Dynamic Defense Profiling Enables Cognitive Jailbreak of Text-to-Image Models
2026-07-20 • Artificial Intelligence
Artificial Intelligence
AI summaryⓘ
The authors study ways to trick text-to-image AI models into generating inappropriate or restricted images, which usually resist simple prompt changes. They propose a new method called MIND that better understands how these models block unwanted content by analyzing detailed feedback rather than just pass/fail signals. MIND uses multiple tools to break down responses, update beliefs about defenses, and recall past tricks to create more effective prompts that bypass protections. Their experiments show MIND outperforms previous approaches across different defense strategies and commercial systems. This helps reveal how these AI models can be more robust against misuse.
Text-to-Image generationAdversarial attackPrompt engineeringJailbreak attackMulti-modal feedbackDefense mechanismsEvolutionary optimizationStable DiffusionAttack Success RateSemantic sanitization
Authors
Dongdong Yang, Deyue Zhang, Zhao Liu, Zonghao Ying, Wenzhuo Xu, Jiankai Jin, Xiangzheng Zhang, Quanchen Zou
Abstract
Text-to-Image (T2I) generative models have achieved remarkable progress in synthesizing high-quality visual content, yet they remain vulnerable to adversarial misuse, particularly in generating Not-Safe-For-Work (NSFW) images. Most existing jailbreak attacks primarily rely on heuristic prompt engineering or black-box optimization, treating model feedback as a binary signal (success or failure). This coarse-grained paradigm overlooks the rich information embedded in diverse failure modes, such as textual refusal, visual blocking, and semantic sanitization, resulting in inefficient exploration and severe semantic collapse. In this paper, we propose MIND, a cognitive jailbreak framework that reframes adversarial prompt generation as a belief-state inference problem over latent defense mechanisms. Instead of blindly searching for bypass prompts, MIND actively models the target system's latent defense mechanisms by interpreting multi-modal feedback as high-density signals. Specifically, the framework integrates three core components: (1) a Multi-modal Judge for fine-grained feedback decomposition, (2) a Defense Profiler for iterative belief updating, and (3) a Meta-Memory module for retrieving historically effective attack strategies. These components are unified within a reasoning-driven evolutionary optimization process, enabling adaptive and semantically consistent jailbreak generation. Extensive experiments on the I2P benchmark demonstrate the effectiveness of MIND. Under six representative pre-processing and post-processing defense settings applied to the Stable Diffusion v1.5 model, MIND achieves an Attack Success Rate (ASR) of 95.62%, significantly outperforming existing methods. Additionally, the effectiveness of the proposed framework is validated across four widely used commercial T2I systems, achieving the highest ASR of 91.58% on Wan-2.5.