TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks

2026-09-25

AI Summary

This study addresses the high evaluation cost of candidate prompts in text-to-video (T2V) jailbreak attacks under constrained query budgets by formulating jailbreaking as a constrained ranking problem. Methodologically, it introduces a heterogeneous mechanism to expand attack candidates and constructs a multidimensional value estimation model that integrates safety gating, visual harmfulness, and intent preservation, thereby enabling end-to-end potential ranking with prioritized presentation. Experimental results on CogVideoX demonstrate that the proposed approach achieves a TP-ASR@10 of 65.4%, yielding the optimal AUC and the lowest average query count. These findings indicate significant improvements over existing baselines, realizing efficient jailbreaking under low-budget conditions.

Abstract

Existing text-to-video (T2V) jailbreak methods mainly seek more effective or stealthier attack candidates. In guarded T2V systems, however, video generation and security evaluation are costly, so an attacker often cannot test a large candidate pool. We therefore formulate T2V jailbreak as a query-constrained candidate allocation and ranking problem and propose TempQ-Jail. The method combines heterogeneous attack mechanisms to expand candidate coverage, estimates each candidate's end-to-end attack value from security-gate passage, dangerous visual generation, preservation of the original intent, and temporal validity, and ranks candidates so that high-value attacks appear early in a limited query trajectory. We evaluate TempQ-Jail on CogVideoX-5B using 70 common viable intents derived from T2VSafetyBench and compare it with six representative T2V jailbreak methods under a unified protocol. TempQ-Jail achieves TP-ASR@5 and TP-ASR@10 of 48.9% and 65.4%, improving over the strongest baselines by 4.6 and 4.0 percentage points, respectively. It also obtains the highest AUC-TP (0.469) and the lowest AvgQ (6.3). Analyses of query trajectories, candidate allocation, failure attribution, and ablations show that TempQ-Jail more effectively identifies and prioritises candidates with complete attack potential under limited query budgets.

Problem

• Text-to-Video Jailbreak
• Query-Constrained Attack
• Candidate Ranking
• Safety Guardrails

Innovation

• Text-to-Video Jailbreak
• Query-Constrained Optimization
• Candidate Ranking
• Heterogeneous Attack Mechanisms
• Multi-dimensional Value Estimation