CollageAttack exploits cross-modal alignment flaws to jailbreak T2I models

1. 23:22
   论文追踪

   Study evaluates harmful content generation and review gaps in five open-source text-to-image models

   A research team used an automated pipeline to rewrite legitimate news headlines into prompts targeting pornography, graphic violence, harmful stereotypes, self-harm, and hate speech, systematically evaluating the harmful content generation capabilities of five open-source text-to-image models. Human evaluation of 1,500 generated images showed that gore-related prompts had a harmful content generation rate of 89.2%, pornographic content 47.6%, harmful stereotypes 43.6%, hate speech 46.0%, and self-harm 34.5%, with most appearing in graphic or violent forms. Community fine-tuned variants were especially vulnerable to pornographic prompts, with FLUX.1-dev generating clearly realistic harmful images in 30.9% of cases. Evaluation of automated moderation systems found significant detection gaps, with unsafe images able to bypass filters; among synthetic image detectors, models trained only on benign data performed worse on explicit content, while models trained on more diverse data detected better.

1. 16:23
   arXiv：越狱、提示注入、投毒与防御Selected

   CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.

   Researchers from Zhejiang University and Hong Kong Polytechnic University propose CollageAttack, a single-prompt black-box jailbreak method that breaks harmful intent into incomplete text fragments, disperses them onto naturally occurring carriers in the scene, and lets semantics re-emerge through spatial composition on the image plane. On five T2I models—GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro, HiDream-O1-Image, and FLUX.2 [dev]—the method achieves the highest attack success rate on all targets, with an aggregate ASR of 77.0% and a maximum of 86.0%, 18.5 percentage points higher than the strongest baseline on the same models. The cross-model average harmfulness score is 6.12/10, higher than the strongest baseline's 4.23/10; on HiDream-I1 it is 5.38 versus 1.69. Ablation shows that using any single component alone yields harmfulness scores of 0.25, 5.47, and 0.53, respectively, while combining all three reaches 6.41.

Current attention53·Peak in the comparable period54（Oct 7 12:00）·Change over the comparable past 24 hours 0%