Greedy Coordinate Diffusion: Effective and Semantically Coherent Adversarial Attacks via Diffusion Guidance

Adversarial attacks on large language models have limited practical impact despite extensive research. Optimization-based attacks such as Greedy Coordinate Gradient (GCG) (Zou et al., 2023) produce high-perplexity, incoherent suffixes that existing defenses easily detect (Bengio et al., 2024). Moreover, attempting to enforce coherence constraints during optimization often prevents the attack from successfully eliciting the specific targeted response, resulting in low success rates against robust models. Conversely, attacks that maintain coherence often alter the semantic intent of queries; when the model complies with these altered queries, responses fail to address the adversary's original goal. In this work, we introduce Greedy Coordinate Diffusion (GCD), a novel framework that efficiently generates adversarial attacks against safety-aligned models while maintaining low perplexity and high semantic adherence to the adversary's original intent. GCD leverages the generative priors of discrete diffusion language models to guide the search for adversarial suffixes that achieve semantic coherence and adherence. Unlike GCG, GCD does not require direct gradient access, allowing it to operate in a gray-box setting. We show GCD achieves highest ASR while remaining competitive on response-quality scores, and that the constructed adversarial prompts are detected at lower rates than other methods by perplexity-based and guard-model filters.

Companies add safety guardrails to AI chatbots so they refuse harmful requests, like instructions for building weapons. To find weaknesses before bad actors do, researchers design "jailbreaks" - prompts that slip past these guardrails. But today's automated jailbreaks have a catch: the strongest ones produce garbled, nonsense text that a simple filter can spot and block, while the ones that read naturally only work by softening the request until the AI is really answering a harmless question instead. We built a method called Greedy Coordinate Diffusion that gets both at once. It borrows a second AI - one trained to write fluent, natural sentences - to suggest believable wording, then carefully tests each suggestion to keep steering the chatbot toward the genuinely harmful answer. Crucially, it works without peeking inside the target model's inner workings. In our experiments, this produced attacks that read like ordinary human writing yet succeeded far more often than previous methods, even against well-defended models. The takeaway is a warning for defenders: a dangerous prompt can look completely normal, so safety filters that only flag "weird-looking" text aren't enough. Robust defenses need to understand meaning, not just surface patterns.