Reading Text Between Pixels: Inscription-Style Jailbreak Attacks on Text-to-Image Models

The researchers propose an inscription-style jailbreak attack on text-to-image models and a companion black-box attack framework, Etch, achieving an average attack success rate of 65.57% and a maximum of 91.00% across 2 benchmarks and 7 models. The attack exploits the models' newly acquired paragraph-level text rendering capability to induce them to generate images containing harmful textual content (such as fraudulent documents) in visually normal scenes, differing from traditional depictive jailbreaks that pursue violating imagery. Etch decomposes the adversarial prompt into three functionally orthogonal layers: semantic disguise, visual-spatial anchoring, and font encoding; a vision-language model critiques each generated image, locates the layer where the failure occurs, and provides revisions, iteratively optimizing through a zeroth-order loop. The authors state that the results reveal a blind spot in current text-to-image safety alignment and highlight the need for multimodal defense mechanisms with typographic awareness.