It's the first time in the history of the world.
Visual language models have entered the scenes of office assistants, content auditing, robots and smart terminals.
The task they face is not just to read a text, but to understand images, text, and the relationship between the two.
Therefore, the model's security boundary is no longer as simple as "is the sentence dangerous": a sentence may have no obvious risk, an image alone may not trigger a negative response, but can the model accurately determine the true intent after the images are combined?
What is even more remarkable is that the way models generate answers is changing.
The traditional self-recurring visual language model can be roughly understood as "see the diagram first, then write the answer from left to right": after the image is encoded, it forms a visual message and then participates in language generation.
Discrete diffusion vision-language models, abbreviated as dVLM, reveal the answer gradually in a veiled response: the model starts from the state of a large amount of veiled text, and after several rounds of noise, gradually recovers the complete response.
There is a key difference between the two: the visual information in the regression model is closer to a one-time injection, while the dVLM may reuse the visual conditions in each round of de-noise. If the image contains some risk semantics that are not easily detected by surface rules, then it has the opportunity to repeatedly affect the model at multiple stages.
China University and the Beijing Postal University called this phenomenonCross-Step Conditional PropagationThe "dissemination" here does not mean that the image is actually replicated in the model, but rather that visual conditions are constantly involved in the calculation of the successive generation steps, and the effects may accumulate along the generation trajectory.
The main page of the project: https://loststars2002.github.io/DIVA_project_page/
The codeWarehouse： https://github.com/loststars2002/DIVA
For this type of discrete distributed visual language model, the same risk signal hidden in the image may continue to play a role throughout the generation process, as repeatedly warned. The team's DIVA escape attack method used this generation feature to test the security alignment of the model.
Figure 1: The dVLM model can correctly reject the input of harmful text or images; but the same model produces harmful responses after introducing DIVA disruption and rewriting the text.
What exactly is DIVA?
The full name of DIVA is:Discrete-diffusion Vision-language model AttackIt's a model of dispersed disseminated visual language.White box visual escapes from prisonIts goal is not to modify the model parameters, nor is it to claim that all models will inevitably fail, but to construct a comprehensive visual input disturbance under the conditions that researchers can access the model parameters and gradients to test the model's security stability during the entire de-noise process.
DIVA does not simply add noise to the image, but instead designs a complete attack chain around the multi-cycle generation mechanism of dVLM.Intermodal intentions are confusedandOptimization against diffuse perceptionIt consists of two parts: the first is responsible for reorganizing the semantics of the image, and the second is responsible for allowing limited visibility to disrupt adaptation to multiple noise states.
1. Determine what the attacker can do: white box, input side, limited modification
DIVA uses a white box threat model. Researchers can access the parameters, gradients, visual encoders of the target dVLM and the cloaking interfaces used during training, but cannot modify the model weight. The attack occurs only at the logical input end: the pixel-restricted disturbance is superimposed on the original image, accompanied by modified text cues, and the model is then generated in response to the original reverse-noise process.
This setting has two functions. On the one hand, it can establish the attack ceiling under the current mechanism; on the other hand, it can distinguish the effects of "trans-step condition propagation" itself from factors such as black box migration, proxy model errors. Therefore, the paper concludes that dVLM does indeed have a structural attack surface that can be used, and does not mean that the same disturbance can directly attack all business models.
2. Intermodal intent confusion: dismantling an explicit instruction at both ends of a graph
DIVA first transcribes the original risk instruction on the text side, replacing objects, actions, or targets that appear directly with images that are understandable. The transcribed text itself no longer carries all the meaning, but still guides the model to call for visual information.
At the same time, the critical semantics removed from the text are inserted into a composite image. The image consists of a combination of two types of content: one is the text layer that carries keyword clues, and the other is the visual content related to the target semantics. Both form a composite image by superimposition or spelling, so that the complete intent is distributed between the two channels of text and vision.
This can be compared to dismantling an information into two keys: separately checking text or images, which are not intended to be complete; the two parts are reconnected only when the model is multi-moduled. This step exposes the limitations of single-module filtering and provides a semantic carrier for subsequent visual disruption optimization.
3. Cross-step condition dissemination: Why does the same chart have repeated effects?
In self-return VLM, images are usually first encoded as fixed visual foreground, with subsequent text moving from left to right. DIVA generalizes this as "static conditions": visual information enters the model primarily at the beginning of generation.
In dVLM, the answer is initially a series of hidden tokens. Each time the model completes a round of noise, it restores the next set of tokens based on the current part of the answer, text hints, and image characteristics. Since the image characteristics are re-engaged in the calculation in each round, the same visual semantics may have influenced the later state from an earlier state. This is the cross-step transmission that DIVA uses.
Figure 2: Comparison of the visual condition path of the self-return VLM to the discrete spread VLM
4. Spread perception optimization: not a single moment, but covering multiple off-noise states.
Normal visual attacks often revolve around a single forward-to-computing optimization input. DIVA extracts multiple time steps from the complete noise trajectory at each update and constructs different intermediate responses according to the coverage ratio of each time step. When the coverage ratio is high, the model faces an early response that has not yet been formed; when the coverage ratio is low, the model is nearing the end of production.
For each time step, DIVA only calculates the predicted loss at the covered position, measuring whether the current image can drive the model to restore the default non-response goal. It then averages the loss of multiple time steps, allowing the same disruption to adapt to multiple intermediate states simultaneously. In other words, DIVA optimization has a continuous effect not on a single "shots" but on the entire generation trajectory.
The gradient then passes through the visual encoder, polymorphic projection layer and two-way diffusion Transformer, and then returns to the input image. After each update, the perturbation is projected back to the specified pixel range, and the final image is cut into the legitimate devalue range.
5. Why not write a complete answer ahead of time with a very short goal?
DIVA uses a very short affirmative, non-refusal prologue as a teacher-mandated goal during the optimization phase to push the model across the decision-making boundary of "refuse or continue to answer" rather than requiring the model mechanics to reproduce a pre-written whole paragraph. After optimization, the attack effect is determined by the model's freely generated results and assigned to an independent security assessor for subsequent judgement.
This design reduced the reliance on external mismatched models and focused research on whether security strategies were circumvented rather than memory or repetition of fixed text.
6. Category-level sharing disruption: testing commonality rather than remembering a problem
DIVA does not learn a disturbance for each problem individually, but instead focuses on multiple suggestions in the same risk category, combining to optimize a shared disturbance. When training, different suggestions flow into the optimization process, with each suggestion covering multiple off-noise time steps. This type of disturbance requires simultaneous adaptation of "multi-questions" and "multi-states", thus reducing over-adaptation to a single sentence.
In actual reasoning, the only thing needed to be done is to disrupt the category level of the pre-offline computation by adding the corresponding composite image and then passing the graph input to the original dVLM. The model structure, weight and standard reversible noise-de-noise process do not need to be modified. The paper report calculations also show that the main cost occurs during the offline optimization phase; storage disruption involves the reasoning only when the image is combined with cutting.
Figure 3: Complete DIVA process. On the left side, cross-modal intent is mixed, and on the right side, multiple noise-free time steps combined to optimize limited visual disturbance.
In general, the full link to DIVA is as follows:Decomplete graph semantic array constructing complex image array sampling multiple de-noise state array summarizing each phase loss array within pixel constraints updating disruptive arrays to be categorized as units of offline sharing arrays using the original generating process check free responseThe key to the method is not "noise is louder", but to match the visual input with the way the dVLM reads images.
What needs to be emphasized is that this is a white-box study. The paper lacks publicly optimized disruptive files, directly replicable attack scripts, specific steps, and disruptive budgets, with the aim of revealing mechanisms and promoting defense research, rather than providing operational guidance for real systems.
What did the experiment tell us?
The team tested the LLaDA-V, MMaDA, and LLaDA 2.0-Uni discrete distributed visual language models on two multimodal security benchmarks, HADES and VLSBench, and compared them to non-attack models and visual jailbreaking methods designed for self-return models.
The ASR (Attack Success Rate, attack success rate) is a security risk indicator: the higher the number, the easier it is for a model to generate content that does not comply with security strategies, and it does not mean that the overall capability of the model is greater.
1. All three target models appear clearlyThe risks
Under HADES's Beaver semantic evaluation indicator, the average ASR for DIVA on the three target models is:
LLaDA-V：58.80%；
MMaDA：67.73%；
LLaDA2.0-Uni：69.07%。
The results in all three groups were higher than the comparison methods in the corresponding models. In particular, on MMaDA, DIVA was 6.67 percentage points higher than DIJA; on LLaDA 2.0-Uni, DIVA was 19.20 percentage points higher than DIJA.
These figures do not mean that "the model has completely lost its security capability", but rather that when the attack method is designed to target distributed-generated structural characteristics, the visual security lines that were originally built primarily for the auto-retro model may not be adequate.
2. Exchanging a test distribution,The risksIt still exists.
The test distribution of the VLSBench is closer to being left out of the scenario rather than being directly involved in the disruption optimization of the correspondent. On this basis, DIVA's ASR on LLaDA-V and MMaDA is 52.07% and 74.16%, respectively, the highest in the comparison method.
This shows that the phenomenon observed in the paper does not depend solely on a fixed set of problems. Cross-step condition propagation is more like structural risk associated with the model generation mechanism, but this is not equivalent to a disruption that can be transferred unconditionally to all models; the disruption in the paper still needs to be re-optimized for target models and risk categories.
3. Dissolving experiments: The key is not just "adding noise".
In the dilution experiment on LLaDA-V, the research team gradually added complex image perturbations, random perturbations, disrupted spatial structure perturbations, and complete DIVA optimization perturbations. The average ASR gradually increased from 32.93% to 41.00%, 44.53%, 52.67%, eventually reaching 58.80%.
The results show that the effect of DIVA cannot be simply summed up as "the bigger the image noise, the more effective it is". The complex image itself provides cross-modal semantics, and the spatial structure contributes part of the effect, while optimizing for multiple de-noise states is the main advantage of the whole approach.
4. Virtually unchanged, the interior of the model may continue to be affected.
The paper also analyzes the perceptibility of disturbances. Before magnification, the attack image is highly similar to the original image when observed with the naked eye; after magnification, low-dimensional changes can be seen in the distributed image.
Figure 4: Sensitivity analysis of representational disturbances
This reminds us that security auditing cannot rely solely on artificial browsing of images, nor can it be based solely on simple pixel difference thresholds to determine the reliability of inputs. Models can be very sensitive to statistical changes that are invisible to the human eye, and these changes can be used repeatedly in multi-cycle generation.
From "results of attacks" to "defense revelations".
The most interesting thing about DIVA is not how much it raises a certain ASR number, but that it raises a defensive question:Are we just checking the input of the model and the final answer and ignoring how the answer is generated step by step?
Based on the results of the paper, the multi-modal security system of the future can be strengthened in at least the following ways:
1. Check the semantics of cross-modal combinations.Text filtering and image filtering need to work in sync, and the two forms cannot be completely separated.
2. Monitor stability at the production stage.In the case of a distributed model, it is possible to evaluate the safety of different noise ranges for abnormal switching.
3. Red team testing for different generating architectures.The risk interfaces of the self-return model and the spread model are not the same, and assessment methods cannot be simply moved.
4. To move the safety alignment from the final output to the production trajectory.If the model has formed a distinctly unsafe direction in the intermediate stage, it may be too late to intercept the final step.
These directions can be used for security acceptance before the model goes online, red team evaluation, multi-modal content auditing and return testing after the model is updated. For systems that require continuous image processing, such as robots, smart terminals, security monitoring over time is particularly important.
Summary
When a model moves from "look at a picture and answer it" to "repeated reference images in the production process", security issues extend from static input checks to dynamic production trajectories.
DIVA's work reminds us that the security alignment of a distributed visual language model requires an understanding of its unique generation mechanisms and a vigilance at every stage where visual conditions may be reinjected.