Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models

2026-07-19

AI Summary

This work addresses critical limitations in existing text-to-video jailbreak attacks, which often neglect temporal consistency and suffer from inefficient, unstructured exploration under black-box settings. The authors propose the BSB framework, which uniquely treats temporal consistency as a core attack dimension. By constructing two benign boundary states and interpolating to generate harmful intermediate frames, BSB leverages Monte Carlo Tree Search for efficient and structured exploration within a textual proxy space. Coupled with sparse video-level evaluation calibration, the method achieves an average 18.6% improvement in attack success rate over the strongest baseline across mainstream models—including Veo 3.1, Sora 2, Seedance, and Kling v1—demonstrating significantly enhanced black-box attack efficiency and generalization capability.

Abstract

Recently, text-to-video (T2V) models have been widely deployed, sparking growing concerns over their robustness against jailbreak attacks. Existing jailbreak methods, mostly adapted from text-to-image attacks, suffer notable drawbacks when applied to T2V systems. They fail to fully leverage temporal consistency, an inherent characteristic of video generation. Besides, these methods demand heavy video query optimization, which is infeasible in practical black-box scenarios. Their adversarial prompt search is also driven by heuristic local signals, lacking principled structured exploration strategies. To tackle these limitations, we propose BSB, a structured, query-efficient jailbreak framework for T2V models. BSB harnesses temporal consistency by encoding harmful intent as the transition between two individually harmless boundary states. Under this paradigm, the attack targets boundary-state pairs whose interpolation tends to produce unsafe intermediate frames during video generation. Directly evaluating all candidate pairs within the video space incurs prohibitive computation cost. Instead, BSB conducts Monte Carlo Tree Search (MCTS) in a cheaper textual proxy space and regularly calibrates search outcomes with sparse video-level evaluations. We conduct comprehensive experiments on mainstream commercial T2V models including Veo 3.1, Sora 2, Seedance and Kling v1. Results show BSB surpasses all existing jailbreak baselines, delivering an average 18.6% relative gain in attack success rate over the strongest competitor across evaluated models. Our findings identify temporal consistency as an understudied yet vital attack surface for T2V models and verify that structured search facilitates effective vulnerability discovery under constrained query budgets.

Problem

• jailbreak attacks
• text-to-video models
• temporal consistency
• black-box scenario
• adversarial prompt search

Innovation

• temporal consistency
• jailbreak attack
• text-to-video generation
• Monte Carlo Tree Search
• query-efficient