# DIVA — Cross-Step Conditional Propagation **DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models**

Project page · Paper · Offline viewer

Accepted to EMNLP 2026 Main Conference

DIVA teaser

This repository is the clean, publishable subset of the DIVA research code accompanying our **EMNLP 2026 Main Conference** paper. It contains the model adapters, camera-ready paper PDF, web-ready figures, release checks, and a self-contained project page. The code is intended for authorized, white-box robustness research on discrete diffusion vision-language models (dVLMs). ## Authors Guorui Song*, Runqing Tang*, Jingye Zhang*, Luyuan Zhang*, Feice Huang, Cong Ray, Guocun Wang, Dake Zhong, Choo Sin Wai, Bingquan Dai, Chuming Wang, Tongxu Lin, Wanyu Guo, Haoqian Wang 1 Tsinghua University · 2 Beijing University of Posts and Telecommunications · *Equal contribution ## DIVA in one minute Unlike autoregressive VLMs, a dVLM re-injects the visual embedding at every reverse denoising step. DIVA moves the unsafe intent into a visually grounded composite and optimizes one bounded perturbation against several intermediate masked states. The same condition is therefore present throughout the generation trajectory rather than only in a static prefix.

DIVA overview

## Reported results The following values are transcribed from the paper. They are included for provenance; this release does not ship benchmark prompts, model weights, or generated attack artifacts. ### HADES / Beaver reward model (ASR %, higher is better) | Target model | Native model | + DIVA | Gain | | --- | ---: | ---: | ---: | | LLaDA-V | 54.00 | **58.80** | +4.80 | | MMaDA | 30.80 | **67.73** | +36.93 | | LLaDA2.0-Uni | 23.07 | **69.07** | +46.00 | ### VLSBench (ASR %, higher is better) | Target model | Native model | + DIVA | | --- | ---: | ---: | | LLaDA-V | 49.58 | **52.07** | | MMaDA | 70.10 | **74.16** | ### LLaDA-V ablation (HADES average ASR %) | Condition | ASR | | --- | ---: | | Plain text-only | 32.93 | | Composite image $x_c$ | 41.00 | | Random perturbation $\delta$ | 44.53 | | Shuffled perturbation $\delta$ | 52.67 | | **DIVA perturbation $\delta$** | **58.80** |

Qualitative comparison before and after DIVA

## Scope and responsible use DIVA is a white-box robustness research framework. It optimizes visual inputs to study safety failures in discrete diffusion vision-language models (dVLMs). Use it only on models and data for which you have authorization, and only in an isolated evaluation environment. Do not use the code to bypass safeguards in deployed systems or to generate harmful material. See [`SECURITY.md`](SECURITY.md) before publishing results or reporting a newly discovered issue. This release intentionally excludes model weights, benchmark images/prompts, generated adversarial examples, logs, result tables, local caches, and nested Git repositories. Obtain each benchmark and upstream model from its official source and follow their licenses and terms. ## What is included ```text DIVA/ ├── diva_lladav/ # Pixel-space DIVA for LLaDA-V / LaViDa adapters ├── diva_mmada/ # Pixel-space DIVA for MMaDA MMU ├── diva_llada_uni/ # Semantic-token and soft-embedding DIVA for LLaDA2.0-Uni ├── examples/ # Schema-only, non-sensitive instruction example ├── assets/ # overview, method, experiment, and qualitative figures ├── paper.pdf ├── scripts/check_release.py ├── index.html # Offline project/paper viewer ├── pyproject.toml ├── requirements.txt ├── LICENSE ├── NOTICE.md └── SECURITY.md ``` The model-specific adapters are deliberately kept separate: each one mirrors the target model's official preprocessing and generation path. The release does not vendor those upstream repositories. ## Installation Python 3.10+ and a CUDA-capable PyTorch installation are recommended. Install PyTorch for your CUDA version first, then: ```bash python -m venv .venv source .venv/bin/activate python -m pip install --upgrade pip python -m pip install -r requirements.txt python scripts/check_release.py ``` The checker is CPU-only and does not download weights or data. ## Inputs Prepare your own licensed image and instruction file. The expected JSON shape is shown in [`examples/instructions.example.json`](examples/instructions.example.json): ```json [ {"sample_id": "demo-0", "prompt": "Describe the object in the image.", "y_harm": "A concise description."} ] ``` `y_harm` is the target continuation used by the white-box objective. Do not commit benchmark prompts or target continuations to a public repository; keep them in a private, access-controlled data directory and pass their path at runtime. ## Training commands ### LLaDA-V / LaViDa Clone the official target repository separately and pass its path explicitly: ```bash python -m diva_lladav.attack \ --model_path \ --repo-path \ --category demo \ --image \ --instructions \ --output outputs/lladav/delta_demo.pt \ --epsilon 0.25 --num_steps 5 --K 1 --R 32 ``` The full 500-step setting from the paper is intentionally not run by the smoke command. Use a private benchmark directory and increase `--num_steps`, `--K`, and `--R` only after validating memory and authorization. ### MMaDA The MMaDA adapter imports `MAGVITv2`, `MMadaModelLM`, and `UniversalPrompting` from the official MMaDA checkout. Run it from that checkout (or expose it on `PYTHONPATH`) and provide both model and VQ paths: ```bash MMADA_ROOT= PYTHONPATH= python diva_mmada/attack_mmu.py \ --model_path \ --tokenizer_path \ --vq_model_path \ --category demo \ --image \ --instructions \ --output outputs/mmada/delta_demo.pt \ --num_steps 5 --K 1 --R 32 ``` ### LLaDA2.0-Uni The Uni adapters require both a local LLaDA2.0-Uni checkout (for the image tokenizer) and model weights. The paths are required arguments so that no author-machine paths are hidden in the release: ```bash python -m diva_llada_uni.soft_attack \ --model-path \ --repo-path \ --category demo \ --image \ --instructions \ --output outputs/llada_uni/patch_demo.pt \ --num-steps 5 --span-len 16 --R 32 ``` The resulting checkpoints contain perturbations/embedding patches, optimization history, and command-line metadata. Treat them as sensitive research artifacts and do not upload them together with private prompts or model weights. ## Project page and GitHub Pages The live project page is ****. It includes the abstract, authors, method figures, responsive experiment tables, qualitative results, paper PDF, figure archive, and citation. To preview the same page offline from this repository: ```bash python -m http.server 8000 ``` Open . To enable GitHub Pages for the `DIVA_project_page` repository, open **Settings → Pages**, choose **Deploy from a branch**, select branch **`root`** (the current default; `main` is synchronized) and folder **`/(root)`**, then press **Save**. GitHub will publish the `index.html` at the URL above; deployment normally takes a minute or two. No build command is needed. ## Paper and figures The paper PDF is [`paper.pdf`](paper.pdf). The web-ready figures in [`assets/`](assets/) are derived from the paper's published figure assets and include illustrative safety-critical examples; verify redistribution rights before mirroring them. ## Reproducibility notes - The headline HADES ASR values reported in the paper are **58.8% (LLaDA-V), 67.7% (MMaDA), and 69.1% (LLaDA2.0-Uni)** under the Beaver reward-model metric. They are reported for provenance only; this clean subset does not ship the benchmark or result files needed to reproduce them. - Pin the upstream model commit, tokenizer, benchmark version, image preprocessing, random seed, and CUDA/PyTorch versions in your own experiment record. - `epsilon` is expressed in the normalized `[0, 1]` pixel space. Check the target adapter's preprocessing before comparing values across models. - Never infer a successful jailbreak from loss alone. Evaluate refusal behavior with the model's official safety protocol and an independently reviewed judge. ## Citation ```bibtex @inproceedings{song-etal-2026-diva, title = {DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models}, author = {Song, Guorui and Tang, Runqing and Zhang, Jingye and Zhang, Luyuan and Huang, Feice and Ray, Cong and Wang, Guocun and Zhong, Dake and Wai, Choo Sin and Dai, Bingquan and Wang, Chuming and Lin, Tongxu and Guo, Wanyu and Wang, Haoqian}, booktitle = {Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing}, year = {2026}, publisher = {Association for Computational Linguistics}, note = {Accepted to the EMNLP 2026 Main Conference} } ``` The paper is accepted to the EMNLP 2026 Main Conference. Add the ACL Anthology URL and page numbers here once the proceedings record is published.