Paper deep dive

TempJail: Temporal Jailbreak Attack against Large Vision-Language Models via Subtitle Scheduling

Ling Zhou, Yihao Huang, Jingling Sun, Zhiwen Tian, Yi Zeng, Qihe Liu, Shijie Zhou

Year: 2026Venue: arXiv preprintArea: cs.CVType: PreprintEmbeddings: 46

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%

Last extracted: 8/21/2026, 3:30:42 AM

Summary

The paper introduces TempJail, a black-box video-based jailbreak attack framework targeting Large Vision-Language Models (LVLMs). Unlike previous methods that focus on visual content or static text, TempJail exploits temporal vulnerabilities by optimizing the scheduling (duration and timing) of dialogue-style subtitles embedded in videos. The method constructs query-aligned subtitle sequences, generates benign background videos, and uses Covariance Matrix Adaptation Evolution Strategy (CMA-ES) to optimize subtitle display times, achieving significantly higher Attack Success Rates (ASR) than existing baselines on models like GPT-5 and Gemini 3.5-Flash.

Entities (11)

TempJail · method · 100%Large Vision Language Models · model-class · 98%CMA-ES · algorithm · 95%Gemini-3.5-Flash · model · 95%GPT-5 · model · 95%HADES · dataset · 95%Qwen3-VL-32B-Instruct · model · 95%Qwen3-VL-Plus · model · 95%Subtitle Scheduling · technique · 95%VLJailbreakBench · dataset · 95%VideoJail · baseline-method · 90%

Relation Signals (10)

TempJail → targets → Large Vision Language Models

confidence 98% · TempJail: Temporal Jailbreak Attack against Large Vision-Language Models

TempJail → evaluatedon → Gemini-3.5-Flash

confidence 95% · Extensive experiments on... Gemini 3.5-Flash... demonstrate that TempJail achieves the highest attack success rate

TempJail → evaluatedon → GPT-5

confidence 95% · Extensive experiments on... GPT-5... demonstrate that TempJail achieves the highest attack success rate

TempJail → evaluatedon → Qwen3-VL-Plus

confidence 95% · We evaluate Qwen3-VL-Plus... as the target models

TempJail → evaluatedon → Qwen3-VL-32B-Instruct

confidence 95% · We evaluate... Qwen3-VL-32B-Instruct as the target models

TempJail → optimizeswith → CMA-ES

confidence 95% · TempJail applies Covariance Matrix Adaptation Evolution Strategy (CMA-ES) to optimize the display duration

TempJail → testedondataset → HADES

confidence 95% · Extensive experiments on two datasets... HADES

TempJail → testedondataset → VLJailbreakBench

confidence 95% · Extensive experiments on two datasets... VLJailbreakBench

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Large vision-language models (LVLMs) have achieved remarkable progress in video understanding and reasoning. Despite extensive studies on text- and image-based jailbreaks, video jailbreaks against LVLMs remain largely unexplored. Existing video jailbreak methods mainly manipulate textual content embedded in videos, while overlooking how such information is organized over time. Our analysis reveals that jailbreak effectiveness depends not only on the semantics of textual information but also on its temporal presentation, including duration and timing-slot allocation. Motivated by this finding, we use subtitles, which are common in real-world videos and allow semantic content to be presented under precise temporal control without appearing visually intrusive, as a natural attack medium. Based on this insight, we propose TempJail, a black-box video-based jailbreak framework that constructs query-aligned dialogue-style subtitle sequences and optimizes their temporal scheduling to exploit temporal vulnerabilities in LVLMs and elicit responses that satisfy the harmful intent of the source query. Extensive experiments on four representative LVLMs and two datasets demonstrate that TempJail achieves the highest attack success rate across all evaluated model--dataset settings, outperforming the strongest baseline by 53 and 18 percentage points in dataset-averaged ASR on GPT-5 and Gemini 3.5-Flash, respectively.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

42,203 characters extracted from source content.

Expand or collapse full text

TempJail: Temporal Jailbreak Attack against Large Vision-Language Models via Subtitle Scheduling Ling Zhou 1 , Yihao Huang 2 , Jingling Sun 1 , Zhiwen Tian 1 , Yi Zeng 1 , Qihe Liu 1 , Shijie Zhou 1 1. University of Electronic Science and Technology of China, Chengdu, China 2. East China Normal University, Shanghai, China Abstract—Largevision-languagemodels(LVLMs)have achieved remarkable progress in video understanding and rea- soning. Despite extensive studies on text- and image-based jailbreaks, video jailbreaks against LVLMs remain largely un- explored. Existing video jailbreak methods mainly manipulate textual content embedded in videos, while overlooking how such information is organized over time. Our analysis reveals that jailbreak effectiveness depends not only on the semantics of tex- tual information but also on its temporal presentation, including duration and timing-slot allocation. Motivated by this finding, we use subtitles, which are common in real-world videos and allow semantic content to be presented under precise temporal control without appearing visually intrusive, as a natural attack medium. Based on this insight, we propose TempJail, a black-box video-based jailbreak framework that constructs query-aligned dialogue-style subtitle sequences and optimizes their temporal scheduling to exploit temporal vulnerabilities in LVLMs and elicit responses that satisfy the harmful intent of the source query. Extensive experiments on four representative LVLMs and two datasets demonstrate that TempJail achieves the highest attack success rate across all evaluated model–dataset settings, outperforming the strongest baseline by 53 and 18 percentage points in dataset-averaged ASR on GPT-5 and Gemini 3.5-Flash, respectively. I. INTRODUCTION In recent years, large language models have rapidly evolved toward multimodal intelligence, giving rise to large vision- language models (LVLMs) that have demonstrated remarkable progress in image understanding, video understanding, cross- modal question answering, and multimodal reasoning [1], [2]. Compared with traditional text-only large language models, LVLMs substantially expand the perceptual boundary of AI systems by incorporating visual and temporal signals. How- ever, this expanded capability also introduces new security risks. In particular, when models directly consume semanti- cally rich visual inputs such as images and videos, their safety alignment mechanisms may exhibit vulnerabilities that differ from those observed in purely textual settings [3], [4], [5], [6], [7]. Existing jailbreak studies have primarily targeted the textual and visual modalities [8], [9], while the safety of LVLMs under video inputs remains less explored. Early work such as VideoJail extends image-based typographic attacks to videos by overlaying largely static text on video frames [10]. More recent methods explore content composition and variation: MCV combines semantically related but distinct clips to in- crease visual diversity [11], whereas SPTV constructs typo- graphic videos using semantic variants of harmful queries and Content-centric Video-based Jailbreaks Low ASR Ignoring temporal factors ... Focus on content composition Static text / Text-variant frames ... TempJail (Ours) High ASR Probing temporal vulnerability ... Query-aligned dialogue context & Subtitle-level temporal optimization Fig. 1: Comparison of existing video-based jailbreaks and TempJail: prior methods rely on video content composition while largely ignoring temporal factors, whereas TempJail leverages query-aligned dialogue context and subtitle-level temporal optimization to achieve more effective attacks. safety-proximal text frames [12]. Despite their methods being reasonable, these methods mainly investigate what content is presented, with limited attention to how it is organized over time. Temporal structure, however, is a defining characteristic of video. Motivated by the prevalence of subtitles in real- world videos, we use them to probe temporal vulnerabilities in LVLMs. The effect of subtitles depends not only on their semantic content, but also on their order, timing, and dura- tion. Our preliminary experiments show that these temporal factors can substantially affect LVLM responses, revealing an underexplored source of safety risk in video-based LVLMs. Based on this observation, we propose TempJail, a black- box temporal jailbreak attack against large vision-language models via subtitle scheduling. Given a harmful query, Tem- pJail first reformulates it into a sequence of semantically connected questions, which naturally lead to the original query. Through multi-turn interaction with a substitute model, Tem- pJail then obtains a coherent dialogue-like response sequence, which is combined with the original query to construct the final subtitles. Next, according to the dialogue content, TempJail employs a text-to-video model to generate a background video, making the overall video appear more natural. Finally, Temp- Jail applies Covariance Matrix Adaptation Evolution Strategy (CMA-ES) [13] to optimize the display duration of each arXiv:2608.19737v1 [cs.CV] 20 Aug 2026 subtitle segment, thereby controlling how harmful semantics are temporally exposed to the target model. As illustrated in Figure 1, unlike existing methods that mainly focus on increas- ing video content diversity or concatenating static typographic frames, TempJail shifts the focus from content construction alone to the temporal scheduling of subtitle semantics in videos. Extensive experiments across multiple datasets and models verify the effectiveness of TempJail in black-box settings, and systematically analyze the effects of different subtitle configurations on attack success rates. The main contributions of this paper are as follows: • We introduce a temporal perspective on video-based jailbreak attacks against LVLMs. To the best of our knowledge, we are the first to investigate how the tem- poral organization of textual content along the video timeline affects attack effectiveness. Our findings extend prior studies that have primarily focused on content construction, highlighting temporal organization as an important yet underexplored factor in multimodal safety. • We propose TempJail, a black-box subtitle-based video jailbreak framework. Specifically, the method consists of three stages: subtitle construction, video generation, and subtitle timing optimization. By jointly modeling subtitle content and its temporal organization, TempJail effectively exploits the temporal sensitivity of LVLMs. • Extensive experiments on two datasets, four LVLMs, and four baselines show that TempJail consistently achieves the best performance, outperforming the strongest base- line by 53 percentage points. Ablation analysis reveals that temporal scheduling alone improves GPT-5’s aver- aged ASR from 11% to 71%, highlighting the importance of temporal organization in LVLM jailbreaks. I. RELATED WORK A. Large Vision-Language Models Large vision-language models (LVLMs) have rapidly evolved from early image-centric systems such as BLIP- 2 [14], InstructBLIP [15], and LLaVA [16] into a broader family of general-purpose multimodal models. These early LVLMs primarily connected pretrained visual encoders with large language models to support tasks involving static images, including image captioning, visual question answering, and vision-language instruction following. More recent research has extended this paradigm to temporally structured visual inputs, enabling models to process and reason over sequences of video frames. Representative open-source video-capable LVLMs include Video-ChatGPT [17], Video-LLaMA [18], LLaVA-Video [19], and CogVLM2 [20]. These models ex- plore different mechanisms for aggregating multi-frame vi- sual information and incorporating temporal cues, thereby supporting tasks such as video question answering, video captioning, multimodal dialogue, and temporal event under- standing. Meanwhile, widely deployed multimodal model fam- ilies, including the GPT series [21], [22], [23], the Gemini family [24], [25], [26], and Qwen3-VL variants [27], have further broadened the practical scope of multimodal perception and reasoning. B. Jailbreaking Large Vision-Language Models Jailbreaking attacks against LVLMs have been extensively studied in the image modality. Existing methods conceal harmful intent through typographic prompts, multimodal link- age, automatically generated jailbreak prompts, and interactive black-box optimization [28], [29], [30], [31]. These studies have revealed diverse vulnerabilities of LVLMs under static visual inputs. By contrast, video jailbreak attacks remain comparatively underexplored. VideoJail [10] leverages video generation mod- els to amplify harmful content embedded in images and uses carefully designed textual prompts to direct the model’s attention toward malicious queries. MCV [11] constructs videos by concatenating multiple short clips depicting diverse contexts related to a harmful query, demonstrating the effects of clip number, video dynamics, and contextual diversity on jailbreak effectiveness. SPTV [12] constructs safety-proximal typographic videos by selecting visually diverse typographic frames that preserve the harmful intent while remaining close to benign videos in the representation space. Although these methods leverage different aspects of video, they mainly focus on generation, clip composition, or frame-level content, rather than the temporal progression of harmful semantics. In contrast, our work constructs dialogue-style subtitle sequences and optimizes segment durations to expose the temporal vul- nerabilities of LVLMs under video inputs. I. MOTIVATION To motivate the design of our method, we conduct a series of controlled experiments to identify the key factors that influence subtitle-based video jailbreak attacks. Our analysis focuses on two questions: (1) How do subtitle display form and content affect jailbreak effectiveness? (2) How do subtitle duration and timing-slot allocation affect jailbreak effectiveness when the subtitle content remains unchanged? We use HADES [32] and VLJailbreakBench [33], two multimodal safety datasets covering diverse harmful-request categories. We randomly sample 50 examples from each dataset while preserving their category distributions. We eval- uate Qwen3-VL-Plus [34] and Qwen3-VL-32B-Instruct [27] as the target models and report attack success rate (ASR) and refusal rate (R). Unless otherwise specified, each video has a resolution of 1280 × 720, a duration of 5 seconds, and a frame rate of 10 FPS. During target-model inference, videos are sampled at the same rate of 10 FPS, ensuring that every rendered frame is included in the input. The decoding temperature is fixed to 0. All videos in this section use a solid-white background to exclude interference from non-textual visual content. Each dialogue consists of five question–answer rounds, yielding ten subtitle segments, followed by the harmful query. The irrelevant dialogue, generated by GPT-5, discusses TABLE I: Effects of subtitle display form, content, and duration on HADES using Qwen3-VL-Plus. We report attack success rate (ASR) and refusal rate (R). “–” indicates that, at a 1-second duration, dialogue + query is equivalent to query only because the query occupies the entire subtitle duration. Key results are highlighted in bold. Display PatternSubtitle Content ASR (%)R (%) 1s2s3s4s5sAvg.1s2s3s4s5sAvg. Subtitle–Blank Query only384244404241.2635858586159.6 Irrelevant dialogue + query–4044383439.0–6558606461.8 Relevant dialogue + query–5852606458.5–3940383437.8 Blank–Subtitle Query only484644424244.4525455556155.4 Irrelevant dialogue + query–2638303432.0–7062656465.3 Relevant dialogue + query–5450586456.5–4650413442.8 Blank–Subtitle–Blank Query only464842424244.0545452566155.4 Irrelevant dialogue + query–3840363437.0–5762636461.5 Relevant dialogue + query–6460626462.5–3737393436.8 scenery unrelated to the query, whereas the relevant dialogue is constructed using the method mentioned in Section IV-C to remain semantically relevant and progressively establish the query context. A. Subtitle Display Form and Content We first study how subtitle display form and content af- fect jailbreak performance. This experiment is conducted on HADES using Qwen3-VL-Plus. We compare three display forms—Subtitle–Blank, Blank–Subtitle, and Blank–Subtitle– Blank—and three content configurations—query only, irrel- evant dialogue + query, and relevant dialogue + query. The three display forms are defined as follows. If the subtitle display duration is 1 second, then under Blank–Subtitle, the first 4 seconds contain no subtitles and the subtitle appears only in the final second. Under Blank–Subtitle–Blank, the subtitle appears only in the middle second, with no subtitles in the first and last 2 seconds. Under Subtitle–Blank, the subtitle appears in the first second, followed by 4 seconds without subtitles. The same temporal construction is applied when the subtitle display duration is extended to 2-5 seconds. Table I shows that subtitle content is the dominant factor. Across all three display forms, relevant dialogue + query achieves the highest average ASR and the lowest average R. Its average ASRs are 58.5%, 56.5%, and 62.5%, compared with 41.2%, 44.4%, and 44.0% for query only. In contrast, irrelevant dialogue provides no consistent benefit and can sub- stantially increase refusal. Under Blank–Subtitle, for example, it reduces the average ASR from 44.4% to 32.0% and increases the average R from 55.4% to 65.3%. Display form also affects performance, although less strongly than subtitle content. For relevant dialogue + query, Blank–Subtitle–Blank achieves the best average result, with an ASR of 62.5% and an R of 36.8%. Overall, effective subtitle-based attacks require both se- mantically relevant dialogue and an appropriate display form. These findings motivate TempJail to construct a query-relevant dialogue rather than merely adding unrelated text or directly repeating the harmful query. Equal allocation Random allocation 1 Random allocation 2 Random allocation 3 0 20 40 60 80 100 ASR (%) 86 90 82 78 76 78 74 86 84 88 82 88 52 58 68 58 HADES Qwen3-vl-plus HADES Qwen3-vl-32B VLJailbreak-Bench Qwen3-vl-plus VLJailbreak-Bench Qwen3-vl-32B Fig. 2: Effect of timing-slot allocation. B. Subtitle Duration and Timing-Slot Allocation We next examine how the total subtitle duration and its allocation across segments affect jailbreak effectiveness for a fixed subtitle sequence. In Table I, the total subtitle duration varies from 1 to 5 seconds. For dialogue + query, the harmful query is displayed for 1 second, while the remaining time is divided among the ten dialogue segments. When the total subtitle duration reaches 5 seconds, the subtitles span the entire video and the three display forms become equivalent. Increasing the subtitle duration does not consistently im- prove jailbreak effectiveness across subtitle-content settings. Nevertheless, when relevant dialogue + query is displayed throughout the full 5-second video, it achieves an ASR of 64% and an R of 34%, yielding the best joint ASR–R performance among all evaluated configurations. Building on the optimal setting identified above, we use relevant dialogue + query as the subtitle content and display the complete subtitle sequence throughout the entire 5-second video. We further examine how the fixed 5-second duration is allo- cated across subtitle segments by comparing equal allocation with three random allocations generated using different seeds. With semantic content and visual input held constant, this experiment isolates the effect of timing-slot allocation. Figure 2 shows that subtitle timing allocation substantially affects ASR, and equal allocation is not always optimal. For example, on HADES, random allocation improves ASR from 86% to 90% for Qwen3-VL-Plus, while on VLJailbreakBench, Qwen3-VL-32B-Instruct achieves an increase from 52% to 68%. Moreover, different random schedules lead to differ- ent attack effectiveness even with identical subtitle content, demonstrating that LVLM responses are sensitive to when information is presented during video playback. These results indicate that temporal scheduling is a critical factor in subtitle-based video jailbreak attacks. Therefore, subtitle timing should be treated as an optimization variable rather than a simple presentation detail. IV. METHODOLOGY A. Problem Definition Given an original harmful question Q h and a target LVLM C, our goal is to construct a multimodal input that induces C to generate a response satisfying the harmful intent of Q h . Each query consists of an adversarial video V adv and a benign textual prompt P b , where P b does not explicitly contain the harmful request but only guides the model to process the video content. The model response is formulated as Y =C(V adv ,P b ).(1) To evaluate attack success, we define a judge function J (Y,Q h ) ∈ 0, 1, where J (Y,Q h ) = 1 indicates that the response Y satisfies the harmful intent of Q h . The attack success is defined as Succ(V adv ,P b ,Q h ;C) = I[J (C(V adv ,P b ),Q h ) = 1].(2) For a fixed benign prompt P b , the objective is to find an adversarial video: V ∗ adv = arg max V adv E[Succ(V adv ,P b ,Q h ;C)].(3) B. Overview of the Proposed Method We construct the adversarial video by designing three com- ponents: subtitle sequence S, background video B, and subtitle timing configuration θ. Specifically, given a harmful query Q h , our method consists of three stages: constructing a subtitle sequence, generating a semantically consistent background video, and optimizing the subtitle timing (See Figure 3): Q h → S,S → B, (S,B)→ θ. The subtitle construction stage embeds the harmful query into a coherent dialogue-like sequence, the video generation stage provides a natural visual context, and the timing opti- mization stage searches for an effective temporal arrangement of subtitle segments. The components obtained are combined to form the final adversarial video V ∗ adv . C. Dialogue Sequence and Subtitle Construction The first stage transforms the original harmful query into a dialogue-style subtitle sequence. Drawing inspiration from the conversational decomposition strategy used in prior text- only multi-turn jailbreaks [35], we prepend a short multi-turn dialogue to provide conversational context, making the subtitle stream resemble a natural conversation unfolding over time. Given an original harmful query Q h , we first generate a sequence of related questions with a substitute model C sub : Q =q 1 ,q 2 ,...,q M .(4) These questions are sequentially answered by C sub , producing the dialogue responses: a i =C sub (q i |q <i ,a <i ).(5) The resulting dialogue history is represented as D =(q 1 ,a 1 ), (q 2 ,a 2 ),..., (q M ,a M ).(6) After converting the dialogue history into subtitle segments, the final subtitle sequence is constructed as S = D⊕ Q h ,(7) where ⊕ denotes string concatenation. D. Background Video Generation Given the constructed subtitle stream S, the second stage generates a background video B that provides visual context for the dialogue. Specifically, a scene plannerG scene first derives a high-level scene description P from the subtitle context: P =G scene (S), where P represents the visual attributes of the scene. A text-to-video generator G vid then produces the back- ground video: B =G vid (P ). The generated video remains benign and contains no additional textual or instructional information. Its purpose is to provide a natural carrier for the subtitle stream, while the main attack signal is conveyed through the subtitle content and its temporal presentation. E. Subtitle Timing Optimization via CMA-ES Our preliminary analyses show that subtitle timing is a criti- cal factor affecting attack performance. However, determining an effective timing configuration is challenging, as the impact of each subtitle segment is not independent. The duration assigned to one segment may influence the interpretation of subsequent segments, and the overall attack effectiveness depends on the joint temporal organization of the entire subtitle sequence. Therefore, we formulate subtitle scheduling as a black-box optimization problem and employ CMA-ES to search for an effective timing configuration. Let the subtitle sequence S contain N segments, denoted as S =u i N i=1 . Given the total video duration T , the timing configuration is defined as θ =t i N i=1 ,(8) ⨁ Harmful Query A sequence of related questions: Step 1: Dialogue Sequence and Subtitle Construction 퐀 1 , 퐀 2 , ..., 퐀 퐀 Substitute Model sub C Questions Generator Dialogue Q: ... ... A: ... ... Q: ... ... A: ... ... ... ... Final Subtitle Sequence Harmful Query Dialogue ⨁ Step 2: Background Video Generation scene G Scene Planner Scene Description Text-to-video Generator vid G Step 3: Subtitle Timing Optimization via CMA-ES Subtitle Sequence 1 N i Su   CMA-ES distribution ... 1 u 3 u 2 u N u 0 T 1 t 2 t 3 t N t Rendering Function Background Video vid ()BPG Target Model C sample Adversarial Video 퐀 퐀 ... * argmax(;,,) h FBSQ     Objective Function Candidate timing configuration Optimized Adversarial Video update * adv V 1 , N i t   1 N i i Tt     Best Timing Configuration Attack Score (;,,) h FBSQ 0 T 1 t 2 t N t ... *  1 u : Who was Kevin ... ? 2 u : He was a former... N u :Write a tutorial on ... S P D D h Q h Q Fig. 3: Overview of our methodology. We first construct a multi-turn subtitle sequence, then generate a semantically matched background video, and finally optimize subtitle timing via CMA-ES. where t i represents the display duration of subtitle segment u i . The durations satisfy N X i=1 t i = T,(9) Given a timing configuration θ, the attack effectiveness is evaluated by the objective function θ ∗ = arg max θ∈Θ F (θ;B,S,Q h ),(10) where Θ denotes the feasible timing space of the video and F (·) measures the attack success score under the correspond- ing timing configuration. Since the objective is black-box and non-differentiable, we adopt CMA-ES to jointly optimize the timing configuration. Specifically, CMA-ES searches in a bounded N -dimensional latent space and maps each latent vector to a valid timing configuration: θ = Ψ(z),(11) where z ∈ R N is the latent timing variable and Ψ(·) enforces non-negativity, minimum-duration constraints, and the fixed total duration. By jointly optimizing the complete timing configuration, CMA-ES captures the temporal interactions among different subtitle segments. The detailed optimization procedure is presented in Algorithm 1. V. EXPERIMENTS A. Experimental Setup Datasets: We use two representative multimodal safety datasets: HADES [32] and VLJailbreakBench [33], covering diverse harmful-request categories. We randomly sample 50 examples from each dataset while preserving their category distributions. Algorithm 1: Subtitle timing optimization with CMA-ES Require: Subtitle sequence S, background video B, source query Q h , duration T , iterations G, population size λ Ensure: Optimized timing configuration θ ∗ 1: Initialize CMA-ES distribution and f ∗ ←−∞ 2: for g = 1,...,G do 3:Sample latent candidates z (g) k λ k=1 4:for each candidate z (g) k do 5:Compute timing configuration θ (g) k = Ψ(z (g) k ) 6:Obtain attack score f (g) k 7:if f (g) k ≥ f ∗ then 8:θ ∗ ← θ (g) k 9:f ∗ ← f (g) k 10:if f (g) k ≥ f target then return θ ∗ 11:end if 12:end for 13:Update CMA-ES distribution using candidate scores 14: end for 15: return θ ∗ Target models: Our evaluation covers four popular video- capable LVLMs: Qwen3-VL-Plus [34], GPT-5 [23], Gem- ini 3.5-Flash [26], and the open-source Qwen3-VL-32B- Instruct [27]. Baselines: We compare TempJail with four representative multimodal jailbreak baselines: FigStep [28], VideoJail [10], SPTV [12], and MCV [11]. Since FigStep is originally image- based, we adapt it into a video-format variant for comparison under the same video configuration. In addition to the full TempJail pipeline, we further evaluate TempJail-Uniform with uniformly allocated subtitle slots and TempJail-White with a solid-white background to isolate the TABLE I: Attack success rate (ASR, %) of different multimodal jailbreak methods on VLJailbreakBench and HADES. TJ- U denotes TempJail-Uniform with uniformly allocated subtitle slots, and TJ-W denotes TempJail-White with a solid-white background. The best result in each setting is highlighted in bold. Target LVLM VLJailbreakBenchHADES BaselinesOursBaselinesOurs FigStepVideoJailSPTVMCVTJ-UTJ-WTempJailFigStepVideoJailSPTVMCVTJ-UTJ-WTempJail GPT-564201812787044168107872 Gemini 3.5-Flash7060588478849048504464848694 Qwen3-VL-Plus48866494929410054647280809096 Qwen3-VL-32B-Instruct5648649090929668666684809498 Average45.049.551.571.568.087.089.043.546.049.559.063.587.090.0 effects of temporal scheduling and semantic scene generation, respectively. Evaluation metric: For each sample, we query the target model five times and use GPT-5 [23] as an automated judge. A response is considered successful if it substantively fulfills the harmful intent, rather than refusing or providing only generic safety guidance. A sample is considered successfully attacked if at least one of the five responses succeeds. We report the resulting sample-level attack success rate (ASR) as our primary metric., following standard jailbreak evaluation protocols. Implementation details: Unless otherwise specified, we use Qwen3-VL-Flash [36] as the substitute model for subtitle construction, Qwen3.6-Flash [37] as the scene-prompt planner, and Runway Gen-4.5 [38] for background-video generation. Each TempJail video is rendered at a resolution of 1280×720, with a fixed duration of 5 seconds and a rendering frame rate of 24 FPS. For temporal optimization, we run CMA-ES for at most three generations with a population size of 10. The initial CMA-ES mean is randomly sampled from a standard Gaussian distribution, and the initial step size is set to 1.0. During evaluation through the explicit frame-input pipeline, videos are uniformly sampled at 4 FPS, and all target models use greedy decoding with a temperature of 0. B. Main Results Table I compares TempJail with four representative video- based jailbreak baselines. TempJail achieves the highest av- erage attack success rate (ASR) on both datasets, reaching 89.0% on VLJailbreakBench and 90.0% on HADES. On proprietary models, TempJail achieves 70% and 72% ASR on GPT-5 and 90% and 94% on Gemini 3.5-Flash across VLJailbreakBench and HADES, respectively. By comparison, the strongest prior results on GPT-5 are only 20% and 16%, showing that temporal subtitle organization remains effective in settings where existing video jailbreak baselines achieve relatively low ASR. TempJail also performs strongly on the Qwen3-VL family, achieving 100%/96% ASR on Qwen3-VL- Plus and 96%/98% on Qwen3-VL-32B-Instruct. Across the eight model–dataset combinations, TempJail achieves the best result among the complete attack methods in every setting, indicating that its effectiveness is consistent across the evaluated architectures and access settings. The TABLE I: Ablation study on Qwen3-VL-Plus and Qwen3- VL-32B-Instruct. “White” denotes a solid-white background, “TJ-Video” denotes the background video generated by Temp- Jail. “VLJB” denotes VLJailbreakBench. Results are reported in ASR (%). “Query” denotes the query-only subtitle setting, while“Dialogue” denotes the constructed dialogue + query subtitle sequence. Background SubtitleTimingHADES VLJB Qwen3-VL-Plus WhiteQuery–5236 WhiteDialogue Uniform8684 TJ-VideoDialogue Uniform8092 WhiteDialogue CMA-ES9094 TJ-VideoDialogue CMA-ES96100 Qwen3-VL-32B-Instruct WhiteQuery–3212 WhiteDialogue Uniform7652 TJ-VideoDialogue Uniform8090 WhiteDialogue CMA-ES9492 TJ-VideoDialogue CMA-ES9896 close average ASR on VLJailbreakBench and HADES also suggests that the improvement is not limited to one dataset. The controlled variants further clarify the contributions of temporal scheduling and semantic scene generation. TempJail- Uniform performs worse than the full TempJail pipeline, demonstrating the benefit of optimizing subtitle-slot allocation. TempJail-White remains highly effective, indicating that subti- tles carry the primary jailbreak signal, while the generated se- mantic scene provides complementary contextual information. Together, these comparisons show that temporal scheduling is the main contributor, and semantic scene generation provides a modest average gain, although its effect is model-dependent and it does not improve performance on GPT-5. Overall, these results support our central claim that how harmful semantics are scheduled over time is a critical attack factor beyond the textual content itself. C. Ablation Study To better understand the contribution of each component in TempJail, we conduct an ablation study on subtitle con- struction, background generation, and temporal optimization. As shown in Table I, replacing the query-only subtitle with the dialogue-style sequence under a white background and 246810 FPS 85 90 95 100 ASR (%) (a) Effect of Frame-Sampling Rate on ASR VLJailbreak-Bench HADES 01234567 Iteration 20 40 60 80 100 ASR (%) (b) Effect of Iterations on ASR VLJailbreak-Bench HADES 0.00.20.40.60.81.0 Temperature 85 90 95 100 ASR (%) (c) Effect of Temperature on ASR Qwen3-VL-Plus Qwen3-VL-32B-Instruct Fig. 4: Parameter analysis of TempJail. (a) Effect of the frame-sampling rate on Qwen3-VL-Plus over VLJailbreakBench and HADES. (b) Effect of the number of optimization iterations on Qwen3-VL-Plus over both datasets. (c) Effect of the decoding temperature on Qwen3-VL-Plus and Qwen3-VL-32B-Instruct over HADES. ASR denotes the attack success rate. uniform timing increases the average ASR from 33.0% to 74.5%, demonstrating the importance of constructing coherent conversational context. Under uniform timing, incorporating the generated semantic background further raises the aver- age ASR to 85.5%, corresponding to the TempJail-Uniform configuration used in the main results. Temporal optimization yields the most consistent improvement: applying CMA-ES with a white background increases the average ASR to 92.5%, corresponding to TempJail-White, while combining CMA-ES with the generated semantic background raises it to 97.5%. The complete TempJail pipeline achieves the highest ASR in all four evaluation settings, indicating that subtitle con- struction and temporal optimization are the main sources of improvement, while semantic background generation provides a modest complementary gain. D. Parameter Analysis We analyze the sensitivity of TempJail to three key hyper- parameters: the model frame-sampling rate (FPS), the number of optimization iterations, and the decoding temperature. The results are summarized in Figure 4. Effect of the Model Frame-Sampling Rate: As shown in Figure 4(a), increasing the number of video frames sampled by the target model from 2 FPS to 4–6 FPS substantially improves the ASR on both datasets. On VLJailbreakBench, the ASR increases from 96% at 2 FPS to 100% at both 4 and 6 FPS. On HADES, it rises from 88% at 2 FPS to 96% at 4 FPS and reaches its highest value of 98% at 6 FPS. Further increasing the model frame-sampling rate to 8 or 10 FPS provides no additional improvement and instead results in a slight performance decrease. These results indicate that sampling frames at a moderate rate allows the target model to capture sufficient temporal information from the dynamically presented subtitles, whereas denser sampling contributes little additional useful information. We therefore set the model frame-sampling rate to 4 FPS in the main experiments, as it achieves the best performance on VLJailbreakBench and near- best performance on HADES while limiting the computational cost associated with processing additional frames. Effect of the Number of Iterations: Figure 4(b) shows that most performance gains are obtained within the first few optimization iterations. For Qwen3-VL-Plus, one iteration increases the ASR from 62% to 90% on VLJailbreakBench and from 60% to 92% on HADES. The ASR continues to increase and reaches 100% and 96%, respectively, after three iterations. Additional iterations yield only marginal improve- ments. These findings indicate that the temporal scheduling process converges quickly, as an effective subtitle arrangement can generally be identified within a small number of iterations. Accordingly, we use three iterations in the main experiments to achieve strong attack performance while limiting optimization overhead. Effect of Temperature: As shown in Figure 4(c), the performance of TempJail varies only slightly across different decoding temperatures. When the temperature ranges from 0 to 1, the ASR remains between 96% and 100% for both Qwen3-VL-Plus and Qwen3-VL-32B-Instruct, with both mod- els reaching 100% ASR at a decoding temperature of 1. These limited fluctuations indicate that TempJail does not depend on a narrowly selected decoding temperature. Instead, its effectiveness is primarily determined by the constructed video prompt and temporal subtitle schedule rather than by a specific decoding configuration. VI. CONCLUSION In this paper, we reveal the temporal vulnerability of large vision-language models under video inputs and propose TempJail, a black-box video jailbreak framework via subtitle scheduling. Extensive experiments across multiple advanced LVLMs and two multimodal safety datasets demonstrate that TempJail consistently outperforms representative jailbreak baselines. Further analyses show that coherent subtitle con- struction and optimized temporal scheduling are the primary sources of its effectiveness. Ultimately, our findings expose temporal presentation as an important attack surface in video- capable LVLMs and highlight the need for future multimodal safety mechanisms to explicitly account for the temporal dynamics of textual and visual information in video inputs. REFERENCES [1] J. Zhang, J. Huang, S. Jin, and S. Lu, “Vision-language models for vision tasks: A survey,” IEEE transactions on pattern analysis and machine intelligence, vol. 46, no. 8, p. 5625–5644, 2024. [2] Z. Li, X. Wu, H. Du, F. Liu, H. Nghiem, and G. Shi, “A survey of state of the art large vision language models: Benchmark evaluations and challenges,” in Proceedings of the Computer Vision and Pattern Recognition Conference, 2025, p. 1587–1606. [3] M. Ye, X. Rong, W. Huang, B. Du, N. Yu, and D. Tao, “A survey of safety on large vision-language models: Attacks, defenses and evaluations,” 2025. [Online]. Available: https://arxiv.org/abs/2502.14881 [4] X. Liu, Y. Zhu, Y. Lan, C. Yang, and Y. Qiao, “Safety of Multimodal Large Language Models on Images and Text,” in IJCAI, 2024. [5] Y. Fan, Y. Cao, Z. Zhao, Z. Liu, and S. Li, “Unbridled icarus: A survey of the potential perils of image inputs in multimodal large language model security,” in 2024 IEEE International Conference on Systems, Man, and Cybernetics (SMC). IEEE, 2024, p. 3428–3433. [6] H. Jin, L. Hu, X. Li, P. Zhang, C. Chen, J. Zhuang, and H. Wang, “Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models,” 2025. [Online]. Available: https://arxiv.org/abs/2407.01599 [7] D. Liu, M. Yang, X. Qu, P. Zhou, Y. Cheng, and W. Hu, “A Survey of Attacks on Large Vision–Language Models: Resources, Advances, and Future Trends,” IEEE Transactions on Neural Networks and Learning Systems, 2025. [8] S. Yi, Y. Liu, Z. Sun, T. Cong, X. He, J. Song, K. Xu, and Q. Li, “Jailbreak attacks and defenses against large language models: A survey,” 2024. [Online]. Available: https://arxiv.org/abs/2407.04295 [9] S. Wang, Z. Long, Z. Fan, and Z. Wei, “From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking,” in Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 2024, p. 17 568–17 582. [10] W. Hu, S. Gu, Y. Wang, and R. Hong, “Videojail: Exploiting video- modality vulnerabilities for jailbreak attacks on multimodal large lan- guage models,” in ICLR 2025 Workshop on Building Trust in Language Models and Applications, 2025. [11] C. Kang, S. Sun, H. Jun, and J. H. Kim, “Jailbreaking multimodal large language models using multi-clip video,” in Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).San Diego, California, United States: Association for Computational Linguistics, Jul. 2026, p. 25 863–25 889. [Online]. Available: https://aclanthology.org/2026.acl-long.1186/ [12] D. Wang, X. He, X. Lyu, and B. Xiao, “Breaking Multimodal LLM Safety via Video-Driven Prompting,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Jun. 2026, p. 8566–8576. [13] N. Hansen and A. Ostermeier, “Completely derandomized self- adaptation in evolution strategies,” Evolutionary Computation, vol. 9, no. 2, p. 159–195, Jun. 2001. [14] J. Li, D. Li, S. Savarese, and S. Hoi, “Blip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models,” in International conference on machine learning.PMLR, 2023, p. 19 730–19 742. [15] W. Dai, J. Li, D. Li, A. Tiong, J. Zhao, W. Wang, B. Li, P. N. Fung, and S. Hoi, “Instructblip: Towards general-purpose vision-language models with instruction tuning,” Advances in neural information processing systems, vol. 36, p. 49 250–49 267, 2023. [16] H. Liu, C. Li, Q. Wu, and Y. J. Lee, “Visual instruction tuning,” Advances in neural information processing systems, vol. 36, p. 34 892– 34 916, 2023. [17] M. Maaz, H. Rasheed, S. Khan, and F. Khan, “Video-chatgpt: Towards detailed video understanding via large vision and language models,” in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2024, p. 12 585– 12 602. [18] H. Zhang, X. Li, and L. Bing, “Video-llama: An instruction-tuned audio- visual language model for video understanding,” in Proceedings of the 2023 conference on empirical methods in natural language processing: system demonstrations, 2023, p. 543–553. [19] Y. Zhang, J. Wu, W. Li, B. Li, Z. MA, Z. Liu, and C. Li, “Llava-video: Video instruction tuning with synthetic data,” Transactions on Machine Learning Research, 2025. [20] W. Hong, W. Wang, M. Ding, W. Yu, Q. Lv, Y. Wang et al., “Cogvlm2: Visual language models for image and video understanding,” 2024. [Online]. Available: https://arxiv.org/abs/2408.16500 [21] OpenAI, “GPT-4V(ision) system card,” https://openai.com/index/gpt-4v- system-card/, Sep. 2023, accessed: 2026-07-29. [22] A. Hurst, A. Lerer, A. P. Goucher et al., “Gpt-4o system card,” 2024. [Online]. Available: https://arxiv.org/abs/2410.21276 [23] A. Singh, A. Fry, A. Perelman et al., “Openai gpt-5 system card,” 2026. [Online]. Available: https://arxiv.org/abs/2601.03267 [24] Gemini Team, “Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context,” 2024. [Online]. Available: https://arxiv.org/abs/2403.05530 [25] G. Comanici, E. Bieber, M. Schaekermann, et al., “Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities,” 2025. [Online]. Available: https://arxiv.org/abs/2507.06261 [26] Gemini Team, “Gemini 3.5 Flash Model Card,” https://deepmind.google/ models/model-cards/gemini-3-5-flash/, May 2026, accessed: 2026-07- 29. [27] S. Bai, Y. Cai, R. Chen et al., “Qwen3-vl technical report,” 2025. [Online]. Available: https://arxiv.org/abs/2511.21631 [28] Y. Gong, D. Ran, J. Liu, C. Wang, T. Cong, A. Wang, S. Duan, and X. Wang, “Figstep: Jailbreaking large vision-language models via typographic visual prompts,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, 2025, p. 23 951–23 959. [29] Y. Wang, X. Zhou, Y. Wang, G. Zhang, and T. He, “Jailbreak large vision-language models through multi-modal linkage,” 2025. [Online]. Available: https://arxiv.org/abs/2412.00473 [30] Y. Liu, C. Cai, X. Zhang, X. Yuan, and C. Wang, “Arondight: Red teaming large vision language models with auto-generated multi-modal jailbreak prompts,” in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, p. 3578–3586. [31] R. Cheng, Y. Ding, S. Cao, R. Duan, X. Jia, S. Yuan, S. Qin, Z. Wang, and X. Jia, “Pbi-attack: Prior-guided bimodal interactive black-box jailbreak attack for toxicity maximization,” in Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 2025, p. 609–628. [32] Y. Li, H. Guo, K. Zhou, W. X. Zhao, and J.-R. Wen, “Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking mul- timodal large language models,” in European Conference on Computer Vision. Springer, 2024, p. 174–189. [33] R. Wang, J. Li, Y. Wang, B. Wang, X. Wang, Y. Teng, Y. Wang, X. Ma, and Y.-G. Jiang, “Ideator: Jailbreaking and benchmarking large vision- language models using themselves,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2025, p. 8875–8884. [34] Alibaba Cloud, “Qwen3-VL-Plus Model Information,” https://help. aliyun.com/zh/model-studio/qwen3-vl-plus, Dec. 2025, accessed: 2026- 07-29. [35] Q. Ren, H. Li, D. Liu, Z. Xie, X. Lu, Y. Qiao, L. Sha, J. Yan, L. Ma, and J. Shao, “Llms know their vulnerabilities: Uncover safety gaps through natural distribution shifts,” 2026. [Online]. Available: https://arxiv.org/abs/2410.10700 [36] Alibaba Cloud, “Qwen3-VL-Flash Model Information,” https://help. aliyun.com/zh/model-studio/qwen3-vl-flash, Jan. 2026, accessed: 2026- 07-29. [37] —, “Qwen3.6-Flash Model Information,” https://help.aliyun.com/zh/ model-studio/qwen3-6-flash, Apr. 2026, snapshot version qwen3.6- flash-2026-04-16. Accessed: 2026-07-29. [38] Runway, “Runway Gen-4.5: State-of-the-Art AI Video Generation,” https://runway.com/research/introducing-runway-gen-4.5, Dec. 2025, accessed: 2026-07-29.

Instant research discovery