Rendered text can secretly control image generation behavior
When Scene Text Hijacks the Scene: Uncovering, Exploiting, and Mitigating Rendered-Text Semantic Leakage in Image Generation Models
Computer Vision and Pattern Recognition
Summary
Modern AI models that generate images can be guided by text instructions, including text that appears inside the image itself. The authors found that this rendered text not only appears visually but also influences the model's understanding and output beyond just being shown—it can affect other parts of the image or carry hidden meanings. This hidden influence can introduce safety concerns if harmful messages sneak into images unintentionally or maliciously. They also suggest one way to reduce this problem while keeping the image text accurate.
What this means in practice
- •For ai safety teams: Detect and reduce hidden harmful influences from text inside images generated by AI to improve model reliability and safety.
- •For text-to-image system developers: Improve image generation by controlling how embedded text affects entire images, preventing unintended semantic bias.
Authors
Feifei Li, Runjie Wang, Xiaohan Zhang, Zhenxing Qian, Mi Wen, Mi Zhang
Abstract
The reliability and accountability of image generative models (IGMs) are essential for building responsible and trustworthy AI systems. Recent IGMs, such as Nano Banana and GPT-Image, now support complex instruction following, realistic image synthesis, and controllable scene-text rendering. As these capabilities expand, safety analysis must also account for new control channels introduced by complex prompts. In this work, we study rendered-text semantic leakage, a largely overlooked phenomenon in open-domain text rendering. Although rendered text is intended to serve as a local visual constraint that should be reproduced verbatim in the generated image, it also carries linguistic semantics that may be interpreted by the model as part of the input instruction. This makes rendered text a potential semantic control channel whose safety implications remain insufficiently understood. We systematically characterize this phenomenon by decoupling the main visual prompt from the rendered text and measuring their individual and compositional effects on generated images. We quantify semantic leakage and rendering fidelity, and further analyze how leakage emerges from intermediate model evidence. We then show that harmful semantics embedded in scene text can persist through LLM-based prompt enhancement pipelines and steer non-text image regions, even when the main visual prompt remains benign. Finally, we propose a preliminary mitigation approach that reduces unsafe semantic transfer from rendered text to non-text regions while preserving the intended text-rendering behavior on FLUX-2-dev. Our findings reveal rendered text as a dual-use carrier of visible data and latent semantics, exposing a text-centric cross-modal attack surface in modern IGMs.