Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking

• URL: http://arxiv.org/abs/2603.07028v1
• Date: Sat, 07 Mar 2026 04:21:54 GMT
• Title: Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking
• Abstract summary: Recent text-to-video (T2V) models can synthesize complex videos from lightweight natural language prompts.<n>Prior jailbreak attacks typically rewrite unsafe prompts into paraphrases that evade content filters.<n>In this paper, we identify a temporal trajectory infilling vulnerability of T2V systems under fragmented prompts.
• Score: 3.1471354211996956
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Recent text-to-video (T2V) models can synthesize complex videos from lightweight natural language prompts, raising urgent concerns about safety alignment in the event of misuse in the real world. Prior jailbreak attacks typically rewrite unsafe prompts into paraphrases that evade content filters while preserving meaning. Yet, these approaches often still retain explicit sensitive cues in the input text and therefore overlook a more profound, video-specific weakness. In this paper, we identify a temporal trajectory infilling vulnerability of T2V systems under fragmented prompts: when the prompt specifies only sparse boundary conditions (e.g., start and end frames) and leaves the intermediate evolution underspecified, the model may autonomously reconstruct a plausible trajectory that includes harmful intermediate frames, despite the prompt appearing benign to input or output side filtering. Building on this observation, we propose TFM. This fragmented prompting framework converts an originally unsafe request into a temporally sparse two-frame extraction and further reduces overtly sensitive cues via implicit substitution. Extensive evaluations across multiple open-source and commercial T2V models demonstrate that TFM consistently enhances jailbreak effectiveness, achieving up to a 12% increase in attack success rate on commercial systems. Our findings highlight the need for temporally aware safety mechanisms that account for model-driven completion beyond prompt surface form.

Related papers

• Automatic Red Teaming for Implicit Vulnerabilities of Text-to-Image Models [58.59008920408855]
  We propose Adversarial Probing for Implicit VulnErabilities (AdvPIE) to expose implicit vulnerabilities without requiring access to the parameters of target models.<n> AdvPIE adopts a policy agent to generate and refine implicit adversarial prompts based on the feedback from a judge agent.<n>Experiments on standard and safety-aligned T2I models show that AdvPIE1 effectively uncovers implicit vulnerabilities.
  arXiv  Detail & Related papers  (2026-09-05T13:45:09Z)
• TempJail: Temporal Jailbreak Attacks against Image-to-Video Generation Models [6.9498303374340225]
  We investigate three attack scenarios and uncover a temporal vulnerability in I2V systems.<n>We propose TempJail, a novel temporal jailbreak framework for I2V systems.<n>Experiments show that TempJail improves attack success rate over prior state-of-the-art methods by 23.3%.
  arXiv  Detail & Related papers  (2026-08-27T11:15:39Z)
• SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense [77.70598852234149]
  Text-to-Video (T2V) generative models are vulnerable to jailbreak attacks in real-world deployment.<n>We propose SafeCA, a feature-level defense mechanism for safe cross-attention localization and regularization.<n> Experimental results show that SafeCA reduces the jailbreak success rate by about 20% on mainstream T2V models.
  arXiv  Detail & Related papers  (2026-08-11T14:01:24Z)
• TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attacks [3.3681515336200403]
  We propose a training-free, inference-time defense framework that reformulates T2V safety as a causal intervention in a temporally structured semantic space.<n>TrajShield handles explicit unsafe prompts, jailbreak attacks, and temporally emergent risks in a unified manner.
  arXiv  Detail & Related papers  (2026-05-03T07:49:51Z)
• VidLeaks: Membership Inference Attacks Against Text-to-Video Models [17.443499650679964]
  Membership inference attacks (MIAs) provide a principled tool for auditing copyright and privacy violations.<n>We introduce a novel framework VidLeaks, which probes sparse-temporal memorization through two complementary signals.<n>Our work provides the first concrete evidence that T2V leak models substantial membership information through both sparse memorization and temporal memorization.
  arXiv  Detail & Related papers  (2026-01-16T11:35:52Z)
• T2VAttack: Adversarial Attack on Text-to-Video Diffusion Models [67.13397169618624]
  We introduce T2VAttack, a study of adversarial attacks on Text-to-Video (T2V) models from both semantic and temporal perspectives.<n>To achieve an effective and efficient attack process, we propose two adversarial attack methods: T2VAttack-S, which identifies semantically or temporally critical words in prompts and replaces them with synonyms via greedy search, and T2VAttack-I, which iteratively inserts optimized words with minimal perturbation to the prompt.
  arXiv  Detail & Related papers  (2025-12-30T03:00:46Z)
• VEIL: Jailbreaking Text-to-Video Models via Visual Exploitation from Implicit Language [25.38940067963429]
  Prior attacks on text-to-video (T2V) models typically add adversarial perturbations to obviously unsafe prompts.<n>We show that benign-looking prompts containing rich, implicit cues can induce T2V models to generate semantically unsafe videos.<n>We propose VEIL, a jailbreak framework that leverages T2V models' cross-modal associative patterns via a modular prompt design.
  arXiv  Detail & Related papers  (2025-11-17T08:31:43Z)
• PromptSafe: Gated Prompt Tuning for Safe Text-to-Image Generation [30.2092299298228]
  Text-to-image (T2I) models are vulnerable to producing not-safe-for-work (NSFW) content, such as violent or explicit imagery.<n>We propose PromptSafe, a gated prompt tuning framework that combines a lightweight, text-only supervised soft embedding with an inference-time gated control network.<n>We show that PromptSafe achieves a SOTA unsafe generation rate (2.36%) while preserving high benign fidelity.
  arXiv  Detail & Related papers  (2025-08-02T09:09:40Z)
• GenBreak: Red Teaming Text-to-Image Generators Using Large Language Models [65.91565607573786]
  Text-to-image (T2I) models can be misused to generate harmful content, including nudity or violence.<n>Recent research on red-teaming and adversarial attacks against T2I models has notable limitations.<n>We propose GenBreak, a framework that fine-tunes a red-team large language model (LLM) to systematically explore underlying vulnerabilities.
  arXiv  Detail & Related papers  (2025-06-11T09:09:12Z)
• T2V-OptJail: Discrete Prompt Optimization for Text-to-Video Jailbreak Attacks [67.91652526657599]
  We formalize the T2V jailbreak attack as a discrete optimization problem and propose a joint objective-based optimization framework, called T2V-OptJail.<n>We conduct large-scale experiments on several T2V models, covering both open-source models and real commercial closed-source models.<n>The proposed method improves 11.4% and 10.0% over the existing state-of-the-art method in terms of attack success rate.
  arXiv  Detail & Related papers  (2025-05-10T16:04:52Z)
• T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Models [88.63040835652902]
  Text to video models are vulnerable to jailbreak attacks, where specially crafted prompts bypass safety mechanisms and lead to the generation of harmful or unsafe content.<n>We propose T2VShield, a comprehensive and model agnostic defense framework designed to protect text to video models from jailbreak threats.<n>Our method systematically analyzes the input, model, and output stages to identify the limitations of existing defenses.
  arXiv  Detail & Related papers  (2025-04-22T01:18:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.