Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

Jailbreaks and attacks · Papers

Found 14 papers
Filter2

Attack type

Jailbreaks14

Attack technique

Automated search5Encoding and obfuscation7Cross-modal payloads4

Impact

Harmful content13

System type

Models and APIs13

Attacker access

Black-box10

Attack surface / entry point

User input14Images, audio and video4

Layer

Prompt layer13

System component

Memory1Guardrails and judges26Reasoning chains8Vision29Audio7Image generation13Multimodal48
Select any value within a category; different categories must all match. Counts include the other filters you have selected.
System component：MemorySystem component：Image generationTopic: Jailbreaks and attacksClear all
  1. AttacksarXiv 2609.38253

    CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.

    提出 CollageAttack，用空间文本碎片重组越狱文生图模型

    arXiv
    2609.38253
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5

    Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.07216

    DIVA：利用视觉锚点对视频生成模型实施多模态越狱

    提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型

    arXiv
    2609.07216
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Wan, CogVideoX, LTX-Video and others9
    AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。

    DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.01168

    CRACK：用多智能体辩论越狱多层安全过滤的 T2I 模型

    提出 CRACK，用多智能体辩论在黑盒下越狱文生图多层安全过滤

    arXiv
    2609.01168
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Stable Diffusion v1.4, SDXL, DALL·E 3 and others4
    AbstractCRACK 以分层诊断的多智能体辩论搜索多层 T2I 过滤器的联合规避区域。

    CRACK 是面向文本生成图像模型多层安全栈的黑盒越狱框架，用几何上的 Detection Surface 解释为何粗粒度反馈不够。

    Paper analysisRead analysis
  7. AttacksarXiv 2606.09084

    研究者提出 Context-Fractured Decomposition 攻击

    提出 CFD 跨会话分解攻击，利用工件来源缺口绕过工具型 Agent 的本地检查

    arXiv
    2606.09084
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4.1, GPT-5-nano, Claude-3.5-Sonnet and others6
    AbstractCFD 用无指令 artifact 把越狱拆到跨会话。

    CFD针对工具型 LLM 智能体：利用 artifact 来源不被跟踪这一部署失败模式，把有害目标拆开后延迟组合。

    Paper analysisRead analysis
  8. AttacksarXiv 2606.01837

    论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出

    提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像

    arXiv
    2606.01837
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
    AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。

    DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。

    Paper analysisRead analysis
  9. AttacksarXiv 2603.07028

    Two frames suffice: a temporal attack for jailbreaking text-to-video models

    Propose TFM, using start and end frames and implicit substitution to jailbreak text-to-video models

    arXiv
    2603.07028
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Pixverse V5, Hailuo 02, Kling 2.1 Master and others4
    AbstractTFM first extracts start and end frames and then performs implicit substitution.

    TFM is a strictly black-box prompt jailbreak for text-to-video that exploits the model's temporal infilling of unspecified intermediate processes.

    Paper analysisRead analysis
  11. AttacksarXiv 2601.15698

    Beyond Visual Safety: Jailbreaking Multimodal Large Language Models to Generate Harmful Images with Semantically Irrelevant Inputs

    提出 BVS 图文越狱，用中和拼接图和诱导提示词让模型生成有害图像

    arXiv
    2601.15698
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5 (12 January 2026 release), Gemini 1.5 Flash (15 January 2026 release)
    AbstractBVS 以重建后再生成诱导有害图像。

    BVS 用图文对诱导 MLLM 生成有害图像。作者认为，相对文本越狱和单模态图像诱导，视觉生成的安全审查仍不充分。

    Paper analysisRead analysis
  14. AttacksarXiv 2503.01839

    研究者用微调大语言模型越狱带安全护栏的文生图模型

    提出 PromptTune，微调 LLM 改写提示以越狱文生图护栏

    arXiv
    2503.01839
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    No-box (offline transfer)
    Evaluated models
    SDXL-Turbo, MACE, SafeGen
    AbstractLLM 改写可提高过滤器绕过率。

    PromptTune 用微调 LLM 改写提示词，攻击带安全过滤器或对齐的文生图模型。

    Paper analysisRead analysis
You have reached the end