Two frames suffice: a temporal attack for jailbreaking text-to-video models

When a text-to-video prompt only specifies sparse start and end frames, the model may fill in harmful intermediate frames on its own, while the prompt surface still looks harmless.

• Context of emergence: The authors state that recent T2V models can generate complex videos from very short natural language, and real-world misuse makes safety alignment urgent. Existing jailbreaks usually rewrite unsafe prompts into paraphrases that bypass content filtering while preserving the original meaning.
• Limitations of existing work: The authors state that these rewrites often still leave explicit sensitive cues in the input, and thus do not exploit the implicit world knowledge and experiential representations learned by the model. The authors believe such implicit behavior is difficult to evaluate or constrain.
• Core observation: When the prompt only gives sparse boundaries (e.g., start and end frames) and leaves the intermediate evolution unspecified, the model may autonomously reconstruct a trajectory containing harmful intermediate frames, while the prompt can still appear harmless to input-side or output-side filtering. The authors call this temporal trajectory infilling.
• Approach in this paper: They propose a fragmented prompt framework, TFM (Two Frames Matter). It condenses an originally unsafe request into a temporally sparse two-frame extraction, then uses implicit substitution to reduce overly conspicuous sensitive cues.
• Threat model:
  • Knowledge: The paper states strictly black-box. The attacker only submits prompts through the public API of the target system G and receives generated results, knowing only the general input–output interface.
  • Invisibility: No access to parameters, architecture beyond public disclosure, training data, safety policies, filter implementations, or gradients, and no ability to modify the model or its safety modules.
  • Inputs that can be changed: Only prompts can be changed via the API; a limited number of queries can be sent to observe generated videos and available API feedback. The paper does not give a query limit.
  • Goal: Construct an adversarial prompt X′ such that both input filtering and output filtering are bypassed (the paper uses 0 to denote bypass and 1 to denote the opposite), and induce G to generate unsafe videos. Table 1 includes systems both with and without built-in filtering.

Text-to-Video Jailbreak

• SceneSplit (Lee et al., 2025b): Splits an unsafe request into multiple individually harmless scene prompts, leveraging temporal composition to steer the video toward the original intent, with iterative scene-level refinement and reuse of previously successful split patterns.
• T2V-OptJail (Liu et al., 2025): Formulates jailbreak as discrete prompt optimization, using LLM-guided iterative search to simultaneously pursue filter bypass and semantic consistency.
• VEIL (Ying et al., 2025): Uses semantic anchors, auditory triggers, and style modulation to compose superficially harmless modular prompts, leveraging cross-modal associations to guide generation, and searches in a constrained prompt space.

Safety Evaluation and Guardrails

• T2VSafetyBench (Miao et al., 2024): The paper claims this is the first benchmark specifically evaluating text-to-video safety. It provides categories, collects real examples, LLM-generated prompts, and jailbreak inputs, and after frame sampling uses GPT-4o with human review for annotation.
• SAFEWATCH (Chen et al., 2024): A video guardrail based on multimodal large models, supporting customizable policies, outputting multi-label judgments and explanations grounded in content, and releasing large-scale video data across multiple safety categories.
• Text-to-image reference: When introducing the benchmark, the paper mentions Unsafe Diffusion (Ou et al., 2023) and MMA-Diffusion (Yang et al., 2023) as connections to text-to-image safety evaluation, not as experimental baselines for TFM.

Prompt Rewriting in the Introduction

• JailbreakDiffBench (Jin et al., 2025): The introduction associates it with rewriting unsafe prompts into semantically equivalent, filter-bypassing variants, and states that some methods can perform this transformation efficiently. The introduction places Jin et al., 2025 alongside methods that still embed explicit unsafe content in the input. The paper does not list it as an experimental baseline.

Baselines and Data

• Baseline methods: TSB (Miao et al., 2024, described as a direct attack baseline), DACA, RAB (Tsai et al., 2023), VEIL. DACA is described in §5.1 as multi-agent attribute substitution and recombination (citing Deng and Chen, 2023), and §5.2 additionally cites Wang et al., 2024. RAB injects target sensitive concepts into benign prompts in continuous space. The paper states that dedicated T2V jailbreak methods are limited, so it adapts representative text-to-image prompt attacks to T2V following recent safety benchmark protocols.
• Benchmark: The main experiments use the cleaned subset of T2VSafetyBench, with 14 categories, 50 random prompts per category, totaling 700 unsafe prompts.

The authors position TFM outside prompt rewriting that still retains explicit unsafe content in the input and does not exploit temporal trajectory completion: it keeps only start and end boundaries and performs implicit substitution to probe model completion under sparse temporal constraints. The paper does not detail experimental differences with SceneSplit or T2V-OptJail.

TFM changes an originally unsafe, time-structured prompt into a specification containing only the first and last frames, then reduces the surface explicitness of boundary descriptions to trigger the model's completion of intermediate trajectories. Both steps are guided by GPT-4o; the attack does not access model internals.

System and Goal

• Pipeline: Given prompt X and system G, the authors write generation as Y = f_post(g(f_pre(X))), i.e., input filtering, then generation, then output filtering.
• Filtering is not universal: The authors state that not all T2V models have built-in input and output filtering. Table 1 lists both systems with and without them; the analysis assumes the system has these filters.
• Success condition: The adversarial prompt X′ must make both filter outputs 0. The paper specifies that 0 indicates bypass, 1 the opposite. The attack success probability is written as P(A(X′))=P(f_pre(X′)=0)· P(f_post(Y′)=0), meaning both filters must be bypassed simultaneously.
• Interface: Only prompts on the public API can be modified. Parameters, filter implementations, and gradients are unavailable.

Temporal Boundary Prompting (TBP)

• Frame structure: A video is written as a sequence of T frames, and the prompt has corresponding frame descriptions. The boundary operator B(·) operates on an LLM-guided, temporally organized prompt.
• What is kept: Only the start and end descriptions are kept; intermediate frame descriptions are set to ∅, indicating that the process does not write descriptions for those frames. The output is XB=(x1, xT).
• Authors' rationale: The authors argue that T2V learns cross-modal associations over time, such as words and images, and that boundary cues harmless to filtering may still activate latent visual knowledge and lead to policy-violating outputs in subsequent generation.

Covert Substitution Module (CSM)

• Sensitive words: Boundary prompts may still contain words likely to trigger filters. The sensitive set S is defined by an LLM. m(w) marks whether a word belongs to S; explicitness r(w) is a non-negative number, larger meaning more explicit. The authors argue that sensitive words often have higher r(w), making them more likely to trigger filters. The paper does not provide the vocabulary of S.
• Substitution rule: The operator L(·) selects, for sensitive words, a replacement from a candidate set with the smallest r and lower than the original; non-sensitive words are unchanged. Algorithm 1 removes degenerate candidates (the paper gives the example of an empty string); if no valid replacement exists, the original word is kept.
• Output: The result is XC containing only the replaced first and last frames. The paper's main text does not provide the full rewritten prompt.

Merge Order and Division of Labor

• Order: TBP first, then CSM. The authors denote the reverse order as REVS_SEQ, which is not the main pipeline.
• How TBP enters generation: The authors denote the latent intermediate trajectory between the two boundaries as Z and write generation as marginalization over Z. After TBP, the condition is only the first and last frames. Zu denotes the set of latent trajectories that would lead to unsafe intermediate frames. The authors argue that, compared to prompts that explicitly constrain intermediate states, TBP relies more on learned temporal priors; if the boundaries implicitly imply a harmful evolution direction, the inferred trajectory is more likely to fall into Zu.
• How CSM enters filtering: The explicit risk R(X) is the sum of m(w)r(w) over words. The authors assume that the probability of triggering input filtering increases monotonically with R. Since replacement words have lower r, R(XC) is not higher than R(XB), so XC bypasses text moderation with probability not lower than XB. The authors thus claim that CSM enables the generation process exploited by TBP to occur.
• How success is recorded: In experiments, a trial is counted as successful if the filter accepts the adversarial prompt and the generated video is judged to contain unsafe content. Frame sampling and duration are described in the experimental setup.

Experimental Setup

• Data: T2VSafetyBench. The authors state that the original release mixes unmodified prompts and prompts already modified by attack methods, making direct comparison unsuitable. For each category, they first kept prompts that were unique and in natural language, then randomly sampled 50, totaling 700 across 14 categories.
• Categories: The Aspect column in Table 2 is Pornography, Borderline Pornography, Violence, Gore, Disturbing Content, Public Figures, Discrimination, Political Sensitivity, Copyright, Illegal Activities, Misinformation, Sequential Action, Dynamic Variation, Coherent Contextual.
• Target Models: For effectiveness evaluation, four commercial models are named: Pixverse V5, Hailuo 02, Kling 2.1 Master, Doubao Seedance-1.0 Pro. The table headers abbreviate them as Pixverse, Hailuo, Kling, Seedance. The abstract states that evaluation was conducted on open-source and commercial models; Table 2 and §5.2 report ASR only for these four commercial systems. §5.1 states that seven common T2V models were evaluated, but that section only lists the four commercial models above.
• Filters (Table 1): Pixverse and Seedance have both input and output filters; Hailuo and Kling have only output filters; open-source Wan, CogVideoX, and HunyuanVideo have neither input nor output filters. This table does not include ASR.
• Baselines and Judgment: TSB, RAB, DACA, VEIL. The main metric is ASR: the filter accepts the adversarial prompt, and GPT-4o judges that the video contains unsafe content (f=1). Videos are uniformly 5 seconds, with one frame sampled every 0.5 seconds; if any frame is unsafe, the entire video is considered unsafe. The rewriting LLM in §4 is also GPT-4o. The ASR formula in §5.1 could not be verified in typesetting; the success condition follows the above text. The paper does not report the number of repetitions.
• Ablation Sampling: §5.3 states that both ablation and defense studies sampled 25 items from each of the 14 aspects and were conducted on commercial models. The main text does not provide defense experiment numbers.

Main Results

According to Table 2, average ASR across 14 categories. The OURS column is TFM.

Swipe horizontally to read the table

Model	TSB	RAB	DACA	VEIL	TFM
Pixverse	28.0%	15.0%	29.0%	45.0%	52.0%
Hailuo	33.0%	28.0%	31.0%	48.0%	60.0%
Kling	35.0%	24.0%	33.0%	46.0%	49.0%
Seedance	34.0%	15.0%	27.0%	44.0%	45.0%

• Authors' Statement on Average Results: The authors state that TFM achieves the highest average ASR across all four systems. Relative to VEIL, Hailuo is 12.0% higher, Pixverse +7.0%, Kling +3.0%, and Seedance +1.0%. The abstract mentions up to 12% ASR improvement, while the introduction and conclusion mention up to +12% or +12.0% absolute gain. The authors explain the narrower advantages on Kling and Seedance as being due to stricter end-to-end review leaving less room for pure prompt evasion, and state that the results support that "start and end states plus implicit words can reduce detectability, with unsafe semantics emerging in temporal completion."
• Category-Level: The authors state that TFM is highest in all 14 categories on Pixverse, with Copyright tied at 28.0% (DACA also 28.0% in Table 2); on Hailuo, TFM is highest in all 14 categories; on Kling and Seedance, TFM is best in 10 categories each. Examples given by the authors: For Pornography, TFM achieves 90.0% on Pixverse, 96.0% on Hailuo, and 94.0% on Kling, which are 10.0, 2.0, and 6.0 points higher than VEIL; for Gore, relative to VEIL, Pixverse is 8.0% higher and Hailuo 10.0% higher. On Hailuo, Public Figures is 40.0% (compared to 28.0%) and Political Sensitivity is 70.0% (compared to 58.0%).
• Not Every Cell Is Highest: On Kling, for Copyright, TFM is 4.0%, lower than DACA's 16.0% and VEIL's 10.0%; for Illegal Activities, TFM is 58.0%, lower than TSB's 74.0% and VEIL's 60.0%; for Misinformation, TFM is 30.0%, lower than VEIL's 34.0%; for Dynamic Variation, TFM is 20.0%, lower than DACA's 22.0%. On Seedance, for Pornography, TFM is 84.0%, lower than VEIL's 88.0%; for Disturbing Content, TFM is 42.0%, lower than VEIL's 44.0%; for Copyright, TFM is 4.0%, lower than DACA's 14.0%, with TSB at 0.0% in that row. The authors do not provide individual explanations for these below-baseline cells.

Step-by-Step Ablation

• What Was Tested: Removing TBP or removing CSM. The Pixverse and Hailuo rows are labeled W/O TBP and W/O CSM; the Kling and Seedance rows are labeled NO_TBP and NO_CSM. Table 3 shows average ASR across 14 categories. §5.3 states that the ablation uses 25 items per category, while the main experiment uses 50 per category; the TFM column in Table 3 matches the average in Table 2, and the paper does not explain why they are identical.
• Table 3: Removing TBP yields Pixverse 21.0%, Hailuo 21.0%, Kling 8.0%, Seedance 8.0%; removing CSM yields 27.0%, 24.0%, 14.0%, 16.0%; TFM yields 52.0%, 60.0%, 49.0%, 45.0%. The authors also state that removing CSM yields 21.0% and removing TBP yields 15.0%; these two numbers do not correspond to any row in Table 3.
• Authors' Statement on Figure 3: The authors state that TBP provides a temporal scaffold and CSM performs word camouflage. They state that removing TBP reduces the average ASR for Sequential Action from 63.0% to 21.0%; removing CSM reduces Pornography from 91.0% to 33.0%. The text transcription did not preserve the curves in the figure; these numbers come from the authors' description of Figure 3.

Order and Intermediate Frames

• Order: REVS_SEQ applies CSM before TBP. Table 4 average ASR: Pixverse 45.0% vs. TFM 52.0%, Hailuo 49.0% vs. 60.0%, Kling 37.0% vs. 49.0%, Seedance 31.0% vs. 45.0%. The authors state that the canonical order is higher on all four systems, and the two steps are not interchangeable: first establishing the boundary scaffold allows CSM to perform implicitization without disrupting temporal coherence; replacing first and then extracting boundaries may lose or distort implicit cues.
• Intermediate Frames: WITH_MIDDLE or WITH_MIDDLEFRAME adds an additional frame beyond the boundaries. Table 3 shows Pixverse 35.0%, Hailuo 37.0%, Kling 26.0%, Seedance 28.0%. The authors state that the aggregate across four systems is 31.5% (Tab. 3), still about 20% lower than the full pipeline.
• Category Imbalance: The authors state that in Figure 3, adding intermediate frames raises Pornography to 57.0%, while Public Figures remains at 22.0% and Dynamic Variation at 24.0%. The authors argue that a single internal waypoint does not elicit rich temporal completion over the missing segment and does not replace CSM; it strengthens semantic anchoring in some categories but reduces the temporal sparsity that boundary prompts rely on.

Other Ablations and Analyses

• The paper does not report parameter sweeps for iteration count, explicitness thresholds, or query counts.
• The probability decomposition in §4.4 has no separate experimental numbers.
• Copyright shows low ASR in multiple cells, as seen in the main results with Kling 4.0% and Seedance 0.0% and 4.0%; the authors do not explain why.
• The main experiment uses 50 items per category, the ablation uses 25 per category; the paper does not report the number of repetitions.
• §5.3 mentions that defense studies share sampling with ablations, but the main text provides no ASR or utility numbers for defense methods.

Limitations and future directions noted by the authors

• System scope and timeliness (§7): The authors state that TFM was evaluated only on a limited set of commercial T2V systems under a black-box setting. These systems may update models and safety pipelines without notice, so absolute ASR will change over time; fully characterizing generalization requires covering more providers and versions.
• Measurement protocol (§7): The authors state that ASR relies on sparse frame sampling and automated safety evaluation, where a segment is flagged as unsafe if any sampled frame is flagged as unsafe. This protocol may miss brief unsafe content between sampled frames and may over-penalize borderline cases; finer-grained temporal auditing and stronger human verification would improve measurement fidelity.
• Directions in the conclusion (§6): The authors state that time-aware safety mechanisms are needed to account for model-driven completion, rather than only looking at the prompt's surface form and sparse frame checks.

Experimental coverage

• Target models in the ASR table: Pixverse V5, Hailuo 02, Kling 2.1 Master, Doubao Seedance-1.0 Pro, 4 commercial systems in total, tested via black-box APIs (Table 2, §5.1).
• Data scale: The main experiment uses the cleaned subset of T2VSafetyBench, 50 items per category across 14 categories, 700 items in total; the ablation uses 25 items per category across 14 categories (§5.1, §5.3).
• Baselines and variants: The main results compare against TSB, RAB, DACA, VEIL. The ablation includes removing TBP, removing CSM, REVS_SEQ, and adding intermediate frames (Table 3, Table 4).
• Judgment: Videos are 5 seconds long, one frame is sampled every 0.5 seconds, and GPT-4o makes a binary judgment. The paper does not report the number of repetitions, the query limit, or the agreement between this automated judgment and humans.
• Filter table: Table 1 records the presence or absence of input/output filtering for 7 systems, including the open-source Wan, CogVideoX, and HunyuanVideo; these open-source systems do not appear in the ASR results in Table 2. §5.3 states that the defense study and the ablation use the same sampling, and the main text does not give defense experiment numbers.

TFM is a strict black-box prompt jailbreak for text-to-video, exploiting the model's temporal completion of unspecified intermediate processes.

• Problem: Rewriting-based jailbreaks often leave sensitive cues in the input. The authors argue that when only start and end frames are given without specifying intermediate evolution, the model may complete harmful intermediate frames, yet the prompt may still pass input or output filters.
• Method: GPT-4o first performs TBP, keeping only the first and last frames; then performs CSM, replacing sensitive words with less explicit but semantically aligned expressions. The attacker only modifies prompts on the public API. Videos are fixed at 5 seconds, with one frame sampled every 0.5 seconds; success is recorded if the filter accepts the prompt and GPT-4o flags any frame as unsafe.
• Main results: Data is the cleaned subset of T2VSafetyBench, 14 categories totaling 700 prompts. In Table 2, TFM's average ASR is Hailuo 60.0%, Pixverse 52.0%, Kling 49.0%, Seedance 45.0%. The authors state that relative to VEIL, the highest is 12.0% on Hailuo, and +1.0% on Seedance; the abstract also mentions improvements of up to 12%. In the same table, TFM is not the highest in every category; for example, Kling's Illegal Activities is 58.0%, lower than TSB's 74.0%; Seedance's Pornography is 84.0%, lower than VEIL's 88.0%.
• Ablations: In Table 3 and Table 4, removing either step or replacing before boundary extraction results in lower average ASR across the four commercial models compared to full TFM. The authors state that the two steps are complementary, and boundary prompting is key to inducing unsafe temporal reconstruction.
• Authors' conclusion: The authors argue that safety mechanisms need to handle model-driven temporal completion, not just check prompt surface and sparse frames. They also state that commercial pipelines may update, and current frame sampling with automatic judgment may miss detections or over-penalize.