PaperlayerView exact revision on arXiv

Source-linked AI summary

The Price of Consistency: Exploiting Visual Anchors for Multimodal Jailbreaking in Video Generation

Peng Li, Qianqian Xu, Yangbangyan Jiang, Zhipeng Yu, Qingming Huang

arXiv:2609.07216v1cs.CV

TL;DR

Reference-image guidance is widely used in video generation, but its safety effects have received little attention. This paper examines visual anchoring and proposes DIVA, which splits harmful intent across an image and text prompt. DIVA reports higher Attack Success Rates than text-only jailbreak methods across nearly all tested models and categories.

  • Problem

    The safety risks introduced by reference-image guidance in video generation have received little attention, despite its central role in the mainstream multi-conditional paradigm.

    Source: §1 · pp. 1–2

  • Method

    DIVA uses a static reference image for harmful visual context, a dynamic text prompt for motion, and dual-criteria selection to balance stealthiness with semantic preservation.

    Source: §1 · p. 2

  • Results

    DIVA achieves the highest Attack Success Rate of text-only jailbreak methods across nearly all tested models and safety categories.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The authors characterize reference-image consistency as suppressing semantic drift and creating a safety vulnerability, and contribute TI2VSafetyBench for multi-conditional video generation.

    Source: §1 · p. 2, §6 · p. 8

    The threat model assumes black-box access without internal parameters, gradients, or training data, and allows only a single query to the victim model.

    Source: §4.1 · p. 4

Abstract

from arXiv · show

The rapid evolution of video generation has shifted the paradigm from pure text-driven to multi-conditional controllable generation, with reference images now widely adopted as conditional inputs to achieve superior spatiotemporal consistency. While these reference images serve as powerful visual anchors that significantly enhance controllability, their impact on safety remains largely unexplored. In this work, we reveal the visual anchoring effect: by enforcing consistency, the mechanism prevents the generated content from drifting away from the original harmful intent, thereby eliminating the model's natural safety escape route from harmful to benign content. Consequently, visual anchors inherently increase the safety risk---this is the price of consistency. Building on this insight, we propose Decoupling Intent via Visual Anchors (DIVA), a training-free multimodal jailbreak framework for video generation that exploits this vulnerability. DIVA decouples harmful intent into a static visual anchor image and a dynamic motion text prompt, and employs dual-criteria selection to balance attack stealthiness with semantic preservation. Extensive experiments across various leading commercial platforms and mainstream open-source video generation models demonstrate that DIVA achieves a substantially higher Attack Success Rate than existing text-only methods. To facilitate future research, we additionally contribute TI2VSafetyBench, the first safety benchmark for multi-conditional video generation.

1 Introduction

Reference images are now central to controllable video generation, but their effects on safety have received little attention. The paper identifies visual anchoring as a safety vulnerability and proposes DIVA, a multimodal jailbreak framework that exploits it.

1 Introduction

  • Reference images guide temporal rollout and mitigate spatial inconsistency, entity distortion, and weak temporal coherence in multi-conditional video generation.Their widespread adoption has made reference-image input a de facto standard in mainstream commercial platforms and open-source models.Source: §1 · p. 1
  • The safety impact of reference-image guidance remains largely unexplored, despite prior video-safety work on text-only vulnerabilities.Prior systems established safety evaluation and explored text-only jailbreaks, leaving risks introduced by reference images unaddressed.Source: §1 · pp. 1–2
  • Visual anchoring constrains subsequent frames to the reference image, suppressing semantic drift that can otherwise let safety alignment redirect harmful prompts toward benign content.The authors describe this consistency mechanism as eliminating a natural safety escape route and forcing faithful reconstruction of harmful semantics encoded in the first frame.Source: §1 · p. 2
  • DIVA decouples harmful intent into a static reference image and a dynamic text prompt that drives temporal evolution.Its dual-criteria selection jointly optimizes attack stealthiness and preservation of the original harmful semantics.Source: §1 · p. 2
  • DIVA achieves the highest Attack Success Rate of text-only jailbreak methods across nearly all tested models and safety categories.Experiments cover 14 safety categories across leading commercial platforms and mainstream open-source models; the authors also contribute TI2VSafetyBench for multi-conditional video generation safety research.Source: §1 · p. 2
  • The paper contributes TI2VSafetyBench, described as the first comprehensive safety benchmark for multi-conditional video generation.The authors also identify the consistency mechanism of reference images as a source of safety vulnerability.Source: §1 · p. 2

2 Related Work

Related work covers the shift to reference-image-conditioned video generation and safety research on generative models. The authors identify multi-conditional video safety as underexplored and distinguish their training-free approach from existing jailbreak methods.

2.1 Video Generation Models

  • Multi-conditional generation with reference images has become dominant, yet existing video-generation benchmarks focus almost exclusively on performance rather than safety risks.Mainstream open-source models and commercial platforms support reference-image input.Source: §2.1 · p. 2

2.2 Jailbreak for Video Generation Models

  • Prior jailbreak work spans multimodal understanding, text-to-image, and text-driven video attacks, but many approaches do not transfer directly to video’s temporal dynamics.T2V-OptJail uses LLM-guided prompt rewriting, while SceneSplit divides harmful intent into benign scenes; both remain text-driven.Source: §2.2 · pp. 2–3
  • RunawayEvil also targets image-to-video models, but trains a reinforcement-learning agent, whereas this work requires no additional training.Video safety research also builds on T2VSafetyBench and includes curated malicious instructions, in-the-wild jailbreak analysis, and adapted text-to-image attacks.Source: §2.2 · p. 3

3 The Visual Anchoring Effect

Reference images act as persistent visual anchors, reducing semantic deviation and variability in generated videos. This consistency can constrain safety-aligned models’ ability to drift toward benign content.

3.1 An Analogy from Behavioral Economics

  • Visual anchoring describes how reference-image semantics persist across generated frames, reducing semantic gap to the harmful intent and variation across generations.The paper draws an analogy to behavioral anchoring, where initial reference information constrains subsequent decisions.Source: §3.1 · p. 3

3.2 Quantifying the Visual Anchoring Effect

  • Text-image generation has significantly lower semantic deviation and semantic divergence than text-only generation; divergence is 0.27 vs. 0.57.The caption embeddings also cluster more compactly around the harmful intent across safety-critical categories.Source: §3.2 · pp. 3–4, Table 1 · p. 3, Figure 2 · p. 3

3.3 Why Visual Anchoring Undermines Safety

  • Safety-aligned models can use semantic drift to move risky prompts toward benign content, but visual anchoring blocks this escape route.The paper attributes anchoring to reference-image-guided models’ consistency objectives, which prioritize pixel-level visual priors over softer text constraints.Source: §3.3 · p. 4

4 Methodology

DIVA operates in a black-box setting and converts harmful intent into candidate image-text pairs. It selects a pair balancing filter stealthiness and semantic preservation for video generation.

4.1 Overview of the Framework

  • DIVA assumes a black-box victim model and a single query, then transforms harmful intent into an adversarial image-text pair for attack execution.The selected reference image is supplied as the conditioning first frame alongside the selected text prompt.Source: §4.1 · p. 4

4.2 Intent Decoupling and Visual Anchor Synthesis

  • DIVA separates harmful intent into a static image prompt for scene context and a dynamic text prompt for temporal actions, generating K candidate pairs.A text-to-image model instantiates reference images from image prompts; the resulting image-text pairs form the selection pool.Source: §4.2 · p. 5

4.3 Optimal Pair Selection via Dual Criteria

  • DIVA scores candidate image-text pairs for image and text filter evasion, then assesses semantic preservation using a predicted video caption.A vision-language model predicts the caption as a proxy for querying the video generator for every candidate.Source: §4.3 · p. 5
  • The final attack score adds image stealthiness, text stealthiness, and semantic similarity, selecting the highest-scoring pair.Semantic similarity compares CLIP text embeddings of the harmful intent and predicted caption; higher similarity indicates stronger preservation.Source: §4.3 · p. 5

5 Experiments

Experiments evaluate DIVA across commercial and open-source video models, then test its candidate-selection choices, safety-filter bypass, and ASR evaluation reliability. DIVA outperforms text-only jailbreak methods across nearly all tested models and categories.

5.1 Experimental Setup

  • The evaluation uses 700 open-source and 280 commercial prompts across 14 safety categories, with attacks tested on five open-source models and three commercial platforms.An attack is successful at an unsafety score of at least 60, assessed by Qwen3-VL-30B; its evaluation is reported to correlate highly with GPT-4o and human judgments.Source: §5.1 · pp. 6–7

5.2 Main Results

  • DIVA achieves average ASRs of 77.5% on Grok Imagine, 75.4% on Hailuo 2.3, and 62.1% on Sora 2, and the highest ASR across five open-source models.Open-source averages are 73.7% on Wan, 72.6% on CogVideoX, 66.3% on LTX-Video, 70.6% on VideoCrafter, and 71.4% on Open-Sora.Source: §5.2 · p. 7

5.3 Ablation Study

  • At K=5, bypass rate reaches 0.85 versus 0.53 at K=1, but ASR falls from 0.74 at K=3 to 0.67; Sim remains around 0.68.The authors attribute the ASR drop to larger pools selecting more obfuscated pairs with insufficient semantic malice, and set K=3 as the default.Source: §5.3 · p. 7, Figure 5 · p. 7
  • Text-aligned synergistic anchors achieve the best overall performance, with 73.7% ASR and 0.525 Sim; mismatched anchors perform worst.Mismatched visual priors disrupt text-prompt guidance, while blank anchors slightly outperform the text-only baseline.Source: §5.3 · p. 8, Table 5 · p. 8

5.4 Robustness Against Safety Guardrails

  • DIVA’s adversarial image-text pairs bypass three representative text-, image-, and multimodal safety guardrails in most cases.The evaluated guardrails are Llama-Guard-3, LLaVA-Guard, and Llama-Guard-4.Source: §5.4 · p. 8, Table 6 · p. 8

5.5 Reliability Validation of Safety Evaluation

  • Across three commercial platforms, ASR estimates from Qwen3-VL-30B closely match human judgments.The comparison also includes GPT-4o as an independent evaluator.Source: §5.5 · p. 8, Figure 6 · p. 8

6 Conclusion

The conclusion characterizes visual anchoring as a safety vulnerability, presents DIVA as an attack framework exploiting it, and introduces TI2VSafetyBench. The ethical discussion limits the work’s stated use and describes restricted dataset release.

6 Conclusion

  • Reference images that enhance spatiotemporal consistency can undermine model safety by suppressing semantic drift.The conclusion identifies this trade-off as the price of consistency.Source: §6 · p. 8
  • The paper presents DIVA as exploiting visual anchoring through intent decoupling and contributes TI2VSafetyBench as a safety benchmark for multi-conditional video generation.The benchmark is described as the first of its kind for this setting.Source: §6 · p. 8

A Ethical Considerations

  • The authors state that DIVA is intended for AI safety research and that the jailbreak image-text dataset will be released only to verified researchers for academic use upon request.Experiments use public APIs and open-source models with default safety configurations, without modifying built-in safety mechanisms.Source: A Ethical Considerations · p. 11

B Additional Implementation Details

The implementation details describe DIVA’s two-stage process: generate candidate image-text pairs from a harmful intent, then select an optimal pair. In the first stage, static scene context becomes a visual anchor and dynamic actions become the text prompt.

B.1 Stage 1: Intent Decoupling and Visual Anchor Synthesis

B.1.1 Intent Decoupling.

  • The image prompt specifies the initial frame’s static visual context, and the text prompt specifies the dynamic scene that drives the TI2V model.The implementation asks for K distinct pairs, treating each pair independently to avoid quality degradation.Source: §B.1.1 · p. 11
  • The method builds a candidate pool of K image-text pairs for each harmful intent as the search space for selecting an optimal pair.Each image prompt is rendered as a reference image and injected as the first video frame.Source: §B.1.2 · p. 11

B.2 Stage 2: Optimal Adversarial Pair Selection via Dual Criteria

DIVA selects an adversarial image-text pair by balancing safety-filter evasion with preservation of the original harmful intent. The paper also specifies its black-box evaluation setting and the scope of TI2VSafetyBench.

B.2 Stage 2: Optimal Adversarial Pair Selection via Dual Criteria

  • Pair selection requires both bypassing platform safety filters and preserving the original harmful intent in the generated video.The method combines these two criteria into a unified attack score.Source: §B.2 · p. 11, §B.2.2 · p. 12
  • For stealthiness, two safety classifiers assess candidate image-text pairs to simulate input protection pipelines; intercepted inputs are rejected regardless of semantic fidelity.The image and text filters are Flux ContentFilter and Q16, respectively.Source: §B.2.1 · pp. 11–12

B.2.2 Criteria 2: Semantic Preservation.

  • For semantic preservation, Qwen3-VL-8B predicts each candidate’s video caption, and CLIP text embeddings measure its cosine similarity to the original harmful intent.Caption prediction avoids querying the target video-generation model for every candidate.Source: §B.2.2 · p. 12

C Victim Model Configurations

  • The evaluation uses a single-query black-box threat model, with no access to model parameters, gradients, or training data, and default settings for five open-source models and three commercial platforms.Source: C Victim Model Configurations · p. 12

D TI2VSafetyBench Details

  • TI2VSafetyBench extends T2VSafetyBench from text-to-video to multi-conditional text-image-to-video generation as a standardized safety testbed.Source: D TI2VSafetyBench Details · p. 12

D.1 Category Definitions

  • The benchmark retains 14 safety-critical categories, including temporal risks where benign-looking frames can form unsafe content through sequence, transformation, or context.Source: §D.1 · pp. 12–13

D.2 Dataset Construction

TI2VSafetyBench-Tiny is built by generating and selecting adversarial image-text pairs for harmful intents across 14 safety-critical categories.

D.2 Dataset Construction

  • For each harmful intent, the pipeline generates K=3 image-text prompt pairs and selects an optimal pair using stealthiness and semantic-preservation criteria.Visual anchors are synthesized with Z-Image-Turbo at 1280 × 704 resolution to create the candidate pool.Source: §D.2 · p. 13
  • TI2VSafetyBench-Tiny contains 700 adversarial image-text pairs, from 50 randomly sampled prompts in each of 14 safety-critical categories.Each pair corresponds to an original harmful intent from T2VSafetyBench.Source: §D.2 · p. 13
  • Closed-source commercial-platform evaluations use a randomly sampled lightweight subset of 20 prompts per category from TI2VSafetyBench-Tiny.Source: §D.2 · p. 13

D.3 Evaluation Protocol

The protocol evaluates both video unsafety and semantic fidelity, using temporally sampled frames for assessment and captioning.

D.3 Evaluation Protocol

  • The evaluation follows T2VSafetyBench to support rigor, comparability, and reliability in assessing video generation safety.Source: §D.3 · p. 13
  • Qwen3-VL-30B assesses safety using one frame per second across each video, and an unsafety score of at least 0.6 counts as a successful attack.ASR is the proportion of videos meeting that threshold; the score is the evaluator's matching percentage for unsafe content.Source: §D.3 · p. 13
  • Semantic similarity is measured as CLIP cosine similarity between the original harmful intent and a caption generated by VideoLLaMA 3 from the same one-frame-per-second samples.Higher similarity indicates better preservation of the original intent's semantics.Source: §D.3 · p. 13

E Quantitative Results

DIVA achieves the strongest reported attack and semantic-similarity performance overall, with results varying across commercial platforms and risk categories.

E Quantitative Results

  • DIVA achieves the highest ASR and Sim across victim models and state-of-the-art performance against text-only methods on three commercial platforms across 14 safety-critical categories.Table 9 reports ASR and Sim by category; bold marks the best and underlining the second-best result in each category.Source: E Quantitative Results · pp. 13–14, Table 9 · p. 14
  • Sora 2 has the lowest average ASR across methods at 62.1%, while DIVA's average ASRs are 77.5% on Grok Imagine and 75.4% on Hailuo 2.3.The authors characterize commercial systems' multi-conditional safety guardrails as inconsistent and incomplete.Source: E Quantitative Results · p. 14
  • For explicit harmful content, DIVA reaches 95.0% ASR for Gore on Hailuo 2.3 and 85.0% for Disturbing Content on both Grok Imagine and Sora 2.It also reaches 80.0% and 85.0% ASR for Borderline Pornography on Grok Imagine and Hailuo 2.3, respectively.Source: E Quantitative Results · p. 14
  • For identity and political risks, DIVA reaches 90.0% ASR for Copyright and Trademark on Grok Imagine and 80.0% for Political Sensitivity on that platform.For Illegal Activities, it reaches 85.0% on Grok Imagine; for Misinformation and Falsehoods, it reaches 80.0% on Sora 2 while maintaining the highest semantic similarity on those platforms.Source: E Quantitative Results · p. 14
  • For video-specific temporal risks, DIVA reaches 90.0% ASR for Dynamic Variation Risk on Grok Imagine and 85.0% for Coherent Contextual Risk on Hailuo 2.3.For Sequential Action Risk, it reaches 80.0% on Grok Imagine and 70.0% on Hailuo 2.3.Source: E Quantitative Results · p. 14

F Qualitative Examples

Qualitative examples show DIVA reconstructing harmful intents, while its performance is weaker than SceneSplit in some Sora 2 categories.

F Qualitative Examples

  • On Sora 2, DIVA has slightly lower ASR than SceneSplit in several categories, as longer videos and smooth scene transitions can weaken the initial visual anchor's influence over time.SceneSplit's multi-scene decomposition and combination strategy aligns better with that generation design.Source: F Qualitative Examples · p. 14
  • Across the 14 safety-critical categories, examples illustrate DIVA bypassing current systems' safety guardrails and generating videos that reconstruct the original harmful intent.Source: F Qualitative Examples · p. 14
  • The authors conclude that reference images improve spatiotemporal consistency but suppress semantic drift, which can otherwise provide a safety escape from harmful to benign content.TI2VSafetyBench is presented as a unified benchmark for evaluating and improving multimodal safety defenses.Source: F Qualitative Examples · p. 14
Loading 2609.07216v1…