Dynamic Defense Profiling Enables Cognitive Jailbreak of Text-to-Image Models

2026-07-20

AI Summary

Current jailbreaking attacks on text-to-image models suffer from low efficiency, semantic collapse, and neglect of critical information in defense feedback. This work proposes the MIND framework, which, for the first time, formulates jailbreaking as a cognitive reasoning process over latent defense mechanisms. By integrating multimodal feedback parsing, dynamically updating a defense profile, and employing meta-memory-driven strategy retrieval, MIND enables semantically coherent and adaptive attacks. The approach transcends the limitations of conventional black-box optimization, achieving a 95.62% attack success rate (ASR) across six defense configurations on Stable Diffusion v1.5 and up to 91.58% ASR on four major commercial text-to-image generation systems.

Abstract

Text-to-Image (T2I) generative models have achieved remarkable progress in synthesizing high-quality visual content, yet they remain vulnerable to adversarial misuse, particularly in generating Not-Safe-For-Work (NSFW) images. Most existing jailbreak attacks primarily rely on heuristic prompt engineering or black-box optimization, treating model feedback as a binary signal (success or failure). This coarse-grained paradigm overlooks the rich information embedded in diverse failure modes, such as textual refusal, visual blocking, and semantic sanitization, resulting in inefficient exploration and severe semantic collapse. In this paper, we propose MIND, a cognitive jailbreak framework that reframes adversarial prompt generation as a belief-state inference problem over latent defense mechanisms. Instead of blindly searching for bypass prompts, MIND actively models the target system's latent defense mechanisms by interpreting multi-modal feedback as high-density signals. Specifically, the framework integrates three core components: (1) a Multi-modal Judge for fine-grained feedback decomposition, (2) a Defense Profiler for iterative belief updating, and (3) a Meta-Memory module for retrieving historically effective attack strategies. These components are unified within a reasoning-driven evolutionary optimization process, enabling adaptive and semantically consistent jailbreak generation. Extensive experiments on the I2P benchmark demonstrate the effectiveness of MIND. Under six representative pre-processing and post-processing defense settings applied to the Stable Diffusion v1.5 model, MIND achieves an Attack Success Rate (ASR) of 95.62%, significantly outperforming existing methods. Additionally, the effectiveness of the proposed framework is validated across four widely used commercial T2I systems, achieving the highest ASR of 91.58% on Wan-2.5.

Problem

• Text-to-Image models
• adversarial misuse
• jailbreak attacks
• NSFW generation
• defense mechanisms

Innovation

• cognitive jailbreak
• defense profiling
• multi-modal feedback
• belief-state inference
• text-to-image models