Diffusion Large Language Models (dLLMs) have recently emerged as a competitive non-autoregressive paradigm due to their unique training and inference approach. However, there is currently a lack of safety study on this novel architecture. In this paper, we present the first analysis of dLLMs' safety performance and propose a novel safety alignment method tailored to their unique generation characteristics. Specifically, we identify a critical asymmetry between the defender and attacker in terms of security. For the defender, we reveal that the middle tokens of the response, rather than the initial ones, are more critical to the overall safety of dLLM outputs; this seems to suggest that aligning middle tokens can be more beneficial to the defender. The attacker, on the contrary, may have limited power to manipulate middle tokens, as we find dLLMs have a strong tendency towards a sequential generation order in practice, forcing the attack to meet this distribution and diverting it from influencing the critical middle tokens. Building on this asymmetry, we introduce Middle-tOken Safety Alignment (MOSA), a novel method that directly aligns the model's middle generation with safe refusals exploiting reinforcement learning. We implement MOSA and compare its security performance against eight attack methods on two benchmarks. We also test the utility of MOSA-aligned dLLM on coding, math, and general reasoning. The results strongly prove the superiority of MOSA.

Real-time object detection is a cornerstone of autonomous mobile systems, yet these systems remain critically vulnerable to adversarial attacks. Current defenses are often too slow on mobile platforms for real-time operation or fail to provide robust protection across diverse threat models. To bridge this gap, we present R²DShield, a lightweight, on-device input shield that provides real-time and broad-spectrum defense for object detectors on mobile platforms. Essentially, R²DShield diversifies the input-gradient landscape while enforcing a natural data manifold prior, thereby simultaneously disrupting the adversarial perturbation and invalidating its off-manifold components. It first injects learnable Bayesian-guided noise to diversify input gradients, and then projects the input to a low-dimensional latent to strip off-manifold adversarial patterns and compress the input efficiently; it finally leverages a lightweight single-step generative adversarial network to reconstruct a purified latent that is in turn decoded into a clean image. We implement and evaluate R²DShield on an NVIDIA Jetson AGX Orin, a widely-used mobile AI platform. R²DShield consistently outperforms five state-of-the-art methods across six common object detectors against a broad suite of attacks, improving robustness by an average of 2.29x while introducing a mere 22 ms of additional latency.

Despite substantial efforts in safety alignment, recent research indicates that Large Language Models (LLMs) remain highly susceptible to jailbreak attacks. Among these attacks, finetuning-based ones that compromise LLMs’ safety alignment via fine-tuning stand out due to its stable jailbreak performance. In particular, a recent study indicates that fine-tuning with as few as 10 harmful question-answer (QA) pairs can lead to successful jailbreaking across various harmful questions. However, such malicious fine-tuning attacks are readily detectable and hence thwarted by moderation models. In this paper, we demonstrate that LLMs can be jailbroken by fine-tuning with only 10 benign QA pairs; our attack exploits the increased sensitivity of LLMs to fine-tuning data after being overfitted. Specifically, our fine-tuning process starts with overfitting an LLM via fine-tuning with benign QA pairs involving identical refusal answers. Further fine-tuning is then performed with standard benign answers, causing the overfitted LLM to forget the refusal attitude and thus provide compliant answers regardless of the harmfulness of a question. We implement our attack on the ten LLMs and compare it with five existing baselines. Experiments demonstrate that our method achieves significant advantages in both attack effectiveness and attack stealth. Our findings expose previously unreported security vulnerabilities in current LLMs and provide a new perspective on understanding how LLMs’ security is compromised, even with benign fine-tuning. Our code is available at https://github.com/ZHIXINXIE/ten_benign.git.

Wired serial communication protocols such as UART are widely used in today’s IoT systems for their simple connection and good industry ecology. However, due to the simplicity of these protocols, they are vulnerable to attacks that falsify the communication. In this work, we propose the BitDance attack that can arbitrarily flip the bits of serial communication without any physical contact utilizing intentional electromagnetic interference (IEMI). We describe the physical process of how electromagnetic interference influences the voltage, build up a model to demonstrate the bit-level control principle of our work, and implement the attack on 6 different sensors with UART, a widely used serial communication protocol. The result shows we can inject bit-level information and disable legitimate communication from the system with a maximum success rate of 45.4 and 100. Finally, we propose countermeasures to mitigate the impact of this attack.

Counting phased small RNA cycles (PSRC) from mapped small RNA positions is a repeatedly invoked subproblem in the computation of identifying TRANS-ACTING siRNA (TAS) loci and loci of other small RNAs forming through mechanisms similar to that of trans-acting small interfering RNAs (ta-siRNAs). The efficiency of counting PSRC has a clear impact on the efficiency of the algorithms predicting these loci. There are two closely related variants on counting PSRC in real applications: WPSRC, which counts the number of distinct small RNAs falling onto the phased positions in a sliding window, and MPSRC, which counts the maximum consecutive PSRC from mapped small RNA positions. In this paper, we develop fast algorithms for both WPSRC and MPSRC. Our algorithms have O(max(S)) time complexity, while the existing algorithm and its variant have O(|S|·max(S)) and O(|S|·L) time complexity for MPSRC and WPSRC respectively, where S is a set of mapped small RNA positions and L the length of sliding window for WPSRC. Experimental results on two real-life datasets show that our algorithms are significantly faster than the existing algorithm and its variant. The proposed algorithms are applicable to TAS-like clusters with any PSRC length including 21-nt.