Anjun Hu

3/3 The evaluation covers DiffusionGemma and LLaDA-2 Mini on Banking, Slack, Travel, and Workspace tasks. Tests include static injections and adaptive search with up to 100 attacker queries per scenario. On Slack, DiffusionGemma’s attack success rate falls from 95.24% to 0% with oracle policies. Policy quality remains crucial: automatically generated policies can miss restrictions. Utility and overhead vary, and protection covers only represented constraints. Paper: arxiv.org/abs/2610.15177 Huge thanks to all co-authors Michael Cardei, Anjun Hu (@anjunhu), Chenrui Ma, Francesco Pinto (@FraPintoML), Chawin Sitawarin (@csitawarin), and Chulin Xie (@ChulinXie)! 🙌 A pleasure building CoDA together!

I am excited about our new work: Only What You’ve Signed up For: Secure Workflows with Constrained Diffusion Agents. An AI agent should be able to read a document without giving that document control over its actions. Suppose you ask an agent to share a report with Alice, view-only. A malicious instruction hidden in retrieved content tells it to create a public link with edit access. Our new paper introduces CoDA: Policy-Constrained Diffusion Agents, a framework that enforces task permissions directly during generation. Diffusion language models repeatedly refine their output. CoDA uses those steps to constrain protected fields, such as tool names, recipients, and permissions, to values allowed by a security policy. That policy is established from trusted instructions before the agent encounters untrusted content. No retraining required. We evaluated CoDA on Banking, Slack, Travel, and Workspace tasks in AgentDojo, using DiffusionGemma and LLaDA-2 Mini. Adaptive attackers had up to 100 queries per scenario. With human-verified “oracle” policies, we observed 0% attack success under the adaptive attacks evaluated, across both model families and all four suites. Policy quality remains crucial: automatically generated policies can miss restrictions, and protection covers only the constraints represented in the policy. Task utility and inference overhead also vary. This is a really exciting direction: making security constraints part of how agents generate their actions! Check out our CoDA paper: 📄 arxiv.org/abs/2610.15177 and the project page: coda-dllm.github.io Huge thanks to all co-authors Michael Cardei, Anjun Hu (@anjunhu), Chenrui Ma, Francesco Pinto (@FraPintoML), Chawin Sitawarin (@csitawarin), and Chulin Xie (@ChulinXie)! Such a fun collaboration 🙌