Source-linked AI summary
TempJail: Temporal Jailbreak Attacks against Image-to-Video Generation Models
Qi Lu, Zehui Guo, David Yuanda Gan, Zijing Li, Hengda Zhang, Weijun Xu, Qiankun Zhang
TL;DR
Existing I2V safety evaluations largely overlook attacks in which unsafe semantics emerge through temporal composition rather than a single frame. TempJail decomposes malicious captions into visual and temporal controls, camouflages both modalities, and improves attack success over prior methods on closed-source commercial models.
Problem
Existing I2V jailbreak studies largely overlook the temporal dimension, although unsafe semantics may emerge through composition across time.
Method
TempJail separates a malicious caption into an initial visual condition and temporal text instruction, using diffusion-based image injection and innocuous subject-action-scene rewriting.
Results
TempJail substantially outperforms prior methods across closed-source Kling, Seedance, Veo, and PixVerse systems.
Takeaways & Limitations
I2V safety analysis must account for malicious semantics that are reconstructed through temporal composition even when individual modalities appear benign.
Takeaways & Limitations
The paper identifies synchronized auditory cues in integrated audio-visual generation as a direction for future multimodal jailbreak research.
Abstract
from arXiv · showhide
In recent years, image-to-video (I2V) generation models have made remarkable progress in subject consistency and temporal coherence, enabling high quality video synthesis. However, these advances also introduce new safety risks. Existing studies mainly focus on jailbreak attacks involving single frame violations, while largely overlooking the temporal dimension unique to video generation models. In this paper, we investigate three attack scenarios and uncover a temporal vulnerability in I2V systems: unsafe semantics may emerge not from a single frame, but from semantic composition over time. We further identify two key challenges in such attacks: temporal abstraction and semantic camouflage. To address these issues, we propose TempJail, a novel temporal jailbreak framework for I2V systems. For temporal abstraction, we decompose a target malicious caption into an initial frame visual condition and a temporal text instruction. For semantic camouflage, on the image side we model semantic injection as controlled latent perturbation in diffusion sampling and introduce gradient guidance from pretrained encoders. On the text side, we rewrite the caption into an innocuous ``subject-action-scene'' template that bypasses safety filters while preserving temporal guidance. In the black-box inference phase, these two modalities jointly enable malicious semantics to be gradually triggered over time. Experiments on closed-source commercial models, including Kling, Seedance, Veo and PixVerse, show that TempJail improves attack success rate over prior state-of-the-art methods by 23.3\% under GPT-5.2 evaluation and 22.0\% under human evaluation. Our codes are available at \href{https://github.com/luqi-glory/TempJail}{GitHub}.
1 Introduction
I2V models introduce a temporal safety surface because unsafe semantics can emerge through composition across frames rather than from a single frame. TempJail addresses temporal abstraction and semantic camouflage by jointly controlling visual and textual inputs.
- Existing I2V jailbreak methods induce unsafe content in only a few frames and largely ignore video’s temporal dimension.
- Unsafe semantics can emerge through semantic composition over time, exploiting I2V models’ sequence orchestration and temporal coherence.
- Temporal attacks face two challenges: translating complex malicious scenes into temporal controls and disguising malicious concepts across image and text modalities.
- TempJail decouples a malicious caption into an initial visual condition and temporal text instruction, then injects concealed semantics through diffusion sampling and rewritten prompts.
- TempJail systematically studies this attack surface and successfully jailbreaks closed-source systems including Kling, Seedance, Veo, and PixVerse.
2 Related Works
Video safety research progressed from text-to-video jailbreaks toward image-to-video attacks, but existing methods remain limited in their handling of temporal behavior.
- I2V generates temporally coherent video from a static image and text prompts using learned spatiotemporal scene dynamics.
- Early T2V studies established benchmark-based safety evaluation and attacks based on harmful prompts, subscene decomposition, and text-space optimization.
- As I2V gained traction, attacks shifted toward combining textual instructions with image manipulation or visual instruction following.
3 Preliminaries
The paper models an I2V system as a mapping from an image and text instruction to a video, with hierarchical safety checks over inputs and output.
- An I2V model M maps an input image x and textual instruction p to a video V.
- The safety filter F checks the input image, text prompt, and final video at multiple levels.
- The attack seeks an input pair whose image, text, and generated video are each classified as benign by the safety filter.
- The temporal objective measures the likelihood that the video exhibits the target malicious concept throughout its evolution.
4 Case Study
Three cases expose how temporal decomposition can reveal malicious semantics, why complex events require abstraction, and why both modalities need semantic camouflage.
- Case 1: Case 1 shows that dispersing a sensitive term across successive frames can deceive defenses and reveal malicious semantics temporally.
- Case 2: Case 2 shows that rigidly splitting complex prompts produces overly intricate action sequences and semantic collapse.
- Effective temporal attacks therefore require high-level temporal abstraction and camouflage of malicious semantics in both text and image inputs.
- Case 3: Case 3 shows that explicit malicious concepts in images or prompts become salient enough to trigger safety detection and block generation.
5 TempJail: A Complete Illustration
TempJail constructs an initial malicious image and a camouflaged temporal instruction, then combines them so I2V generation reconstructs unsafe semantics over time while evading safety filters.
- Temporal abstraction: TempJail decouples a malicious video caption into an initial-frame visual condition and a temporal text instruction.The two components respectively construct the input image and govern temporal evolution during inference.
- Initial frame construction: The initial frame is built by generating a reference image from malicious concepts and transferring those semantics into a benign image under a stealth constraint.The resulting malicious image serves as the visual seed and initial-state constraint.
- Temporal evolution guidance: The temporal instruction uses subject, action, and scene components, with stagewise actions and neutral wording to guide evolution while avoiding prompt-level filtering.The subject anchors identity, the action drives temporal progression, and the scene constrains environmental changes.
- Guided semantic injection: TempJail selects local patches with the greatest cross-encoder semantic similarity to guide semantic injection during optimization.The objective averages cosine similarity across pretrained visual encoders, while Winner-Takes-All selects the most informative patch per iteration.
- Camouflage in sampling: Instead of pixel-space perturbations that create removable high-frequency noise, TempJail applies bounded latent perturbations during reverse diffusion and reinjects real noise to preserve benign-image appearance.The real-noise strategy maintains consistency with the benign image after repeated semantic perturbations.
- Black-box inference: During inference, the camouflaged image embeds malicious concepts in the first frame while the text prompt governs later frames, allowing temporal coherence to reconstruct semantic continuity.The attack succeeds when fragmented cues are triggered and completed across the generated sequence.
6 Experiments
Experiments evaluate TempJail on four commercial I2V systems using ASR and semantic similarity, comparing it with baselines and variants. Results show strong attack performance, while ablations identify semantic camouflage, temporal logic, and latent-space design choices as important.
- 6.1 Experimental Setting: Evaluations use 700 balanced prompts from 14 T2VSafetyBench categories across Kling, Seedance, Veo, and PixVerse.A jailbreak succeeds only when all inputs and the generated video bypass safety filtering and the video contains unsafe content.
- 6.2 Main Results: 63.36% and 65.54% ASR are achieved on Kling and PixVerse under LLM evaluation, compared with 58.61% on Seedance and 62.57% on Veo.Human and LLM evaluation results are reported as highly consistent, and CLIP-S exceeds 0.24 across all models.
- 6.3 Comparison with Baselines: 71.38% average ASR under the Violence concept surpasses VII’s 49.06% across four models.The comparison covers five representative baselines, including text-only and joint image-text attacks.
- 6.4 Comparison with Different Variants: Removing semantic camouflage causes a substantial performance drop, while pixel-space optimization can introduce noise removed during denoising.The variant study also finds the Subject-Action-Scene template essential for malicious-concept activation and temporal abstraction.
- 6.5 Ablation Study: Attack performance saturates near δ=0.0025, declines with overly small patch ratios, and generally benefits from more candidate patches within a reasonable range.The ablation tests Winner-Takes-All and Real-Noise Injection on Veo and Seedance, with CLIP-S and ASR as metrics.
7 Conclusion and Limitations
The paper presents TempJail as a systematic investigation of temporal vulnerabilities in I2V systems. It concludes that unsafe semantics can be embedded and reconstructed through temporal composition even when individual modalities appear benign, while identifying synchronized audio-visual jailbreaks as a future concern.
- 7 Conclusion and Limitations: TempJail is presented as the first systematic investigation into temporal vulnerabilities in I2V generation systems.The work focuses on unsafe semantics emerging through temporal composition rather than a single frame.
- 7 Conclusion and Limitations: Unsafe semantics can be stealthily embedded and reconstructed through temporal composition even when individual modalities appear benign.The conclusion notes that integrated audio-visual generation motivates future research on synchronized auditory cues.