TempQ-Jail improves forbidden text to video attack success rates efficiently
TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks
MultimediaCryptography and SecurityComputer Vision and Pattern Recognition
Summary
Generating harmful or forbidden videos from text prompts can be costly and slow to test. The authors designed TempQ-Jail, a method that smartly ranks possible video prompts to find the ones that can successfully bypass security filters faster. By combining different attack strategies and scoring videos for danger and relevance, it finds effective attacks earlier than previous methods. Their tests show this method achieves higher success rates and requires fewer attempts to find risky videos.
What this means in practice
- •For security teams: Assess text-to-video models by efficiently identifying prompts that can bypass content filters using minimal testing queries.
- •For video platform operators: Improve prevention systems by understanding attack patterns that exploit video generators under limited query conditions.
Authors
Tianmeng Fang, Jiancheng Wang, Chen Wang, Liming Wang, Wei Wang, Jiayang Liu, Xiaochun Cao
Abstract
Existing text-to-video (T2V) jailbreak methods mainly seek more effective or stealthier attack candidates. In guarded T2V systems, however, video generation and security evaluation are costly, so an attacker often cannot test a large candidate pool. We therefore formulate T2V jailbreak as a query-constrained candidate allocation and ranking problem and propose TempQ-Jail. The method combines heterogeneous attack mechanisms to expand candidate coverage, estimates each candidate's end-to-end attack value from security-gate passage, dangerous visual generation, preservation of the original intent, and temporal validity, and ranks candidates so that high-value attacks appear early in a limited query trajectory. We evaluate TempQ-Jail on CogVideoX-5B using 70 common viable intents derived from T2VSafetyBench and compare it with six representative T2V jailbreak methods under a unified protocol. TempQ-Jail achieves TP-ASR@5 and TP-ASR@10 of 48.9% and 65.4%, improving over the strongest baselines by 4.6 and 4.0 percentage points, respectively. It also obtains the highest AUC-TP (0.469) and the lowest AvgQ (6.3). Analyses of query trajectories, candidate allocation, failure attribution, and ablations show that TempQ-Jail more effectively identifies and prioritises candidates with complete attack potential under limited query budgets.