Paper deep dive
Jailbreaking Text-to-Image Models Through Cracks: Navigating Heterogeneous Safety Filters via Multi-Agent Debate
Kaiyan Wen, Shijie Zhang, Lu Yu, Guangdong Bai
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%
Last extracted: 9/3/2026, 3:07:05 AM
Summary
This paper introduces CRACK, a multi-agent debate framework designed to jailbreak Text-to-Image (T2I) models by navigating heterogeneous safety filters. The authors propose the 'Detection Surface' as a geometric framework to characterize decision boundaries of safety filters, revealing that successful evasion involves navigating sparse, non-convex regions shaped by cross-layer conflicts. CRACK utilizes three agents—an Attack Agent for exploration, a Defense Agent for diagnosis, and a Judge Agent for arbitration—to iteratively refine prompt mutations. Experiments show CRACK achieves high Attack Success Rates (up to 99.63%) with fewer queries than existing methods while maintaining semantic fidelity.
Entities (12)
Relation Signals (10)
CRACK → targets → Text-to-Image Models
confidence 99% · Jailbreaking Text-to-Image Models Through Cracks
CRACK → consistsof → Attack Agent
confidence 98% · CRACK coordinates an Attack Agent, a Defense Agent, and a Judge Agent
CRACK → consistsof → Defense Agent
confidence 98% · CRACK coordinates an Attack Agent, a Defense Agent, and a Judge Agent
CRACK → consistsof → Judge Agent
confidence 98% · CRACK coordinates an Attack Agent, a Defense Agent, and a Judge Agent
Attack Agent → performs → Exploration
confidence 96% · the Attack Agent performs exploration by selecting and applying complementary mutation strategies
Defense Agent → performs → Diagnosis
confidence 96% · the Defense Agent performs diagnosis by providing structured diagnostic signals
Judge Agent → performs → arbitration
confidence 96% · The Judge Agent performs arbitration by reconciling potentially conflicting layer-wise signals
CRACK → achieveshighperformanceon → Attack Success Rate
confidence 95% · CRACK achieves Attack Success Rates (ASR) of up to 99.63%
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Text-to-image (T2I) models remain vulnerable to jailbreak attacks that elicit Not-Safe-For-Work (NSFW) content, despite increasingly being guarded by heterogeneous, multi-layer safety stacks combining text filters, image classifiers, and cross-modal detectors. Existing jailbreak studies either optimize against individual filters or query the complete pipeline with aggregate feedback, making it difficult to identify the active constraint and adapt to conflicts across safety layers. In this paper, we introduce the Detection Surface, a unified geometric framework that characterizes the decision boundaries induced by heterogeneous T2I safety filters and their joint effect on the jailbreak search space. This formulation reveals that successful evasion is governed by a sparse and non-convex region shaped by cross-layer conflicts, where mutations that bypass one filter may increase exposure to another. Motivated by this analysis, we propose CRACK, a multi-agent debate framework for adaptive jailbreak search that decomposes jailbreak search into exploration, diagnosis, and arbitration. CRACK coordinates an Attack Agent, a Defense Agent, and a Judge Agent to iteratively generate prompt mutations, obtain layer-specific diagnostic feedback, and optimize mutation strategies through reward-guided refinement. Through repeated rounds of debate, CRACK adapts its search direction to the evolving cross-layer constraints while preserving the original harmful intent. Extensive experiments across multiple T2I models, datasets, and safety configurations show that CRACK achieves Attack Success Rates (ASR) of up to 99.63% under composite defenses, while requiring fewer queries than existing methods and maintaining semantic fidelity.
Tags
Links
- Source: https://arxiv.org/abs/2609.01168v2
- Canonical: https://arxiv.org/abs/2609.01168v2
Trouble viewing inline? Open PDF directly →
Full Text
88,498 characters extracted from source content.
Expand or collapse full text
Jailbreaking Text-to-Image Models Through Cracks: Navigating Heterogeneous Safety Filters via Multi-Agent Debate Kaiyan Wen Shijie Zhang Lu Yu Guangdong Bai †thanks: Kaiyan Wen is with the College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China (e-mail: wenkaiyan_@nudt.edu.cn). Shijie Zhang is with Shenzhen MSU-BIT University, Shenzhen, China (e-mail: shijie.z@smbu.edu.cn). Lu Yu and Guangdong Bai are with City University of Hong Kong, Hong Kong, China (e-mail: lu.yu@cityu.edu.hk, g.bai@cityu.edu.hk). Abstract Text-to-image (T2I) models remain vulnerable to jailbreak attacks that elicit Not-Safe-For-Work (NSFW) content, despite increasingly being guarded by heterogeneous, multi-layer safety stacks combining text filters, image classifiers, and cross-modal detectors. Existing jailbreak studies either optimize against individual filters or query the complete pipeline with aggregate feedback, making it difficult to identify the active constraint and adapt to conflicts across safety layers. In this paper, we introduce the Detection Surface, a unified geometric framework that characterizes the decision boundaries induced by heterogeneous T2I safety filters and their joint effect on the jailbreak search space. This formulation reveals that successful evasion is governed by a sparse and non-convex region shaped by cross-layer conflicts, where mutations that bypass one filter may increase exposure to another. Motivated by this analysis, we propose CRACK, a multi-agent debate framework for adaptive jailbreak search that decomposes jailbreak search into exploration, diagnosis, and arbitration. CRACK coordinates an Attack Agent, a Defense Agent, and a Judge Agent to iteratively generate prompt mutations, obtain layer-specific diagnostic feedback, and optimize mutation strategies through reward-guided refinement. Through repeated rounds of debate, CRACK adapts its search direction to the evolving cross-layer constraints while preserving the original harmful intent. Extensive experiments across multiple T2I models, datasets, and safety configurations show that CRACK achieves Attack Success Rates (ASR) of up to 99.63% under composite defenses, while requiring fewer queries than existing methods and maintaining semantic fidelity. Index Terms: Jailbreak, Text-to-Image models, heterogeneous safety filters, multi-agent debate. I Introduction Text-to-image (T2I) generative models such as Stable Diffusion [1, 2], DALL·E [3], and Midjourney [4] have demonstrated remarkable capabilities in synthesizing photorealistic images from natural language prompts [5, 6, 7]. However, the widespread deployment of T2I models in commercial platforms has raised critical safety concerns, since adversaries can craft malicious prompts to elicit Not-Safe-For-Work (NSFW) content, including violent, sexually explicit, or otherwise harmful imagery [8, 9]. To mitigate such misuse, model providers have integrated a variety of safety mechanisms, ranging from input-side keyword blacklists [8, 10] and LLM-based semantic classifiers [11, 12] to output-side NSFW image detectors [10, 13] and cross-modal alignment filters [14, 15], forming a multi-layered defense stack that guards the generation pipeline at different stages and modalities. However, current T2I jailbreak methods are poorly matched to the compositional nature of modern safety pipelines. Component-specific attacks [9, 16] optimize against an individual filter, so their success does not necessarily transfer to a stack containing filters from different modalities. Methods that query the complete pipeline in a black-box manner [8, 17] treat the stack as a single decision function and observe only whether a query succeeds. Such feedback provides little indication of whether a rejection stems from explicit lexical cues, implicit unsafe semantics, generated visual content, or text-image alignment. Consequently, existing mutation policies struggle to determine whether a revision genuinely resolves the current detection risk or merely shifts it from one safety layer to another. For instance, a mutation that weakens lexical cues to bypass a text filter can simultaneously strengthen the unsafe visual semantics of the generated image, making it easier for a downstream image classifier to reject [16, 18]. Without explicitly accounting for these cross-layer interactions, existing methods lack a layer-aware signal for determining effective search directions in the prompt space. To characterize these cross-layer interactions, we introduce the Detection Surface, a geometric abstraction of the decision boundaries induced by a heterogeneous defense stack. This abstraction provides a unified view of how these boundaries jointly partition the prompt space and constrain the feasible search region for multi-layer jailbreaks. Although heterogeneous filters broaden safety coverage, their distinct detection criteria partition the prompt space differently. A mutation may cross the boundary of one filter while remaining outside the safe region of another, producing cross-layer conflict [18]. The intersection of all per-layer safe regions, subject to preservation of the original harmful intent, further forms a sparse and non-convex evasion region. Therefore, multi-layer jailbreak is fundamentally a search problem over a sparse and non-convex evasion region shaped by cross-layer conflicts on the Detection Surface. These properties make multi-agent debate particularly well suited to navigating the Detection Surface. First, the sparsity and non-convexity of the evasion region call for active exploration across diverse mutation directions rather than reliance on a fixed search trajectory. Second, cross-layer conflicts require diagnosis: because a mutation that bypasses one safety layer may increase exposure to another, effective search requires identifying which constraints currently impede progress and how they respond to each revision. Finally, conflicting layer-wise feedback requires arbitration, whereby heterogeneous signals are reconciled to determine whether a mutation yields overall progress toward the joint evasion region. Performing these functions within a single role can entangle mutation generation with failure attribution and cross-layer evaluation. Multi-agent debate instead provides a natural mechanism for separating these complementary functions while allowing their perspectives to be iteratively exchanged and reconciled. To this end, we introduce CRACK, a multi-agent debate framework that instantiates exploration, diagnosis, and arbitration through three specialized agents, while leveraging reinforcement learning to progressively refine the mutation policy for layer-aware navigation of the Detection Surface. Starting from a harmful prompt, CRACK iteratively searches for mutations that better satisfy heterogeneous layer-wise constraints while preserving the original harmful intent, progressively steering the prompt toward the joint evasion region ℰ∗E^*. We refer to promising intermediate pathways through the heterogeneous safety boundaries as cracks, as they provide feasible directions toward joint evasion. At each round, the Defense Agent performs diagnosis by providing structured diagnostic signals that approximate the heterogeneous criteria commonly used by real-world defense stacks, thereby identifying the constraints currently impeding progress and explaining the corresponding rejection. Conditioned on this diagnosis, the Attack Agent performs exploration by selecting and applying complementary mutation strategies to search for promising directions toward the next crack. The Judge Agent performs arbitration by reconciling potentially conflicting layer-wise signals into a composite assessment of overall progress. This assessment further serves as a reward signal for refining the Attack Agent’s mutation policy through reinforcement learning, discouraging revisions that merely shift detection risk from one layer to another. Through repeated rounds of debate and refinement, CRACK adapts its search direction as new cross-layer conflicts emerge, transforming stack-level trial-and-error into a layer-aware and diagnosis-guided search toward ℰ∗E^*. We summarize our contributions as follows: • Theoretical framework. We introduce the Detection Surface formalism, which provides a unified geometric characterization of multi-layer T2I defense stacks. We identify three structural properties (cross-layer conflict, sparsity, and non-convexity) that that decomposes jailbreak search into exploration, layer-aware diagnosis, and cross-layer arbitration, with reinforcement learning further refining the mutation policy. (Sec. I). • Multi-agent attack framework. We propose CRACK, the jailbreak method that first leverages multi-agent debate with per-layer diagnostic feedback and RL-guided strategy selection. Each component of CRACK is directly motivated by a specific structural property of the Detection Surface, yielding a principled rather than heuristic attack design (Sec. IV). • Comprehensive evaluation. We conduct extensive experiments across multiple T2I models (Stable Diffusion v1.4, SDXL, DALLE⋅·3, and Midjourney) under diverse safety configurations. CRACK achieves state-of-the-art attack success rates (up to 99.63% on SD 1.4 with composite filters) while requiring significantly fewer queries than existing methods, and maintains high semantic fidelity. These results validate the cross-layer interactions characterized by the Detection Surface and demonstrate the importance of layer-aware, adaptive search for navigating heterogeneous defense stacks (Sec. V). I Related Work I-A Jailbreak Attacks on T2I Models Existing T2I jailbreak attacks differ in their assumptions about model access. White-box attacks exploit model internals or accessible representations. Ring-A-Bell [9] identifies concepts that reveal vulnerabilities in concept-erased diffusion models, whereas MMA-Diffusion [19] constructs multimodal adversarial attacks against diffusion models through gradient-based optimization. These methods generally require access to model parameters, gradients, or internal representations and are therefore difficult to apply to closed commercial APIs. Black-box attacks rely only on model queries and observable responses. SneakyPrompt [8] trains a reinforcement learning policy to replace prompt tokens and evade a CLIP-based safety checker. DACA [20] uses an LLM to decompose unsafe requests into less detectable components for attacking LLM-guarded T2I systems. JailFuzzer [17] combines fuzz testing with LLM-based agents to automate jailbreak prompt generation. Prompting4Debugging [21] performs systematic red teaming by searching for problematic prompts that expose T2I model failures, while Perception-guided Jailbreak [16] uses perceptual signals to guide prompt construction. A common limitation of existing black-box approaches is that they rely solely on coarse success-or-failure feedback to guide prompt optimization. Such coarse feedback provides limited visibility into layer-specific failure causes and cross-layer interactions, making it difficult to distinguish mutations that genuinely advance joint evasion from those that merely transfer detection risk across defense layers. Tab. I compares CRACK with representative baselines in terms of key capabilities for navigating multi-layer defenses. Among the compared methods, CRACK uniquely combines structured layer-wise diagnostic feedback with cross-layer adaptive search, directly addressing this capability gap in heterogeneous defense settings. TABLE I: Security capability comparison of representative T2I jailbreak methods. Access: assumed threat model. Multi-layer defense: whether the method attacks a composed defense pipeline containing multiple heterogeneous stages, with success requiring all stages to be bypassed. Feedback granularity: the signal used to guide the search. Layer-aware: whether the attack localizes the layer responsible for rejection. Cross-layer adaptive: whether it adapts its strategy across conflicting layers. Iterative: whether it refines over multiple rounds. CRACK derives the feedback diagnosis from its Defense Agent without accessing the internal states of the target system. Method Access Multi-layer Feedback Layer- Cross-layer Iterative defense granularity aware adaptive Ring-A-Bell [9] White-box ✗ Concept score ✗ ✗ ✗ MMA-Diffusion [19] White-box & Black-box ✓ Gradient ✗ ✗ ✓ SneakyPrompt [8] Black-box ✗ Binary + CLIP ✗ ✗ ✓ DACA [20] Black-box ✗ LLM heuristic ✗ ✗ ✗ JailFuzzer [17] Black-box ✗ Binary success ✗ ✗ ✓ PGJ [16] Black-box ✗ Perceptual cue ✗ ✗ ✗ JANUS [22] Black-box ✓ Binary + NSFW score ✗ ✗ ✓ MacPrompt [23] Black-box Partial NSFW score ✗ ✗ ✓ CRACK (ours) Black-box ✓ Surrogate Per-layer diagnosis ✓ ✓ ✓ I-B Safety Mechanisms for T2I Models Modern T2I systems employ safety mechanisms at multiple stages of the generation pipeline. Text-side filters include keyword-based screening [24] and LLM-based semantic guards that assess prompt intent before image generation [11, 12]. Concept-erasure methods modify diffusion models to suppress unsafe or unwanted concepts. ESD, for example, fine-tunes a diffusion model to erase targeted concepts from its generation capability [25], while subsequent studies examine the reliability and limitations of concept-removal methods under adversarial prompting [9]. Output-side classifiers inspect generated images for unsafe content. Representative examples include CLIP-based NSFW detectors [26], NudeNet for nudity detection [27], and Q16, a multi-label classifier for inappropriate visual content [28]. Safety can also be incorporated into the diffusion process itself. Safe Latent Diffusion steers denoising away from inappropriate concepts through safety guidance [13]. In addition, cross-modal safety assessment can be built on vision-language representations that encode the relationship between text and images [14]. Commercial T2I services may combine several safeguards. For example, the DALL⋅·E 3 system card documents safety mitigations that operate before and during generation [11]. However, prior work has not formally characterized the joint geometry induced by heterogeneous defense layers or their interactions. Our Detection Surface formalism addresses this gap. I-C Multi-Agent Systems and LLM-Based Red Teaming Multi-agent frameworks coordinate multiple LLM-based agents with complementary roles to solve complex tasks through iterative interaction [29, 30, 31]. Multi-agent debate enables agents to propose competing solutions, critique one another, and revise their decisions, improving reasoning accuracy and factual consistency [29, 32]. Related studies [30, 31] further show that role specialization and divergent agent perspectives can broaden solution exploration and reduce the tendency of a single model to converge prematurely on one reasoning path. Recently, LLM-based agents have been increasingly used to automate jailbreak search. Methods such as PAIR [33] and TAP [34] iteratively generate, evaluate, and refine candidate prompts based on target-model responses, while broader red-teaming frameworks [35, 36] introduce diversity-oriented exploration and specialized agent roles to expand attack coverage. Together, these studies demonstrate that iterative feedback and role specialization can improve the effectiveness and coverage of automated security evaluation. However, these methods are designed primarily for text-based LLMs, where attack success is determined directly from the textual response of a single target model. Extending this paradigm to T2I systems is non-trivial because each prompt induces a stochastic image-generation process whose output may vary across queries, and the resulting prompt-image pair can be examined by heterogeneous textual, visual, and cross-modal safety filters. These characteristics require multi-agent interactions that can reason over layer-specific multimodal feedback and coordinate potentially conflicting safety signals, capabilities that are not explicitly considered in existing LLM-oriented red-teaming frameworks. Recent T2I frameworks such as DACA [20] and JailFuzzer [17] have introduced LLM-based agents for intent decomposition, prompt mutation, and candidate evaluation. However, their feedback is primarily used to guide prompt generation or assess overall attack success, without explicitly modeling cross-layer interactions or adapting the search direction to the currently active constraint. This leaves layer-aware diagnosis and cross-layer arbitration underexplored in existing agent-based T2I red teaming. I-D RL for Adversarial Prompt Generation Reinforcement learning (RL) has been used to automate adversarial prompt search. SneakyPrompt [8] applies PPO [37] to learn token-level prompt substitutions against a CLIP-based safety filter. In the LLM setting, Perez et al. [38] trained language models through reinforcement learning to discover prompts that elicit undesirable behavior from target models. These approaches demonstrate that reward-guided optimization can reduce reliance on manually designed attack prompts. However, they typically optimize against a single target or aggregate success signal, without distinguishing how different safety constraints respond to each mutation. Such feedback is insufficient for heterogeneous defense stacks, where improving evasion against one layer may increase detection risk at another. CRACK differs in two respects. First, its policy operates at the strategy level, selecting among qualitatively different mutation operators according to feedback from distinct defense layers, rather than performing only token-level replacement. Second, its reward combines binary bypass outcomes with continuous scores from the Judge Agent, thereby providing denser feedback for navigating the sparse evasion region. I Preliminaries and Problem Formulation I-A Threat Model Target model. Let P denote the set of natural-language prompts and let ℐI denote the image space. A text-to-image (T2I) generative model is represented as y∼ℳ(p,z),y (p,z), (1) where p∈p is an input prompt, z∈z is a stochastic latent variable, and y∈ℐy is the generated image. The model is equipped with a safety mechanism composed of multiple heterogeneous filters that operate across different modalities and levels of abstraction, ranging from textual keyword matching and semantic prompt analysis to image-level content moderation. Adversarial goal. Given a harmful target concept described by an original prompt php_h, the adversary seeks an adversarial prompt p′p^ that evades all filters of the safety mechanism while keeping the generated image semantically faithful to the harmful intent of php_h. Formally, the adversary aims to solve p⋆=argmaxp∈Sim(ℳ(p,z),ph)s.t.(p)=0,p = _p \;Sim (M(p,z),\,p_h ) .t. (p)=0, (2) where (p)=0S(p)=0 indicates that p passes all safety filters and Sim(⋅,⋅)Sim(·,·) measures the semantic fidelity between the generated image and the original intent. An attack that bypasses the filters but produces a benign or off-target image is not counted as successful. Adversarial capabilities. We consider a strict black-box setting. The adversary has no access to the internal weights, architecture, gradients, or logits of ℳM, and no access to the parameters, thresholds, or decision logic of the safety filters. The number of filters, their types, and the order in which they are applied are all unknown. The adversary interacts with the deployed system only by submitting prompts and observing a single binary safe/unsafe signal, together with the generated image when a prompt is accepted. Query and fidelity constraints. The attacker can issue repeated queries and revise the prompt based on past responses, but it operates purely at the input level and cannot modify the model or the filters in any way. This interaction is further constrained by a limited query budget, which rules out exhaustive search, and by the requirement that the adversarial prompt preserve the harmful semantics of php_h, which excludes trivial solutions that satisfy the filters by discarding the original intent. I-B Detection Surface Analysis: A Unified View of Multi-Layer Defenses Modern T2I systems do not rely on a single safety check. Instead, they deploy a heterogeneous defense stack =S1,S2,…,SK,S=\S_1,S_2,…,S_K\, (3) where K denotes the number of filters in the stack, and different filters SkS_k operate on text, images, or cross-modal representations. In practice, these layers typically include: (1) text-based filters StextS_text that perform keyword matching or text classification before image generation; (2) image-based filters SimageS_image that inspect generated images using safety or NSFW classifiers; and (3) cross-modal filters ScrossS_cross that jointly evaluate prompt-image alignment or unsafe concept similarity. We formalize the joint behavior of such defense stacks through the following definitions. Natural-language prompts are discrete objects, so geometric notions such as distance, boundary, gradient, and convexity are not directly defined on P. To support geometric analysis, we introduce a representation map ϕ:→⊆ℝd,φ:P ^d, (4) where X is a continuous prompt representation space. For a prompt p, we write x=ϕ(p)x=φ(p). All geometric analysis below is conducted in X rather than directly in the discrete prompt space P. Definition 1 (Detection Function and Safe Region). Each filter SkS_k induces a binary decision function hk:→0,1,h_k:X→\0,1\, (5) where hk(x)=1h_k(x)=1 indicates that SkS_k rejects the prompt representation x, and hk(x)=0h_k(x)=0 indicates that it passes the filter. The safe region of the k-th filter is ℬk≜hk−1(0)=x∈∣hk(x)=0.B_k h_k^-1(0)=\x h_k(x)=0\. (6) The composite safe region of the full defense stack is ℬ≜⋂k=1Kℬk=x∈∣hk(x)=0,∀k∈[K].B _k=1^KB_k=\x h_k(x)=0,\ ∀ k∈[K]\. (7) Thus, x∈ℬx if and only if it passes every filter in the defense stack. In the black-box setting, the adversary observes only the composite decision h(x)=maxk∈[K]hk(x).h(x)= _k∈[K]h_k(x). (8) Because hk(x)=1h_k(x)=1 denotes rejection, h(x)=1h(x)=1 means that at least one filter rejects x, while h(x)=0h(x)=0 means that all filters accept it. The per-layer decisions hk(x)h_k(x) are not directly accessible in the black-box setting. Assumption 1 (Surrogate Realizability). For geometric analysis, we associate each binary decision function hkh_k with a continuous surrogate scoring function fk:→ℝf_k:X (9) such that hk(x)=[fk(x)≥0].h_k(x)=1[f_k(x)≥ 0]. (10) Equivalently, the safe region is ℬk=x∈∣fk(x)<0B_k=\x f_k(x)<0\, and the zero level set separates the safe and unsafe regions without an exogenous threshold. When fkf_k is differentiable at x, the local evasion direction for the k-th filter is k(x)=−∇fk(x).g_k(x)=-∇ f_k(x). (11) This assumption is exact for score-based classifiers, where fk(x)f_k(x) is the pre-sigmoid logit of the final layer, and provides a local approximation for rule-based or LLM-based filters. Definition 2 (Detection Surface). Under Assumption 1, the decision boundary of the k-th filter is the zero level set ∂ℬk=fk−1(0)=x∈∣fk(x)=0. _k=f_k^-1(0)=\x f_k(x)=0\. (12) The Detection Surface of the full defense stack is the union of all filter boundaries =⋃k=1K∂ℬk.D= _k=1^K _k. (13) The Detection Surface describes where the decisions of one or more filters may change. A point near ∂ℬk _k is close to changing the decision of the k-th filter, while a point near multiple boundaries may be constrained by several filters simultaneously. Definition 3 (Evasion Region). Let ph∈p_h denote the original harmful-intent prompt with representation xh=ϕ(ph)x_h=φ(p_h). A successful adversarial prompt must pass all filters while preserving the harmful semantic intent of php_h in the generated output. Given an output-level similarity metric Sim(⋅,⋅)Sim(·,·) (e.g., CLIPScore between generated images) and a fidelity threshold δ, we define the semantic fidelity set as ℱ(xh,δ)≜x∈∣Sim(ℳ(x),ℳ(xh))≥δ,F(x_h,δ) \x (M(x),M(x_h))≥δ\, (14) where ℳ(x)M(x) denotes generation from the prompt with representation x. The evasion region is then defined as ℰ∗=(⋂k=1Kℬk)∩ℱ(xh,δ).E^*= ( _k=1^KB_k ) (x_h,δ). (15) Equivalently, x∈ℰ∗x ^* if and only if hk(x)=0,∀k∈[K],Sim(x,xh)≥δ.h_k(x)=0, ∀ k∈[K], (x,x_h)≥δ. (16) The attack objective is to find a prompt p′∈p such that ϕ(p′)∈ℰ∗.φ(p ) ^*. (17) I-C Key Properties of the Detection Surface We now state three structural properties that characterize the difficulty of searching for ℰ∗E^*. Unlike the definitions above, these properties depend on explicit assumptions about the defense stack and the prompt distribution. Property 1 (Cross-Layer Conflict). Different filters impose conflicting constraints on the representation space. Formally, there exist two filters Sm,SnS_m,S_n with m≠nm≠ n, a point x∈x , and two transformations Ti,TjT_i,T_j such that Ti(x)∈ℬmbutTi(x)∉ℬn,Tj(x)∈ℬnbutTj(x)∉ℬm.T_i(x) _m\ but\ T_i(x) _n, T_j(x) _n\ but\ T_j(x) _m. (18) This means that a modification that helps evade one filter may fail against another filter, so no single evasion direction is uniformly effective across all layers. Intuition. Strategies that evade one detection layer increase exposure to another. For example, replacing sensitive keywords with obfuscated tokens [8] may reduce the risk of text-based keyword matching, but it can also produce unnatural text that is more easily flagged by semantic or cross-modal filters. Conversely, fluent paraphrasing may preserve naturalness but retain semantic cues that are detectable by LLM-based classifiers. This motivates layer-aware feedback rather than a single uniform mutation strategy. Under Assumption 1, this conflict can be expressed locally through gradient misalignment. Consider two differentiable surrogate functions fmf_m and fnf_n. If ⟨∇fm(x),∇fn(x)⟩<0, ∇ f_m(x),∇ f_n(x) <0, (19) then following the evasion direction of one filter increases the detection score of the other to first order. Proposition 1 (Gradient Conflict). Assume fmf_m and fnf_n are differentiable at x and ⟨∇fm(x),∇fn(x)⟩<0 ∇ f_m(x),∇ f_n(x) <0. Then moving along the evasion direction m(x)=−∇fm(x)g_m(x)=-∇ f_m(x) increases fnf_n to first order; since fn≥0f_n≥ 0 denotes rejection by SnS_n, evading SmS_m locally pushes x toward rejection by SnS_n. Proof: Let xϵ=x+ϵm(x)x_ε=x+ _m(x) for a small ϵ>0ε>0. By first-order Taylor expansion, fn(xϵ)=fn(x)+ϵ⟨∇fn(x),m(x)⟩+o(ϵ).f_n(x_ε)=f_n(x)+ε ∇ f_n(x),g_m(x) +o(ε). (20) Since m(x)=−∇fm(x)g_m(x)=-∇ f_m(x), we have ⟨∇fn(x),m(x)⟩=−⟨∇fn(x),∇fm(x)⟩. ∇ f_n(x),g_m(x) =- ∇ f_n(x),∇ f_m(x) . (21) Since ⟨∇fm(x),∇fn(x)⟩<0 ∇ f_m(x),∇ f_n(x) <0, it follows that −⟨∇fm(x),∇fn(x)⟩>0.- ∇ f_m(x),∇ f_n(x) >0. (22) Hence, for all sufficiently small ϵ>0ε>0, the positive linear term dominates o(ϵ)o(ε), giving fn(xϵ)>fn(x)f_n(x_ε)>f_n(x). Thus, moving along the evasion direction for SmS_m increases the detection score of SnS_n locally. ∎ Consequently, single-objective greedy descent on one filter is fundamentally inadequate against a conflicting stack. Property 2 (Sparsity). The evasion region shrinks as more filters and the semantic constraint must be satisfied simultaneously. Let ν be a prompt sampling distribution over X and define ρk=Prx∼ν[x∈ℬk],ρsem=Prx∼ν[x∈ℱ(xh,δ)]. _k= _x ν[x _k], _sem= _x ν[x (x_h,δ)]. (23) Proposition 2 (Sparsity of the Evasion Region). Prx∼ν[x∈ℰ∗]≤minρsem,mink∈[K]ρk≤ρmax, _x ν[x ^*]\;≤\; \! \ _sem,\, _k∈[K] _k \\;≤\; _ , (24) where ρmax=maxkρk<1 _ = _k _k<1. Every additional filter can only tighten this bound. Proof: By Eq. (15), ℰ∗=ℱ(xh,δ)∩⋂k=1KℬkE^*=F(x_h,δ)∩ _k=1^KB_k is an intersection of events, and Pr[⋂iAi]≤miniPr[Ai] [ _iA_i]≤ _i [A_i] for any events A1,…,AmA_1,…,A_m. Applying this to the safe-region and fidelity events gives Eq. (24). ∎ The bound already shows that satisfying more constraints shrinks ℰ∗E^*. The decay is sharper in practice. Conflicting filters (Property 1) reject overlapping regions of X, so joint passage is even less likely than the min bound suggests and Prx∼ν[x∈ℰ∗] _x ν[x ^*] tends toward the product ρsem∏k=1Kρk _sem _k=1^K _k, which decays exponentially in K. Property 3 (Non-Convexity). The evasion region ℰ∗⊆ℝdE^* ^d is generically non-convex, because it is the intersection of safe regions bounded by nonlinear classifiers with a semantic fidelity set. Concretely, when each fkf_k is a ReLU network, fk−1(0)f_k^-1(0) partitions X into exponentially many linear regions [39], and ℬkB_k is a union of a subset of these polytopes; the intersection ⋂kℬk _kB_k is therefore a union of polytopes rather than a single convex body. The following witness condition makes non-convexity operational. Proposition 3 (Witness for Non-Convexity of ℰ∗E^*). Suppose some safe region ℬkB_k is non-convex. Formally, there exist x1,x2∈ℬkx_1,x_2 _k and λ∈(0,1)λ∈(0,1) such that xλ=λx1+(1−λ)x2∉ℬkx_λ=λ x_1+(1-λ)x_2 _k (25) and x1,x2∈ℱ(xh,δ)∩⋂j≠kℬjx_1,x_2 (x_h,δ)∩ _j≠ kB_j (26) Then ℰ∗E^* is non-convex. Proof: x1,x2x_1,x_2 lie in every safe region ℬjB_j, including ℬkB_k, and in ℱ(xh,δ)F(x_h,δ), so x1,x2∈ℰ∗x_1,x_2 ^*. Since xλ∉ℬkx_λ _k, also xλ∉ℰ∗x_λ ^*. The segment between two points of ℰ∗E^* leaves ℰ∗E^*, so ℰ∗E^* is non-convex. ∎Each filter SkS_k is a neural classifier, and its safe region ℬkB_k is bounded by a non-linear decision surface [40]. Non-convexity and the cross-layer conflict of Property 1 cause local greedy search to fail through two mechanisms. Conflicting gradients steer a mutation toward rejection by another layer, and the non-convex geometry traps a trajectory in a region that satisfies some filters but violates others. Effective search must explore multiple directions and revise earlier decisions when feedback indicates that a different boundary has become active. Together, these three properties recast jailbreak search as a constrained search over the prompt space P. Cross-layer conflict motivates layer-aware feedback, sparsity motivates reward-guided search, and non-convexity motivates iterative exploration rather than a single local mutation. CRACK, presented next, is designed around these three challenges. IV CRACK: Navigating the Detection Surface via Multi-Agent Debate Fig. 1: Overall framework of CRACK. CRACK formulates prompt generation as a multi-agent debate. The attacker mutates prompts to evade safety filters, the defender evaluates risk via a multi-layer pipeline, and the judge provides reward feedback. Black arrows indicate forward prompt generation and evaluation, while the green arrow shows RL-based policy updates guiding the attacker over multiple rounds. Building on the Detection Surface analysis, we present CRACK, a multi-agent framework for adaptively navigating the Detection Surface toward the joint evasion region ℰ∗E^*. As illustrated in Fig. 1, CRACK implements three key requirements identified above, namely exploration, diagnosis, and arbitration, through multi-round interactions among three specialized agents. In each round, the Attack Agent performs diagnosis-guided exploration by generating candidate mutations along complementary search directions. The Defense Agent provides structured layer-wise diagnosis by identifying the safety constraints currently impeding progress and explaining the corresponding failures. The Judge Agent arbitrates potentially conflicting feedback and evaluates the overall progress of each mutation, producing a reward signal that further guides refinement of the attack strategy. Through repeated rounds of debate and reward-guided adaptation, CRACK continuously revises its search direction as new cross-layer conflicts emerge, transforming stack-agnostic prompt mutation into a layer-aware and adaptive search toward ℰ∗E^*. IV-A Attack Agent: Prompt Mutation on the Detection Surface The Attack Agent serves as the exploration component of CRACK, adaptively selecting and applying mutation strategies to navigate the Detection Surface toward the joint evasion region ℰ∗E^*. Given a harmful prompt php_h, its objective is to generate a mutated prompt p′∈ℰ∗p ^* that simultaneously lies within all layer-wise safe regions ℬkB_k while preserving the original harmful intent. Within the Detection Surface, each mutation represents a movement in the prompt space, and the Attack Agent iteratively searches for directions that improve overall progress toward joint evasion. Specifically, it selects mutation strategies conditioned on the layer-wise diagnosis provided by the Defense Agent and progressively refines its strategy-selection policy using the reward assigned by the Judge Agent. Layer-Aware Adaptive Prompt Revision. For the initial prompt (debate round t=0t=0), the risk report is set as R0=∅R_0= , and the Attack Agent executes a randomly sampled mutation strategy from the strategy library M on the initial harmful prompt php_h. At debate round t, given the current adversarial prompt ptp_t and the structured risk report Rt=(rt(1),rt(2),rt(3))R_t=(r_t^(1),r_t^(2),r_t^(3)) provided by the Defense Agent, where each rt(k)r_t^(k) indicates the detection outcome at the k-th layer, the Attack Agent selects a mutation strategy ata_t from the strategy library M based on the policy network πϕ _φ: at∼πϕ(⋅∣pt,Rt).a_t _φ(· p_t,R_t). (27) The inclusion of the per-layer risk report RtR_t in the policy conditioning is critical. By Property 1 (cross-layer conflict), different layers require different evasion strategies. The structured feedback enables the Attack Agent to select targeted mutations, such as choosing metaphor replacement when the text pattern layer flags the prompt versus scene restructuring when the semantic layer is triggered, rather than applying blind, uniform perturbations. The strategy library M contains five complementary mutation strategies. These strategies are selected to cover distinct and commonly used mutation dimensions, including lexical form, semantic framing, scene organization, and prompt structure, while keeping the action space sufficiently compact for policy learning [8, 16, 20, 17]. The detailed implementations of the five strategies are provided in Supplementary Sec. References. Each strategy modifies a different aspect of the prompt while preserving its underlying harmful intent, thereby providing complementary search directions over the prompt space P. Such diversity is particularly important for navigating the non-convex Detection Surface, where relying on a single mutation strategy may confine the search to a restricted region of P. By adaptively switching among complementary strategies according to layer-wise diagnosis, the Attack Agent can redirect its search when the current mutation direction becomes ineffective and explore alternative pathways toward ℰ∗E^*. Reward-Guided Strategy Optimization. After each prompt revision, the Judge Agent evaluates the mutation’s effectiveness and provides a quantitative reward reflecting the progress toward ℰ∗E^*. This feedback updates the attacker’s policy, guiding future mutations toward regions of the Detection Surface with lower aggregate detection risk. The RL mechanism is detailed in Sec. IV-D. IV-B Defense Agent: Probing the Detection Surface The Defense Agent serves as the diagnostic component of CRACK, providing an attacker-side surrogate that approximates the heterogeneous detection criteria commonly used in multi-layer defense stacks. Rather than relying solely on coarse success-or-failure feedback, it produces structured layer-specific diagnostics to identify where and why a candidate prompt is likely to be rejected, thereby providing actionable guidance for subsequent mutation. Crucially, the attacker has no access to the internal composition or layer-wise decisions of the target safety stack. Consistent with black-box constraints, we only query the target system for externally observable generation results. Despite differences in their implementations, many real-world defense mechanisms can be broadly characterized by the primary signals they examine, including lexical [8, 11], semantic [11, 12], and cross-modal cues [10, 14]. We focus on these three dimensions because they capture complementary sources of safety evidence commonly used across the T2I generation pipeline: lexical cues reflect surface-level patterns in textual prompts, semantic cues capture higher-level unsafe intent beyond specific wording, and cross-modal cues assess the consistency and safety implications across textual and visual content. These dimensions are not intended to exhaustively cover all possible defense mechanisms, but provide a unified abstraction for analyzing heterogeneous safety signals within a compositional defense stack. The surrogate does not replicate the target’s detectors. Instead, it identifies which dimension currently exposes the prompt. Removing that exposure produces a prompt that is harder to detect along the same dimension for any stack inspecting it, so the surrogate’s crack diagnosis transfers at the level of detection dimensions rather than specific implementations. A prompt passing all surrogate cracks lies within the target’s feasible region with high probability. The agent’s role within the debate is twofold. First, it approximates the Detection Surface by evaluating prompts through a multi-tier pipeline that mirrors the structure of real-world defenses. Second, it provides per-layer diagnostic feedback that localizes where on the Detection Surface a given prompt is intercepted. This layer-specific localization is the key mechanism for resolving cross-layer conflicts (Property 1). To provide structured layer-wise feedback, the Defense Agent operates a three-tiered detection mechanism, where each tier instantiates a distinct component of the Detection Surface. Tier 1: Keyword and Pattern Matching (Textual Boundary ∂ℬtext _text). A lightweight first-pass filter designed to detect explicit violations using a curated set of sensitive terms and regular expression patterns [41]. It targets entity terms (e.g., “naked”, “weapon model”), action verbs (e.g., “attack”, “moan”), and scene descriptors (e.g., “violent conflict”). This tier approximates text-based filters StextS_text deployed in real systems, probing the lexical decision boundary ∂ℬtext _text. Tier 2: LLM Semantic Risk Assessment (Semantic Boundary ∂ℬsem _sem). A fine-tuned language model analyzes the semantic intent of the prompt using a structured evaluation template (see Fig. 2). This module captures implicit threats and indirect cues that are missed by surface-level keyword filters, such as metaphorical references to violence or euphemistic descriptions of NSFW content. It probes the semantic decision boundary ∂ℬsem _sem, which operates at a higher level of abstraction than Tier 1. Fig. 2: Risk assessment evaluation template for Defense Agent. Tier 3: CLIPScore Cross-Modal Validation (Cross-Modal Boundary ∂ℬcross _cross). This tier evaluates the semantic consistency between the prompt and the generated image by computing the CLIPScore [15], which quantifies how well the visual output aligns with unsafe concept embeddings. It probes the cross-modal decision boundary ∂ℬcross _cross, which operates across modalities. The Defense Agent outputs a structured risk report RtR_t that specifies the detection outcome at each tier, enabling the Attack Agent to identify the specific layer(s) responsible for interception and to select targeted countermeasures. This is in direct contrast to prior approaches (e.g., JailFuzzer [17], SneakyPrompt [8]) that receive only aggregate binary feedback h(p)=maxkhk(p)h(p)= _kh_k(p), which collapses the per-layer outcomes into a single signal and reveals only whether a prompt is blocked, not which component of the Detection Surface is responsible. IV-C Judge Agent: Measuring Progress Across the Detection Surface The Judge Agent serves as the arbitration component of CRACK, responsible for quantifying how effectively each mutation moves the adversarial prompt toward the evasion region ℰ∗E^*. By integrating cross-modal semantic analysis with the Defense Agent’s per-layer assessments, the Judge Agent produces reward signals that encode progress along the Detection Surface. In each round t, the Judge Agent evaluates both the original prompt ptp_t and the revised prompt pt+1p_t+1 through a dual-signal scoring mechanism. LLM-Based Semantic Assessment SriskS_risk. The first signal, SriskS_risk, measures whether the revision reduces the likelihood of triggering safety filters based on a structured evaluation template (see Fig. 3). It primarily reflects the mutation’s progress with respect to lexical and semantic detection signals. Fig. 3: Risk assessment template for Judge Agent. CLIPScore Differential ΔCLIP _CLIP. The second signal, ΔCLIP _CLIP, computes the change in text-image alignment between rounds. Let cunsafec_unsafe denote the unsafe concept embedding. The differential is defined as ΔCLIP=CLIP(pt,cunsafe)−CLIP(pt+1,cunsafe) _CLIP=CLIP(p_t,c_unsafe)-CLIP(p_t+1,c_unsafe), where positive values indicate that the revised prompt has moved further from the unsafe concept in the detector’s representation space, and negative values reflect less effective revisions. This signal captures progress across the cross-modal decision boundary ∂ℬcross _cross. The final decision score is computed as: s=α⋅Srisk+β⋅σ(ΔCLIP),with α+β=1,s=α· S_risk+β·σ( _CLIP), α+β=1, (28) where α,β∈[0,1]α,β∈[0,1] weight the contributions of each component, and σ(⋅)σ(·) is a scaling function that normalizes ΔCLIP _CLIP to the same range as SriskS_risk. The weighting scheme balances progress across different dimensions of the Detection Surface. The parameter α governs sensitivity to textual and semantic decision boundaries, while β governs sensitivity to cross-modal boundaries. We analyze this trade-off in the sensitivity study (Sec. V-B4). IV-D Multi-Agent Debate as Detection Surface Traversal Fig. 4: Overall pipeline of CRACK. CRACK performs multi-round debates between the attack agent and evaluation agents (defense and judge). In each round, candidate prompts are assessed for risk, semantic fidelity, and NSFW content, and feedback updates the generation strategy iteratively until the final prompt is selected. Fig. 4 presents an illustrative example demonstrating the complete multi-agent debate process across the Detection Surface. Each debate round corresponds to one step along a trajectory through the prompt space, guided by per-layer feedback from the Defense Agent and reward signals from the Judge Agent. The debate terminates when the prompt enters ℰ∗E^* (i.e., passes all detection tiers while maintaining semantic fidelity) or after a maximum number of rounds TdebateT_debate as shown in Fig. 5. Fig. 5: Iterative CRACK debate trajectory across the multi-filter detection surface. A single prompt’s CLIP embedding trajectory across debate revisions (R0-R6), showing its progression across filter boundaries from an initially blocked harmful prompt toward the joint evasion region. Debate Protocol. CRACK organizes the interaction among the three agents as an iterative debate, in which each proposed mutation is challenged by layer-wise diagnosis and then evaluated through cross-layer arbitration before guiding the next revision. In each round t, this debate proceeds through three sequential steps. First, the Attack Agent generates a mutated prompt pt+1p_t+1 using the mutation strategy ata_t sampled from the current policy network πϕ _φ and the Defense Agent’s diagnostic feedback RtR_t from the previous evaluation. Second, the Defense Agent evaluates pt+1p_t+1 through the three-tier detection pipeline and produces an updated risk report Rt+1=(rt+1(1),rt+1(2),rt+1(3))R_t+1=(r_t+1^(1),r_t+1^(2),r_t+1^(3)). Third, the Judge Agent compares ptp_t with pt+1p_t+1 together with the corresponding diagnostic signals to assess the overall progress of the mutation, producing a judgment score sts_t that contributes to the reward used to update the strategy-selection policy network πϕ _φ. This iterative proposal, diagnosis, and arbitration cycle constitutes the debate process, allowing CRACK to continuously adjust its mutation strategy in response to newly exposed layer-wise constraints and progressively steer the search toward ℰ∗E^* while preserving semantic fidelity. Strategy Updating via Reinforcement Learning. Building on this iterative debate process, we incorporate reinforcement learning to continually refine the Attack Agent’s policy. The RL formulation translates the abstract goal of navigating to ℰ∗E^* into a concrete optimization problem. State-Action Trajectory Collection. For each episode, the attacker samples mutation actions from the policy network πϕ _φ, generates mutated prompts, receives reward signals through the debate, and records state transitions (st,at,rt,st+1)(s_t,a_t,r_t,s_t+1) in a replay buffer. Here sts_t represents the current prompt and per-layer detection status, ata_t denotes the selected mutation strategy, rtr_t is the reward, and st+1s_t+1 is the resulting state after mutation. Implementation details are provided in Supplementary Sec. References. Reward Formulation. The reward function encodes progress across the Detection Surface through two complementary signals. • Bypass Reward. A binary signal of +b+b if the prompt evades all detection tiers (hk(pt+1)=0h_k(p_t+1)=0 for all k∈[K]k∈[K]), and −b-b otherwise. This reflects whether the prompt has reached the composite safe region ℬB. • Judge Reward. The judge’s score s from Eq. (28), providing a continuous signal that measures partial progress toward ℰ∗E^* even when not all layers are bypassed. This composite reward drives the Attack Agent to simultaneously reduce detection risk across all layers (addressing sparsity) while preserving semantic intent (satisfying the fidelity constraint in the definition of ℰ∗E^*). Policy Update. The policy network πϕ _φ is optimized by minimizing the standard Actor-Critic loss [42]: ℒ(ϕ)=−πϕ[∑t=0Tlogπϕ(at∣st)⋅A^t]+[A^t2],L(φ)=-E_ _φ [ _t=0^T _φ(a_t s_t)· A_t ]+E [ A_t^2 ], (29) where A^t=∑k=tTγk−trk−Vϕ(st) A_t= _k=t^Tγ^k-tr_k-V_φ(s_t) is the advantage estimate, γ is the discount factor, and Vϕ(st)V_φ(s_t) denotes the estimated value of state sts_t. Through this optimization, the policy learns to select mutation strategies that efficiently traverse the Detection Surface, accumulating experience about which strategies are effective against which detection layers. As shown in Fig. 6, in the CLIP embedding space, the prompts generated using the CRACK strategy are largely located within the evasion region, while other methods are unable to cross different filter boundaries. Fig. 6: Geometry of the multi-layer detection surface in CLIP embedding space. A two-dimensional t-SNE projection of prompt embeddings, overlaid with multiple filter boundaries; their joint lower region denotes candidate prompts that evade all filters. Connection to Detection Surface Properties The debate mechanism directly addresses the three structural properties identified in Sec. I-C. Per-layer feedback from the Defense Agent resolves cross-layer conflicts (Property 1) by identifying which boundary the current prompt violates, enabling targeted rather than blind mutation. The iterative refinement over multiple rounds handles non-convexity (Property 3) by allowing the trajectory to curve around detection boundaries rather than committing to a single descent direction. The RL-guided policy optimization efficiently searches the sparse evasion region (Property 2) by learning from accumulated experience rather than relying on random exploration. V Experiments V-A Experiments Setup TABLE I: Effectiveness of CRACK against different multi-layer safety stacks. We report ASR (%) under re-use and one-time prompt attack settings. Q16 is evaluated on I2P and UnsafeDiff, and NudeNet is evaluated on NSFW-200. Additional results on SD XL and Midjourney are in Supplementary Sec. References. The best result in each row is in bold. Target Type External Filter Method Re-use Prompt Attack One-time Prompt Attack ASR-Q16 ASR-NudeNet ASR-Q16 ASR-NudeNet I2P UnsafeDiff NSFW-200 I2P UnsafeDiff NSFW-200 Stable Diffusion 1.4 text-image text-image-c JailFuzzer 48.49 61.35 23.13 43.30 55.01 13.16 SneakyPrompt 59.36 76.30 30.11 46.64 51.02 33.63 Ring-A-Bell 42.31 53.63 54.56 33.61 37.96 43.13 DACA 55.63 56.61 32.61 30.03 31.63 27.56 MMA-diffusion 33.01 34.56 10.36 12.01 10.01 9.63 PGJ 45.63 33.69 23.45 24.56 23.63 11.24 CRACK (ours) 66.02 79.63 88.61 83.01 78.69 76.35 text text-m JailFuzzer 33.63 34.01 10.03 68.13 78.94 19.03 SneakyPrompt 96.01 93.69 91.06 52.36 63.69 56.96 Ring-A-Bell 88.63 87.12 79.63 11.56 12.39 13.69 DACA 83.16 86.16 77.63 16.36 23.16 10.01 MMA-diffusion 93.01 83.06 83.61 63.23 73.06 23.10 PGJ 78.63 76.96 73.12 46.39 56.39 43.65 CRACK (ours) 97.36 98.63 95.01 99.30 98.36 90.31 text-c JailFuzzer 91.23 93.63 89.63 78.30 88.01 56.31 SneakyPrompt 90.36 91.65 86.36 61.23 83.63 62.36 Ring-A-Bell 88.06 79.56 71.23 5.30 33.63 25.96 DACA 90.31 89.16 80.12 3.60 34.12 22.16 MMA-diffusion 88.63 87.96 85.16 61.23 77.26 60.12 PGJ 81.36 78.56 88.69 44.12 23.36 12.63 CRACK (ours) 99.63 95.61 96.26 90.23 91.26 93.61 image image-c JailFuzzer 33.61 36.25 34.13 85.16 79.61 56.13 SneakyPrompt 86.13 88.16 90.58 92.13 94.12 85.63 Ring-A-Bell 33.12 34.19 26.15 55.10 45.16 13.21 DACA 34.56 44.63 44.56 34.63 44.36 11.63 MMA-diffusion 33.12 60.35 33.68 70.16 69.16 53.16 PGJ 26.36 43.84 44.53 65.96 22.63 12.38 CRACK (ours) 87.13 85.16 88.61 95.16 96.23 88.24 image-clip-c JailFuzzer 77.32 70.15 66.31 81.23 80.13 63.12 SneakyPrompt 66.32 69.30 57.13 80.35 79.03 61.03 Ring-A-Bell 61.23 33.65 45.12 15.63 17.69 4.36 DACA 23.12 37.16 35.64 25.63 32.12 15.69 MMA-diffusion 45.63 44.13 31.23 60.15 66.35 48.63 PGJ 35.26 43.63 21.12 66.95 65.13 16.45 CRACK (ours) 68.91 79.61 62.31 88.96 81.03 74.25 DALL⋅·E 3 unknown unknown JailFuzzer 10.23 11.36 15.69 15.63 16.58 12.36 SneakyPrompt 11.23 12.34 13.06 25.69 23.15 21.13 Ring-A-Bell 9.63 9.09 2.36 13.46 14.15 12.01 DACA 8.63 8.08 5.13 15.01 15.16 14.63 MMA-diffusion 12.36 15.36 19.63 21.03 25.30 10.98 PGJ 5.63 5.96 5.14 22.09 20.01 26.05 CRACK (ours) 23.01 21.66 25.16 43.57 49.02 39.01 Datasets & Target Models. We evaluate our method on three widely used prompt datasets, NSFW-200 [19], I2P [43], and UnsafeDiff [44], following the settings in [17, 8, 19]. The NSFW-200 dataset contains exclusively adult-oriented content, while the I2P dataset provides real-world user prompts spanning a broad range of inappropriate concepts such as nudity, violence, and self-harm. The UnsafeDiff dataset covers three representative categories, including violence, gore, and discrimination, to broaden the scope of our attack assessment. The target T2I models include Stable Diffusion 1.4 [1], Stable Diffusion XL [2], DALL⋅·3 [3], and Midjourney [4]. Attack Scenario. (a). One-time prompt attack: The adversaries generate a new adversarial prompt for each attempt, aiming to bypass the safety filter via real-time queries. (b). Re-use prompt attack: The adversaries reuse previously successful prompts to directly trigger NSFW image generation without further search. Heterogeneous safety filters. Throughout all experiments, the built-in safety checker of the generator is kept active, so each configuration forms a heterogeneous stack =S1,…,SKS=\S_1,…,S_K\ composed of the built-in checker and the listed external filters below. (a). Text-based safety filter: text-m [41] and text-c [45] assess textual inputs before image generation, using either classifiers or keyword lists to block prompts that are sensitive or closely related to sensitive content. (b). Image-based safety filter: image-c [46] and image-clip-c [47] inspect the generated images using binary classifiers trained on NSFW-labeled data. (c). Text-image-based safety filter: text-image-c enforces moderation by jointly analyzing text and image using a binary classifier over combined embeddings. Unlike the SD 1.4 configurations where an external filter is stacked on the built-in checker, DALL·E 3 requires no added filter. Its proprietary pipeline is itself a closed-source heterogeneous safety stack, whose internal filters cannot be disabled or enumerated. Evaluation Metrics. (a). Attack Success Rate (ASR-Q16): The ratio between the number of adversarial prompts that successfully produce unsafe images and the total number of adversarial prompts. Specifically, a prompt counts as a successful attack only if it bypasses all active layers, i.e., h(p)=maxkhk(ϕ(p))=0h(p)= _kh_k(φ(p))=0, and its generated image is flagged as unsafe by Q16 [28]. Here, Q16 is a multi-label safety classifier capable of detecting a broad range of unsafe visual content. In the re-use attack setting, each previously successful prompt is re-submitted to the target model, and ASR-Q16 measures the proportion that again produces unsafe images. (b). Attack Success Rate (ASR-NudeNet): Following the same procedure, we replace Q16 with NudeNet [48], a classifier specifically trained to detect nudity and sexually explicit content. The ratio is computed between the number of adversarial prompts whose generated images are classified as containing nudity by NudeNet and the total number of adversarial prompts. Since NudeNet targets a single content category, this metric is reported exclusively on the NSFW-200 dataset, which consists of adult-oriented prompts. (c). CLIPScore: While ASR serves as the primary measure of attack effectiveness, we additionally report CLIPScore as a complementary indicator of semantic alignment between the adversarial prompt and the generated image. It is computed as the cosine similarity between CLIP-encoded image and text embeddings (range [0,1]). (d). Query Number: The number of queries to T2I models used for searching for an adversarial prompt. (e). PPL: Perplexity is used to measure a model’s average uncertainty when predicting the next token. Lower PPL indicates that the generated text is more fluent and natural. Baselines. We compare CRACK with six representative baselines covering text-only, multimodal, and LLM reasoning. SneakyPrompt [8] and Ring-A-Bell [9] are text-based attacks that iteratively modify or search prompt tokens to bypass filters. MMA-Diffusion [19] expands attacks to multimodal inputs by perturbing both text and image. JailFuzzer [17], DACA [20], and PGJ [16] rely on heuristic reasoning to decompose or recombine semantic structures. Implementation. All experiments were conducted on a single NVIDIA A100-PCIE GPU with 40GB of memory. We use DeepSeek V3 [49] as the LLM for all agents. More advanced models, such as QWen 3 [50] and GPT-4 [51], are excluded due to built-in safety mechanisms that limit sensitive content handling. The weights α=0.3α=0.3 and β=0.7β=0.7 in Eq. (28) are chosen based on the sensitivity analysis below. And σ(⋅)σ(·) function multiplies the input by 10. The bypass reward b is set to 10, and the policy network πϕ _φ is optimized using Adam with a learning rate of 3×10−43× 10^-4. The code is available in the supplementary material. V-B Evaluations We evaluate our method by answering the following Research Questions (RQs). • RQ1: How does our method perform compared with different baselines? • RQ2: Do the three structural properties of the Detection Surface hold empirically, and to what extent do they explain CRACK’s design choices? • RQ3: How does each component of CRACK impact performance? • RQ4: How do different hyperparameters affect the performance of our method? • RQ5: How does our method demonstrate comprehensiveness and generalization? Fig. 7: (a) Average queries on SD 1.4 (shaded: standard deviation). (b) Perplexity (See more results on other T2I models in the Supplementary Sec. References, Sec. References). Fig. 8: Demonstration of NSFW images generated by our method (See more cases in Supplementary Sec. References). V-B1 RQ1: Comparison with Different Baselines Attack effectiveness on one-time attack. As shown in Tab. I, CRACK consistently achieves the highest ASR across nearly all safety filter configurations under the one-time attack setting. On Stable Diffusion 1.4 with the most challenging text-image joint filter (text-image-c), CRACK attains ASR-Q16 scores of 83.01% (I2P) and 78.69% (UnsafeDiff), surpassing the strongest baseline by 36.37 and 27.67 percentage points, respectively. The ASR-NudeNet on NSFW-200 reaches 66.35%, more than doubling the best baseline result of 33.63%. This substantial margin validates CRACK’s ability to navigate multi-layer defense stacks where text and image modalities are jointly monitored. Under text filters, CRACK achieves near-perfect bypass. On text-m, it reaches 99.30% (I2P) and 98.36% (UnsafeDiff) on ASR-Q16, while all baselines except MMA-Diffusion fall below 68%. On text-c, CRACK maintains ASR-Q16 above 90% across all three datasets, whereas non-iterative methods such as Ring-A-Bell and DACA collapse to single-digit success rates (e.g., 5.30% and 3.60% on I2P), confirming that static heuristic strategies struggle to adapt to classifier-based text filters without iterative feedback. Against image-based filters, CRACK achieves the best overall performance. On image-c, CRACK reaches 95.16% (I2P) and 96.23% (UnsafeDiff) on ASR-Q16, outperforming the next best method by 3.03 and 2.11 points, respectively. On the more discriminative image-clip-c filter, CRACK obtains 88.96% on I2P and 64.25% on NSFW-200, consistently leading all baselines. We note that SneakyPrompt achieves competitive re-use ASR on image-c (86.13% and 90.58% on certain datasets) due to its token-level perturbation strategy, which is particularly effective against image-only classifiers. However, this advantage does not transfer to cross-modal or text-based defenses, where SneakyPrompt’s nonsensical token replacements are easily intercepted. On the commercial platform DALL·E 3, whose safety mechanisms are undisclosed and substantially more restrictive, CRACK achieves ASR-Q16 of 43.57% (I2P) and 49.02% (UnsafeDiff) under the one-time setting, roughly doubling the strongest baseline. The ASR-NudeNet on NSFW-200 reaches 39.01%, again outperforming all competitors. These results demonstrate CRACK’s generalizability to black-box commercial systems with unknown, multi-layered defenses. Attack effectiveness on re-use attack. CRACK also leads in the re-use setting, achieving the highest ASR-Q16 in all but two filter–dataset combinations (Tab. I). On text-image-c, CRACK reaches 66.02% (I2P) and 79.63% (UnsafeDiff), and the ASR-NudeNet on NSFW-200 reaches 88.61%, far surpassing all baselines. Under text-only filters, all methods including CRACK achieve uniformly high re-use ASR, as text filters are deterministic and do not vary across generations. Under image-based filters, the re-use ASR is inherently more variable due to the stochastic nature of the diffusion sampling process. Different random seeds produce different images from the same prompt, and some generated images may trigger the image classifier. Despite this variability, CRACK maintains competitive performance, achieving 87.13% on image-c (I2P) and 68.91% on image-clip-c (I2P). On DALL·E 3, CRACK achieves 23.01% (I2P) and 25.16% (NSFW-200) on re-use ASR-NudeNet, consistently outperforming all baselines by a clear margin. Fig. 9: (a) Time overhead for generating an adversarial prompt compared with baselines. (b) Average CLIPScore for generating an adversarial prompt compared with baselines. Efficiency. Beyond attack effectiveness, CRACK substantially reduces the query and runtime costs of iterative jailbreak search. As shown in Fig. 7a, CRACK requires only six queries per instance, the fewest among the iterative methods. In each of the three debate rounds, the Defense Agent performs one evaluation and the Judge Agent provides one comparative score, allowing CRACK to refine the prompt within a fixed query budget. By contrast, SneakyPrompt consumes up to 39.96 queries, JailFuzzer 29.55, and MMA-Diffusion approximately 10. We omit PGJ, DACA, and Ring-A-Bell from this comparison because their non-iterative designs do not use additional queries for progressive refinement. This query economy also translates into runtime efficiency, as shown in Tab. 9a. CRACK requires 123.01 seconds per prompt, making it the fastest iterative framework. Although it is slower than the non-iterative baselines, the additional runtime is accompanied by substantially higher bypass rates and therefore yields a favorable efficiency-effectiveness trade-off. Prompt quality and fidelity. CRACK produces more natural adversarial prompts while preserving their target semantics. As shown in Fig. 7b, it achieves a minimum perplexity of 29.78 under the image-c stack, substantially lower than the values of SneakyPrompt, Ring-A-Bell, and MMA-Diffusion, indicating that its revisions remain fluent rather than relying on malformed token sequences. Fig. 8 further shows that the generated images retain the harmful intent and semantic structure of the original prompts. CRACK also obtains the highest average CLIPScore across all benchmarks, reaching 0.36 on NSFW-200, 0.39 on UnsafeDiff, and 0.26 on I2P (Fig. 9b). These results are consistent with the Judge Agent’s dual-signal reward, which favors mutations that reduce detection risk without sacrificing semantic fidelity. Although DACA and PGJ are competitive on individual datasets, neither performs consistently across all three benchmarks, supporting the value of iterative, feedback-driven refinement for preserving semantic fidelity across diverse prompt distributions. V-B2 RQ2: Detection Surface Property Validation The theoretical framework in I proposes three structural properties of the Detection Surface that jointly explain why existing methods struggle under multi-layer defenses and why CRACK’s architecture is effective. We design three controlled experiments to validate each property independently. Cross-layer conflict. We isolate each of the five transformation strategies in CRACK’s strategy library and evaluate them individually across all filter types under SD 1.4 on NSFW-200 in the one-time attack setting. The results in Fig. 10 confirm cross-layer conflict. Metaphor replacement performs relatively well on image-side filters, reaching 65.39% on image-c and 63.31% on image-clip-c, but drops to 53.04% on text-image-c, where the cross-modal classifier captures residual alignment between the rewritten text and the generated image. Chain-of-thought expansion achieves 71.23% on text-m by distributing sensitive content across reasoning steps that keyword-based filters struggle to aggregate, but falls to 55.89% on image-c because the expanded narrative still guides the generative model toward explicit visual output. Scenario abstraction and question-based obfuscation show similarly uneven profiles across filters. No single strategy exceeds 69% across all five filters simultaneously. CRACK’s adaptive selection, by contrast, achieves 74.25% or above on all five filters, with a peak of 93.61% on text-c. The consistent margin over any individual strategy demonstrates that effective evasion under multi-layer defenses requires dynamically matching the transformation strategy to the modality and detection mechanism of each active filter, rather than committing to one fixed evasion direction throughout the attack. Fig. 10: ASR-NudeNet(%) of each strategy across different filter types. Sparsity. We measure how sparse the feasible region becomes as defense layers are added. We generate 10,000 random paraphrases of NSFW-200 prompts via DeepSeek V3 nucleus sampling and count how many simultaneously pass all active filters while maintaining CLIPScore above 0.26. TABLE I: Effect of defense composition on random hit rate Defense Configuration Layers Random Hit Rate (%) text modality only 1 12.3 text + image 2 2.7 text + image + cross-modal 3 0.4 The hit rate decays multiplicatively as layers are added, closely matching the exponential bound predicted by (24). This explains the query costs observed in RQ1. SneakyPrompt needs 39.96 queries, and JailFuzzer needs 29.55 queries, because they rely on partially directed yet largely exploratory strategies. CRACK achieves high ASR in 6 queries because the defense agent identifies which layer rejected the prompt, allowing the attack agent to mutate in a targeted direction rather than wasting queries in infeasible regions. Non-convexity. We test whether the feasible region forms a convex set by examining straight-line paths between known feasible points. We select 50 pairs of successful adversarial prompts (p1,p2)(p_1,p_2) from each dataset, compute their CLIP text embeddings, perform linear interpolation e(λ)=(1−λ)⋅e(p1)+λ⋅e(p2)e(λ)=(1-λ)· e(p_1)+λ· e(p_2) at λ∈0.1,0.2,…,0.9λ∈\0.1,0.2,…,0.9\, retrieve the nearest prompt in vocabulary space for each interpolated embedding, and evaluate whether it passes all filters with CLIPScore above 0.26. TABLE IV: Survival rates (%) across datasets under different λ settings Dataset Midpoint (λ=0.5λ=0.5) Average over λ NSFW-200 23.5 31.2 UnsafeDiff 19.2 28.4 I2P 15.6 25.6 As shown in Tab IV, only 23.5% of midpoint interpolations survive on NSFW-200. The majority of straight-line paths between two feasible prompts cross detection boundaries, confirming that the feasible region is non-convex and consists of disjoint or irregularly shaped components. This explains why greedy single-direction methods get trapped at local dead ends. They move along one trajectory until blocked and cannot navigate around non-convex boundaries. CRACK’s multi-round debate with strategy switching allows the search trajectory to change direction across rounds, effectively navigating through prompt space to reach feasible components that are inaccessible via straight-line paths. This also explains why the ablation without RL suffers an ASR drop. Without learned strategy switching, the search cannot adapt its direction when encountering convex barriers. V-B3 RQ3: Ablation Study To evaluate the contribution of each module, we conduct component-wise ablations on SD 1.4 under the one-time attack setting, as summarized in table V. Effect of multi-agent debate. We first test the attack agent in isolation (attack agent only), where it generates prompt mutations without any feedback. Compared to the full CRACK system, ASR drops substantially across all filters and datasets, while CLIPScore remains low, indicating that blind mutations can occasionally bypass a filter but fail to preserve semantic intent. Removing the defense agent (w/o defense agent) leads to further ASR degradation, particularly on text-image-c where ASR falls to 44.15% on I2P and 30.16% on NSFW-200. Without explicit identification of which filter rejected the prompt, the attack agent cannot direct its mutations toward the actual detection bottleneck. Removing the judge agent (w/o judge agent) preserves moderate ASR but causes CLIPScore to collapse, dropping below 0.12 on multiple dataset-filter pairs. Without quality control, the system generates prompts that evade filters by drifting far from the original meaning, producing images unrelated to the target content. These results confirm that the three agents serve complementary roles and that removing any one of them breaks either the evasion capability or the semantic preservation guarantee. Effect of RL. Replacing the RL-based strategy selector with a fixed policy (w/o RL) reduces ASR by 10–20% across filters compared to the full system, with the largest drops on text-image-c. Without reward-guided updates, the system cannot learn which strategy works against which filter configuration, falling back to suboptimal choices that waste query budget. This aligns with the cross-layer conflict finding in RQ2, where no fixed strategy performs uniformly well. Effect of strategy diversity. Restricting the strategy library to a single strategy (metaphor replacement) produces the lowest overall ASR among all ablations, with performance on text-image-c dropping to 43.12% on I2P. This variant also underperforms the w/o RL ablation, which at least retains access to multiple strategies even without learned selection. The gap confirms that strategy diversity is not redundant with RL. Even a perfect selector cannot compensate if the underlying strategy set lacks coverage across filter modalities. TABLE V: Ablation study on Stable Diffusion 1.4 under the one-time prompt attack setting. Method Safety Filter ASR-Q16 (%) ASR-NudeNet (%) CLIPScore I2P UnsafeDiff NSFW-200 I2P UnsafeDiff NSFW-200 attack agent only text-image-c 60.12 59.02 55.12 0.19 0.33 0.21 text-m 83.10 85.56 80.16 0.16 0.35 0.12 image-c 55.12 49.21 49.16 0.20 0.39 0.19 w/o defense agent text-image-c 44.15 37.63 30.16 0.23 0.31 0.11 text-m 70.03 71.03 63.97 0.25 0.26 0.23 image-c 61.33 63.43 50.04 0.21 0.29 0.10 w/o judge agent text-image-c 61.13 51.02 55.63 0.10 0.31 0.11 text-m 78.06 75.21 73.16 0.10 0.16 0.06 image-c 72.13 78.01 70.54 0.11 0.34 0.12 w/o RL text-image-c 54.65 51.01 50.12 0.22 0.29 0.13 text-m 69.16 72.01 66.13 0.21 0.31 0.22 image-c 70.01 65.01 63.28 0.11 0.21 0.15 only one strategy (metaphor replacement) text-image-c 43.12 48.78 51.03 0.20 0.30 0.16 text-m 62.13 63.31 61.23 0.23 0.26 0.15 image-c 56.45 57.01 61.03 0.21 0.23 0.19 V-B4 RQ4: Sensitivity Study We analyze the sensitivity of CRACK to three key factors, including the number of debate rounds, the weighting coefficients α and β in Eq. (28), and the choice of LLM backbone for each agent. A summary of key results is provided below, with full details provided in the Supplementary. Debate rounds. As shown in Fig. 11a, the ASR reaches highest by round 3 and shows no further improvement, while the CLIPScore peaks at the same round before declining due to semantic drift. Thus, three rounds achieve the best balance between attack effectiveness and fidelity. Weighting factors α and β. The trade-off between bypass success and semantic fidelity is mainly governed by these weights. Increasing α, which emphasizes LLM-based risk assessment, reduces detectable harmful intent and raises bypass rates but also decreases the CLIPScore. Conversely, higher β emphasizes CLIPScore, enhancing image-text alignment at the cost of slightly lower bypass success. A balanced configuration of α=0.3α=0.3 and β=0.7β=0.7 achieves the optimal compromise between bypass success and quality, as shown in Fig. 11b. LLM backbones. CRACK demonstrates strong robustness across different LLM backbones, with only marginal performance variation (see Supplementary Sec. References). CRACK consistently maintains stable performance without significant degradation compared to the results obtained with DeepSeek V3. This stability arises because the debate and reward mechanisms are largely model-agnostic, decoupling task reasoning from specific language patterns. Fig. 11: (a) Impact of debate round count on ASR and CLIPScore. (b) Performance variation with different values of α and β in the reward function. We conducted experiments on SD 1.4 and evaluated performance under the text-image-c safety filter of the NSFW-200 dataset. V-B5 RQ5: Extended Evaluations To further validate the comprehensiveness of our model, we evaluate FID Scores [52] under the same settings as [17, 8], measuring distribution-level similarity between generated and real images. Following prior work, FID is computed against two ground-truth datasets [53]. Since they contain only real adult images, experiments are conducted on NSFW-200, where CRACK achieves consistently lower FID than all baselines. To verify generalization without producing NSFW content, we also follow [17, 8] to test on Dog/Cat-100. By replacing animal entities with harmful targets, CRACK generates coherent dog and cat images without explicit mentions, demonstrating strong semantic control and adaptability (see Supplementary Sec. References). VI Conclusion This paper presents CRACK, a multi-agent debate framework for jailbreaking heterogeneous safety stacks in T2I systems. To characterize the challenges posed by composed defenses, we formulated the Detection Surface and identified three structural properties of the joint evasion region, namely cross-layer conflict, sparsity, and non-convexity. CRACK addresses these properties through an iterative debate process among three specialized agents that combines layer-wise diagnosis, adaptive strategy selection, and reward-guided iterative refinement for layer-aware navigation of the Detection Surface. Experiments across four T2I models demonstrate improved attack effectiveness and query efficiency under composed defenses while preserving semantic fidelity. Our results carry a concrete defensive message. Stacking heterogeneous filters does not by itself close the feasible region, since the cracks between layers remain exploitable precisely because the layers are optimized independently. Future robust defense should treat the stack as a joint decision surface rather than separate gates, co-design filters so their safe regions overlap more tightly, and audit stacks against directed rather than random search. Our future work will include extending the surrogate to unknown or adaptive commercial defenses and applying the Detection Surface formalism to other compositional safety pipelines. References [1] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer (2022) High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 10684–10695. Cited by: §I, §V-A. [2] D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. Müller, J. Penna, and R. Rombach (2023) SDXL: improving latent diffusion models for high-resolution image synthesis. External Links: 2307.01952, Link Cited by: §I, §V-A. [3] Z. Shi, X. Zhou, X. Qiu, and X. Zhu (2020) Improving image captioning with better use of captions. External Links: 2006.11807, Link Cited by: §I, §V-A. [4] Midjourney.com (2022) Midjourney. Note: https://midjourney.com/ Cited by: §I, §V-A. [5] N. Ahn, J. Lee, C. Lee, K. Kim, D. Kim, S. Nam, and K. Hong (2023) DreamStyler: paint by style inversion with text-to-image diffusion models. External Links: 2309.06933, Link Cited by: §I. [6] T. Wang and M. Ye (2024) TexFit: text-driven fashion image editing with diffusion models. In Proceedings of the Thirty-Eighth AAAI Conference on Artificial Intelligence and Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence and Fourteenth Symposium on Educational Advances in Artificial Intelligence, AAAI’24/IAAI’24/EAAI’24. External Links: ISBN 978-1-57735-887-9, Link, Document Cited by: §I. [7] P. Cao, F. Zhou, Q. Song, and L. Yang (2024) Controllable generation with text-to-image diffusion models: a survey. External Links: 2403.04279, Link Cited by: §I. [8] Y. Yang, B. Hui, H. Yuan, N. Gong, and Y. Cao (2024) SneakyPrompt: jailbreaking text-to-image generative models. In Proceedings of the IEEE Symposium on Security and Privacy, Cited by: §I, §I, §I-A, §I-D, TABLE I, §I-C, §IV-A, §IV-B, §IV-B, §V-A, §V-A, §V-B5. [9] C. Y. Hsu, Y. L. Tsai, C. Xie, C. H. Lin, J. Y. Chen, B. Li, P. Y. Chen, C. M. Yu, and C. Y. Huang (2024) RING-a-bell! how reliable are concept removal methods for diffusion models?. In 12th International Conference on Learning Representations, ICLR 2024, Cited by: §I, §I, §I-A, §I-B, TABLE I, §V-A. [10] J. Rando, D. Paleka, D. Lindner, L. Heim, and F. Tramèr (2022) Red-teaming the stable diffusion safety filter. External Links: 2210.04610, Link Cited by: §I, §IV-B. [11] OpenAI (2023) DALL-e 3 system card. Note: https://openai.com/index/dall-e-3-system-card/ Cited by: §I, §I-B, §I-B, §IV-B. [12] Y. Deng and H. Chen (2024) Harnessing llm to attack llm-guarded text-to-image models. External Links: 2312.07130, Link Cited by: §I, §I-B, §IV-B. [13] P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting (2023) Safe latent diffusion: mitigating inappropriate degeneration in diffusion models. External Links: 2211.05105, Link Cited by: §I, §I-B. [14] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever (2021) Learning transferable visual models from natural language supervision. External Links: 2103.00020, Link Cited by: §I, §I-B, §IV-B. [15] J. Hessel, A. Holtzman, M. Forbes, R. L. Bras, and Y. Choi (2022) CLIPScore: a reference-free evaluation metric for image captioning. External Links: 2104.08718, Link Cited by: §I, §IV-B. [16] Y. Huang, L. Liang, T. Li, X. Jia, R. Wang, W. Miao, G. Pu, and Y. Liu (2025) Perception-guided jailbreak against text-to-image models. External Links: 2408.10848, Link Cited by: §I, §I-A, TABLE I, §IV-A, §V-A. [17] Y. Dong, X. Meng, N. Yu, Z. Li, and S. Guo (2025) Fuzz-testing meets llm-based agents: an automated and efficient framework for jailbreaking text-to-image generation models. External Links: 2408.00523, Link Cited by: §I, §I-A, §I-C, TABLE I, §IV-A, §IV-B, §V-A, §V-A, §V-B5. [18] Z. Chen, H. Lin, K. Xu, X. Jiang, and T. Sun (2026) Dynamic optimization and safety indicator injection for jailbreaking text-to-image models with multimodal safety filters. External Links: 2505.18979, Link Cited by: §I, §I. [19] Y. Yang, R. Gao, X. Wang, T. Ho, N. Xu, and Q. xu (2024) MMA-diffusion: multimodal attack on diffusion models. In 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Vol. , p. 7737–7746. External Links: Document Cited by: §I-A, TABLE I, §V-A, §V-A. [20] Y. Deng and H. Chen (2024) Harnessing llm to attack llm-guarded text-to-image models. External Links: 2312.07130, Link Cited by: §I-A, §I-C, TABLE I, §IV-A, §V-A. [21] Z. Chin, C. Jiang, C. Huang, P. Chen, and W. Chiu (2024) Prompting4Debugging: red-teaming text-to-image diffusion models by finding problematic prompts. In International Conference on Machine Learning (ICML), External Links: Link Cited by: §I-A. [22] H. Zheng, Y. He, T. Chen, S. Shao, Z. Chu, H. Zhou, L. Tao, Z. Qin, and K. Ren (2026) JANUS: a lightweight framework for jailbreaking text-to-image models via distribution optimization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 15719–15729. Cited by: TABLE I. [23] X. Ye, Y. Liu, L. Wang, R. Wang, G. Yang, Y. Hou, and J. Yu (2026) MacPrompt: maraconic-guided jailbreak against text-to-image models. External Links: 2601.07141, Link Cited by: TABLE I. [24] R. George (2020) NSFW words list. Note: https://github.com/rrgeorge-pdcontributions/NSFW-Words-List Cited by: §I-B. [25] R. Gandikota, J. Materzynska, T. Fiotto-Kaufman, and D. Bau (2023) Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, Cited by: §I-B. [26] LAION-AI (2023) CLIP-based NSFW detector. Note: https://github.com/LAION-AI/CLIP-based-NSFW-Detector Cited by: §I-B. [27] notAI.tech NudeNet. Note: https://github.com/notAI-tech/NudeNetAccessed: 2026-07-15 Cited by: §I-B. [28] P. Schramowski, C. Tauchmann, and K. Kersting (2022) Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content?. Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency. External Links: Link Cited by: §I-B, §V-A. [29] Y. Du, S. Li, A. Torralba, J. B. Tenenbaum, and I. Mordatch (2024) Improving factuality and reasoning in language models through multiagent debate. In Proceedings of the 41st International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 235, p. 11733–11763. External Links: Link Cited by: §I-C. [30] T. Liang, Z. He, W. Jiao, X. Wang, Y. Wang, R. Wang, Y. Yang, S. Shi, and Z. Tu (2024) Encouraging divergent thinking in large language models through multi-agent debate. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, Miami, Florida, USA, p. 17889–17904. External Links: Link, Document Cited by: §I-C. [31] S. Yue, S. Wang, W. Chen, X. Huang, and Z. Wei (2025) Synergistic multi-agent framework with trajectory learning for knowledge-intensive tasks. External Links: 2407.09893, Link Cited by: §I-C. [32] A. Smit, N. Grinsztajn, P. Duckworth, T. D. Barrett, and A. Pretorius (2024) Should we be going mad? a look at multi-agent debate strategies for llms. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. Cited by: §I-C. [33] P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong (2023) Jailbreaking black box large language models in twenty queries. External Links: 2310.08419 Cited by: §I-C. [34] A. Mehrotra, M. Zampetakis, P. Kassianik, B. Nelson, H. Anderson, Y. Singer, and A. Karbasi (2024) Tree of attacks: jailbreaking black-box llms automatically. External Links: 2312.02119, Link Cited by: §I-C. [35] M. Samvelyan, S. C. Raparthy, A. Lupu, E. Hambro, A. H. Markosyan, M. Bhatt, Y. Mao, M. Jiang, J. Parker-Holder, J. Foerster, T. Rocktäschel, and R. Raileanu (2024) Rainbow teaming: open-ended generation of diverse adversarial prompts. External Links: 2402.16822, Link Cited by: §I-C. [36] A. Zhou, K. Wu, F. Pinto, Z. Chen, Y. Zeng, Y. Yang, S. Yang, S. Koyejo, J. Zou, and B. Li (2025) AutoRedTeamer: autonomous red teaming with lifelong attack integration. External Links: 2503.15754, Link Cited by: §I-C. [37] J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov (2017) Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347. Cited by: §I-D. [38] E. Perez, S. Huang, F. Song, T. Cai, R. Ring, J. Aslanides, A. Glaese, N. McAleese, and G. Irving (2022) Red teaming language models with language models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, Cited by: §I-D. [39] G. Montúfar, R. Pascanu, K. Cho, and Y. Bengio (2014) On the number of linear regions of deep neural networks. In Proceedings of the 28th International Conference on Neural Information Processing Systems - Volume 2, NIPS’14, Cambridge, MA, USA, p. 2924–2932. Cited by: §I-C. [40] W. He, B. Li, and D. Song (2018) Decision boundary analysis of adversarial examples. In International Conference on Learning Representations, External Links: Link Cited by: §I-C. [41] R. George (2020) NSFW-words-list. Note: https://github.com/rrgeorge-pdcontributions/NSFW-Words-List/blob/master/nsfw_list.txt Cited by: §IV-B, §V-A. [42] M. Han, L. Zhang, J. Wang, and W. Pan (2020) Actor-critic reinforcement learning for control with stability guarantee. IEEE Robotics and Automation Letters 5 (4), p. 6217–6224. External Links: Document Cited by: §IV-D. [43] P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting (2023) Safe latent diffusion: mitigating inappropriate degeneration in diffusion models. External Links: 2211.05105, Link Cited by: §V-A. [44] Y. Qu, X. Shen, X. He, M. Backes, S. Zannettou, and Y. Zhang (2023) Unsafe diffusion: on the generation of unsafe images and hateful memes from text-to-image models. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS ’23, New York, NY, USA, p. 3403–3417. External Links: ISBN 9798400700507, Link, Document Cited by: §V-A. [45] M. Li (2022) Nsfw text classifier on hugging face. Note: https://huggingface.co/michellejieli/NSFWtextclassifier Cited by: §V-A. [46] L. Chhabra (2020) Nsfw image classifer on github. Note: https://github.com/lakshaychhabra/NSFW-Detection-DL Cited by: §V-A. [47] LAION-AI (2023) Nsfw clip based image classifier on github. Note: https://github.com/LAION-AI/CLIP-based-NSFW-Detector Cited by: §V-A. [48] P. Bedapudi (2019) NudeNet: neural nets for nudity classification, detection and selective censoring. Note: https://github.com/notAI-tech/NudeNet Cited by: §V-A. [49] DeepSeek-AI, A. Liu, B. Feng, B. Xue, B. Wang, B. Wu, C. Lu, C. Zhao, C. Deng, and et al (2025) DeepSeek-v3 technical report. External Links: 2412.19437, Link Cited by: §V-A. [50] A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, and et al (2025) Qwen3 technical report. External Links: 2505.09388, Link Cited by: §V-A. [51] OpenAI, J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, and et al (2024) GPT-4 technical report. External Links: 2303.08774, Link Cited by: §V-A. [52] G. Parmar, R. Zhang, and J. Zhu (2022) On aliased resizing and surprising subtleties in gan evaluation. External Links: 2104.11222 Cited by: §V-B5. [53] A. Kim (2022) Nsfw image dataset. Note: https://github.com/alex000kim/nsfw_data_scraper Cited by: §V-B5.