Search papers, labs, and topics across Lattice.
This paper introduces TempJail, a novel framework designed to exploit temporal vulnerabilities in image-to-video (I2V) generation models through sophisticated jailbreak attacks. By addressing challenges like temporal abstraction and semantic camouflage, TempJail enables malicious semantics to be triggered progressively over time, rather than relying on single-frame violations. Experimental results demonstrate a significant improvement in attack success rates, achieving a 23.3% increase in effectiveness compared to existing methods when evaluated with GPT-5.2 and a 22.0% increase in human assessments.
Malicious semantics can be stealthily injected into videos over time, revealing a critical vulnerability in I2V generation models that traditional single-frame attacks overlook.
In recent years, image-to-video (I2V) generation models have made remarkable progress in subject consistency and temporal coherence, enabling high quality video synthesis. However, these advances also introduce new safety risks. Existing studies mainly focus on jailbreak attacks involving single frame violations, while largely overlooking the temporal dimension unique to video generation models. In this paper, we investigate three attack scenarios and uncover a temporal vulnerability in I2V systems: unsafe semantics may emerge not from a single frame, but from semantic composition over time. We further identify two key challenges in such attacks: temporal abstraction and semantic camouflage. To address these issues, we propose TempJail, a novel temporal jailbreak framework for I2V systems. For temporal abstraction, we decompose a target malicious caption into an initial frame visual condition and a temporal text instruction. For semantic camouflage, on the image side we model semantic injection as controlled latent perturbation in diffusion sampling and introduce gradient guidance from pretrained encoders. On the text side, we rewrite the caption into an innocuous ``subject-action-scene''template that bypasses safety filters while preserving temporal guidance. In the black-box inference phase, these two modalities jointly enable malicious semantics to be gradually triggered over time. Experiments on closed-source commercial models, including Kling, Seedance, Veo and PixVerse, show that TempJail improves attack success rate over prior state-of-the-art methods by 23.3\% under GPT-5.2 evaluation and 22.0\% under human evaluation. Our codes are available at \href{https://github.com/luqi-glory/TempJail}{GitHub}.
