Nemotron-TwoTower diffusion swap bypasses safety guardrails

Safety alignment is not architecture-agnostic; porting safety-aligned autoregressive weights into non-autoregressive or diffusion decoding schemes creates massive security loopholes that bypass existing safeguards.

* Traditional safety alignment (RLHF, DPO, SFT) is fundamentally coupled with causal next-token generation and cannot automatically transfer to iterative denoising.

* The denoiser tower in the TwoTower architecture is fine-tuned to predict missing or corrupted text in parallel blocks, operating outside the causal context where safety boundaries were established.

* Bypassing autoregressive causal constraints allows adversarial prompts to exploit the diffusion decoding process, leading to toxic, biased, or unaligned outputs despite starting with a highly aligned base model.

* Enterprises adopting hybrid or non-autoregressive decoding paradigms for speed must completely redesign safety evaluation pipelines and cannot rely on original upstream model alignment.