arXiv:2608.10933cs.CV2026-08

提出安全注意力定位与调控机制,有效防御文本生成视频的越狱攻击。

SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense

论文配图:SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense
图 1 · 摘自论文原文
  • 通过分析交叉注意力特征空间差异,定位防御关键区域。
  • 在主流T2V模型上降低约20%越狱成功率,推理延迟仅增0.1秒。
  • 适合需高安全性与低延迟部署的商业视频生成系统。

文本生成视频(T2V)模型在实际部署中易受越狱攻击,生成有害内容。现有防御方法依赖输入过滤或重构,不仅计算开销大,还常扭曲语义。本文首次系统分析干净样本与越狱样本在交叉注意力特征空间中的差异,发现扩散过程中存在累积分离效应和线性可分性逐步增强的趋势。基于此,提出SafeCA:一种特征级防御机制,通过单次推理内清洁提示的注意力稳定性分析,识别关键防御区域与数值;利用能量归一化注意力掩码抑制异常激活,并引入轻量语义适配器引导异常语义流;同时通过反向传播特征异常信号检测并压制潜在恶意词元,提升商用模型的可部署性。实验表明,SafeCA在主流T2V模型上将越狱成功率降低约20%,推理开销仅增加0.1秒,且保持良好文本-视频语义一致性。整体提供了一种可部署的T2V生成模型架构级防护范式。

原文摘要 · Abstract (English)

Text-to-Video (T2V) generative models are vulnerable to jailbreak attacks in real-world deployment, leading them to produce harmful or inappropriate content. Existing defense approaches mainly rely on input filtering or reconstruction, which not only incur high computational latency but also tend to distort semantics. To address these issues, we experimentally and systematically analyze the differences between clean and jailbreak samples in the cross-attention feature space, revealing for the first time a cumulative separation effect and a progressively increasing trend of linear separability between the two during the diffusion process. Based on this insight, we propose SafeCA, a feature-level defense mechanism for safe cross-attention localization and regularization. Firstly, we identify key defensive regions and values through attention stability analysis using cross-attention features collected from clean prompts within a single inference. Secondly, SafeCA mitigates anomalous activations via attention masking with energy normalization and introduces a lightweight semantic-space adapter to redirect abnormal semantic flows. Furthermore, we detect and suppress potentially malicious tokens by back-propagating feature anomaly signals to the input cue words, thereby enhancing the deployability of the defense in commercial models. Experimental results show that SafeCA reduces the jailbreak success rate by about 20% on mainstream T2V models, adds almost no inference overhead (+0.1s), and maintains good text-video semantic consistency. Overall, SafeCA provides an architecture-level, deployable protection paradigm for T2V generation models.

视频生成安全防御注意力机制

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。