Paper deep dive
Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models
Xingkai Peng, Jun Jiang, Jiayang Liu, Kejiang Chen, Weiming Zhang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 7/21/2026, 4:49:56 AM
Summary
The paper introduces BSB, a structured and query-efficient jailbreak framework for Text-to-Video (T2V) models. BSB exploits temporal consistency by decomposing harmful intents into two individually benign boundary states (start and end of a video). It uses Monte Carlo Tree Search (MCTS) in a textual proxy space to find boundary pairs that, when interpolated by the T2V model, generate unsafe intermediate content. BSB outperforms existing baselines with an 18.6% relative gain in attack success rate across models like Veo 3.1, Sora 2, Seedance, and Kling v1.
Entities (10)
Relation Signals (9)
BSB → evaluatedon → Veo-3.1
confidence 95% · We conduct comprehensive experiments on mainstream commercial T2V models including Veo 3.1...
BSB → evaluatedon → Kling v1
confidence 95% · We conduct comprehensive experiments on mainstream commercial T2V models including ... Kling v1.
BSB → evaluatedon → Seedance
confidence 95% · We conduct comprehensive experiments on mainstream commercial T2V models including ... Seedance ...
BSB → evaluatedon → Sora 2
confidence 95% · We conduct comprehensive experiments on mainstream commercial T2V models including ... Sora 2 ...
BSB → exploits → Temporal Consistency
confidence 95% · BSB harnesses temporal consistency by encoding harmful intent as the transition between two individually harmless boundary states.
BSB → uses → Monte Carlo Tree Search
confidence 92% · BSB conducts Monte Carlo Tree Search (MCTS) in a cheaper textual proxy space...
Existing Methods → suffersfrom → Temporal Consistency Underutilization
confidence 90% · They fail to fully leverage temporal consistency, an inherent characteristic of video generation.
BSB → outperforms → SceneSplit
confidence 88% · Results show BSB surpasses all existing jailbreak baselines...
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Recently, text-to-video (T2V) models have been widely deployed, sparking growing concerns over their robustness against jailbreak attacks. Existing jailbreak methods, mostly adapted from text-to-image attacks, suffer notable drawbacks when applied to T2V systems. They fail to fully leverage temporal consistency, an inherent characteristic of video generation. Besides, these methods demand heavy video query optimization, which is infeasible in practical black-box scenarios. Their adversarial prompt search is also driven by heuristic local signals, lacking principled structured exploration strategies. To tackle these limitations, we propose BSB, a structured, query-efficient jailbreak framework for T2V models. BSB harnesses temporal consistency by encoding harmful intent as the transition between two individually harmless boundary states. Under this paradigm, the attack targets boundary-state pairs whose interpolation tends to produce unsafe intermediate frames during video generation. Directly evaluating all candidate pairs within the video space incurs prohibitive computation cost. Instead, BSB conducts Monte Carlo Tree Search (MCTS) in a cheaper textual proxy space and regularly calibrates search outcomes with sparse video-level evaluations. We conduct comprehensive experiments on mainstream commercial T2V models including Veo 3.1, Sora 2, Seedance and Kling v1. Results show BSB surpasses all existing jailbreak baselines, delivering an average 18.6% relative gain in attack success rate over the strongest competitor across evaluated models. Our findings identify temporal consistency as an understudied yet vital attack surface for T2V models and verify that structured search facilitates effective vulnerability discovery under constrained query budgets.
Tags
Links
- Source: https://arxiv.org/abs/2607.17279v1
- Canonical: https://arxiv.org/abs/2607.17279v1
Trouble viewing inline? Open PDF directly →
Full Text
58,686 characters extracted from source content.
Expand or collapse full text
Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models Xingkai Peng penglevy@mail.ustc.edu.cn University of Science and Technology of ChinaHefeiAnhuiChina , Jun Jiang jungle0430@mail.ustc.edu.cn University of Science and Technology of ChinaHefeiAnhuiChina , Jiayang Liu ljyljy957@gmail.com University of Science and Technology of ChinaHefeiAnhuiChina , Weiming Zhang zhangwm@ustc.edu.cn University of Science and Technology of ChinaHefeiAnhuiChina and Kejiang Chen chenkj@ustc.edu.cn University of Science and Technology of ChinaHefeiAnhuiChina (2018) Abstract. Recently, text-to-video (T2V) models have seen rapid adoption across a wide range of applications, raising increasing concerns about their safety under jailbreak attacks. However, existing jailbreak methods, primarily adapted from text-to-image paradigms, face significant limitations in T2V settings. Specifically, these approaches often underutilize temporal consistency, which is an intrinsic property of video generation. Furthermore, they typically rely on intensive video queries optimization processes that are impractical under realistic black-box constraints. Moreover, adversarial prompt search in these methods is guided by heuristic local feedback rather than a principled strategy for structured exploration. To address these challenges, we propose BSB, a structured and query-efficient jailbreak framework for T2V models. BSB exploits temporal consistency by reframing harmful intent as a transition between two individually benign boundary states. Under this formulation, the attack reduces to finding boundary-state pairs whose interpolation is most likely to elicit unsafe intermediate content during video generation. Since directly evaluating such pairs in the video space is prohibitively expensive, BSB performs Monte Carlo Tree Search (MCTS) in a low-cost textual proxy space and periodically calibrates the search with sparse video-based evaluations. Extensive experiments on representative commercial T2V models, including Veo 3.1, Sora 2, Seedance, and Kling v1, demonstrate that BSB consistently outperforms prior jailbreak baselines. Specifically, BSB achieves an 18.6% average relative improvement in attack success rate over the strongest baseline across these commercial models. Overall, our results reveal temporal consistency as a critical yet underexplored attack surface in T2V models and show that structured search enables efficient vulnerability discovery under limited query budgets. Disclaimer: This paper includes potentially harmful or offensive images that may not be suitable for all readers. Multimodal Attack, Text-to-Video Models, Temporal Consistency, Jailbreak Attack †copyright: acmlicensed†journalyear: 2018†doi: X.X†conference: Make sure to enter the correct conference title from your rights confirmation email; June 03–05, 2018; Woodstock, NY†isbn: 978-1-4503-X-X/2018/06†submissionid: 1844†ccs: Security and privacy Social aspects of security and privacy†ccs: safety and privacy Software and application safety 1. Introduction In recent years, diffusion-based generative models have fueled remarkable advances in text-to-video (T2V) synthesis. Modern representative models, including Wan2.2 (Wang et al., 2025a), Sora 2 (Peng et al., 2025), Kling v1 (Team, 2025), Veo 3.1 (Wiedemer et al., 2025), and Seedance (Seedance et al., 2025), can generate high-fidelity, prompt-aligned videos from natural language prompts. Alongside such progress, safety risks associated with T2V models have grown increasingly critical. Analogous to large language models (LLMs) and text-to-image (T2I) models, T2V models are susceptible to jailbreak attacks: adversaries design malicious prompts to circumvent built-in safety filters and trigger the generation of harmful, policy-violating video content. Figure 1. Illustration of BSB. Given a harmful intent, BSB searches for two benign boundary states, A and C, that specify the beginning and end of the video and can individually bypass safety filters. Conditioned on these two searched adversarial prompts, the T2V model automatically synthesizes intermediate states, such as B, to maintain temporal consistency. Although A and C are safe in isolation, the auto-completed intermediate state B may exhibit unsafe semantics, thereby enabling harmful generation. While jailbreak attacks have been extensively studied in LLM and T2I domains (Zhao et al., 2025; Zou et al., 2023; Yang et al., 2024; Ba et al., 2024; Tsai et al., 2024), security research on T2V models remains in its early stages. Current commercial T2V models commonly adopt two lines of defense: text-based and video-based safety filters (Liang et al., 2025). Yet, the robustness of these defensive mechanisms against practical black-box adversarial attacks remains largely unexamined, making it crucial to explore the safety boundaries of state-of-the-art (SOTA) T2V models. Existing work (Miao et al., 2024; Liu et al., 2025; Ying et al., 2026; Wang et al., 2025b) in this area has progressed along two complementary directions: safety evaluation and active jailbreak exploration. On the evaluation side, T2VSafetyBench (Miao et al., 2024) establishes a structured safety taxonomy and benchmark dataset, enabling large-scale assessment of safety risks in T2V models. On the attack side, subsequent studies progressively refined jailbreak strategies. T2V-OptJail (Liu et al., 2025) formulates jailbreak as a discrete prompt optimization problem, refining unsafe prompts to bypass safety filters while maintaining semantic alignment. Building on this, RunwayEvil (Wang et al., 2025b) further proposes a self-evolving multimodal jailbreak framework for I2V models that dynamically coordinates text-image attacks to outperform existing methods. Concurrently, SceneSplit (Lee et al., 2025) proposes a black-box method that decomposes a harmful narrative into multiple individually benign scenes whose sequential combination steers the model toward unsafe outcomes. Despite this progress, prior T2V jailbreak methods underexplore attack surfaces unique to video generation. Many inherit prompt-centric strategies from T2I attacks, while even T2V-specific methods such as SceneSplit rely on explicit scene composition rather than temporally coherent interpolation between benign conditions. As a result, temporal consistency remains insufficiently explored in prior work. Beyond this conceptual gap, existing methods rely heavily on interaction with the target T2V model, repeatedly generating full video outputs during the search process. Given the computational demands and practical constraints of commercial T2V models, such direct iteration can introduce substantial overhead in realistic black-box settings. Furthermore, prompt refinement in existing methods is typically driven by heuristic LLM feedback, guiding the search based solely on immediate model responses. Without an explicit mechanism to compare and evaluate alternative exploration paths, the search process remains largely reactive and difficult to control under limited query budgets. To bridge this gap, we propose a novel framework for T2V models that explicitly incorporates temporal characteristics while enabling structured, query-efficient exploration. Our framework is built on a key insight: unlike static T2I models, T2V generation is inherently governed by temporal consistency, which enforces coherent semantic evolution across frames. Rather than directly rewriting a harmful prompt or repeatedly querying the video model, we decompose the target intent along the temporal dimension and construct two benign boundary states corresponding to the beginning and end of the video. While each boundary state is individually safe and can pass existing safety filters, temporal consistency forces the model to generate a coherent transition between them. As a result, the generative trajectory may traverse intermediate states that exhibit unsafe semantic evolution, thereby inducing harmful content even though both boundary states remain benign. To further reduce attack cost, we relocate the primary exploration process to the textual domain. Candidate prompts are explored within a lower-cost text proxy space, while video generation is reserved for sparse feedback stages. This design significantly reduces reliance on repeated full video generation under realistic black-box constraints. Within this proxy space, we formulate prompt transformation as a sequential decision process and perform search using Monte Carlo Tree Search (MCTS). Each node represents a pair of boundary prompts, and each action corresponds to a rewriting operation that produces a new candidate pair. Unlike prior methods that iteratively update a single prompt based on local feedback, MCTS maintains a set of competing candidates and explicitly explores multiple rewriting trajectories. The search is guided by a UCT-based policy, which balances exploring new transformations and exploiting high-reward candidates under a limited query budget. Extensive evaluations on representative commercial T2V models demonstrate that BSB consistently outperforms existing baselines. Specifically, it achieves an 18.6% average relative improvement in attack success rate (ASR) over the strongest baseline on commercial models, including Veo 3.1, Sora 2, Seedance, and Kling v1. In summary, our contributions are as follows: • We identify temporal consistency as a new attack surface for T2V jailbreaks. By constructing two individually benign boundary states, we demonstrate that the generated video trajectory can generate unsafe intermediate semantics without exposing explicit violations at either boundary. • We propose BSB, a structured and practical jailbreak framework for T2V models. BSB shifts optimization to the text space, making jailbreak attacks more feasible in real-world black-box settings by reducing dependence on repeated video generation. Built on this design, it further incorporates MCTS-based search to improve attack success and support more structured exploration. • We conduct extensive experiments across diverse T2V models, demonstrating that BSB not only achieves SOTA ASR but also exhibits superior resilience against various safety filters, underscoring an underexplored deficiency in modern T2V defensive frameworks. 2. Related Work 2.1. Text-to-Video Generative Models Text-to-video (T2V) generation has undergone rapid evolution with advances in large-scale generative modeling and multimodal learning. Early methods extend text-to-image synthesis to the temporal domain using frame-wise generation or interpolation, enabling the synthesis of short videos but with limited temporal coherence (Hong et al., 2023; Singer et al., 2023; Ho et al., 2022). Subsequent work emphasizes explicit spatio-temporal modeling, with diffusion-based architectures becoming the dominant paradigm. Video Diffusion Models and related methods jointly model spatial and temporal dimensions, substantially improving motion consistency and long-range dynamics (Blattmann et al., 2023). More recent models further unify text, image, and video generation within shared latent or transformer-based architectures, leveraging large-scale multimodal pretraining to enhance semantic alignment and scene dynamics (Villegas et al., 2023; Chen et al., 2024; Khachatryan et al., 2023). These advances are reflected in both open-source and commercial T2V models. Open-source models such as Wan2.2 focus on scalable spatio-temporal modeling and controllable generation, while commercial models including Veo 3.1, Sora 2, Seedance, and Kling v1 demonstrate state-of-the-art performance in high-resolution, temporally coherent video synthesis (Wang et al., 2025a; Wiedemer et al., 2025; Peng et al., 2025; Seedance et al., 2025; Team, 2025). Despite their success, the increasing realism and accessibility of T2V models raise new safety concerns, as video generation introduces an additional temporal dimension that amplifies the potential for harmful content (Liu et al., 2025; Wang et al., 2025b). 2.2. Jailbreaking Text-to-Video Models Compared to text-to-image (T2I) models, jailbreak research on text-to-video (T2V) generation remains relatively underexplored, despite the growing capability of T2V models to produce realistic and temporally coherent video content, providing more attack angles. Current progress on T2V jailbreak research can be broadly categorized into two directions. The first line of work focuses on benchmark construction for systematic safety evaluation. Representative efforts such as T2VSafetyBench curate unsafe or policy-violating prompts from existing multimodal safety benchmarks and leverage large language models to expand malicious prompt sets, enabling standardized evaluation across multiple T2V models (Miao et al., 2024; Qu et al., 2025; Wang and Yang, 2024). These benchmarks provide valuable foundations for measuring unsafe video generation but primarily emphasize coverage and evaluation, rather than the efficiency or adaptivity of jailbreak strategies. The second line of work explores jailbreak methods tailored to T2V models. Recent studies propose optimization-based pipelines that iteratively rewrite or mutate prompts using large language models (LLMs), coupled with multimodal consistency checks to maintain semantic coherence while improving attack success rates. For example, T2V-OptJail (Liu et al., 2025) formulates T2V jailbreaks as a discrete prompt optimization problem, employing a joint optimization approach that simultaneously seeks to bypass safety filters and preserve semantic consistency. Another notable approach, based on a scene splitting strategy, deconstructs a harmful narrative into a sequence of benign scenes, bypassing safety filters that evaluate prompts in isolation by constraining the model’s generative output space through sequential composition (Lee et al., 2025). Furthermore, frameworks like RunwayEvil (Wang et al., 2025b) apply reinforcement learning and LLM-based exploration to autonomously expand attack strategies for image-to-video models, demonstrating high adaptability and attack success by exploiting cross-modal interactions between text and image. These frameworks highlight that T2V models are vulnerable to structured prompt manipulation, thereby exposing a potential avenue for more targeted attacks. Our work builds upon this line of research by similarly adopting prompt optimization and LLM-guided search as core components for exploring the jailbreak space. The above methods largely focus on how prompts are optimized, but treat video generation itself as a black-box outcome of these manipulations. Consequently, they typically rely on frequent video generation or dense multimodal evaluation as feedback signals, resulting in substantial computational overhead and limited scalability under practical query budgets. Moreover, these methods largely overlook a key property intrinsic to video generation, namely, temporal continuity, which governs how visual content evolves coherently over time and plays a critical role in the safety behavior of T2V models. 3. Method Figure 2. Overview of BSB, a temporal jailbreak framework for text-to-video models. BSB exploits temporal consistency between two individually safe boundary states to elicit unsafe intermediate semantics in the video. (A) Temporal Boundary Decomposition constructs benign boundary prompts from the harmful target intent. (B) Text-side Proxy Search explores and refines boundary candidates in a low-cost textual space under a composite reward. (C) Sparse Video-based Calibration verifies promising candidates in the video domain and feeds grounded feedback back into the search process. These three components form a structured and query-efficient pipeline for jailbreaking text-to-video models. In this section, we first define the Threat Model that underpins our work. We then provide an overview of the BSB framework, including the core components and their roles in the overall system. Following this, we present a detailed description of each key component and elaborate on the workflow of BSB, highlighting the effect of these components and how they collaboratively address the problem of text-to-video (T2V) model jailbreaks. 3.1. Threat Model We study jailbreak attacks against an online T2V generation model under a black-box setting. We model the target system as a video generation model ℳM that is accessible only through an API. Given a text prompt p, the model either returns a generated video ℳ(p)M(p) or produces a refused response due to its built-in safety mechanisms. Since modern T2V models are typically equipped with safety filters, directly submitting sensitive prompts usually results in rejection or non-informative outputs. Adversary Goal. The adversary is a malicious user whose objective is to generate videos that violate the content policy of the model (referred to as harmful videos). To this end, the adversary aims to construct a jailbreak prompt p~ p that can bypass the deployed safety filters while still inducing ℳM to generate harmful content. In other words, the attacker seeks to transform an initially sensitive request into a modified prompt that evades detection yet preserves the malicious intent. Black-box Access and Cost Constraint. We assume that the adversary has no knowledge of the internal architecture, parameters, training data of ℳM, nor the implementation details of its safety mechanisms. The adversary can only interact with the model via API queries and observe whether a prompt is accepted and a video is returned. Moreover, T2V generation is computationally expensive and often charged on a per-query basis. Therefore, we assume the adversary operates under a bounded video query budget, making query efficiency a critical constraint. Safety Filters. We assume the defender deploys commonly used safety mechanisms in contemporary T2V models. In particular, we consider two types of filters and assume that the defender adopts one or both of them: • Text-based safety filter ℱtextF_text. This filter evaluates the input prompt prior to video generation and blocks prompts deemed sensitive. In practice, ℱtextF_text is often implemented as a binary classifier operating on the raw text or its embedding representation, or as a rule-based mechanism relying on predefined lists of sensitive keywords or phrases. Its purpose is to prevent unsafe prompts from reaching the video generator. • Video-based safety filter ℱvideoF_video. This filter evaluates the generated video after synthesis. A typical implementation samples frames from the generated video and applies harmful content detection to each sampled frame using a binary image classifier trained on labeled safe and unsafe images. If any sampled frame is classified as harmful, the entire video is flagged as unsafe, and the generation is rejected. We denote the overall safety pipeline as ℱF, which may consist of ℱtextF_text, ℱvideoF_video, or their combination. A prompt p is accepted only if it passes the pre-generation text-based filter and the resulting video passes the post-generation video-based filter; otherwise, the model returns a refusal or a sanitized output. Adversary Capability. Consistent with prior work on automated jailbreak attacks, we assume the adversary has sufficient resources and expertise to develop or employ an auxiliary language model to iteratively generate and refine candidate prompts based on the observed accept/refuse feedback, while remaining subject to the aforementioned query budget constraint. 3.2. Key Idea and Overall Pipeline Our attack exploits a fundamental property that T2V models must preserve, namely, temporal consistency. Temporal consistency enforces coherent dependencies between adjacent frames, ensuring smooth and continuous video generation along the temporal dimension. Unlike traditional jailbreaking attacks that directly manipulate the target prompt, our approach operates on the prompt across time. By decomposing a harmful target intent along the temporal dimension, the video model, to preserve temporal consistency, may generate intermediate frames that contain harmful content. This attack bypasses existing safety filters because such filters typically assess the prompt or output as a whole and fail to account for the temporal evolution of content during the video generation process. Given a target prompt p containing harmful intent, we first employ a large language model as a semantic analyzer to identify the semantic component h that describes the harmful event while preserving the remaining benign context. We then use the same model to derive two alternative textual descriptions, h−h^- and h+h^+, corresponding to the temporal boundary states immediately before and immediately after the harmful event. Neither description explicitly states the harmful event itself; instead, both remain textually natural, contextually coherent with the original prompt, and individually bypass text-based safety filters when evaluated in isolation. By replacing h with h−h^- and h+h^+, we obtain two boundary prompts, denoted as p−p^- and p+p^+. These prompts specify the pre-event and post-event conditions of the original harmful event, respectively, while preserving semantic coherence with the safe part of the original prompt. Consequently, both boundary prompts remain linguistically natural and contextually grounded. Crucially, this boundary-based substitution is only effective in the context of T2V generation. Unlike static generation settings, video models are explicitly trained to maintain temporal consistency across frames, enforcing smooth semantic evolution over time. When conditioned on p−p^- and p+p^+, the model is therefore encouraged to generate a temporally coherent sequence that implicitly explores the semantic space between the two boundary states. Formally, let ℳM denote a T2V diffusion model that generates a video sequence V=f1,…,fTV=\f_1,…,f_T\ conditioned on text. Given two boundary prompts p−p^- and p+p^+, which describe the initial and terminal states of the video, respectively, we denote their joint temporal condition by d=(p−,p+)d=(p^-,p^+). Specifically, to accommodate the single-prompt interface of black-box T2V models, we operationalize the d as a monolithic textual sequence synthesized via a canonical temporal template, whose details are provided in the supplementary material, thereby reconciling the boundary-state constraints within a unified input context. Modern T2V models generate videos through joint denoising of a latent video tensor tz_t under the shared condition d: (1) pθ(0:Td−1∣d)=∏t=1Tdpθ(t−1∣t,d),p_θ(z_0:T_d-1 d)= _t=1^T_dp_θ(z_t-1 _t,d), with the final video decoded as V=Dec(0)V=Dec(z_0). Since denoising is performed on the latent representation of the entire video rather than on individual frames, intermediate frames are jointly constrained by both boundary prompts. Consequently, the generated video tends to evolve smoothly from the semantics of h−h^- toward those of h+h^+, and semantic attributes associated with the original harmful component h may emerge during this temporal evolution, even though neither boundary prompt explicitly contains restricted content. 3.3. Text-side Proxy Search To effectively optimize the boundary prompts p−p^- and p+p^+, we employ Monte Carlo Tree Search (MCTS) as a black-box textual optimizer. The search is performed in a discrete text space, where each iteration explores candidate boundary prompts that preserve semantic consistency with the target prompt p while improving the likelihood of bypassing the text-based safety filter. In this way, MCTS provides a structured mechanism for balancing semantic fidelity and adversarial utility during boundary prompt optimization. Definition of the State and Action Space. We formulate boundary prompt optimization as a sequential decision-making process over a discrete linguistic space. Each tree node corresponds to a state s=⟨p−,p+⟩s= p^-,p^+ , where p−p^- and p+p^+ denote the current pre-event and post-event boundary prompts derived from the original prompt p. The root state s0s_0 is initialized by the boundary prompts generated from the LLM. From a given state s, the action space (s)A(s) consists of discrete boundary rewriting actions, where each action edits boundary prompts through rewriting and produces a successor state s′=T(s,a)s =T(s,a). In this formulation, nodes represent prompt states, while edges represent rewriting actions. UCT-based Heuristic Path Selection. Each MCTS iteration consists of selection, expansion, evaluation, and backpropagation. During selection, starting from the root, we recursively choose an action according to the UCT rule (2) UCT(s,a)=Q(s,a)+clnN(parent(s))N(s,a)+ϵ,UCT(s,a)=Q(s,a)+c N(parent(s))N(s,a)+ε, until reaching either a leaf state or a non-fully-expanded state. Here, Q(s,a)Q(s,a) denotes the estimated value of applying action a at state s, N(s)N(s) is the visit count of state s, and N(s,a)N(s,a) is the number of times action a has been selected from s. During expansion, if the selected state is non-terminal and still contains untried rewriting actions, we instantiate one new child state by applying a sampled action from (s)A(s). A state is regarded as fully expanded when all actions in its candidate rewriting set have been instantiated. A state is regarded as terminal if it reaches the maximum search depth, has no valid rewriting actions, or already achieves a sufficiently high reward. Self-Evaluation and Backpropagation. After expansion, we directly evaluate the newly created state using a black-box reward function and use this score for backpropagation. This design is more suitable for textual optimization, where each rewrite can already be directly assessed through model queries. Specifically, we define the reward by combining three factors: filter feasibility, semantic relevance, and harmfulness risk. At the input level, both rewritten prompts p−p^- and p+p^+ must pass the text safety filter in order to remain admissible during search. According to the threat model, we use the text-based safety filter ℱtext(⋅)F_text(·) and define (3) ℛfilter(p−,p+)=[ℱtext(p−)=1∧ℱtext(p+)=1],R_filter(p^-,p^+)=I [F_text(p^-)=1\; \;F_text(p^+)=1 ], where [⋅]I[·] denotes the indicator function and ℱtext(p)=1F_text(p)=1 indicates that the prompt passes the filter. To prevent semantic drift from the original prompt p, we use an auxiliary LLM to infer the implicit intermediate prompt p′p from the current boundary pair. The prompt p′p is used only for reward evaluation and is not included in the search state. Based on p′p , we define semantic relevance as (4) ℛrel(p′,p)=cos((p),(p′)),R_rel(p ,p)= \! (e(p),e(p ) ), where (⋅)e(·) denotes a text encoder. To assess the harmful content implied by the rewritten prompts, we employ an LLM-based evaluator to estimate harmfulness on the inferred prompt p′p . The evaluator outputs a scalar score indicating the degree of unsafe intent reflected in p′p : (5) ℛharm(p′)=HLLM(p′).R_harm(p )=H_LLM(p ). The final reward used for backpropagation is defined as (6) R(s,a)=ℛfilter(p−,p+)⋅(λrℛrel(p′,p)+λhℛharm(p′)),R(s,a)=R_filter(p^-,p^+)· ( _rR_rel(p ,p)+ _hR_harm(p ) ), where λr _r and λh _h control the trade-off between semantic relevance and harmfulness risk. The resulting reward is then backpropagated along the selected path to update all visited state-action statistics. 3.4. Sparse Video-based Calibration While text-side UCT search explores rewritten prompts under textual constraints, unsafe intent may only manifest after grounding into the visual domain. We therefore introduce a video-based feedback mechanism that augments the text search with cross-modal evaluation signals. Given the current text-side search tree, we select the top-k leaf nodes according to their action values Q(s,a)Q(s,a) and generate videos using a fixed video generation model to ground the rewritten prompts in the visual domain. Each generated video viv_i is evaluated using a frozen vision language model (VLM) together with safety evaluators, producing video domain feedback signals. First, we apply a video-based safety filter ℱvideo(⋅)F_video(·) to detect explicit harmful content. If harmful content bypass the filter, ℱvideo(vi)=1F_video(v_i)=1: (7) ℛfiltervis(vi)=[ℱvideo(vi)=1].R_filter^vis(v_i)=I [F_video(v_i)=1 ]. To assess semantic consistency and harmfulness in the video domain, we use the VLM to summarize each video into a textual caption p~i p_i. Semantic relevance to the original prompt p is computed using the same embedding-based metric as in the text domain: (8) ℛrelvis(p~i,p)=cos((p),(p~i)).R_rel^vis( p_i,p)= \! (e(p),e( p_i) ). Video-grounded harmfulness is estimated by applying the LLM-based evaluator to p~i p_i, defined as an expected risk over multiple evaluation contexts: (9) ℛharmvis(p~i)=ℍLLM(p~i).R_harm^vis( p_i)=H_LLM ( p_i ). The video-based reward for each leaf node ℓi _i is defined as: (10) Rvis(ℓi)=ℛfiltervis(λrℛrelvis+λhℛharmvis),R^vis( _i)=R_filter^vis ( _rR_rel^vis+ _hR_harm^vis ), where λr _r and λh _h balance semantic relevance and harmfulness. Video-based feedback is not used to expand the UCT search tree, but to recalibrate the direction of text-side exploration periodically. Specifically, sparse video evaluation is performed only on the top-k leaf nodes identified by textual rewards, and the resulting video-based scores are used to select a single candidate for anchoring subsequent search. If a successful attack is detected at the video level, the procedure terminates immediately. Otherwise, the leaf node with the highest video-based reward is promoted as the root of a new text-side search stage. In this manner, grounded video feedback selectively reshapes the search frontier without incurring the prohibitive cost of full cross-modal expansion, enabling an iterative refinement process driven jointly by textual efficiency and visual verification. 4. Experiments Table 1. Comparison of ASRs across 14 aspects on commercial T2V models. Compared with prior jailbreak baselines, including TSB, DACA, and SceneSplit, our method performed best overall. Bold indicates the best performance in each category under each model. Gray background highlights our method. Model Veo 3.1 Sora 2 Seedance Kling v1 Category TSB DACA SceneSplit !18Ours TSB DACA SceneSplit !18Ours TSB DACA SceneSplit !18Ours TSB DACA SceneSplit !18Ours Pornography 34.0% 18.0% 38.0% !1890.0% 4.0% 2.0% 20.0% !1842.0% 38.0% 20.0% 42.0% !1876.0% 26.0% 14.0% 42.0% !1880.0% Borderline Pornography 41.0% 26.0% 42.0% !1870.0% 18.0% 10.0% 42.0% !1856.0% 44.0% 24.0% 28.0% !1850.0% 46.0% 28.0% 58.0% !1876.0% Violence 60.0% 32.0% 82.0% !1896.0% 34.0% 18.0% 72.0% !1886.0% 52.0% 28.0% 68.0% !1874.0% 62.0% 30.0% 72.0% !1874.0% Gore 55.0% 28.0% 74.0% !1892.0% 30.0% 16.0% 64.0% !1884.0% 58.0% 30.0% 84.0% !1894.0% 64.0% 32.0% 76.0% !1882.0% Disturbing Content 48.0% 26.0% 68.0% !1876.0% 46.0% 24.0% 68.0% !1870.0% 44.0% 22.0% 60.0% !1866.0% 32.0% 18.0% 66.0% !1872.0% Public Figures 5.0% 2.0% 12.0% !1824.0% 2.0% 4.0% 10.0% !1816.0% 10.0% 4.0% 8.0% !1836.0% 8.0% 4.0% 14.0% !1834.0% Discrimination 44.0% 24.0% 56.0% !1860.0% 50.0% 26.0% 62.0% !1866.0% 42.0% 22.0% 58.0% !1862.0% 28.0% 16.0% 62.0% !1864.0% Political Sensitivity 34.0% 22.0% 62.0% !1872.0% 20.0% 12.0% 58.0% !1860.0% 30.0% 18.0% 54.0% !1862.0% 36.0% 20.0% 64.0% !1868.0% Copyright 16.0% 8.0% 16.0% !1830.0% 10.0% 6.0% 10.0% !1814.0% 6.0% 4.0% 8.0% !1818.0% 12.0% 6.0% 8.0% !1820.0% Illegal Activities 56.0% 30.0% 82.0% !1884.0% 64.0% 34.0% 76.0% !1886.0% 56.0% 28.0% 76.0% !1880.0% 42.0% 22.0% 76.0% !1878.0% Misinformation 42.0% 24.0% 60.0% !1878.0% 56.0% 28.0% 68.0% !1870.0% 18.0% 10.0% 58.0% !1856.0% 34.0% 18.0% 66.0% !1862.0% Sequential Action 58.0% 20.0% 72.0% !1876.0% 42.0% 16.0% 68.0% !1854.0% 52.0% 20.0% 66.0% !1866.0% 48.0% 18.0% 72.0% !1868.0% Dynamic Variation 32.0% 16.0% 70.0% !1872.0% 46.0% 20.0% 74.0% !1880.0% 24.0% 12.0% 64.0% !1870.0% 38.0% 18.0% 68.0% !1874.0% Coherent Contextual 24.0% 14.0% 50.0% !1854.0% 36.0% 18.0% 40.0% !1862.0% 32.0% 16.0% 46.0% !1848.0% 18.0% 10.0% 40.0% !1852.0% !10 Avg. 39.2% 20.7% 56.0% !1869.6% 32.7% 16.7% 52.3% !1860.4% 36.1% 18.4% 51.4% !1861.3% 35.3% 18.1% 56.0% !1864.6% 4.1. Experimental Setup Datasets. We conduct our experiments on T2VSafetyBench (Miao et al., 2024), a comprehensive benchmark for safety-critical evaluation of text-to-video(T2V) models. We adopt a subset of the benchmark while retaining all 14 safety categories to ensure broad coverage of potential risk types. Specifically, the categories include pornography, borderline pornography, violence, gore, disturbing content, public figures, discrimination, political sensitivity, copyright, illegal activities, misinformation, sequential action, dynamic variation, and coherent context. For each category, we randomly sample 50 prompts, resulting in a total of 700 evaluation prompts. Baselines. To comprehensively evaluate BSB, we compare it against three representative baselines with distinct design paradigms, including a benchmark-oriented baseline for T2V safety evaluation, a jailbreak method originally developed for text-to-image (T2I) models and adapted to the T2V setting, and an existing jailbreak method specifically designed for T2V models. T2VSafetyBench (TSB) (Miao et al., 2024) is included as a dedicated evaluation benchmark that provides standardized prompts and attack protocols for assessing safety vulnerabilities in T2V models. DACA (Deng and Chen, 2023) is a jailbreak method originally proposed for T2I generative models. It employs a multi-agent framework to identify sensitive visual descriptors in harmful prompts and replaces them with semantically related alternatives, which are subsequently recombined into a coherent adversarial prompt designed to bypass safety filters. SceneSplit (Lee et al., 2025) is designed for jailbreaking T2V generative models. It decomposes a harmful prompt into multiple scene-level prompts that appear benign in isolation, thereby reducing explicit harmfulness while preserving the original attack intent. To further improve effectiveness, SceneSplit iteratively refines the most influential scene based on generation feedback and maintains a strategy library to reuse successful manipulations in future attacks. For fair comparison, we follow the original implementation protocols of all baselines as closely as possible; when adapting methods originally designed for T2I models to the T2V setting, we directly use their generated adversarial prompts as textual inputs for video generation. Evaluation Metrics. To assess the effectiveness of the generated prompts, we use the Attack Success Rate (ASR) as the primary evaluation metric. The ASR is defined as the percentage of jailbreak prompts that meet two criteria: (1) the prompt successfully bypasses the model’s safety filter, and (2) the generated video contains harmful content, such as pornography, violence, or other harmful material. The ASR is calculated as the proportion of such successful jailbreak prompts to the total number of tested prompts. We use GPT-5 (Singh et al., 2025) as the evaluator to determine whether the generated videos contain harmful content. The evaluation protocol follows the setup of T2VSafetyBench (Miao et al., 2024), including the frame sampling strategy and prompting format. GPT-5 is employed exclusively for safety judgment. For each generated video, we sample one frame per second and present these frames, along with the corresponding prompt, to GPT-5 for final assessment of whether the attack is successful. All details of the evaluation procedure adhere to the T2VSafetyBench setting. Target T2V Model and Safety Filters The target T2V models include Veo 3.1 (Wiedemer et al., 2025), Sora 2 (Peng et al., 2025), Seedance (Seedance et al., 2025), and Kling v1 (Team, 2025), all of which are equipped with built-in safety filtering mechanisms. We model the safety filtering component in eqs. 3 and 7 through separate text-side and output-side checks, corresponding to ℛfilterR_filter and ℛfiltervisR_filter^vis, respectively. For the text domain, we instantiate ℛfilterR_filter using a local LlamaGuard3-8b model (Llama Team, 2024), a moderation-oriented language model designed to classify unsafe or policy-violating textual content. Its binary decision is used to determine whether a candidate prompt passes the text-side filtering stage. For the output domain, we approximate ℛfiltervisR_filter^vis using a vision-language model (VLM) named VideoLLaMA2-7B (Cheng et al., 2024) to directly assess the returned result from the target T2V system. If the output contains explicit refusal signals (e.g., policy-violation messages) or corresponds to degenerate generations (e.g., fully black videos), it is directly regarded as failing the output-side filter. Only when the output passes this filtering stage do we further employ the VLM to obtain textual descriptions for subsequent evaluation. In addition to commercial T2V models, we also conduct experiments on a local T2V model Wan2.2 (Wang et al., 2025a) equipped with external safety filters (George., 2020; Khader et al., 2025; Chhabra., 2020; Llama Team, 2024). Detailed configurations and results are provided in the supplementary material. Implementation. For all target models, we use their default generation configurations. The auxiliary language model used for prompt analysis and rewriting is GPT-5.2, while the text similarity is computed using a Sentence-Transformer encoder. For the text-side proxy search, the exploration coefficient in the UCT policy is set to c=1.4c=1.4, and the reward weights are λr=0.5 _r=0.5 and λh=0.5 _h=0.5. In each search stage, MCTS runs for at most 30 simulations with a branching factor of 4, i.e., each node expands up to four candidate prompt rewrites. During the search, nodes that satisfy predefined feasibility or reward thresholds are directly promoted to the calibration candidate set. The search stops when either the candidate set reaches the size k=3k=3 or the maximum number of simulations is reached. The search–calibration cycle is repeated for at most three stages. All threshold values follow the default settings described in the supplementary material. 4.2. Main Results We compare BSB with three representative baselines, namely TSB, DACA, and SceneSplit, on commercial T2V models. As shown in Table 1, BSB consistently achieves the highest ASR across nearly all settings, demonstrating strong effectiveness over existing jailbreak baselines. In particular, BSB attains average ASRs of 69.6% on Veo 3.1, 60.4% on Sora 2, 61.3% on Seedance, and 64.6% on Kling v1, corresponding to an average relative improvement of 18.6% over the strongest baseline across these commercial systems. These results indicate that BSB generalizes effectively across representative commercial T2V models. A closer examination shows that the gains are particularly pronounced in high-risk categories such as Pornography, Violence, Gore, and Illegal Activities. This advantage stems from the core design of BSB. Rather than directly exposing unsafe intent in the prompt, BSB leverages the temporal consistency inherent in T2V models and constructs two benign boundary states whose semantic coupling naturally drives the generation process through harmful intermediate states. Meanwhile, its MCTS-based text search and sparse video calibration jointly ensure that the exploration remains both structured and visually grounded. Consequently, BSB is especially effective when harmful content emerges through semantic evolution over time, rather than through explicit surface-level prompts. Another notable observation is that Public Figures and Copyright remain low-ASR categories across all methods. We conjecture that these categories are inherently more difficult because success depends not only on bypassing safety filters, but also on accurately rendering recognizable identities or protected symbols, such as a celebrity face or a trademarked logo. Compared with event-centric categories like violence, gore, and illegal activities, they require higher visual fidelity and semantic specificity, making successful jailbreaks harder even after prompt acceptance. Figure 3. Visualization of video jailbreaking performance using BSB, these are the categories of Pornography, Gore, and Dynamic Variation. 4.3. Ablation Study Ablation on Core Component. Due to the high cost of repeated video generation, we conduct ablation studies on Veo 3.1 as a representative commercial T2V model, while cross-model generalization is evaluated separately in the main results. We ablate BSB along its three core components: Temporal Boundary Decomposition (TBD), Text-side Proxy Search, and Sparse Video-based Calibration (SVC). To isolate the contribution of each module, we remove one component at a time from BSB. w/o TBD directly optimizes the original prompt without constructing boundary-state pairs. w/o MCTS retains the boundary prompts but replaces tree-structured search with greedy rewriting. w/o SVC removes intermediate visual grounding and performs search only in the textual proxy space. The ablation results in Table 2 show that all three components are important to BSB, while contributing in different ways. In terms of ASR, removing TBD causes the largest drop, from 69.6% to 45.2%, indicating that temporal boundary decomposition is the core structural component of the attack. Without TBD, BSB can no longer construct benign boundary states that implicitly induce harmful intermediate trajectories under temporal consistency. Removing MCTS also leads to a substantial decrease, from 69.6% to 52.7%, showing that effective search is still necessary after the attack space has been properly structured. By contrast, removing SVC yields a smaller but still clear drop to 60.4%, suggesting that SVC mainly serves as a calibration module rather than the primary source of attackability. A similar pattern is observed in the average number of video queries. The full BSB requires only 2.46 queries on average, indicating high search efficiency. Removing SVC causes the largest increase, up to 5.28, which highlights the discrepancy between text-domain and video-domain optimization: candidates that appear optimal textually do not necessarily induce videos with the desired semantic similarity and harmfulness. Without sparse video-based calibration, the search is repeatedly drawn toward prompt-level optima that transfer poorly to the video domain, leading to substantially more video queries. Removing MCTS likewise increases the query cost to 3.31, as the search must rely on broader text-side exploration to obtain effective top-k candidates. In contrast, removing TBD raises the video query count only moderately to 2.97. This is because the additional overhead is mainly shifted to text-level exploration rather than repeated video-level refinement. Overall, these results show that TBD provides the structural basis of the attack, while MCTS and SVC mainly improve the efficiency and reliability of the search process. Table 2. Ablation of the core components of BSB on Veo 3.1. TBD MCTS SVC ASR ↑ Avg. Video Queries ↓ ✓ ✓ ✓ 69.6% 2.46 × ✓ ✓ 45.2% 2.97 ✓ × ✓ 52.7% 3.31 ✓ ✓ × 60.4% 5.28 Ablation on Hyperparameters. Figure 4 illustrates the attack success rate (ASR) and the average number of video queries under different MCTS search budgets, while other hyperparameters are fixed. When the budget increases from a very small value to a moderate range, ASR improves significantly, since more text-side simulations allow the search to explore promising rewriting paths more effectively. However, further increasing the budget brings only marginal improvements in ASR, while the efficiency gain becomes limited because additional simulations are often spent on low-value branches. To balance attack effectiveness and text query efficiency, we set the MCTS search budget to 30 in our experiments. Figure 4 illustrates the ASR and the average number of video queries under different text candidate widths, while other hyperparameters are fixed. Increasing the width from a small value to a moderate range improves ASR, as more candidate rewrites enhance exploration diversity and reduce the risk of poor local optima. However, excessively large widths introduce many redundant candidates and significantly increase the video query cost without notable improvements in ASR. To balance attack success and query efficiency, we set the text candidate width to 3 in our experiments. Figure 4. ASR and average video query costs under different search hyperparameters: (left) MCTS search budget and (right) text candidate width. 5. Ethics Consideration The proposed method, BSB, has the potential to create a positive societal impact by improving the safety and reliability of text-to-video (T2V) models. In particular, BSB exposes an underexplored vulnerability associated with temporal consistency: even when the prompts describing the start and end of a video are individually benign, the model may still generate harmful intermediate content as it constructs a coherent transition between them. By uncovering this weakness, our work can support researchers and practitioners in developing more robust safeguards that reason about temporal semantic evolution, rather than relying solely on prompt-level screening or checks on isolated frames. We believe this can contribute to safer deployment and more trustworthy use of T2V systems. At the same time, BSB carries risks similar to those of other jailbreak methods. In the wrong hands, it could be used to circumvent existing safety protections and produce harmful video content, including violent, sexual, or misleading material. We do not present this work as a means of enabling misuse. Instead, our goal is to study a vulnerability that already exists in current T2V models and to make that weakness more visible to the research community. We hope this work will motivate future efforts on temporally aware safety evaluation, detection, and defense, ultimately strengthening the long-term safety and accountability of video generation models. 6. Discussion and Conclusion In this work, we investigate the safety vulnerabilities of text-to-video (T2V) generation models and identify temporal consistency as a new attack surface for jailbreak attacks. Based on this insight, we propose BSB, a structured jailbreak framework that decomposes harmful intent into two individually benign boundary prompts whose temporal coupling can induce unsafe intermediate semantics. By combining text-side proxy search with sparse video-based calibration, BSB enables efficient exploration of the jailbreak space under realistic query budgets. Extensive experiments on representative commercial T2V models demonstrate that BSB consistently achieves higher attack success rates than existing baselines while maintaining low query cost. Our findings highlight the importance of considering temporal dynamics in the safety design of multimodal generative models. Future work may explore stronger defenses that explicitly account for temporal semantic evolution in video generation models. One limitation of our method is that it still requires a small number of video-level queries for calibration, which introduces additional query cost. Moreover, the effectiveness of the attack depends on the quality of the LLM-guided boundary decomposition. Improving decomposition reliability and further reducing query dependence, therefore, remain important directions for future work. Acknowledgements.To Robert, for the bagels and explaining CMYK and color spaces. References Z. Ba, J. Zhong, J. Lei, P. Cheng, Q. Wang, Z. Qin, Z. Wang, and K. Ren (2024) SurrogatePrompt: bypassing the safety filter of text-to-image models via substitution. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS 2024, Salt Lake City, UT, USA, October 14-18, 2024, B. Luo, X. Liao, J. Xu, E. Kirda, and D. Lie (Eds.), p. 1166–1180. External Links: Link, Document Cited by: §1. A. Blattmann, R. Rombach, H. Ling, T. Dockhorn, S. W. Kim, S. Fidler, and K. Kreis (2023) Align your latents: high-resolution video synthesis with latent diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, p. 22563–22575. External Links: Document Cited by: §2.1. H. Chen, Y. Zhang, X. Cun, M. Xia, X. Wang, C. Weng, and Y. Shan (2024) VideoCrafter2: overcoming data limitations for high-quality video diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024, p. 7310–7320. External Links: Document Cited by: §2.1. Z. Cheng, S. Leng, H. Zhang, Y. Xin, X. Li, G. Chen, Y. Zhu, W. Zhang, Z. Luo, D. Zhao, and L. Bing (2024) VideoLLaMA 2: advancing spatial-temporal modeling and audio understanding in video-llms. External Links: 2406.07476, Link Cited by: §4.1. L. Chhabra. (2020) Nsfw image classifier on github.. Note: https://github.com/lakshaychhabra/NSFW-Detection-DL Cited by: §4.1. Y. Deng and H. Chen (2023) Divide-and-conquer attack: harnessing the power of LLM to bypass the censorship of text-to-image generation model. CoRR abs/2312.07130. External Links: Link, Document, 2312.07130 Cited by: §4.1. R. George. (2020) Nsfw words list on github.. Note: https://github.com/rrgeorge-pdcontributions/NSFW-Words-List/blob/master/nsfw_list.txt Cited by: §4.1. J. Ho, W. Chan, C. Saharia, J. Whang, R. Gao, A. A. Gritsenko, D. P. Kingma, B. Poole, M. Norouzi, D. J. Fleet, and T. Salimans (2022) Imagen video: high definition video generation with diffusion models. CoRR abs/2210.02303. External Links: Document, 2210.02303 Cited by: §2.1. W. Hong, M. Ding, W. Zheng, X. Liu, and J. Tang (2023) CogVideo: large-scale pretraining for text-to-video generation via transformers. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023, Cited by: §2.1. L. Khachatryan, A. Movsisyan, V. Tadevosyan, R. Henschel, Z. Wang, S. Navasardyan, and H. Shi (2023) Text2Video-zero: text-to-image diffusion models are zero-shot video generators. In IEEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023, p. 15908–15918. External Links: Document Cited by: §2.1. M. E. Khader, E. A. Bouzidi, A. Oumida, M. Sbaihi, E. Binard, J. Poli, W. Ouerdane, B. Addad, and K. Kapusta (2025) DiffGuard: text-based safety checker for diffusion models. External Links: 2412.00064, Link Cited by: §4.1. W. Lee, H. Park, D. Lee, B. Ham, and S. Kim (2025) Jailbreaking on text-to-video models via scene splitting strategy. CoRR abs/2509.22292. External Links: Link, Document, 2509.22292 Cited by: §1, §2.2, §4.1. S. Liang, J. Liu, J. Zhai, T. Fang, R. Tu, A. Liu, X. Cao, and D. Tao (2025) T2VShield: model-agnostic jailbreak defense for text-to-video models. CoRR abs/2504.15512. External Links: Link, Document, 2504.15512 Cited by: §1. J. Liu, S. Liang, S. Zhao, R. Tu, W. Zhou, A. Liu, D. Tao, and S. K. Lam (2025) T2V-optjail: discrete prompt optimization for text-to-video jailbreak attacks. External Links: 2505.06679, Link Cited by: §1, §2.1, §2.2. A. @. M. Llama Team (2024) The llama 3 herd of models. External Links: 2407.21783, Link Cited by: §4.1, §4.1. Y. Miao, Y. Zhu, L. Yu, J. Zhu, X. Gao, and Y. Dong (2024) T2VSafetyBench: evaluating the safety of text-to-video generative models. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024, A. Globersons, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. M. Tomczak, and C. Zhang (Eds.), Cited by: §1, §2.2, §4.1, §4.1, §4.1. X. Peng, Z. Zheng, C. Shen, T. Young, and X. G. et al. (2025) Open-sora 2.0: training a commercial-level video generation model in $200k. CoRR abs/2503.09642. External Links: Link, Document, 2503.09642 Cited by: §1, §2.1, §4.1. Y. Qu, X. Shen, Y. Wu, M. Backes, S. Zannettou, and Y. Zhang (2025) UnsafeBench: benchmarking image safety classifiers on real-world and ai-generated images. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS 2025, Taipei, Taiwan, October 13-17, 2025, C. Huang, J. Chen, S. Shieh, D. Lie, and V. Cortier (Eds.), p. 3221–3235. External Links: Document Cited by: §2.2. T. Seedance, H. Chen, S. Chen, X. Chen, Y. Chen, Y. Chen, and Z. C. et al. (2025) Seedance 1.5 pro: A native audio-visual joint generation foundation model. CoRR abs/2512.13507. External Links: Link, Document, 2512.13507 Cited by: §1, §2.1, §4.1. U. Singer, A. Polyak, T. Hayes, X. Yin, J. An, S. Zhang, Q. Hu, H. Yang, O. Ashual, O. Gafni, D. Parikh, S. Gupta, and Y. Taigman (2023) Make-a-video: text-to-video generation without text-video data. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023, Cited by: §2.1. A. Singh, A. Fry, A. Perelman, and A. T. et al. (2025) GPT-5. External Links: 2601.03267, Link Cited by: §4.1. K. Team (2025) Kling-omni technical report. CoRR abs/2512.16776. External Links: Link, Document, 2512.16776 Cited by: §1, §2.1, §4.1. Y. Tsai, C. Hsu, C. Xie, C. Lin, J. Chen, B. Li, P. Chen, C. Yu, and C. Huang (2024) Ring-a-bell! how reliable are concept removal methods for diffusion models?. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024, Cited by: §1. R. Villegas, M. Babaeizadeh, P. Kindermans, H. Moraldo, H. Zhang, M. T. Saffar, S. Castro, J. Kunze, and D. Erhan (2023) Phenaki: variable length video generation from open domain textual descriptions. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023, Cited by: §2.1. A. Wang, B. Ai, B. Wen, C. Mao, and C. X. et al. (2025a) Wan: open and advanced large-scale video generative models. CoRR abs/2503.20314. External Links: Link, Document, 2503.20314 Cited by: §1, §2.1, §4.1. S. Wang, R. Qian, Y. Lyu, Q. Liu, L. Zou, J. Qin, S. Liu, and C. Shan (2025b) RunawayEvil: jailbreaking the image-to-video generative models. CoRR abs/2512.06674. External Links: Link, Document, 2512.06674 Cited by: §1, §2.1, §2.2. W. Wang and Y. Yang (2024) VidProM: A million-scale real prompt-gallery dataset for text-to-video diffusion models. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024, A. Globersons, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. M. Tomczak, and C. Zhang (Eds.), Cited by: §2.2. T. Wiedemer, Y. Li, P. Vicol, S. S. Gu, N. Matarese, K. Swersky, B. Kim, P. Jaini, and R. G. et al. (2025) Video models are zero-shot learners and reasoners. CoRR abs/2509.20328. External Links: Link, Document, 2509.20328 Cited by: §1, §2.1, §4.1. Y. Yang, B. Hui, H. Yuan, N. Gong, and Y. Cao (2024) SneakyPrompt: jailbreaking text-to-image generative models. In IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024, p. 897–912. Cited by: §1. Z. Ying, M. Chen, N. Li, Z. Wang, W. Zhang, Q. Zou, Z. Jing, A. Liu, and X. Liu (2026) SPARK: jailbreaking t2v models by synergistically prompting auditory and recontextualized knowledge. External Links: 2511.13127, Link Cited by: §1. J. Zhao, K. Chen, W. Zhang, and N. Yu (2025) SQL injection jailbreak: a structural disaster of large language models. In Findings of the Association for Computational Linguistics: ACL 2025, W. Che, J. Nabende, E. Shutova, and M. T. Pilehvar (Eds.), Vienna, Austria, p. 6871–6891. External Links: Link, Document, ISBN 979-8-89176-256-5 Cited by: §1. A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson (2023) Universal and transferable adversarial attacks on aligned language models. CoRR abs/2307.15043. External Links: Link, Document, 2307.15043 Cited by: §1.