利用视频时序一致性设计高效劫持攻击,突破现有方法局限。
Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models

- 将有害意图编码为无害边界状态间的过渡,利用视频时序一致性触发危险帧
- 在主流模型上实现平均18.6%的攻击成功率提升,超越最强基线
- 适用于查询受限的黑盒场景,适合安全评估与模型鲁棒性研究者
近期文本生成视频(T2V)模型广泛应用,引发对其对抗劫持攻击鲁棒性的关注。现有劫持方法多源自文本到图像攻击,未能充分利用视频生成的时序一致性特性,且需大量视频查询优化,在实际黑盒场景中不可行。其对抗提示搜索依赖启发式局部信号,缺乏系统化探索策略。为此,我们提出BSB框架,通过将有害意图编码为两个独立无害边界状态之间的转换,利用时序一致性,定位在插值过程中易生成不安全中间帧的边界对。直接评估所有候选对计算成本过高,因此BSB在廉价文本代理空间中进行蒙特卡洛树搜索(MCTS),并定期通过稀疏视频级评估校准结果。在Veo 3.1、Sora 2、Seedance和Kling v1等主流商业T2V模型上的实验表明,BSB显著优于所有现有基线,跨模型平均攻击成功率相对提升18.6%。研究揭示了时序一致性是未被充分重视但关键的攻击面,验证了结构化搜索在有限查询预算下有效发现漏洞的能力。
原文摘要 · Abstract (English)
Recently, text-to-video (T2V) models have been widely deployed, sparking growing concerns over their robustness against jailbreak attacks. Existing jailbreak methods, mostly adapted from text-to-image attacks, suffer notable drawbacks when applied to T2V systems. They fail to fully leverage temporal consistency, an inherent characteristic of video generation. Besides, these methods demand heavy video query optimization, which is infeasible in practical black-box scenarios. Their adversarial prompt search is also driven by heuristic local signals, lacking principled structured exploration strategies. To tackle these limitations, we propose BSB, a structured, query-efficient jailbreak framework for T2V models. BSB harnesses temporal consistency by encoding harmful intent as the transition between two individually harmless boundary states. Under this paradigm, the attack targets boundary-state pairs whose interpolation tends to produce unsafe intermediate frames during video generation. Directly evaluating all candidate pairs within the video space incurs prohibitive computation cost. Instead, BSB conducts Monte Carlo Tree Search (MCTS) in a cheaper textual proxy space and regularly calibrates search outcomes with sparse video-level evaluations. We conduct comprehensive experiments on mainstream commercial T2V models including Veo 3.1, Sora 2, Seedance and Kling v1. Results show BSB surpasses all existing jailbreak baselines, delivering an average 18.6% relative gain in attack success rate over the strongest competitor across evaluated models. Our findings identify temporal consistency as an understudied yet vital attack surface for T2V models and verify that structured search facilitates effective vulnerability discovery under constrained query budgets.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。