Search papers, labs, and topics across Lattice.
The paper introduces Visual Instruction Injection (VII), a training-free jailbreaking framework that exploits the visual instruction-following capabilities of image-to-video (I2V) generation models to inject malicious intent. VII uses a Malicious Intent Reprogramming module to distill harmful intent from unsafe text prompts while minimizing static harmfulness, and a Visual Instruction Grounding module to render these intents as visual instructions within a safe input image. Experiments on four commercial I2V models demonstrate that VII achieves high attack success rates (up to 83.5%) and near-zero refusal rates, significantly surpassing existing baselines.
Image-to-video models can be jailbroken by hiding malicious instructions in seemingly harmless reference images, achieving an 83.5% attack success rate on commercial systems.
Image-to-Video (I2V) generation models, which condition video generation on reference images, have shown emerging visual instruction-following capability, allowing certain visual cues in reference images to act as implicit control signals for video generation. However, this capability also introduces a previously overlooked risk: adversaries may exploit visual instructions to inject malicious intent through the image modality. In this work, we uncover this risk by proposing Visual Instruction Injection (VII), a training-free and transferable jailbreaking framework that intentionally disguises the malicious intent of unsafe text prompts as benign visual instructions in the safe reference image. Specifically, VII coordinates a Malicious Intent Reprogramming module to distill malicious intent from unsafe text prompts while minimizing their static harmfulness, and a Visual Instruction Grounding module to ground the distilled intent onto a safe input image by rendering visual instructions that preserve semantic consistency with the original unsafe text prompt, thereby inducing harmful content during I2V generation. Empirically, our extensive experiments on four state-of-the-art commercial I2V models (Kling-v2.5-turbo, Gemini Veo-3.1, Seedance-1.5-pro, and PixVerse-V5) demonstrate that VII achieves Attack Success Rates of up to 83.5% while reducing Refusal Rates to near zero, significantly outperforming existing baselines.
