This survey integrates four disconnected tracks of adversarial evaluation—diffusion-based attacks on text and LLMs, image classifiers, vision-language models, and input purification defenses—into a single conceptual framework. It focuses on the LLM-side slice to unify vocabulary, threat models, and benchmarks around denoising diffusion as a shared generative mechanism.
- Catalogs fifty published papers across four scope areas plus four diffusion-LLM-as-victim entries and ten non-diffusion baselines.
- Proposes a six-class taxonomy of diffusion roles in adversarial pipelines augmented by a threat-model axis for attacker knowledge, query budget, and target accessibility.
- Applies a five-dimension framework (attack success rate, transferability, query budget, perplexity, defense-evasion) uniformly across modalities.
- Covers four diffusion-based defenses that form the natural evaluation backdrop for new attacks alongside the attack catalog.
The review identifies five recurring weaknesses in current LLM-side literature and provides a research agenda of open questions and concrete experimental designs to guide future work.