VII: Visual instruction injection for jailbreaking image-to-video generation models

The researchers propose the VII visual instruction injection framework, which carries the malicious intent of unsafe text prompts into the image-to-video generation process via visual instructions in a reference image, thereby jailbreaking I2V models. The method is training-free and transferable, and contains two modules: malicious intent reprogramming and visual instruction grounding. On four commercial I2V models—Kling-v2.5-turbo, Gemini Veo-3.1, Seedance-1.5-pro and PixVerse-V5—VII's attack success rate reaches up to 83.5%, with the refusal rate dropping to near zero, and the authors state it significantly outperforms existing baselines.