Diffusion language models (DLMs) have recently emerged as a promising alternative to autoregressive (AR) models, offering parallel decoding and controllable sampling dynamics while achieving competitive generation quality at scale. Despite this progress, the role of sampling mechanisms in shaping refusal behavior and jailbreak robustness remains poorly understood. In this work, we present a fundamental analytical framework for step-wise refusal dynamics, enabling comparison between AR and diffusion sampling. Our analysis reveals that the sampling strategy itself plays a central role in safety behavior, as a factor distinct from the underlying learned representations. Motivated by this analysis, we introduce the Step-Wise Refusal Internal Dynamics (SRI) signal, which supports interpretability and improved safety for both AR and DLMs. We demonstrate that the geometric structure of SRI captures internal recovery dynamics, and identifies anomalous behavior in harmful generations as cases of \emph{incomplete internal recovery} that are not observable at the text level. This structure enables lightweight inference-time detectors that generalize to unseen attacks while matching or outperforming existing defenses with over $100\times$ lower inference overhead.

翻译：扩散语言模型（DLMs）最近已成为自回归（AR）模型的一种有前景的替代方案，它提供并行解码和可控的采样动态，同时在大规模生成质量上达到竞争水平。尽管取得了这一进展，采样机制在塑造拒绝行为和越狱鲁棒性方面的作用仍然鲜为人知。在这项工作中，我们提出了一个用于分析逐步拒绝动态的基本框架，使得能够比较AR与扩散采样。我们的分析表明，采样策略本身在安全行为中起着核心作用，这是一个区别于底层学习表征的因素。受此分析启发，我们引入了逐步拒绝内部动态（SRI）信号，该信号支持对AR和DLMs的可解释性和改进的安全性。我们证明，SRI的几何结构捕捉了内部恢复动态，并将有害生成中的异常行为识别为\textit{不完全内部恢复}的情况，这在文本层面是不可观测的。这种结构使得轻量级的推理时检测器能够泛化到未见过的攻击，同时匹配或超越现有防御方法，且推理开销降低超过$100\times$。