PaperlayerView exact revision on arXiv

Source-linked AI summary

TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks

Tianmeng Fang, Jiancheng Wang, Chen Wang, Liming Wang, Wei Wang, Jiayang Liu, Xiaochun Cao

arXiv:2609.31032v1cs.MMcs.CRcs.CV

TL;DR

Limited, costly target queries make candidate testing difficult, while candidate stealth alone leaves uncertainty about sustained, intent-aligned videos. TempQ-Jail estimates end-to-end attack value and ranks candidates; on CogVideoX-5B it improves strict success rates and overall query-trajectory metrics over the strongest baselines.

  • Problem

    Existing T2V jailbreak methods focus on candidate construction, yet it remains uncertain whether candidates generate videos aligned with the original intent and sustained dangerous events.

    Source: §2.2 · p. 4

  • Method

    TempQ-Jail combines heterogeneous candidate construction, end-to-end attack-value estimation, and budget-aware ranking to prioritize candidates in a finite query trajectory.

    Source: §6 · p. 14

  • Results

    48.9% TP-ASR@5 and 65.4% TP-ASR@10 improve over the strongest baselines by 4.6 and 4.0 percentage points; AUC-TP is highest at 0.469 and AvgQ lowest at 6.3.

    Source: §6 · p. 14

  • Takeaways & Limitations

    Candidate generation and accessibility under limited budgets are distinct yet equally important issues, and TempQ-Jail unifies candidate-value assessment with query-priority optimization.

    Source: §6 · p. 14

    The evaluation uses a guarded setup where blocked prompts do not proceed to video generation and each candidate submission counts as one target query.

    Source: §5.1 · p. 10

Abstract

from arXiv · show

Existing text-to-video (T2V) jailbreak methods mainly seek more effective or stealthier attack candidates. In guarded T2V systems, however, video generation and security evaluation are costly, so an attacker often cannot test a large candidate pool. We therefore formulate T2V jailbreak as a query-constrained candidate allocation and ranking problem and propose TempQ-Jail. The method combines heterogeneous attack mechanisms to expand candidate coverage, estimates each candidate's end-to-end attack value from security-gate passage, dangerous visual generation, preservation of the original intent, and temporal validity, and ranks candidates so that high-value attacks appear early in a limited query trajectory. We evaluate TempQ-Jail on CogVideoX-5B using 70 common viable intents derived from T2VSafetyBench and compare it with six representative T2V jailbreak methods under a unified protocol. TempQ-Jail achieves TP-ASR@5 and TP-ASR@10 of 48.9% and 65.4%, improving over the strongest baselines by 4.6 and 4.0 percentage points, respectively. It also obtains the highest AUC-TP (0.469) and the lowest AvgQ (6.3). Analyses of query trajectories, candidate allocation, failure attribution, and ablations show that TempQ-Jail more effectively identifies and prioritises candidates with complete attack potential under limited query budgets.

1 Introduction

Guarded T2V attacks face costly, limited queries, and filter passage alone does not ensure a dangerous, intent-preserving, temporally valid video. TempQ-Jail expands candidate coverage, estimates end-to-end value, and ranks candidates to prioritize stronger attacks.

1 Introduction

  • Input-filter passage alone does not establish attack success: generated videos may be safe, off-intent, or show risk only briefly.T2V harmful events can also emerge across multiple temporal segments even when individual segments appear insignificant.Source: §1 · p. 2
  • Black-box attackers may generate many candidates locally, but costly target queries make it difficult to test them or predict their end-to-end effectiveness in advance.The paper reframes the task as candidate allocation and ranking under a finite query budget.Source: §1 · p. 2
  • TempQ-Jail combines heterogeneous candidate construction, end-to-end attack-value estimation, and budget-aware ranking to prioritize high-value candidates within limited target queries.Its value assessment covers dangerous visual generation, preservation of original intent, and temporal validity, alongside security-gate passage.Source: §1 · p. 3
  • 48.9% TP-ASR@5 and 65.4% TP-ASR@10 improve over the strongest baseline by 4.6 and 4.0 percentage points, respectively.Across the complete query trajectory, TempQ-Jail also achieves the highest AUC-TP (0.469) and lowest AvgQ (6.3).Source: §1 · p. 3

2 Related Work

The related work traces how temporal video generation creates a distinct safety concern, reviews candidate-focused T2V jailbreaks, and describes evaluation and safeguards that motivate end-to-end attack assessment.

2.1 Text-to-Video Generation

  • Coherent video generation sustains events across frames, making temporal persistence a security concern beyond the static-image setting.The section frames this as the property targeted by the paper’s attack-success criterion.Source: §2.1 · p. 4

2.2 Jailbreak Attacks on T2V Systems

  • Existing T2V jailbreaks use semantic rewriting, decomposition, scene reorganization, reconstruction, and search, but leave uncertainty about sustained, intent-aligned video outcomes and candidate access priority.The paper identifies end-to-end value assessment and budget-aware ranking as under-addressed compared with candidate generation.Source: §2.2 · p. 4

2.3 Safety Evaluation and Safeguarding for T2V Models

  • T2V safety work evaluates harmful generation across safety dimensions and develops input-, generation-, and output-stage defenses, motivating attack metrics beyond filter bypass.Such evaluation must also account for dangerous content, attack-intent maintenance, and temporal continuity in generated videos.Source: §2.3 · pp. 4–5

3 Problem Definition

The paper formulates black-box T2V jailbreaking as ordering a fixed candidate pool so that candidates capable of complete attack success are reached within a finite query budget.

3.1 Problem Setting and Threat Model

  • The attacker constructs candidate prompts locally but has finite target queries and, in the standard black-box setting, cannot access the victim model’s internal parameters, gradients, or training data.Target submissions are counted as queries, including candidates intercepted by the security gate.Source: §3.1 · p. 5

3.2 Success of End-to-End Attacks

  • Strict TP-Success requires gate passage, dangerous visual content, preservation of the original intent, and temporal continuity.This distinguishes candidates that merely bypass a filter from those that induce the target hazardous video.Source: §3.2 · pp. 5–6

3 Problem Definition

  • The objective is to place strictly successful candidates early in the ranking so they are accessed under finite query budgets.The problem is framed as access priority within a preconstructed pool, not simply increasing candidate count.Source: §3 · p. 5, §3.3 · p. 6

3.3 Query-Limited Candidate Allocation

  • A ranking determines which candidate prefix is accessible under budget B, and the objective considers strict success across multiple budgets.Higher placement makes a strictly successful candidate more likely to be accessed under different finite budgets.Source: §3.3 · p. 6

4 TempQ-Jail

TempQ-Jail treats T2V jailbreak as allocating limited target queries among candidates, combining diverse candidate construction, end-to-end value estimation, and budget-aware ranking. Its pipeline prioritizes candidates with greater estimated potential for complete attack success.

4.1 Overview

  • TempQ-Jail combines heterogeneous candidate construction, end-to-end attack value estimation, and budget-aware ranking to prioritize candidates likely to succeed within a finite query budget.The ranking turns candidate values into a query sequence so higher-value candidates are reached earlier.Source: §4.1 · p. 6

4.2 Heterogeneous Candidate Construction

  • Four candidate families—Generic, DACA-derived, T2V-OptJail-derived, and Hybrid—cover linguistic rewrites, decomposed events, optimized prompts, and combinations including temporal reconstruction.The four families have equal scale in the initial pool and are evaluated together.Source: §4.2 · pp. 6–7

4.3 End-to-End Attack Value Estimation

  • Candidate utility combines gate-pass probability, hazardous visual risk, temporal validity, semantic preservation, and ensemble prediction uncertainty.Uncertainty preserves some ranking priority for candidates whose predicted effectiveness is unstable.Source: §4.3 · p. 8

4.4 Budget-Aware Candidate Ranking

  • Low-temperature Gumbel noise adjusts near-ties while utility sets primary priority; each budget accesses a prefix of one shared ranking, with queries stopping on success or exhaustion.The ordering is not regenerated for different budgets, and early success can shorten the accessed prefix.Source: §4.4 · pp. 8–9

4.5 Overall Optimisation Pipeline

  • The fixed pipeline constructs candidates, scores and ranks them with a frozen surrogate, then queries sequentially until strict success or Bmax.The implementation uses 40 candidates per intent and trains the surrogate offline on 450 warm-up candidate-query examples outside the final test set.Source: §4.5 · pp. 9–10

5 Experiment

Experiments compare TempQ-Jail with six jailbreak methods under a shared query-constrained protocol. TempQ-Jail leads on strict attack success and query efficiency, with analyses examining query order, candidate allocation, failure outcomes, module contributions, and risk categories.

5.1 Experimental Setup

  • The unified evaluation uses CogVideoX-5B, 70 common viable intents, and the same guarded-system setup, query budget, success criteria, and generation configuration for all methods.The intent set was screened from T2VSafetyBench; six methods are compared with TempQ-Jail, and blocked submissions still count toward the query budget.Source: §5.1 · p. 10

5.2 Overall Attack Performance

  • 48.9% TP-ASR@5 and 65.4% TP-ASR@10 are TempQ-Jail’s highest strict attack rates at budgets 5 and 10.These improve over T2V-OptJail’s 44.3% TP-ASR@5 by 4.6 points and DACA’s 61.4% TP-ASR@10 by 4.0 points; AUC-TP is 0.469 and AvgQ is 6.3, versus the strongest baselines’ 0.425 and 6.8.Source: §5.2 · p. 11, Table 1 · p. 12

5.3 Query Efficiency under Limited Budgets

  • TempQ-Jail leads from B = 2 onward and sustains higher TP-ASR across later budgets, although T2V-OptJail performs slightly better at B = 1.The budgets evaluate prefixes of a fixed query sequence, so the trajectory reflects where strictly successful candidates occur.Source: §5.3 · pp. 11–12, Figure 3 · p. 12

5.4 Discussion

  • Ranking shifts the Top-5 candidate mix from equal initial source shares to 34% DACA-derived, 32% T2V-OptJail-derived, and 8% Generic candidates.The Top-5 proportions describe ranked candidates, not queries actually executed, since querying can stop early after success.Source: §5.4 · p. 12
  • Most baseline failures occur after gate passage: Passed-Safe rates are 72.7% for DACA, 83.7% for SceneSplit, 88.5% for SPARK, and 84.0% for TFM.TP-Success is measured per executed query and is not directly comparable with per-intent TP-ASR@B; TFM’s TP-Success rate is 2.2% versus TempQ-Jail’s 11.0%.Source: §5.4 · p. 13, Figure 4 · p. 13
  • All three core modules contribute positively, with end-to-end attack value estimation having the largest role; candidate construction improves coverage while ranking advances high-value candidates.The ablation variants use the main experiment’s victim model, test set, and query budget.Source: §5.4 · p. 13, Table 3 · p. 13
  • TempQ-Jail has the best overall cross-category TP-ASR@5, with micro and macro averages of 48.9% and 50.9%, respectively.It leads for Violence, Self-harm, and Pornography, while T2V-OptJail leads for Gore and DACA for Illegal Activity and Disturbing Content.Source: §5.4 · pp. 13–14, Table 4 · p. 14

6 Conclusion

TempQ-Jail reframes guarded T2V jailbreak as query-constrained candidate allocation and ranking, combining heterogeneous candidate construction, end-to-end value estimation, and budget-aware prioritisation. On CogVideoX-5B, it leads the reported query-budget metrics and analyses indicate more effective prioritisation of candidates with full attack potential.

6 Conclusion

  • TempQ-Jail expands candidate coverage with heterogeneous construction, estimates end-to-end attack value across four dimensions, and ranks high-value candidates early within a finite query trajectory.The value dimensions are security-gate passage, dangerous visual generation, preservation of original intent, and temporal validity.Source: §6 · p. 14
  • TP-ASR@5 reached 48.9% and TP-ASR@10 reached 65.4%, improving over the strongest baselines by 4.6 and 4.0 percentage points; AUC-TP was highest at 0.469 and AvgQ lowest at 6.3.The evaluation used CogVideoX-5B and 70 common viable intents derived from T2VSafetyBench.Source: §6 · p. 14
  • Query-trajectory, candidate-allocation, failure-attribution, and ablation analyses indicate more effective identification and prioritisation of candidates with full attack potential.The paper distinguishes candidate-generation capability from candidate accessibility under limited budgets and unifies value assessment with query-priority optimisation.Source: §6 · p. 14

Declarations

The declarations report the study's data availability, author contributions, funding and competing-interest status, and research conduct. Safety-sensitive materials are subject to access restrictions, and experiments were conducted offline on a locally hosted CogVideoX-5B model.

Declarations

  • Processed evaluation data are available from the corresponding author upon reasonable request, while safety-sensitive attack materials may be access-restricted to mitigate potential misuse.The benchmark data derive from publicly available T2VSafetyBench.Source: Declarations · p. 14
  • The authors declare no competing financial interests or personal relationships, and report that the study received no funding.Source: Declarations · p. 14
  • The author-contribution statement assigns roles across conceptualization, methodology, software, analysis, curation, visualization, writing, resources, and supervision; the acknowledgements thank CogVideoX and T2VSafetyBench developers.The authors state that ethics approval was not required because the study involved no human participants or animals.Source: Declarations · pp. 14–15
  • Experiments used an offline, locally hosted CogVideoX-5B behind a self-deployed safety gate, with no third-party or commercial service attacked and no live system or users affected.The unsafe intents came from T2VSafetyBench, and generated videos were viewed only by the authors for scoring and retained in restricted local storage.Source: Declarations · p. 15

Related papers

Loading 2609.31032v1…