6\ connectors (Table 4). Table 4: Adaptive attack detection AUROC. Attacks on HarmBench and AdvBench prompts against benign AlpacaEval and XSTest prompts. Top: PAD titration. On Dream-7B, SED fails at nc=1,2n_c\!=\!1,2 but ΔE E slope rescues detection (bold). Bottom: Anchoring sweep: R0R_0 is constant; slope signals increase with tintert_inter. LLaDA-8B Dream-7B Config R0R_0+SED ΔE E Q1 R0R_0+SED ΔE E Q1 All 3 PAD titration nc=0n_c=0 0.94 0.30 0.96 0.25 0.96 nc=1n_c=1 0.53 0.55 0.41 0.74 0.74 nc=2n_c=2 0.90 0.39 0.52 0.98 0.98 nc=3n_c=3 0.93 0.50 0.81 1.00 1.00 nc=4n_c=4 0.95 0.40 0.87 1.00 1.00 nc=6n_c=6 0.93 0.11 0.96 1.00 1.00 Anchoring tinter=1t_inter=1 0.94 0.58 0.96 0.45 0.96 tinter=2t_inter=2 0.94 0.70 0.96 0.54 0.96 tinter=4t_inter=4 0.94 0.82 0.96 0.80 0.96 tinter=8t_inter=8 0.94 0.89 0.96 0.98 0.98 tinter=16t_inter=16 0.97 0.94 0.96 1.00 1.00 tinter=32t_inter=32 0.99 0.30 0.99 0.25 0.99 Results. On LLaDA-8B, the R0R_0+SED combination detects all configurations that reliably produce harmful content (nc≥2n_c≥ 2, AUROC 0.90–0.95). Reducing to nc=1n_c\!=\!1 drops all signals below detection, but a single connector is insufficient to induce harmful generation: the model produces only truncated stubs rather than actionable harmful content (see Appendix G for generated outputs at each ncn_c). The attacker cannot reduce template intensity below the detection threshold without also falling below the barrier-crossing threshold. On Dream-7B, where R0R_0 + SED slope alone is evaded by reduced-intensity PAD (nc≤2n_c≤ 2), the ΔE E slope rescues detection (Table 4), confirming that monitoring both subspaces is necessary for architecture-robust coverage. For nc≥3n_c≥ 3, ΔE E slope achieves near-perfect detection (≥0.996≥ 0.996). The subspace decomposition explains this: on Dream, PAD’s disruption concentrates in VsV_s, so reducing template intensity weakens the V⟂V_ signal (SED) while the VsV_s signal (ΔE E slope) remains strong. Anchoring timing sweep. We sweep tinter∈1,2,4,8,16,32t_inter∈\1,2,4,8,16,32\ (Table 4, bottom). R0R_0 is invariant to timing (AUROC 0.94–0.96) since anchoring does not modify x0x_0, so the R0R_0+SED combination remains strong throughout. The velocity signals increase monotonically with tintert_inter, consistent with Theorem 1: later intervention leaves fewer denoising steps for barrier crossing, requiring higher velocity per step. On LLaDA-8B, ΔE E Q1 rises from 0.580.58 (tinter=1t_inter\!=\!1) to 0.940.94 (tinter=16t_inter\!=\!16); on Dream-7B, from 0.450.45 to 1.001.00 over the same range. At tinter=32t_inter=32, ΔE E drops to 0.250.25–0.300.30 because the intervention falls outside the Q1 measurement window; R0R_0 still detects this configuration (AUROC 0.990.99). 5 Conclusion We proposed an energy-based analysis that unifies jailbreak attacks against diffusion language models as strategies for circumventing the energy barrier that alignment creates between safe and harmful basins. Three training-free detection signals monitor complementary components of this budget: R0R_0 reads the initial safety disposition, while the SED and ΔE E slopes track kinetic energy in complementary subspaces during denoising. Evaluation on different models confirms that basin structure is intrinsic to aligned dLLMs, while the subspace in which kinetic energy concentrates varies with architecture. Limitations include: (i) validation against existing attacks only, with fully adaptive adversaries left to future work; (i) dependence on per-token factorisation and vocabulary sets specific to current MDM objectives, including a language dependence: on Chinese prompts the English token sets lose their mass and R0R_0 degrades until the sets are re-derived in that language (Appendix D.2); (i) threshold-level TPR that varies with architecture despite uniformly strong rank-order detection (Appendix F); and (iv) threshold-level recall on LLaDA that falls as the generation length grows beyond L=128L=128 (Appendix D.4). The account transfers only in part beyond masked diffusion (Appendix C). Acknowledgments and Disclosure of Funding We thank the anonymous reviewers and the area chair for their detailed reports. The discussions of covert-path attackers (§4), energy-motivated aggregation rules (Appendix F.3), and transfer to autoregressive and text-to-image models (Appendix C) grew out of questions raised in review. References [1] A. Arditi, O. Obeso, A. Syed, D. Paleka, N. Panickssery, W. Gurnee, and N. Nanda (2024) Refusal in language models is mediated by a single direction. In Advances in Neural Information Processing Systems, Vol. 37, p. 136037–136083. Cited by: Appendix C. [2] J. Austin, D. D. Johnson, J. Ho, D. Tarlow, and R. van den Berg (2021) Structured denoising diffusion models in discrete state-spaces. In Advances in Neural Information Processing Systems, Vol. 34, p. 17981–17993. Cited by: Appendix C. [3] T. Bach, D. Nguyen, T. M. Le, and T. Tran (2026) Continual safety alignment via gradient-based sample selection. In Findings of the Association for Computational Linguistics: ACL 2026, p. 18870–18887. Cited by: Appendix C. [4] T. Bach, D. Nguyen, T. M. Le, and T. Tran (2026) Rethinking deep alignment through the lens of incomplete safety learning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40, p. 30005–30012. Cited by: Appendix C. [5] T. Bach, T. Nguyen-Tang, D. Nguyen, T. M. Le, and T. Tran (2026) Curvature-aware safety restoration in LLMs fine-tuning. Transactions on Machine Learning Research. Note: External Links: ISSN 2835-8856, Link Cited by: Appendix C. [6] G. Chen, Y. Xia, X. Jia, Z. Li, P. Torr, and J. Gu (2025) LLM jailbreak detection for (almost) free!. In Findings of the Association for Computational Linguistics: EMNLP 2025, Note: arXiv:2509.14558 Cited by: Appendix C, Appendix C. [7] S. Chen, S. Nie, J. Sun, Z. Feng, Z. Li, J. Wen, and C. Li (2025) Masked diffusion models as energy minimization. In Advances in Neural Information Processing Systems, Cited by: Appendix C, Appendix C, §1, §2, §3.1, §3.2. [8] Y. Deng, W. Zhang, S. J. Pan, and L. Bing (2024) Multilingual jailbreak challenges in large language models. In International Conference on Learning Representations (ICLR), Cited by: §D.2. [9] Z. He, T. Sun, Q. Tang, K. Wang, X. Huang, and X. Qiu (2023) Diffusionbert: improving generative masked language models with diffusion models. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 4521–4534. Cited by: Appendix C, §2. [10] X. Hu, P. Chen, and T. Ho (2024) Gradient cuff: detecting jailbreak attacks on large language models by exploring refusal loss landscapes. In Advances in Neural Information Processing Systems, Vol. 37, p. 126265–126296. Cited by: Appendix C. [11] T. Li, M. Chen, B. Guo, and Z. Shen (2025) A survey on diffusion language models. arXiv preprint arXiv:2508.10875. Cited by: Appendix C. [12] X. Li, T. Zhang, Y. Dubois, R. Taori, I. Gulrajani, C. Guestrin, P. Liang, and T. B. Hashimoto (2023) Alpacaeval: an automatic evaluator of instruction-following models. Cited by: §B.2, §2. [13] Z. Li, Z. Nie, Z. Zhou, Y. Liu, Y. Zhang, Y. Cheng, Q. Wen, K. Wang, Y. Guo, and J. Zhang (2025) Diffuguard: how intrinsic safety is lost and found in diffusion large language models. arXiv preprint arXiv:2509.24296. Cited by: §B.4, §1, footnote 1. [14] M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, et al. (2024) Harmbench: a standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 41st International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 235. Cited by: §B.2, §2. [15] S. Nie, F. Zhu, C. Du, T. Pang, Q. Liu, G. Zeng, M. Lin, and C. Li (2024) Scaling up masked diffusion models on text. arXiv preprint arXiv:2410.18514. Cited by: §2. [16] S. Nie, F. Zhu, Z. You, X. Zhang, J. Ou, J. Hu, J. Zhou, Y. Lin, J. Wen, and C. Li (2025) Large language diffusion models. In International Conference on Learning Representations (ICLR), Cited by: Appendix C, §1, §2, §2. [17] S. Nikolenko, M. Papucci, M. Rezaei, and S. Kudukkil Manchingal (2026) What intermediate layers know: detecting jailbreaks from entropy dynamics. In European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML PKDD), Cited by: Appendix C. [18] B. Peng, C. Li, P. He, M. Galley, and J. Gao (2023) Instruction tuning with GPT-4. arXiv preprint arXiv:2304.03277. Cited by: §D.2. [19] X. Qi, A. Panda, K. Lyu, X. Ma, S. Roy, A. Beirami, P. Mittal, and P. Henderson (2025) Safety alignment should be made more than just a few tokens deep. In International Conference on Learning Representations (ICLR), Cited by: Appendix C. [20] P. Röttger, H. Kirk, B. Vidgen, G. Attanasio, F. Bianchi, and D. Hovy (2024) Xstest: a test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 5377–5400. Cited by: §B.2, §F.2, §2. [21] S. S. Sahoo, M. Arriola, Y. Schiff, A. Gokaslan, E. Marroquin, J. T. Chiu, A. Rush, and V. Kuleshov (2024) Simple and effective masked diffusion language models. In Advances in Neural Information Processing Systems, Vol. 37, p. 130136–130184. Cited by: Appendix C, §2. [22] J. Shi, K. Han, Z. Wang, A. Doucet, and M. K. Titsias (2024) Simplified and generalized masked diffusion for discrete data. In Advances in Neural Information Processing Systems, Cited by: Appendix C. [23] Z. Wen, J. Qu, Z. Chen, X. Lu, D. Liu, Z. Liu, R. Wu, Y. Yang, X. Jin, H. Xu, et al. (2026) The devil behind the mask: an emergent safety vulnerability of diffusion LLMs. In International Conference on Learning Representations (ICLR), Cited by: §B.3, §1, §2. [24] M. Xu, T. Geffner, K. Kreis, W. Nie, Y. Xu, J. Leskovec, S. Ermon, and A. Vahdat (2025) Energy-based diffusion language models for text generation. In International Conference on Learning Representations (ICLR), Cited by: Appendix C, §3.1. [25] S. Yamabe and J. Sakuma (2025) Toward safer diffusion language models: discovery and mitigation of priming vulnerability. arXiv preprint arXiv:2510.00565. Cited by: §B.3, §1, §2. [26] L. Yang, Y. Tian, B. Li, X. Zhang, K. Shen, Y. Tong, and M. Wang (2025) Mmada: multimodal large diffusion language models. arXiv preprint arXiv:2505.15809. Cited by: Appendix C. [27] J. Ye, Z. Xie, L. Zheng, J. Gao, Z. Wu, X. Jiang, Z. Li, and L. Kong (2025) Dream 7b: diffusion large language models. arXiv preprint arXiv:2508.15487. Cited by: Appendix C, §1, §2. [28] R. Yu, Q. Li, and X. Wang (2025) Discrete diffusion in large language and multimodal models: a survey. arXiv preprint arXiv:2506.13759. Cited by: Appendix C. [29] H. Zhang, Y. Zhao, S. Liu, Z. Zhou, Z. Ye, W. Wan, M. Li, S. Hu, Y. Zhang, Y. Liu, and L. Y. Zhang (2026) Defending jailbreak attacks on large language models via manifold trajectory kinetics. In USENIX Security Symposium, Cited by: Appendix C. [30] Y. Zhang, F. Xie, Z. Zhou, Z. Li, H. Chen, K. Wang, and Y. Guo (2025) Jailbreaking large language diffusion models: revealing hidden safety flaws in diffusion-based text generation. arXiv preprint arXiv:2507.19227. Cited by: §B.3, §1, §2. [31] F. Zhu, R. Wang, S. Nie, X. Zhang, C. Wu, J. Hu, J. Zhou, J. Chen, Y. Lin, J. Wen, et al. (2025) Llada 1.5: variance-reduced preference optimization for large language diffusion models. arXiv preprint arXiv:2505.19223. Cited by: Appendix C, §1, §2. [32] F. Zhu, Z. You, Y. Xing, Z. Huang, L. Liu, Y. Zhuang, G. Lu, K. Wang, X. Wang, L. Wei, H. Guo, J. Hu, W. Ye, T. Chen, C. Li, C. Tang, H. Feng, J. Hu, J. Zhou, X. Zhang, Z. Lan, J. Zhao, D. Zheng, C. Li, J. Li, and J. Wen (2025) LLaDA-MoE: a sparse MoE diffusion language model. arXiv preprint arXiv:2509.24389. Cited by: §D.5, §2. [33] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson (2023) Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. Cited by: §B.2, §1, §2. Appendix A Proofs A.1 Flow Decomposition of the Kinetic Energy This decomposition motivates the basin picture of §3.1; no later result depends on it. Writing the kinetic energy in continuity-equation form, p˙t(x)=∑x′(Jtx′→x−Jtx→x′) p_t(x)= _x (J_t^x → x-J_t^x→ x ) for some flow JtJ_t, the energy splits into within-basin and cross-basin components: Ek=Ek⏟within-safe flow+Ekℋ⏟within-harmful flow+Ekcross⏟cross-basin flow,E_k= E_k^S_within-safe flow+ E_k^H_within-harmful flow+ E_k^cross_cross-basin flow, (14) where the cross-basin component sums squared flow magnitudes between the two basins: Ekcross=∫01γ˙t−1∑x∈,x′∈ℋor x∈ℋ,x′∈(Jtx→x′)2pt(x)t.E_k^cross= _0^1 γ_t^-1 _ subarraycx ,\,x \\ or x ,\,x subarray (J_t^x→ x )^2p_t(x)\,dt. (15) Eq. (1) constrains only the marginals p˙t p_t, not the underlying flow, so this decomposition is not unique, and we use it solely as a qualitative lens. Alignment funnels probability toward S, driving Ekcross≈0E_k^cross≈ 0, and a jailbreak succeeds when it forces the trajectory across the barrier into ℋH. When Ekcross≈0E_k^cross≈ 0, the Safety Energy Gap ΔE E (Definition 1) stays positive throughout denoising, and an attack that forces cross-basin flow necessarily drives ΔE E below zero. A.2 Proof of Theorem 1 (Kinetic Energy Cost of Barrier Crossing) Remark 1. The constant GmaxG_ absorbs the spectral structure of the Fisher matrix and the geometry of the gap functional into a single bounded quantity. For a categorical distribution, the Fisher matrix has λmax()≤14 _ (F)≤ 14 (since each diagonal entry pv(1−pv)≤14p_v(1-p_v)≤ 14 and ⪯diag(p)F (p)), so Gmax2=maxi,t∇pϕi⊤∇pϕi≤14‖∇pϕ‖22G_ ^2= _i,t _p _i F\, _p _i≤ 14\| _pφ\|_2^2, i.e., Gmax≤12‖∇pϕ‖2G_ ≤ 12\| _pφ\|_2. The gradient ∇pϕi _p _i has entries 1/(∑v∈refpv)1/( _v _refp_v) on refV_ref and −1/(∑v∈comppv)-1/( _v _compp_v) on compV_comp, so GmaxG_ is finite whenever neither ∑v∈refpv _v _refp_v nor ∑v∈comppv _v _compp_v is zero. Proof. The proof chains three standard results from information geometry applied to the MDM trajectory. Step 1: Gap dynamics via per-position contributions. By Definition 2, the factorised Safety Energy Gap decomposes additively over positions: ΔEF=∑i∈MtΔEi E_F= _i∈ M_t E_i. Its time derivative at each position satisfies: dtΔEi(xt,q,t)=dtlog∑v∈refpθ(v∣q,xt)i∑v∈comppθ(v∣q,xt)i. ddt E_i(x_t,q,t)= ddt _v _refp_θ(v q,x_t)_i _v _compp_θ(v q,x_t)_i. (16) By the mean value theorem applied to the trajectory, the total gap change satisfies |ΔEF(xt2)−ΔEF(xt1)|≥2δ| E_F(x_t_2)- E_F(x_t_1)|≥ 2δ, so there exists t∗∈[t1,t2]t^*∈[t_1,t_2] with |dΔEF/dt|t∗≥2δ/(t2−t1)|d E_F/dt|_t^*≥ 2δ/(t_2-t_1). Step 2: Gap rate bounded by Fisher-weighted velocity. The softmax parameterisation identifies the logit vector z as the natural parameter of a categorical exponential family. For the gap functional ϕi _i at position i, the chain rule gives: dtϕi(pti)=∇pϕi⋅p˙ti=∇pϕi⋅(zti)z˙ti=(1/2∇pϕi)⊤(1/2z˙ti), ddt _i(p_t^i)= _p _i· p_t^i= _p _i·F(z_t^i)\, z_t^i=(F^1/2 _p _i) (F^1/2 z_t^i), (17) where p˙ti=(zti)z˙ti p_t^i=F(z_t^i)\, z_t^i follows from the exponential family relationship ∇zp=(z) _zp=F(z) (the Jacobian of the softmax), and 1/2F^1/2 is the matrix square root of the (positive semi-definite) Fisher matrix on the relevant tangent subspace. By plain Cauchy–Schwarz on the right-hand inner product: |dtϕi(pti)|2≤‖∇pϕi‖2⋅(z˙ti)⊤(zti)z˙ti, | ddt _i(p_t^i) |^2≤\| _p _i\|_F^2·( z_t^i) F(z_t^i)\, z_t^i, (18) where ‖∇pϕi‖2:=(∇pϕi)⊤(zti)(∇pϕi)\| _p _i\|_F^2:=( _p _i) F(z_t^i)( _p _i) is the squared Fisher-weighted norm of the gradient. Bounding this by Gmax2G_ ^2 (Eq. (8)) and summing over positions via Cauchy–Schwarz: |dΔEFdt|2=|∑i∈MtddtΔEi|2≤|Mt|⋅Gmax2⋅∑i∈Mt(z˙ti)⊤(zti)z˙ti, | d E_Fdt |^2= | _i∈ M_t ddt E_i |^2≤|M_t|· G_ ^2· _i∈ M_t( z_t^i) F(z_t^i)\, z_t^i, (19) where the first inequality uses Cauchy–Schwarz over positions (|∑iai|2≤|Mt|∑iai2| _ia_i|^2≤|M_t| _ia_i^2) and the second substitutes Eq. (18) with the uniform bound Gmax2G_ ^2. Step 3: Integration. Rearranging Eq. (19) and integrating over [t1,t2][t_1,t_2] with γ˙t−1≥1 γ_t^-1≥ 1: ∫t1t2γ˙t−1∑i∈Mt(z˙ti)⊤(zti)z˙tit≥∫t1t2|dΔEF/dt|2|Mt|⋅Gmax2t. _t_1^t_2 γ_t^-1 _i∈ M_t( z_t^i) F(z_t^i)\, z_t^i\,dt\;≥\; _t_1^t_2 |d E_F/dt|^2|M_t|· G_ ^2\,dt. (20) By the Cauchy–Schwarz inequality for integrals, ∫t1t2|dΔEF/t|2t≥(∫t1t2|dΔEF/t|t)2/(t2−t1)≥(2δ)2/(t2−t1) _t_1^t_2|d E_F/dt|^2\,dt≥( _t_1^t_2|d E_F/dt|\,dt)^2/(t_2-t_1)≥(2δ)^2/(t_2-t_1). Bounding |Mt|≤|M|max|M_t|≤|M|_ completes the proof. ∎ A.3 Proof of Proposition 1 (Properties of the Factorised Gap) Part (i) of Proposition 1 states the following bound, moved here from the main text. Under per-token factorisation, |ΔE(xt,q,t)−ΔEF(xt,q,t)|≤|Mt|⋅(log11−ηref+log11−ηcomp), | E(x_t,q,t)- E_F(x_t,q,t) |\;≤\;|M_t|· ( 11- _ref+ 11- _comp ), (21) where ηref,ηcomp∈[0,1) _ref, _comp∈[0,1) measure the per-position fraction of safe (resp. harmful) sequence mass not captured by the projection onto refV_ref (resp. compV_comp). The correction is small when refV_ref and compV_comp capture the dominant modes of refusal and compliance. Proof. (i) Immediate from Definition 2: ΔEF E_F is defined as a sum over positions, and each term depends only on the per-position distribution pθ(⋅∣q,xt)ip_θ(· q,x_t)_i. (i) Since the sum is over independent terms, replacing any single term ΔEj E_j with a value c changes ΔEF E_F by c−ΔEjc- E_j. Setting c<−∑i≠jΔEic<- _i≠ j E_i drives ΔEF<0 E_F<0. (i) Under per-token factorisation, p(x^∈∣q,xt)=∑x^∈∏i∈Mtpθ(x^i∣q,xt)ip( x q,x_t)= _ x _i∈ M_tp_θ( x_i q,x_t)_i. Define the per-position safe and harmful masses P,i=∑v∈tokpθ(v∣q,xt)i,Pℋ,i=∑v∈ℋtokpθ(v∣q,xt)i,P_S,i=\!\! _v _tok\!\!p_θ(v q,x_t)_i, P_H,i=\!\! _v _tok\!\!p_θ(v q,x_t)_i, where tok,ℋtok⊆S_tok,H_tok are the token-level projections of ,ℋS,H (cf. §3.1). Under the assumption that any sequence whose positions all lie in tokS_tok (resp. ℋtokH_tok) is itself in S (resp. ℋH), we have p(x^∈)=∏i∈MtP,i,p(x^∈ℋ)=∏i∈MtPℋ,i.p( x )\;=\; _i∈ M_tP_S,i, p( x )\;=\; _i∈ M_tP_H,i. By definition of ηref,ηcomp _ref, _comp, Pref,i=(1−ηref)P,iP_V_ref,i=(1- _ref)P_S,i and Pcomp,i=(1−ηcomp)Pℋ,iP_V_comp,i=(1- _comp)P_H,i. Substituting into ΔE=log(p(x^∈)/p(x^∈ℋ)) E= (p( x )/p( x )) and ΔEF=∑ilog(Pref,i/Pcomp,i) E_F= _i (P_V_ref,i/P_V_comp,i): ΔE−ΔEF=∑i∈Mt(−log(1−ηref)+log(1−ηcomp)). E- E_F\;=\; _i∈ M_t\! (- (1- _ref)+ (1- _comp) ). Taking absolute values and using |log(1−ηcomp)|=log11−ηcomp|\! (1- _comp)|= 11- _comp yields the bound. ∎ A.4 Lemma 1 and Proof (Bidirectional Amplification) Lemma 1 (Bidirectional amplification). Under per-token factorisation and the assumption that an injected token τ induces a uniform per-position log-odds shift across masked positions, injecting τ into the denoising state xtx_t shifts the factorised Safety Energy Gap by: ΔEF(xt⊕τ)−ΔEF(xt)=−BA(τ)⋅|Mt|, E_F(x_t τ)- E_F(x_t)=-BA(τ)·|M_t|, (22) where BA(τ)>0BA(τ)>0 is the per-position harmful pull of τ. The corresponding sequence-level shift inherits the same scaling up to the additive correction in Proposition 1(i). Proof. Define the per-position log-odds shift induced by τ at position i as: δi(τ):=logpθ(safei∣q,xt⊕τ)pθ(harmi∣q,xt⊕τ)−logpθ(safei∣q,xt)pθ(harmi∣q,xt). _i(τ):= p_θ(safe_i q,x_t τ)p_θ(harm_i q,x_t τ)- p_θ(safe_i q,x_t)p_θ(harm_i q,x_t). (23) In a bidirectional transformer, every masked position i∈Mti∈ M_t attends to τ with equal access (there is no causal masking). Under the uniform influence assumption, δi(τ)≈δ(τ) _i(τ)≈δ(τ) for all i∈Mti∈ M_t. Defining BA(τ):=−δ(τ)BA(τ):=-δ(τ), the total shift sums to −BA(τ)⋅|Mt|-BA(τ)·|M_t|. ∎ A.5 Proof of Proposition 2 (R0R_0 as Sufficient Statistic) Proof. (i) At t=0t=0, all |M0||M_0| masked positions are conditioned identically on q and ([MASK])L( [MASK])^L, so the per-position distributions are exchangeable: pθ(v∣q,x0)i=pθ(v∣q,x0)jp_θ(v q,x_0)_i=p_θ(v q,x_0)_j for all i,j∈M0i,j∈ M_0. Substituting into Eq. (3) collapses the sum to |M0||M_0| identical terms, giving Eq. (4), whose per-position version is logR0(q) R_0(q). (i) Under exchangeability, the step-0 logit distribution is identical across positions. The log-ratio log(∑v∈refpv)/(∑v∈comppv) ( _v _refp_v )/ ( _v _compp_v ) is the log-likelihood ratio for testing S vs. ℋH when the observation is projected onto ref∪compV_ref _comp. By the Neyman–Pearson lemma, the likelihood ratio is the most powerful test at every significance level, and any equally powerful statistic on this projection is a monotone transformation of R0R_0. (i) Define P=∑v∈pθ(v∣q,x0)P_S= _v p_θ(v q,x_0) and Pref=∑v∈refpθ(v∣q,x0)P_V_ref= _v _refp_θ(v q,x_0), where here ⊆S denotes the token-level safe set (cf. §3.1). Since ref⊆V_ref by construction, we have Pref=(1−ϵref)P_V_ref=(1- _ref)P_S. Thus logR0=log(P/Pℋ)+log(1−ϵref)−log(1−ϵcomp) R_0= (P_S/P_H)+ (1- _ref)- (1- _comp). Rearranging and applying −log(1−ϵ)≤log11−ϵ- (1-ε)≤ 11-ε gives the bound. ∎ A.6 Lemma 2 and Corollary 1 (From Kinetic Energy to Cosine Displacement) Lemma 2 (Logit-space displacement tracks distributional velocity). Let zti∈ℝ||z_t^i ^|V| be the logit vector at masked position i at step t, and let pti=softmax(zti)p_t^i=softmax(z_t^i). Define the logit displacement δti:=zti−z0i _t^i:=z_t^i-z_0^i. Then: DKL(pti∥p0i)=⟨δti,pti⟩−logZ(zti)Z(z0i),D_KL\! (p_t^i\;\|\;p_0^i )= _t^i,\,p_t^i - Z(z_t^i)Z(z_0^i), (24) where Z(z)=∑vexp(zv)Z(z)= _v (z_v). To second order in δti _t^i: DKL(pti∥p0i)=12(δti)⊤(z0i)δti+O(∥δti∥3),D_KL\! (p_t^i\;\|\;p_0^i )= 12\,( _t^i) F(z_0^i)\, _t^i+O(\| _t^i\|^3), (25) where (z0i)=diag(p0i)−p0i(p0i)⊤F(z_0^i)=diag(p_0^i)-p_0^i(p_0^i) is the Fisher information matrix at z0iz_0^i. Proof. The softmax parameterisation pv=exp(zv)/Z(z)p_v= (z_v)/Z(z) identifies z as the natural parameter of a categorical exponential family with log-partition function A(z)=logZ(z)A(z)= Z(z). For exponential families, DKL(pη∥pη′)=A(η′)−A(η)−⟨∇A(η),η′−η⟩D_KL(p_η\|p_η )=A(η )-A(η)- ∇ A(η),\,η -η . Setting η=ztiη=z_t^i and η′=z0iη =z_0^i and noting ∇A(z)=p=softmax(z)∇ A(z)=p=softmax(z) gives Eq. (24). The second-order expansion follows from ∇2A(z)=(z)∇^2A(z)=F(z), the Fisher information matrix of the categorical distribution, which equals diag(p)−pp⊤diag(p)-p . ∎ Corollary 1 (Cosine displacement as kinetic energy proxy). When logit norms ‖zti‖\|z_t^i\| vary slowly relative to angular displacement, the squared Euclidean displacement ‖δti‖2\| _t^i\|^2 is monotonically related to the cosine displacement 1−cos(zti,z0i)1- (z_t^i,z_0^i): ‖δti‖2=‖zti‖2+‖z0i‖2−2‖zti‖|z0i|cos(zti,z0i).\| _t^i\|^2=\|z_t^i\|^2+\|z_0^i\|^2-2\|z_t^i\|\|z_0^i\| (z_t^i,z_0^i). (26) Combining with Eq. (25): a decrease in cos(zti,z0i) (z_t^i,z_0^i) implies an increase in DKL(pti∥p0i)D_KL(p_t^i\|p_0^i) to second order, so the rate of cosine similarity change tracks the per-position kinetic energy integrand. The proportionality constant relating ‖δti‖2\| _t^i\|^2 to (z˙ti)⊤z˙ti( z_t^i) F\, z_t^i depends on the spectrum of (z0i)F(z_0^i). Since the Fisher matrix =diag(p)−pp⊤F=diag(p)-p concentrates mass on high-probability tokens, the SED proxy primarily captures velocity in the dominant-mass subspace; the complementary ΔE E slope (Eq. (13)) recovers the velocity component projected onto VsV_s, motivating the subspace decomposition in Eq. (10). Appendix B Implementation Details B.1 Models and Inference All experiments use greedy confidence-based remasking at temperature 0 with generation length 128 tokens. Models are loaded in bfloat16 precision via HuggingFace AutoModel. For Dream-7B, attention masks use a boolean format, and the mask token is auto-detected from the tokenizer; for the LLaDA family, the default mask token ID (126336) is used. B.2 Datasets Benign prompts comprise 200 instructions from AlpacaEval [12] (loaded via HuggingFace, seeded at 42) and 250 safe prompts from XSTest [20]. Harmful prompts comprise 400 from HarmBench [14] (the standard subset; 110 contextual behaviors are excluded) and 520 from AdvBench [33], using the Behavior field. DIJA prompts use the Refined_behavior field from AdvBench and the Behavior field from HarmBench (920 prompts total). Each model is evaluated on 7 conditions (clean, XSTest, harmful direct, PAD, anchoring t=1t=1, anchoring t=8t=8, DIJA), yielding 5,050 prompts per model and 10,100 prompts in total across LLaDA-8B and Dream-7B. B.3 Attack Implementations PAD. Following original work [30], structural connectors ("Step 1:", "Step 2:", etc.) are inserted at evenly-spaced positions throughout the response region, with the number of connectors ncn_c set to 2 by default. The prompt is encoded normally; connectors replace mask tokens at computed positions before denoising begins. Anchoring. Follow work by [25], generation proceeds normally until step tintert_inter, at which point the model’s current predictions are replaced with tokens from a pre-built harmful response and then re-masked. The model continues denoising from this contaminated state. We evaluate tinter∈1,8t_inter∈\1,8\ in the main experiments and sweep 1,2,4,8,16,32\1,2,4,8,16,32\ for adaptive analysis. DIJA. Following [23], pre-built templates with interleaved harmful tokens and mask spans are used directly. B.4 Detection Signal Computation Vocabulary sets. Refusal tokens refV_ref (36 tokens: sorry, cannot, refuse, …) and compliance tokens compV_comp (32 tokens: here, sure, certainly, …) are constructed by mapping curated word lists to token IDs via the model’s tokenizer. Both single-token and multi-token entries are resolved; only tokens present in the tokenizer’s vocabulary are retained. Step-0 ratio R0R_0. Computed from the logit distribution at the fully masked state (step 0) as the ratio of the average refusal mass to the average compliance mass across all masked positions (Eq. (5)). SED and SED slope. At each denoising step, the cosine similarity between the current and initial logit vectors is averaged over all currently masked positions (Eq. (11)). The SED slope is the coefficient of a linear fit over the first 50% of denoising steps, with the x-axis normalised to [0,1][0,1] for cross-model comparability. ΔE E slope. The factorised Safety Energy Gap (Eq. (3)) is computed at each step from refusal and compliance masses. The ΔE E slope is the linear fit over the first 25% of denoising (Q1). DiffuGuard-SD (Safety Divergence). For each prompt, we compute the cosine distance between the mean-pooled hidden states of the attack input x0x_0 and the clean baseline xoriginx_origin (the raw query without template modification) [13]. For non-template conditions (clean, harmful direct, anchoring), xorigin=x0x_origin=x_0 by construction, so SD ≈0≈ 0. B.5 Reproducibility All sampling, dataset loading, and model-side stochastic operations use a fixed random seed of 4242 throughout. The detection signal computations themselves are deterministic at temperature 00 (greedy confidence-based remasking; see §B). Models and checkpoints. LLaDA-8B (GSAI-ML/LLaDA-8B-Instruct, mask token id 126336), LLaDA-1.5 (ML-GSAI/LLaDA-1.5-Instruct; used in §3.1 ablations only), and Dream-7B (Dream-org/Dream-v0-Instruct-7B; mask token <|mask|> resolved via tokenizer at runtime, with attention mask in boolean format). Models are loaded via HuggingFace AutoModel in bfloat16 precision. Datasets AlpacaEval 200 (loaded via the tatsu-lab/alpaca_eval HuggingFace dataset, sampled with random.Random(42)); XSTest 250 safe prompts; HarmBench 400 (standard subset, Behavior field); AdvBench 520 (Behavior field). DIJA prompts use the Refined_behavior field from AdvBench and Behavior field from HarmBench (920 total). Hyperparameters. Generation length L=128L=128 tokens; temperature T=0T=0 (greedy); remasking strategy: confidence-based, one token transferred per denoising step. PAD connectors nc=2n_c=2 by default (varied in §4: nc∈0,1,2,3,4,6n_c∈\0,1,2,3,4,6\); anchoring tinter∈1,8t_inter∈\1,8\ in main experiments and 1,2,4,8,16,32\1,2,4,8,16,32\ for the parametric sweep. Refusal vocabulary |ref|=36|V_ref|=36 tokens, compliance vocabulary |comp|=32|V_comp|=32 tokens, both constructed by mapping curated word lists to token ids via the model’s tokenizer (see §B). SED slope window: first 50% of denoising; ΔE E slope window: first 25%. Hardware. All inference experiments are run on a single NVIDIA H100 80GB GPU . Total inference compute for the main results (5,050 prompt-condition pairs per model) is approximately 55–77 H100-hours. Numerical precision. The R0R_0 ratio is a small-probability quotient at the all-mask state. We compute it from bfloat16 logits cast to float32 via F.softmax(….float()) prior to the ratio, to avoid bfloat16 mantissa-quantisation artefacts in the log-odds tail (8 mantissa bits is insufficient for stable small-mass ratios). SED cosine similarity is likewise computed in float32. Appendix C Related Work Diffusion language models. Masked diffusion models (MDMs) generate text by iteratively denoising a fully masked sequence [2, 21, 22, 9]. Recent scaling efforts have produced models competitive with autoregressive LLMs: LLaDA [16] trains an 8B-parameter MDM from scratch, Dream [27] adapts from AR-pretrained weights, and MMaDA [26] extends the paradigm to multimodal generation. LLaDA-1.5 [31] further improves alignment via variance-reduced preference optimisation. On the theoretical side, work by [7] proved that MDMs minimise kinetic energy functionals over discrete probability flows, establishing the foundation on which our safety analysis builds. For a comprehensive overview, we refer to recent surveys [11, 28]. Safety signals in autoregressive LLMs. Our step-0 ratio R0R_0 belongs to a family of first-token safety signals in the AR LLM literature [5, 3]. FJD [6] detects jailbreaks via logit confidence of the first generated token, Gradient Cuff [10] analyses the refusal loss landscape via gradient norms, and [1] showed that refusal is mediated by a single representation direction. R0R_0 is the masked-diffusion analogue: it reads safety intent from the all-[MASK] state, exploiting step-0 exchangeability to aggregate over all positions simultaneously rather than observing a single next-token distribution. More broadly, [19, 4] demonstrated that AR safety alignment is “shallow,” concentrating on the first few output tokens. Our energy analysis reveals an analogous phenomenon in dLLMs: alignment shapes the step-0 logit distribution (potential energy) but leaves trajectory dynamics (kinetic energy) largely unguarded against template attacks. Transfer beyond masked diffusion. The account transfers in part. R0R_0 carries over to autoregressive models as the masked-diffusion analogue of first-token signals such as FJD [6], since step-0 exchangeability aggregates evidence over all L response positions rather than one next-token distribution. The trajectory signals do not: measuring the descent needs the same output position to be read more than once, and an autoregressive model commits each position and never returns to it. Concurrent work reads autoregressive trajectories of other kinds, including layer-wise entropy dynamics through the logit lens [17] and manifold-kinetic treatments of the forward pass [29]. Both monitor depth or token position rather than repeated estimation of the same position, so Theorem 1 does not transfer, and we read the asymmetry as a safety advantage of dLLMs: the denoising trajectory exposes computation that autoregressive decoding hides. For text-to-image diffusion the prospects are better. Continuous diffusion models also follow approximate probability-flow trajectories, and concept erasure plausibly creates basins around unsafe concepts. SED transfers most readily, as an elevated score norm where a prompt drags the trajectory across a concept boundary. R0R_0 would need a noise-conditioned analogue read from the score function at high noise. The ΔE E slope does not transfer, since continuous space has no token-factorised gap and hence no refV_ref or compV_comp. Energy-based perspectives on diffusion models. [7] proved that MDMs minimise kinetic energy over discrete probability flows. We extend their result from a characterisation of optimal denoising to a safety interpretation: alignment reshapes the energy landscape into basins, and attacks succeed by circumventing the resulting barrier. [24] proposed Energy-based Diffusion Language Models (EDLM), which introduce sequence-level energy corrections to improve generation quality. From a safety perspective, their non-decomposable interaction terms would close the per-position attack surface identified by Proposition 1(i), since an adversary could no longer shift the Safety Energy Gap by controlling individual positions. Current dLLMs do not use sequence-level corrections, leaving this vulnerability open and motivating future work on energy-corrected alignment. Appendix D Ablation Studies We present three ablation studies: (1) that alignment creates geometrically separable basin structure in the step-0 logit space, (2) that R0R_0 is robust to vocabulary choice, and (3) temporal analysis of where in the denoising trajectory the slope signals concentrate. Studies (1) and (2) are conducted across three dLLM families on 50 prompts per category drawn from AlpacaEval (benign), XSTest (boundary-benign), and HarmBench (harmful direct). D.1 Basin Geometry at Step 0 Setup. We project the step-0 logit distributions onto the vocabulary subspace ref∪compV_ref _comp (the default token set; see §3.1) and apply Linear Discriminant Analysis (LDA) to find the one-dimensional direction that maximally separates safe (clean, XSTest) from harmful (harmful direct) prompts. We report kernel density estimates (KDE) along this axis and annotate each panel with Fisher’s discriminant ratio: J=(μh−μs)2σs2+σh2,J= ( _h- _s)^2 _s^2+ _h^2, (27) where μs,μh _s, _h and σs2,σh2 _s^2, _h^2 are the mean and variance of the LDA projection for safe and harmful prompts, respectively. A larger J indicates better linear separability. Results. Figure 5 shows the LDA projections for all three models. The safe (green/blue) and harmful (black) distributions are clearly separated across all architectures, with a wide gap around the decision boundary (LDA projection=0LDA projection=0). Quantitatively, J=33.23J=33.23 for LLaDA-8B, J=33.24J=33.24 for LLaDA-1.5, and J=139.73J=139.73 for Dream-7B, all indicating strong linear separability. The near-identical values for the two LLaDA variants (J≈33J≈ 33) suggest that the basin structure is robust to the choice of alignment recipe (SFT vs. VRPO), consistent with our claim that basin formation is intrinsic to the masked diffusion training objective rather than a specific alignment procedure. Dream-7B achieves substantially higher separation (J=139.73J=139.73), which we attribute to its AR-initialised weights providing a stronger prior over refusal token placements; this also corresponds to the higher step-0 AUROC of Dream-7B (0.90 vs. 0.86, Figure 4). Geometric statistics from the underlying logit vectors further corroborate this picture. For LLaDA-8B, the inter-basin centroid distance is 0.00990.0099, while the intra-basin spread is 0.01160.0116 (safe) and 0.00500.0050 (harmful), giving a separation ratio of 0.860.86. For LLaDA-1.5 the inter-basin distance is 0.01040.0104, and the ratio is 0.940.94, and for Dream-7B the inter-basin distance is 0.01610.0161 with a separation ratio of 1.441.44, the only model for which the basin distance exceeds the largest intra-basin spread, indicating clean geometric separation in the projected space. Figure 5: LDA basin separation at step 0 across three dLLM families. Each panel shows kernel density estimates of the LDA projection of step-0 logit distributions onto the ref∪compV_ref _comp subspace, evaluated on 50 clean (AlpacaEval, green), 20 boundary-benign (XSTest, blue), and 50 harmful direct (black) prompts per model. The dashed vertical line marks the LDA decision boundary. Fisher’s discriminant ratio J (Eq. 27) is annotated in each panel. Safe and harmful queries are cleanly separated across all three architectures (J≥33J≥ 33), with Dream-7B achieving the strongest separation (J=139.73J=139.73) due to its AR-initialised prior. The clean and XSTest distributions are nearly indistinguishable, confirming that the model does not conflate boundary-benign queries with harmful ones at step 0. D.2 Vocabulary Robustness of R0R_0 Motivation. Section 3.1 (Proposition 2) showed that the approximation error of R0R_0 relative to the true sequence-level safety energy gap is bounded by the vocabulary coverage parameters ϵref _ref and ϵcomp _comp: the bound degrades when the chosen token sets miss the model’s dominant refusal or compliance probability mass. This ablation tests how sensitive detection performance is to the choice of refV_ref and compV_comp in practice, and whether our theoretical prediction, that synonym sets which the model rarely produces should degrade performance, holds empirically. Vocabulary sets. We compare five vocabulary configurations. Default (|ref|=36|V_ref|=36, |comp|=32|V_comp|=32) is the set used in all main experiments, comprising high-frequency refusal tokens (sorry, cannot, refuse, …) and compliance tokens (here, sure, certainly, …). Synonym (|ref|=36|V_ref|=36, |comp|=32|V_comp|=32) uses lexical substitutions of the default set (apologies, regret, decline, … and absolutely, glad, …) that are semantically equivalent but rarely produced by the model. Freq (|ref|=24|V_ref|=24, |comp|=24|V_comp|=24) uses frequency-ranked tokens from general corpora rather than model-specific output distributions. Minimal5 (|ref|=10|V_ref|=10, |comp|=10|V_comp|=10) is a minimal five-token set (sorry, cannot, no for refusal; here, sure, step, 1, the for compliance). Large30 (|ref|=64|V_ref|=64, |comp|=60|V_comp|=60) augments the default set with 14 additional safety-related tokens (illegal, dangerous, prohibited, …). Results. Figure 6 and Table 5 report AUROC for detecting harmful direct queries against benign queries under each vocabulary configuration. Figure 6: Step-0 ratio R0R_0 is robust to vocabulary choice, except for synonym sets. Each panel shows the AUROC for detecting harmful direct queries vs. benign queries (clean ++ XSTest) as a function of vocabulary set, evaluated on LLaDA-8B (left), LLaDA-1.5 (centre), and Dream-7B (right). Four of five vocabulary configurations achieve AUROC ≥0.90≥ 0.90, including the minimal five-token set. The synonym set consistently underperforms (AUROC ≈0.80≈ 0.80–0.830.83) because it selects tokens that carry negligible probability mass in the models’ actual output distributions, increasing the coverage error ϵref _ref predicted by Proposition 2(i). The dashed line marks the chance level (AUROC =0.5=0.5). Table 5: AUROC of R0R_0 (harmful direct vs. benign) under five vocabulary configurations across three dLLM families. Vocabulary sizes |ref||V_ref| / |comp||V_comp| are shown in parentheses. Best result per model in bold. Vocabulary set |||V| sizes LLaDA-8B LLaDA-1.5 Dream-7B default 36 / 32 0.896 0.917 0.989 synonym 36 / 32 0.796 0.788 0.827 freq 24 / 24 0.910 0.915 0.944 minimal5 10 / 10 0.951 0.957 1.000 large30 64 / 60 0.897 0.916 0.991 Three findings stand out. First, detection is robust across four of five vocabulary sets. All configurations except synonym achieve AUROC ≥0.896≥ 0.896 on LLaDA-8B, ≥0.915≥ 0.915 on LLaDA-1.5, and ≥0.944≥ 0.944 on Dream-7B, with variation of at most ±0.055± 0.055 across default, freq, minimal5, and large30. This confirms that basin structure concentrates on a small number of high-mass tokens: any vocabulary that captures the dominant modes of the model’s refusal and compliance distributions performs well. Second, the minimal vocabulary suffices and slightly outperforms. Counterintuitively, minimal5 achieves the highest AUROC in all three models (0.951, 0.957, and 1.000). We attribute this to the minimal set avoiding noise tokens, tokens in larger sets that carry near-zero probability for any query type, which dilute the ratio and reduce discriminability. This is consistent with Proposition 2(i): R0R_0 is a sufficient statistic projected onto ref∪compV_ref _comp, so adding tokens outside the high-mass region can only hurt. Third, synonym sets degrade performance. The synonym set, which selects semantically appropriate but low-frequency tokens, drops AUROC to 0.7960.796–0.8270.827 across models. This is precisely the failure mode identified by Proposition 2(i): when refV_ref misses the model’s dominant refusal tokens, ϵref _ref grows large and the approximation bound degrades. The gap between default (0.8960.896) and synonym (0.7960.796) on LLaDA-8B is 10 AUROC points, while the gap on Dream-7B is 16 points, consistent with the finding that Dream-7B’s stronger basin structure makes the projection loss more costly. The key message for practitioners is simple: any vocabulary set that captures the model’s actual high-probability refusal and compliance tokens will work; the specific tokens matter, but the set size does not. Automatically derived vocabulary. The five sets above are hand-written. To remove the curator entirely, we rank tokens by mean step-0 mass on 50 harmful and 50 benign held-out prompts, discard tokens appearing in both rankings, and keep the top ten per class (auto10). No human judgement enters at any stage. Table 6 compares auto10 with the curated default on a held-out 50/50 split, so absolute values differ from Table 5 while orderings are preserved. The derived set lands within 0.050.05 AUROC of the default on the LLaDA family and above it on Dream-7B. The curated minimal5 set remains best on two of three models, so curation is a convenience rather than a requirement. Every model’s derived refusal set contains sorry, assist, but, ’t and ’m, tokens no curator would list together, surfacing independently on three models: the vocabulary is a measurable property of the model, and the derivation reads it rather than designing it. Table 6: R0R_0 AUROC (harmful direct vs. benign) with the curated default vocabulary and an automatically derived one, on a held-out split of 50 harmful and 50 benign prompts. Vocabulary LLaDA-8B LLaDA-1.5 Dream-7B Curated default 0.935 0.947 0.966 Automatically derived (auto10) 0.894 0.928 0.984 Lexicon evasion. An adversary who knows the token sets would aim to shift the model onto refusal-equivalent tokens that carry little mass in refV_ref. The synonym set above measures exactly this degradation (0.7960.796, 0.7880.788 and 0.8270.827), the failure Proposition 2(i) predicts, and re-deriving the sets from the model’s own behaviour is the countermeasure. Attacks weakened until they slip under the thresholds fall under the sweeps of §4, where configurations that evade all three signals produce only truncated stubs. What remains untested is a prompt that avoids the lexicon while still inducing a harmful trajectory; we return to this in §4. Cross-lingual coverage. We evaluate LLaDA-8B on 315 harmful Chinese prompts from MultiJail [8] (human-translated) and 315 benign Chinese prompts from alpaca-zh [18], keeping the English vocabulary and recalibrating thresholds on the Chinese benign pool (Table 7). The detector goes blind; the model does not. LLaDA still refuses 73% of these prompts, in Chinese (“I’m sorry, I cannot…”), but those tokens lie outside refV_ref, so the English check reads zero. This is the coverage failure Proposition 2(i) predicts rather than a jailbreak. The loss is confined to R0R_0 and to queries with no template: SED uses no vocabulary and still detects Chinese PAD (0.7980.798 against 0.9000.900 in English), whereas a direct harmful query has no template disruption for a trajectory signal to read, so nothing compensates when R0R_0 goes blind. The repair is the auto10 procedure run in the new language: derived from 50/50 held-out Chinese prompts and evaluated on a matched split, R0R_0 rises from 0.7960.796 to 0.9620.962, and the extracted tokens are the ones the model actually refuses with. Table 7: Cross-lingual evaluation on LLaDA-8B: Chinese MultiJail (harmful) and alpaca-zh (benign) prompts, with the English vocabulary and with a vocabulary derived in Chinese. Thresholds recalibrated on the Chinese benign pool. LLaDA-8B, direct harmful English Chinese, English vocab. Chinese, derived vocab. R0R_0 AUROC 0.937 0.796 0.962 OR-detector TPR 0.784 0.060 – SED AUROC (PAD) 0.900 0.798 – D.3 Temporal Analysis of Attack Signatures The energy framework predicts that different attacks should produce distinct temporal patterns. We analyse two dimensions: where in denoising the slope signal concentrates, and how anchoring timing affects detectability. Early trajectory signal (Q1 vs. 50% slope). Table 8 compares SED slope and ΔE E slope computed over the first 25% (Q1) versus the first 50% of denoising. For PAD on LLaDA, SED Q1 slightly underperforms 50% (0.89 vs. 0.90), consistent with PAD’s distributed connectors affecting the entire trajectory. For anchoring t=8t=8, Q1 achieves the highest AUROC across both SED (0.95) and ΔE E slope (0.92 on LLaDA-8B), consistent with anchoring’s single-step intervention creating a sharp early discontinuity. On Dream, ΔE E slope Q1 is the strongest signal for PAD (0.98), confirming that the safety-subspace disruption is concentrated in the early trajectory. Table 8: Temporal signature analysis. AUROC for SED slope and ΔE E slope computed over different trajectory segments (Q1 = first 25%, 50% = first half). ΔE E slope Q1 resolves PAD on Dream where all SED variants fail. PAD Anchoring t=8t=8 Model Metric Q1 50% Full Q1 50% Full LLaDA-8B SED slope 0.89 0.90 0.79 0.95 0.91 0.68 ΔE E slope 0.39 0.43 0.43 0.92 0.82 0.68 LLaDA-1.5 SED slope 0.87 0.87 0.68 0.92 0.85 0.61 ΔE E slope 0.43 0.43 0.45 0.89 0.78 0.66 Dream-7B SED slope 0.72 0.52 0.40 0.83 0.67 0.41 ΔE E slope 0.98 0.96 0.90 0.97 0.94 0.86 Anchoring timing: later intervention, stronger signal. Anchoring at t=1t=1 produces weaker slope signals (SED AUROC 0.57–0.67; ΔE E AUROC 0.47–0.62) than t=8t=8 (SED AUROC 0.67–0.91; ΔE E AUROC 0.82–0.97) across all models. This aligns with the energy interpretation: at t=1t=1, the trajectory has barely left the initial state, preserving recovery capacity; by t=8t=8, more tokens have been committed, and the contamination creates a larger trajectory displacement detectable in both subspaces. Dream’s trajectory signals concentrate in VsV_s. On Dream, SED slope detection is weak across all temporal windows and attacks (AUROC 0.40–0.83), while ΔE E slope consistently achieves strong detection (AUROC 0.86–0.98). This confirms the subspace decomposition finding: Dream’s kinetic energy from attack disruption concentrates in the safety subspace VsV_s rather than the full vocabulary V⟂V_ , making ΔE E slope the primary trajectory signal for AR-initialised architectures. D.4 Generation Length and Block Size We ran the full pipeline at L∈64,256,512L∈\64,256,512\ on LLaDA-8B and Dream-7B, and at L=256L=256 with block decoding at B∈32,64,128,256B∈\32,64,128,256\, recalibrating thresholds at every setting (sixteen settings in total). Realized benign false-positive rate stayed within [0.09,0.12][0.09,0.12] against a 0.100.10 target in every setting. Baseline scale. ΔEF E_F (Eq. (3)) sums over masked positions, so its raw value grows with the number of positions still masked (Table 9). The per-token form ΔEF/|Mt| E_F/|M_t| moves within a factor of two with no trend, and we report it whenever lengths are compared. R0R_0 and SED are per-position quantities (Proposition 2(i), Eq. (11)) and carry no such dependence: their benign baselines are flat in L, and R0R_0 is exactly invariant to block size, giving 0.7770.777 AUROC on LLaDA-8B and 0.9600.960 on Dream-7B at every B, identical to three decimals, as expected of a step-0 statistic. At fixed L the normalization leaves AUROC unchanged; its benefit is that thresholds calibrated at one length remain valid at another. Table 9: Benign baseline of the factorised gap from L=64L=64 to L=512L=512: the raw sum scales with length, the per-token form does not. Benign baseline, L=64L=64 to 512512 LLaDA-8B Dream-7B Raw ΔEF E_F 70.3 to 260.1 (×3.7× 3.7) 154.1 to 1653.6 (×10.7× 10.7) Per-token ΔEF/|Mt| E_F/|M_t| 1.10 to 0.51 2.41 to 3.23 Detection recall. The value of R0R_0 does not depend on length, but its ability to separate does (Table 10). On LLaDA-8B recall falls sharply as L grows, while Dream-7B is stable. The LLaDA detection results in the main text are therefore statements at L=128L=128. Two points limit the concern. Rank-order AUROC holds across the sweep, so it is threshold-level recall that degrades. And the cause is the one Eq. (10) predicts: LLaDA’s basin separation is weak (J≈33J≈ 33 against 139.7139.7 for Dream, Appendix D.1), so detection leans on R0R_0, whose discriminative power dilutes as refusal mass spreads over more positions. Dream, with the stronger basin, is stable. Table 10: OR-detector TPR at the calibrated threshold across generation lengths. OR-TPR at calibrated threshold L=64L=64 L=128L=128 L=256L=256 L=512L=512 LLaDA-8B, direct harmful 0.82 0.78 0.58 0.32 Dream-7B, DIJA 0.62 – – 0.94 Block size. Block size matters for the trajectory signals on Dream, where PAD OR-TPR rises from 0.160.16 at B=32B=32 to 0.940.94 at B=256B=256, because small blocks commit template tokens before the full response context forms. B and L are chosen by the deployer rather than the prompt-level adversary of our threat model, so this is a deployment hazard rather than an attack surface; our guidance is L≤128L≤ 128 with B≥L/2B≥ L/2 on LLaDA and L up to 256 on Dream (§3.3). D.5 A Sparse Mixture-of-Experts dLLM We evaluated LLaDA-MoE-7B-A1B-Instruct [32], a mixture-of-experts dLLM and the first sparse architecture we have tested, under the protocol of §2 (Table 11). It is the most strongly aligned model in our evaluation, R0R_0 reads its refusal basin cleanly, and detection on direct harmful queries and on anchoring matches the dense models. Template attacks split into two cases the paper already documents. PAD is refused 83% of the time by this model, so little barrier crossing remains to detect. For DIJA the ranking is intact (AUROC 0.850.85), but the OR rule does not convert it: R0R_0 and the ΔE E slope are anti-correlated with DIJA on every model we have tested (Table 3), so the Bonferroni correction penalises SED, the one signal that separates this attack. The aggregation rules of Appendix F.3 address this case. Table 11: LLaDA-MoE-7B against the dense models of the main text (range over LLaDA-8B, LLaDA-1.5 and Dream-7B). All TPRs at a guaranteed benign FPR of 10%10\%. ∗See text. Dense models (main text) LLaDA-MoE-7B Refusal rate, direct harmful queries 60 to 80% 99% R0R_0 AUROC, harmful direct 0.90 to 0.99 0.95 OR+Bonferroni TPR, harmful direct 0.78 to 0.82 0.72 OR+Bonferroni TPR, anchoring t=8t=8 0.85 to 0.96 0.85 OR+Bonferroni TPR, PAD 0.18 to 0.91 0.09∗ OR+Bonferroni TPR, DIJA 0.10 to 0.70 0.10∗ Realized benign FPR at 0.100.10 target 0.09 0.08 Appendix E Empirical Verification of Theoretical Assumptions The derivation chain from kinetic energy to computable signals relies on two assumptions: the slow-norm condition in Corollary 1 and the uniform influence assumption in Lemma 1. We verify both empirically across LLaDA-8B and Dream-7B. E.1 Corollary 1: Slow-Norm Condition Corollary 1 establishes that cosine displacement tracks KL divergence, and hence kinetic energy, when logit norms ‖zti‖\|z_t^i\| vary slowly relative to angular displacement. To assess this condition, we record the mean logit norm across masked positions at each denoising step and compute two summary statistics over the first 50% of denoising (the window over which SED slope is measured): the coefficient of variation (CV) of the mean norm trajectory, and the max-to-min ratio. Table 12 reports these statistics. On LLaDA-8B, norm CV is below 0.04 for all categories, with max/min ratios of 1.06–1.15. On Dream-7B, norm CV remains below 0.05 for clean, harmful direct, PAD, and slice, with moderately higher values for anchoring t=8t=8 (0.10) and DIJA (0.12). These elevated values correspond to attacks that inject tokens mid-trajectory, physically altering the logit landscape; even so, the norms vary by only 10–12% relative to their mean, within the regime where the second-order approximation in Corollary 1 is adequate. Figure 7 visualises the condition directly: logit norms (dashed) remain in a narrow band throughout denoising while cosine similarity (solid) diverges substantially across categories. On LLaDA-8B, norms vary by ∼ 15% over the full trajectory while SED changes by 2–8% in the first half, confirming that angular change dominates magnitude change. On Dream-7B, the pattern holds for the first ∼ 70% of denoising; the late-step norm increase occurs outside the SED slope measurement window and does not affect the signal. Figure 7: Slow-norm condition (Corollary 1). Solid lines show the SED trajectory (left axis); dashed lines show the mean logit norm ‖zti‖\|z_t^i\| (right axis). Logit norms remain approximately constant while cosine similarity diverges across categories, confirming that angular displacement dominates magnitude change in the first half of denoising. E.2 Lemma 1: Uniform Influence Lemma 1 assumes that an injected token τ induces a uniform per-position log-odds shift δi(τ)≈δ(τ) _i(τ)≈δ(τ) across all masked positions. To assess this, we compute the per-position Safety Energy Gap ΔEi=log(Pref,i/Pcomp,i) E_i= (P_ref,i/P_comp,i) at each masked position i at each denoising step, and report the coefficient of variation (CV) of ΔEi E_i across positions, averaged over the first 50% of denoising. Table 12 reports ΔEi E_i CV for each category and model. The results reveal an architecture-dependent pattern that aligns with the detection analysis in the main paper. On Dream-7B, template attacks exhibit near-uniform per-position influence: PAD achieves CV =0.45=0.45 and DIJA achieves CV =1.17=1.17, both substantially below the benign baseline (CV =6.13=6.13 for clean). This is precisely the regime where ΔE E slope is the dominant detection signal (AUROC 0.98 for PAD), consistent with Lemma 1’s prediction that uniform influence produces a coherent, detectable ΔE E shift across positions. On LLaDA-8B, per-position influence is less uniform across all categories (CV 3.8–10.2), with no category consistently below 1. This does not invalidate the detection framework, because SED slope, which is derived from the full-vocabulary Fisher velocity (Lemma 2 and Corollary 1) rather than from the uniform influence assumption, is the dominant signal on LLaDA (AUROC 0.90 for PAD). The uniform influence assumption is most precise on the architecture where the signal that depends on it (ΔE E slope) is most effective, and least precise on the architecture where an alternative signal (SED slope) provides detection. Figure 8 visualises this pattern via box plots of per-prompt ΔEi E_i CV. On Dream-7B, PAD and DIJA produce compact distributions near zero, while anchoring t=8t=8 (which intervenes mid-trajectory rather than at initialisation) shows higher and more variable CV, consistent with the single-step perturbation creating heterogeneous influence across positions. Figure 8: Per-position ΔEi E_i uniformity (Lemma 1). Box plots show the coefficient of variation of ΔEi E_i across masked positions, averaged over the first 50% of denoising. On Dream-7B, PAD and DIJA show near-uniform influence (CV <1.2<1.2), validating the assumption for the architecture where ΔE E slope is the primary detection signal. On LLaDA-8B, influence is less uniform, but SED slope (which does not depend on this assumption) provides detection. Table 12: Empirical verification of theoretical assumptions. Norm CV and max/min ratio assess the slow-norm condition (Corollary 1); ΔEi E_i CV assesses per-position uniformity (Lemma 1). Both are computed over the first 50% of denoising. LLaDA-8B Dream-7B Category Norm CV Max/Min ΔEi E_i CV Norm CV Max/Min ΔEi E_i CV Clean benign 0.024 1.11 4.82 0.037 1.20 6.13 XSTest (safe) 0.014 1.07 7.23 0.025 1.14 5.72 Harmful (direct) 0.013 1.06 6.30 0.031 1.17 4.83 Slice prefix 0.020 1.10 3.78 0.036 1.23 3.25 PAD 0.032 1.14 10.24 0.035 1.18 0.45 Anchor (t=1t=1) 0.019 1.09 4.47 0.049 1.26 4.97 Anchor (t=8t=8) 0.037 1.15 8.69 0.101 1.50 10.93 DIJA 0.027 1.11 4.68 0.120 1.61 1.17 E.3 SED Slope Distributions Figure 9 shows SED slope distributions (first 50% of denoising) for benign queries versus attacks that evade R0R_0. Attacks produce steeper (more negative) slopes than benign generation, reflecting higher kinetic energy expenditure consistent with barrier crossing. On LLaDA-8B and LLaDA-1.5, SED slope achieves AUROC 0.84–0.91 across PAD, DIJA, and anchoring t=8t=8. On Dream-7B, SED slope detects DIJA (0.92) but not PAD (0.52), consistent with the architecture-dependent subspace concentration discussed in §3.3. Figure 9: SED slope distributions (first 50% of denoising). Attacks produce steeper slopes than benign, reflecting higher kinetic energy expenditure. AUROC values (vs. benign) shown below each attack. Appendix F Threshold Calibration Analysis The AUROC analysis in the main paper evaluates detection signals as rank-order statistics. This appendix examines threshold-level operating characteristics, addressing how the rank-order separation reported in §3.3 translates to detection at fixed false-positive rates. F.1 Setup For each signal σ∈R0,s,sΔEσ∈\R_0,s,s_ E\, we determine the threshold τσ _σ such that a fraction α of benign queries (AlpacaEval ∪ XSTest, n=450n=450) exceed the threshold. The OR-detector flags a query if any signal exceeds its respective threshold: y^(q)=[R0(q)≥τR]∨[|s(q)|≥τs]∨[|sΔE(q)|≥τΔE]. y(q)=1\! [R_0(q)≥ _R ]\; \;1\! [|s(q)|≥ _s ]\; \;1\! [|s_ E(q)|≥ _ E ]. (28) The combined FPR satisfies FPROR≤kαFPR_OR≤ kα by the union bound, where k=3k=3 is the number of signals. When signal responses are correlated on benign data, the actual combined FPR is lower. We report results at the per-signal level (α∈0.01,0.05,0.10α∈\0.01,0.05,0.10\) and under Bonferroni correction (α=FPRtarget/kα=FPR_target/k), which guarantees FPROR≤FPRtargetFPR_OR _target. Table reports TPR for each signal and the OR-detector at per-signal α=0.05α=0.05 (combined FPR ≈14%≈ 14\%). Table 13 reports Bonferroni-corrected results at guaranteed FPR ≤5%≤ 5\% and ≤10%≤ 10\%. F.2 Analysis Architecture-dependent threshold separation. The gap between AUROC and threshold-level TPR is architecture-dependent and consistent with the Fisher velocity decomposition (§3.2). On Dream-7B, the ΔE E slope achieves strong threshold-level separation for PAD (0.94 TPR at per-signal 5% FPR), reflecting the sharp concentration of attack disruption in the safety subspace VsV_s (Fisher discriminant J=139.73J=139.73). On the LLaDA family, the same attack achieves 0.90 AUROC via SED slope but only 0.24 TPR at the same operating point. This discrepancy arises because the LLaDA SED slope distributions for PAD and benign queries have well-separated means but overlapping tails: the rank-ordering is good (high AUROC), but the extreme quantiles that determine threshold-level detection are not cleanly separated. The higher Fisher discriminant on Dream concentrates the signal more tightly, producing cleaner tail separation. Complementarity at threshold level. The complementarity structure identified via AUROC (Table 2) is preserved at threshold level on Dream-7B: R0R_0 detects harmful direct queries (0.84), ΔE E slope detects PAD (0.94) and anchoring t=8t=8 (0.93), and SED slope detects DIJA (0.63). No single signal achieves >0.26>0.26 TPR on all attacks, but the OR-detector achieves ≥0.78≥ 0.78 on every attack type. On LLaDA-8B, complementarity holds for R0R_0-detectable attacks (harmful direct, anchoring), but the velocity signals’ threshold-level contribution is weaker for template attacks, consistent with the diffuse subspace concentration observed on natively trained architectures (§3.3). Table 13: Bonferroni-corrected OR-detector. Each signal is calibrated at α=FPRtarget/3α=FPR_target/3, guaranteeing combined FPR ≤ target. FPR ≤ 5% FPR ≤ 10% Model Attack TPR FPR TPR FPR LLaDA-8B Harmful direct 0.75 0.051 0.78 0.093 PAD 0.14 0.26 Anchoring t=8t=8 0.84 0.89 DIJA 0.08 0.20 Dream-7B Harmful direct 0.78 0.051 0.82 0.091 PAD 0.85 0.91 Anchoring t=8t=8 0.94 0.96 DIJA 0.56 0.70 Boundary-benign false positives. Table 14 evaluates whether the signals erroneously flag benign queries that mention sensitive topics. Thresholds calibrated at 5% FPR on clean (AlpacaEval) queries produce equal or lower FPR on XSTest [20] across all signals and models. On LLaDA-8B, the SED slope produces 0% FPR on XSTest at a 5% clean threshold. This is consistent with the energy interpretation: XSTest queries occupy the same basin as clean benign queries at step 0 (their R0R_0 distribution is indistinguishable from clean; see Figure 1), and the trajectory follows the same low-velocity geodesic regardless of surface-level content. Table 14: FPR on XSTest boundary-benign queries. Thresholds are calibrated at 5% FPR on clean (AlpacaEval) benign queries. XSTest FPR is consistently ≤ clean FPR. LLaDA-8B Dream-7B Signal τ Clean XSTest τ Clean XSTest R0R_0 5.01 5.0% 4.0% 3.61 5.0% 3.2% SED slope −-0.097 5.0% 0.0% −-0.040 5.0% 2.8% ΔE E slope −-4.60 5.0% 0.4% −-2.05 5.0% 3.2% F.3 Aggregation Rules Beyond OR The OR rule spends its false-positive budget through a union bound that must hold under arbitrary dependence, which leaves slack whenever the signals are correlated. The energy framework prescribes a specific alternative. By Theorem 1 an attack must overspend its budget in at least one subspace, not in total, so the discriminative statistic is the largest single violation: the maximum of the per-signal z-scores, calibrated as one statistic on the signals’ joint benign distribution (max-z). We compare OR, max-z, the sum of z-scores (sum-z), and a logistic combination fit by 5-fold cross-validation, all thresholded only on held-out benign predictions and reusing the per-prompt signal values of the main runs (Table 15). Table 15: TPR at guaranteed benign FPR ≤10%≤ 10\% under four aggregation rules, on the settings where OR is weakest plus Dream-7B PAD. Best per row in bold. Model and attack OR (paper) max-z sum-z logistic LLaDA-8B, PAD 0.287 0.295 0.287 0.565 LLaDA-8B, DIJA 0.214 0.224 0.177 0.537 LLaDA-1.5, DIJA 0.098 0.123 0.128 0.298 Dream-7B, PAD 0.912 0.912 0.841 0.780 Realized benign FPR (target ≤0.10≤ 0.10) 0.087 to 0.093 0.100 0.100 0.100 Three results follow. Max-z matches or beats OR in every setting, with no training. This is expected: OR is already a maximum over per-signal thresholds, and max-z is the same rule calibrated on the joint distribution, so it recovers the union-bound slack. Sum-z loses, as the theory says it should. It trails OR and max-z on Dream-7B PAD and LLaDA-8B DIJA, with one win on LLaDA-1.5 DIJA; adding the overrun across subspaces dilutes the quantity Theorem 1 bounds. The logistic combination goes further where OR is weakest, and its failures are also predicted. It roughly doubles recall on the LLaDA template attacks at the cost of a small labelled calibration set, but it is not uniformly better: it falls on Dream-7B PAD, and on LLaDA-8B direct harmful queries at FPR ≤5%≤ 5\% (0.7530.753 to 0.6900.690). Learning helps where no single signal dominates and hurts where one already carries the detection, the complementarity pattern of §3.3. The gap between AUROC and threshold-level recall is therefore largely a cost of the union bound. We recommend max-z as the training-free default and the logistic combination where labelled calibration data exist. Appendix G Adaptive Attack Details Figure 10 shows representative generated outputs under PAD template titration at nc=0,1,2n_c=0,1,2 on LLaDA-8B. At nc=0n_c\!=\!0, R0R_0 detects harmful intent and the model refuses. At nc=1n_c\!=\!1, both signals are evaded but the output is a truncated stub without actionable harmful content. At nc=2n_c\!=\!2, PAD successfully induces harmful generation, but trajectory velocity detects the disruption (SED slope on LLaDA, ΔE E slope on Dream). This illustrates the core finding: the attacker cannot reduce template intensity below the detection threshold without also falling below the barrier-crossing threshold required to induce harmful generation. Figure 10: PAD titration: generated outputs at nc=0,1,2n_c=0,1,2. At nc=0n_c\!=\!0, R0R_0 detects, and the model refuses. At nc=1n_c\!=\!1, both signals are evaded, but the output is a stub. At nc=2n_c\!=\!2, PAD induces harmful generation, but trajectory velocity detects the disruption.