PaperlayerView exact revision on arXiv

Source-linked AI summary

Jailbreaking Text-to-Image Models Through Cracks: Navigating Heterogeneous Safety Filters via Multi-Agent Debate

Kaiyan Wen, Shijie Zhang, Lu Yu, Guangdong Bai

arXiv:2609.01168v2cs.AIcs.MM

TL;DR

T2I jailbreaks must navigate heterogeneous safety stacks, while prior methods provide limited insight into which layer blocks a prompt. The paper models these constraints with the Detection Surface and searches them with CRACK’s multi-agent debate framework. Across composite defenses, CRACK reaches up to 99.63% ASR while using fewer queries and preserving semantic fidelity.

  • Problem

    Existing T2I jailbreak methods target individual filters or rely on aggregate feedback, limiting adaptation to conflicts across heterogeneous safety layers.

  • Method

    CRACK combines Detection Surface analysis with Attack, Defense, and Judge Agents for exploration, layer-specific diagnosis, arbitration, and reward-guided mutation refinement.

  • Results

    99.63% ASR is achieved under composite defenses, with fewer queries than existing methods and preserved semantic fidelity.

  • Takeaways & Limitations

    Layer-aware adaptive search provides a way to navigate sparse, non-convex evasion regions created by conflicting safety filters.

Abstract

from arXiv · show

Text-to-image (T2I) models remain vulnerable to jailbreak attacks that elicit Not-Safe-For-Work (NSFW) content, despite increasingly being guarded by heterogeneous, multi-layer safety stacks combining text filters, image classifiers, and cross-modal detectors. Existing jailbreak studies either optimize against individual filters or query the complete pipeline with aggregate feedback, making it difficult to identify the active constraint and adapt to conflicts across safety layers. In this paper, we introduce the Detection Surface, a unified geometric framework that characterizes the decision boundaries induced by heterogeneous T2I safety filters and their joint effect on the jailbreak search space. This formulation reveals that successful evasion is governed by a sparse and non-convex region shaped by cross-layer conflicts, where mutations that bypass one filter may increase exposure to another. Motivated by this analysis, we propose CRACK, a multi-agent debate framework for adaptive jailbreak search that decomposes jailbreak search into exploration, diagnosis, and arbitration. CRACK coordinates an Attack Agent, a Defense Agent, and a Judge Agent to iteratively generate prompt mutations, obtain layer-specific diagnostic feedback, and optimize mutation strategies through reward-guided refinement. Through repeated rounds of debate, CRACK adapts its search direction to the evolving cross-layer constraints while preserving the original harmful intent. Extensive experiments across multiple T2I models, datasets, and safety configurations show that CRACK achieves Attack Success Rates (ASR) of up to 99.63% under composite defenses, while requiring fewer queries than existing methods and maintaining semantic fidelity.

I. INTRODUCTION

Modern T2I systems combine heterogeneous safety layers, but existing jailbreak methods lack layer-specific feedback for navigating their conflicting constraints. The paper introduces the Detection Surface and CRACK, a multi-agent framework for adaptive, layer-aware search, and reports strong results under composite defenses.

  • Safety motivation: T2I platforms combine text, semantic, image-level, and cross-modal safeguards across the generation pipeline.
  • Limitations of prior work: Existing attacks either target individual filters or use coarse end-to-end feedback, limiting diagnosis of layer-specific rejection causes.
  • Detection Surface: The Detection Surface models heterogeneous filter boundaries as a sparse, non-convex evasion region shaped by cross-layer conflicts.
  • CRACK framework: CRACK separates jailbreak search into exploration, diagnosis, and arbitration through specialized agents and reinforcement-learning-guided mutation refinement.
  • Evaluation: 99.63% ASR is achieved on SD 1.4 with composite filters, alongside fewer queries than existing methods and high semantic fidelity.

C. Multi-Agent Systems and LLM-Based Red Teaming

Prior agent-based and reinforcement-learning jailbreak methods provide useful iterative search but generally lack explicit reasoning over conflicting multimodal safety layers. CRACK addresses this gap with layer-aware diagnosis, cross-layer adaptation, and denser strategy-level feedback under a strict black-box setting.

  • Existing agent frameworks: Existing multi-agent red-teaming methods use iterative generation and evaluation, but were designed mainly for text-based LLM responses.
  • T2I-specific challenge: T2I jailbreak search must handle stochastic image generation and heterogeneous textual, visual, and cross-modal safety feedback.
  • Unaddressed capability gap: Recent T2I agents guide prompt generation or overall success evaluation without explicitly modeling active cross-layer constraints.
  • CRACK distinction: CRACK selects qualitatively different mutation strategies using distinct layer feedback rather than only token-level replacement.
  • CRACK distinction: CRACK combines binary bypass outcomes with continuous Judge-Agent scores to provide denser feedback for navigating the sparse evasion region.
  • Threat model: The threat model assumes no access to model internals or filter logic, with repeated input-level queries constrained by a limited budget and semantic-fidelity requirement.

B. Detection Surface Analysis: A Unified View of Multi-Layer Defenses

The Detection Surface models heterogeneous filter boundaries in a continuous prompt-representation space, clarifying how their joint constraints define successful evasion. It combines all-filter safety with output-level semantic fidelity.

  • Defense-stack representation: T2I defense stacks combine text, image, and cross-modal filters operating at different modalities and abstraction levels.These layers may include keyword or text classification, generated-image NSFW detection, and prompt-image alignment assessment.
  • Defense-stack representation: Geometric analysis maps discrete prompts into a continuous representation space before defining boundaries and regions.The representation map supports notions such as distance, boundary, gradient, and convexity in X rather than directly in the discrete prompt space P.
  • Joint safety geometry: Each filter defines a binary decision and a safe region, while the composite safe region contains prompts accepted by every filter.The composite region is the intersection of the individual safe regions.
  • Joint safety geometry: The Detection Surface is the union of all filter decision boundaries and marks where one or more filter decisions may change.Points near multiple boundaries may be constrained by several filters simultaneously.
  • Joint safety geometry: A successful evasion prompt must pass every filter while preserving semantic fidelity to the original harmful intent in the generated output.The evasion region combines the composite safe region with the semantic fidelity set based on an output-level similarity metric and threshold δ.

C. Key Properties of the Detection Surface

The Detection Surface search problem is shaped by cross-layer conflict, sparsity, and non-convexity. These properties explain why effective jailbreak search needs layer-aware feedback, diverse exploration, and iterative strategy revision.

  • Cross-Layer Conflict: Different filters can impose conflicting constraints, so a mutation that evades one layer may fail against another.No single evasion direction is uniformly effective across all layers.
  • Cross-Layer Conflict: Following one filter’s evasion direction can increase another filter’s detection score when their gradients are misaligned.The proposition states this occurs to first order under a negative gradient inner product.
  • Implications for Search: Together, these properties make single-objective greedy descent inadequate and motivate layer-aware feedback, reward-guided search, and iterative exploration.Conflicting gradients can redirect mutations toward rejection, while non-convex geometry can trap trajectories satisfying some filters but violating others.
  • Sparsity: The evasion region shrinks as more filters and the semantic constraint must be satisfied simultaneously.Every additional filter tightens the sparsity bound, while conflicting filters can make joint passage less likely than the minimum bound suggests.
  • Non-Convexity: The joint evasion region is generally non-convex because it intersects nonlinear classifier-safe regions with a semantic fidelity set.A segment between two successful points can leave one safe region and therefore leave the joint evasion region.

IV. CRACK: NAVIGATING THE DETECTION SURFACE VIA MULTI-AGENT DEBATE

CRACK navigates the Detection Surface through multi-round interaction among specialized agents. Its design separates mutation exploration, layer-specific diagnosis, and arbitration of conflicting feedback.

  • Multi-Agent Debate: CRACK uses an Attack Agent, Defense Agent, and Judge Agent to implement exploration, diagnosis, and arbitration.The agents interact across multiple rounds to navigate toward the joint evasion region.
  • Multi-Agent Debate: The Attack Agent generates candidate mutations along complementary search directions.The Defense Agent identifies current safety constraints and failures, while the Judge Agent evaluates overall progress and produces a reward signal.

A. Attack Agent: Prompt Mutation on the Detection Surface

The Attack Agent adaptively mutates harmful prompts using layer-wise risk reports and complementary strategies. This conditioning redirects search across the non-convex Detection Surface while preserving harmful intent.

  • Attack Agent: The Attack Agent seeks a mutated prompt inside all layer-wise safe regions while preserving the original harmful intent.Its objective is to reach the joint evasion region E∗ from a harmful prompt.
  • Attack Agent: At each debate round, the Attack Agent conditions mutation-strategy selection on the Defense Agent’s structured per-layer risk report.The report records detection outcomes for the individual layers.
  • Layer-Aware Mutation: Layer-specific diagnosis enables targeted mutations instead of blind uniform perturbations.Examples include metaphor replacement for text-pattern detections and scene restructuring for semantic-layer triggers.
  • Layer-Aware Mutation: CRACK’s five complementary strategies cover lexical form, semantic framing, scene organization, and prompt structure.The compact strategy library supports policy learning while each strategy modifies a distinct prompt dimension.
  • Layer-Aware Mutation: Adaptive switching among mutation strategies helps redirect search when a current direction becomes ineffective in the non-convex Detection Surface.The figure depicts forward generation and evaluation alongside reinforcement-learning policy updates over multiple rounds.

B. Defense Agent: Probing the Detection Surface

The Defense Agent approximates heterogeneous safety criteria through a three-tier pipeline and provides structured, layer-specific diagnostics rather than aggregate rejection feedback.

  • Operational role: The Defense Agent approximates real-world heterogeneous defenses and localizes which Detection Surface dimension intercepts a prompt.Its surrogate transfers at the level of detection dimensions rather than replicating target detector implementations.
  • Detection dimensions: The surrogate’s three dimensions reflect complementary safety evidence commonly examined by real-world defense mechanisms.Lexical cues capture surface patterns, semantic cues capture higher-level unsafe intent, and cross-modal cues assess multimodal consistency.
  • Three-tier detection: The three tiers probe lexical, semantic, and cross-modal decision boundaries.They use keyword and pattern matching, LLM semantic risk assessment, and CLIPScore-based prompt-image validation.
  • Diagnostic feedback: Structured risk reports identify the specific layer or layers responsible for interception, unlike prior binary feedback that only indicates whether a prompt is blocked.This diagnosis gives the Attack Agent actionable information for selecting targeted countermeasures.

C. Judge Agent: Measuring Progress Across the Detection Surface

The Judge Agent measures mutation progress by combining semantic risk reduction with movement away from unsafe concepts in cross-modal representation space.

  • Arbitration: The Judge Agent arbitrates mutation quality by integrating cross-modal semantic analysis with per-layer Defense Agent assessments.Its output is a reward signal encoding progress toward the evasion region.
  • Dual-signal scoring: Srisk measures whether a revision reduces the likelihood of triggering lexical and semantic safety filters.The signal is obtained through a structured semantic-risk assessment comparing successive prompts.
  • Dual-signal scoring: ∆CLIP = CLIP(pt, cunsafe) − CLIP(pt+1, cunsafe) measures movement away from unsafe concepts across the cross-modal boundary.Positive values indicate that the revised prompt is farther from the unsafe concept in detector representation space.
  • Composite score: s = α · Srisk + β · σ(∆CLIP), with α + β = 1, balances textual-semantic and cross-modal progress.α controls sensitivity to textual and semantic boundaries, while β controls sensitivity to cross-modal boundaries.

D. Multi-Agent Debate as Detection Surface Traversal

CRACK treats jailbreak search as iterative traversal of a multi-filter Detection Surface, using debate, diagnosis, arbitration, and reinforcement learning to select mutations.

  • Agent roles: The Defense Agent supplies layer-wise diagnosis, the Attack Agent explores mutation strategies, and the Judge Agent arbitrates conflicting signals.This division separates mutation generation, failure attribution, and cross-layer evaluation.
  • Debate protocol: Each debate round generates a mutation, evaluates it through three detection tiers, and scores its progress using comparative judgment.The cycle repeats until the prompt enters E* or reaches the maximum debate rounds.
  • Reward formulation: The reward combines a continuous Judge score with a binary bypass signal for evading all detection tiers.The composite reward provides partial-progress feedback while preserving the requirement to bypass every active layer.
  • Policy learning: The policy network learns mutation-strategy selection from state-action trajectories and reward signals collected during debate.Its optimization accumulates experience about which strategies work against particular detection layers.
  • Detection Surface traversal: CRACK’s generated prompts are largely located within the joint evasion region, whereas other methods fail to cross different filter boundaries.This observation connects the debate mechanism to the Detection Surface geometry.
  • Experimental scope: The evaluation spans NSFW-200, I2P, and UnsafeDiff across heterogeneous safety stacks and includes one-time and re-use attack settings.DALL·E 3 is evaluated as a proprietary closed-source heterogeneous stack whose internal filters cannot be enumerated.

B. Evaluations

CRACK is evaluated against multiple baselines, datasets, models, and safety configurations, with results showing strong attack effectiveness, efficiency, and prompt fidelity.

  • RQ1: Comparison with Different Baselines: CRACK consistently achieves the highest ASR across nearly all safety-filter configurations in one-time attacks.On SD 1.4 with text-image-c, it reaches 83.01% on I2P and 78.69% on UnsafeDiff, exceeding the strongest baselines by 36.37 and 27.67 percentage points.
  • RQ1: Comparison with Different Baselines: 99.30% on I2P and 98.36% on UnsafeDiff are CRACK’s ASR-Q16 results under the text-m filter.On text-c, CRACK remains above 90% across all three datasets while several non-iterative baselines fall to single-digit success rates.
  • RQ1: Comparison with Different Baselines: 95.16% on I2P and 96.23% on UnsafeDiff are CRACK’s ASR-Q16 results under image-c.On image-clip-c, it reaches 88.96% on I2P and 64.25% on NSFW-200, leading all baselines.
  • RQ1: Comparison with Different Baselines: 43.57% on I2P and 49.02% on UnsafeDiff are CRACK’s ASR-Q16 results on DALL·E 3 under one-time attacks.These results outperform all competitors and extend evaluation to a proprietary stack with undisclosed safety mechanisms.
  • RQ1: Efficiency: Six queries per instance is CRACK’s reported query cost, fewer than the iterative baselines shown.Its three debate rounds use one Defense Agent evaluation and one Judge Agent comparative score per round.
  • RQ1: Prompt quality and fidelity: 29.78 is CRACK’s minimum perplexity under the image-c stack, indicating fluent revisions rather than malformed token sequences.The generated images also retain the harmful intent and semantic structure of the original prompts.

2) RQ2: Detection Surface Property Validation:

The experiments validate that heterogeneous defense stacks create cross-layer conflict, sparse feasible regions, and non-convex evasion paths. These properties explain why targeted diagnosis and adaptive strategy switching improve jailbreak search efficiency.

  • Cross-layer conflict: Individual mutation strategies perform unevenly across filter types, confirming cross-layer conflict in heterogeneous defenses.Metaphor replacement reaches 65.39% on image-c and 63.31% on image-clip-c but only 53.04% on text-image-c; chain-of-thought expansion reaches 71.23% on text-m.
  • Sparsity: 10,000 random paraphrases are used to measure how adding defense layers sparsifies the jointly feasible region.The evaluation requires prompts to pass all active filters while maintaining CLIPScore above 0.26.
  • Sparsity: The feasible-region hit rate decays multiplicatively as defense layers are added, closely matching the predicted exponential bound.This sparsity is linked to exploratory query costs for baseline methods and motivates more directed search.
  • Sparsity: CRACK achieves high ASR in 6 queries, compared with 39.96 queries for SneakyPrompt and 29.55 for JailFuzzer.Layer-specific rejection diagnosis lets CRACK target mutations toward the active bottleneck instead of exploring infeasible regions.
  • Non-convexity: Straight-line interpolation between successful prompts tests whether feasible adversarial prompts form a convex region.The resulting non-convexity explains why greedy single-direction methods can become trapped at local dead ends.
  • Non-convexity: Multi-round debate with strategy switching changes search direction across rounds, helping CRACK navigate non-convex feasible components.The same mechanism explains the ASR reduction observed when RL-based strategy switching is removed.

3) RQ3: Ablation Study:

Ablations show that CRACK’s agents, reward-guided selection, and diverse strategy library contribute complementary capabilities. Sensitivity experiments further identify three debate rounds and balanced reward weights as effective settings, while performance remains stable across LLM backbones.

  • Effect of multi-agent debate: Removing any one of the three agents breaks either evasion capability or semantic preservation.Without the defense agent, text-image-c ASR falls to 44.15% on I2P and 30.16% on NSFW-200; without the judge agent, CLIPScore drops below 0.12 on multiple pairs.
  • Effect of RL: 10–20% ASR reductions occur across filters when RL-based strategy selection is replaced with a fixed policy.The largest drops occur on text-image-c, where fixed strategies cannot adapt to filter-specific effectiveness.
  • Effect of strategy diversity: 43.12% ASR on text-image-c for I2P is obtained when the strategy library is restricted to metaphor replacement.This is the lowest overall ablation result and underperforms the no-RL variant, showing that strategy diversity complements learned selection.
  • Sensitivity analysis: Three debate rounds provide the best balance between attack success and semantic fidelity.ASR and CLIPScore peak by round 3, while additional rounds do not improve ASR and reduce CLIPScore through semantic drift.
  • Sensitivity analysis: α = 0.3 and β = 0.7 achieve the optimal compromise between bypass success and semantic fidelity.Higher α raises bypass rates while lowering CLIPScore; higher β improves alignment while slightly reducing bypass success.
  • Sensitivity analysis: CRACK maintains stable performance across different LLM backbones with only marginal variation.The authors attribute this stability to debate and reward mechanisms that are largely model-agnostic.
Loading 2609.01168v2…