How Transparent is DiffusionGemma?

Source: arXiv:2606.20560 · Published 2026-06-18 · By Joshua Engels, Callum McDougall, Bilal Chughtai, Janos Kramar, Senthoran Rajamanoharan, Cindy Wu et al.

TL;DR

This paper investigates the transparency of DiffusionGemma, a large text diffusion model developed by Google DeepMind, in comparison to standard autoregressive language models like Gemma 4. DiffusionGemma generates text via iterative denoising of a canvas of tokens combined with continuous latent self-conditioning vectors, unlike autoregressive models that generate tokens sequentially. The authors dissect transparency along two axes: variable transparency (understanding intermediate computational states) and algorithmic transparency (reconstructing the model's reasoning process from these states). They initially quantify DiffusionGemma's opaque serial depth (the longest computation path without interpretable bottlenecks) as 28.6x greater than Gemma 4 due to latent computations, suggesting poor transparency at first glance. However, by leveraging the model's intermediate self-conditioning vectors through a token bottleneck approximation, they reduce this opaque serial depth to 1.1x that of Gemma 4 with no drop in downstream capabilities. They further analyze whether these bottleneck tokens are interpretable, finding that most correspond closely to final or nearby tokens and are thus meaningfully interpretable. Assessing monitorability—how well outputs reveal internal reasoning for downstream monitoring—they show DiffusionGemma performs similarly to Gemma 4 despite shorter chains of thought. Finally, a range of case studies uncover novel diffusion-specific reasoning phenomena such as non-chronological step order, token smearing, and retroactive self-correction, illustrating the unique algorithmic transparency challenges diffusion models pose. Overall their work establishes that while diffusion-based LLMs have initially opaque intermediate steps, with effort these can be made nearly as transparent as autoregressive models, supporting ongoing interpretability and safety research.

Key findings

• DiffusionGemma's uninterpretable intermediate bottleneck yields an opaque serial depth 28.6X higher than Gemma 4 (Empirical upper bound: 608,016 vs 21,235 at 256k tokens).
• When treating intermediate self-conditioning vectors via an interpretable token bottleneck, DiffusionGemma's opaque serial depth reduces to 1.1X Gemma 4's (23,571 vs 21,235).
• Restricting intermediate self-conditioning to ~8 natural language tokens per sequence position retains baseline performance on six capability benchmarks.
• Over 85% of the top tokens in the intermediate bottleneck correspond exactly or semantically to final or adjacent tokens, evidencing interpretability.
• DiffusionGemma and Gemma 4 achieve statistically similar monitorability scores on a suite of evaluations (Fig. 4), though DiffusionGemma produces shorter chains of thought on average (Fig. 5).
• Algorithmic case studies reveal unique diffusion-specific phenomena: early response length prediction, retroactive self-correction, token/sequence smearing, and intermediate-context reasoning.
• Adaptive stopping reduces practical denoising steps from 48 to ~12-16, which would further reduce opaque serial depth by about a factor of three vs worst-case calculations.

Threat model

The study assumes an adversary who cannot directly observe internal latent states but can view prompts and final model outputs. The focus is on human interpretability of intermediate states for safety monitoring rather than active adversarial attacks or model manipulation. The adversary cannot alter model internal computations or extract latent vectors directly.

Methodology — deep read

1. Threat Model & Assumptions: The study assumes typical language model adversaries who can observe model inputs and outputs but not internal latents directly. The key question is the model's computational transparency to human understanding, not direct adversarial attacks. They presume natural language tokens in inputs/outputs are interpretable and focus on whether latent intermediate states (self-conditioning vectors) are interpretable.

2. Data: For interpretability analyses, the WildChat dataset (800 prompts, up to 1024 tokens generated) is used to analyze intermediate token distributions. Capability evaluations span Natural2Code, LiveCodeBench, AMC/AIME/IMO math variants, and GPQA benchmarks, all publicly referenced but details on splits and data sizes are limited.

3. Architecture/Algorithm: DiffusionGemma extends the Gemma 4 26B A4B autoregressive transformer with a text diffusion inference mechanism. It initializes a random token canvas of fixed size C, then iteratively denoises it over T=48 steps using a transformer with bidirectional attention and a self-conditioning matrix S_t ∈ ℝ^(C×d_model) passed between steps. Sampling uses entropy-bounded renoising and adaptive stopping based on token entropy. The self-conditioning matrix is generated by softmax(logits) projected back into the embedding space.

4. Training Regime: Not detailed explicitly, but the paper refers to the Gemma 4 family training and design as a base. Interpretability interventions are performed post-training by logit modification functions f_p and f_k that restrict information in the self-conditioning matrix by thresholding or top-k at each token position.

5. Evaluation Protocol: Opaque serial depth is computed empirically and asymptotically using prior methods and a serial depth analyzer tool. Interpretability of bottleneck tokens is assessed by matching extracted tokens against final tokens or semantically similar neighbors. Monitorability is evaluated via an existing suite of probe tasks which test whether downstream monitors can detect changes or reasoning in model outputs under intervention, process, and outcome-property categories. Statistical significance is assessed with bootstrapped 95% intervals.

6. Reproducibility: The serial depth analyzer code is open sourced. The WildChat dataset is public. Code or weights for DiffusionGemma and the full evaluation scripts are not reported as open source. Detailed architecture descriptions and visualizations are provided.

Concrete example: For a prompt requesting an explanation of photosynthesis in two sentences, the model accurately predicts its response length early in the denoising steps via token padding probabilities. Later denoising steps show retroactive self-correction of initially incorrect answers as the model refines reasoning across the canvas. Intermediate token distributions closely match final tokens or neighbors, indicating an interpretable bottleneck.

Technical innovations

• Decomposition of LLM transparency into variable transparency (interpretable intermediate states) and algorithmic transparency (reconstructing reasoning from these states).
• Introduction of an interpretable token bottleneck projection of the self-conditioning matrix to recover transparency in diffusion LLM intermediate representations.
• Use of opaque serial depth metrics, previously applied to autoregressive models, extended to analyze diffusion transformer architectures.
• Identification and characterization of novel diffusion-specific reasoning phenomena such as non-chronological reasoning and token/sequence smearing through interpretability case studies.

Datasets

• WildChat — 800 user prompts, public (Zhao et al., 2024)
• Natural2Code — size unknown, referenced capability benchmark
• LiveCodeBench — size unknown, referenced capability benchmark
• AMC/AIME/IMO math variants — size unknown, referenced capability benchmark
• GPQA — size unknown, referenced capability benchmark

Baselines vs proposed

• Gemma 4 26B A4B opaque serial depth (interpretable bottleneck): 21,235 vs DiffusionGemma 26B A4B: 23,571
• Gemma 4 26B A4B opaque serial depth (uninterpretable bottleneck): 21,235 vs DiffusionGemma 26B A4B: 608,016
• Monitorability G-mean² score on average: Gemma 4 26B A4B = 0.82 vs DiffusionGemma 26B A4B = 0.78 (Fig.4)
• Performance on capability benchmarks: DiffusionGemma with top-k=8 tokens retained in bottleneck matches baseline performance (Fig. 2)

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.20560.

Fig 1: | A simplified architecture diagram of DiffusionGemma, with the first two denoising steps

Fig 2 (page 3).

Fig 9: | Annotated heatmap from the Summary View for a code generation prompt. The model

Fig 14: | Our three dashboard views, shown for the prompt “Write a Haiku about rain.” Top:

Limitations

• Opaque serial depth upper bounds are worst-case and may overestimate effective depth due to adaptive stopping reducing denoising steps.
• Interpretability conclusions rely on the assumption that projecting self-conditioning vectors into top tokens approximates an interpretable bottleneck; some low-probability tokens remain uninterpretable and could encode opaque reasoning.
• Monitorability evaluations do not fully control for chain-of-thought length differences, which affects monitor sensitivity comparisons between models.
• Algorithmic transparency findings are preliminary and qualitative; no formal methods yet exist to fully reconstruct diffusion-based LLM reasoning algorithms.
• Analysis is conducted on one specific diffusion model architecture; other designs or future models with different training regimes might exhibit less interpretability.
• Training details of DiffusionGemma are not fully described, limiting reproducibility of model behaviors.

Open questions / follow-ons

• Can formal mechanistic interpretability methods be developed to fully reconstruct diffusion-based LLM reasoning algorithms across denoising steps?
• How generalizable are the transparency properties found in DiffusionGemma to future diffusion models with larger scales or different training procedures?
• What is the role of low-probability uninterpretable tokens in intermediate states—do they encode meaningful opaque computations or just noise?
• Can monitoring methods be improved to leverage the richer intermediate states of diffusion models beyond final token outputs?

Why it matters for bot defense

For bot-defense and CAPTCHA engineers, this work highlights that advanced latent-space reasoning models like DiffusionGemma remain largely transparent when properly analyzed, particularly through intermediate token bottlenecks. Their similar monitorability to conventional autoregressive models suggests existing monitoring techniques relying on chain-of-thought and output inspection remain viable. However, the unique diffusion-specific phenomena such as non-chronological reasoning and token smearing imply that attacks or evasions exploiting latent-space manipulations could be harder to detect without adapted interpretability tools. Thus, practitioners should be aware that model architectures using diffusion or latent denoising mechanisms may require novel transparency and monitoring approaches to reliably detect misuse or automated evasion attempts. Yet, the general approach of projecting latent states into interpretable tokens to reduce opaque computation paths provides a promising direction for maintaining oversight in evolving model designs.

Cite

@article{arxiv2606_20560,
  title={ How Transparent is DiffusionGemma? },
  author={ Joshua Engels and Callum McDougall and Bilal Chughtai and Janos Kramar and Senthoran Rajamanoharan and Cindy Wu and Arthur Conmy and Asic Q Chen and Jean Tarbouriech and Min Ma and Brendan O'Donoghue and João Gabriel Lopes de Oliveira and Rohin Shah and Neel Nanda },
  journal={arXiv preprint arXiv:2606.20560},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.20560}
}

Read the full paper

• arXiv:2606.20560 (abstract)
• arXiv:2606.20560 (PDF)