{"id":"4c4d629f-d429-4148-b2bd-806db2f5db34","arxiv_id":"2505.08804","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"TokenProber bypasses five NSFW safety checkers on three text-to-image models by separately preserving dirty words and reducing the influence of non-dirty discrepant words.","lead":"TokenProber is a new attack method that rewrites NSFW prompts word by word so that safety filters let them through while the image generator still produces sensitive content. A smart generalist would read it to see how small, seemingly harmless word changes can defeat AI content moderation.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 0.54 improvement rests on an unvalidated surrogate plus a non-auditable human-verification protocol; the paper should be accepted only conditional on an independent, blinded re-verification of the reported NSFW successes.","rationale":"The reader's weakest_assumption identifies the surrogate safety checker's approximation of the T2I decision boundary as the key link. I agree this is the core theoretical vulnerability, but the paper partially defends it with the human-verification step and the low false-positive rates in Table III. The problem is that both of those defenses depend on the same non-blind, author-conducted review: the human verification is the only external check on SC_r, and the false-positive rates are computed using that same review. Thus the single most load-bearing part of the central claim is the audibility of the success criterion, not only the surrogate assumption. The paper itself concedes in Section VI that the surrogate choice is a potential threat to validity, and it does not provide the data needed to assess the reliability of the human labels. I do not see an internal inconsistency that would justify rejection: the ablation study, the reported query efficiency, and the concrete example in Figure 5 are consistent with the proposed mechanism, and the code is promised in an anonymous repository. The correct verdict is therefore the same CONDITIONAL one the reader reached, with the condition made explicit: the headline comparative numbers should be re-verified by independent, blinded human annotation and by a robustness check on the surrogate choice before being taken at face value.","tokens_in":20667,"tokens_out":9138,"duration_ms":99737,"concrete_test":"Select a stratified random sample of reported successful prompts (e.g., 50 per dataset and safety checker, including near-threshold cases where SC_r is just above 0.5), and have independent annotators, blinded to the method and to the SC_t/SC_r scores, classify the generated images using a pre-registered NSFW definition. Measure inter-annotator agreement (e.g., Cohen's kappa), then recompute the Table I bypass rates using only images ratified by the independent panel and compare them with the original rates. If the verified rates differ materially from the reported ones, or if kappa is low, the central claim is not established; additionally, rerunning the pipeline with a second independently trained surrogate would show whether the 0.54 improvement is robust to the surrogate choice.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is empirical: TokenProber's prompts bypass SC_t while still producing NSFW images. In the method, SC_r is used both as the fitness signal and as the success oracle: Algorithm 1 greedily maximizes fitness = SC_r(p,I) - SC_t(p,I) and returns a prompt as soon as InValid(p,I) = (SC_t(p,I) < 0.5) && (SC_r(p,I) > 0.5) holds (Section III-C). Therefore, every reported success is, by construction, a prompt that SC_r classifies as NSFW; the search is not independently checking whether the image is actually NSFW. The only evidence that SC_r-positive means genuinely NSFW is the human-verification step described in Section IV-A5: two authors reviewed the generated images, ambiguous cases were discussed, and no controversial examples arose. No inter-rater agreement, no annotation protocol, no number of independently re-rated images, and no third-party verification are reported. Moreover, Section VI lists the surrogate choice as a potential threat to validity, and the false-positive rates in Table III are computed using this same human review, so they cannot serve as an independent check on it. If SC_r is overconfident or miscalibrated on DreamLike or Stable-Diffusion-v1.5, or if the author review is systematically permissive, the headline average improvement of 0.54 could be substantially lower. The mechanism story is plausible and the ablations are informative, but the quantitative claim is not auditable from the paper as written.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"TokenProber proposes an automated method for generating adversarial prompts that bypass NSFW safety checkers in text-to-image (T2I) models while preserving the NSFW nature of the generated content. The method performs word-level sensitivity analysis to distinguish dirty words (semantically essential to NSFW generation) from discrepant words (words that unduly influence the target safety checker). It then mutates dirty words via semantically similar substitutions and discrepant words via semantically distant substitutions, guided by a fitness function that maximizes the difference between a surrogate safety checker (SC_r) and the target checker (SC_t). The authors evaluate TokenProber against five safety checkers and three T2I models using 324 seed prompts, reporting an average bypass-rate improvement of 0.54 over state-of-the-art baselines, with lower query counts and time usage, plus ablations showing the contribution of each mutation strategy.","tokens_in":20994,"tokens_out":3033,"duration_ms":32589,"significance":"If the reported results hold, the paper makes a useful contribution to robustness evaluation of T2I safety mechanisms. The central idea is plausible and interesting: instead of merely substituting dirty words, one should exploit the discrepancy between the generative model's rendering of NSFW content and the safety checker's sensitivity to non-dirty words. The paper includes a broad experimental matrix (3 models × 5 checkers × 3 datasets), ablations for both mutation strategies, and an efficiency analysis. Credit is also due for comparing against multiple baselines, including a variant of SneakyPrompt with the proposed cross-check oracle, and for making the code and data available. However, the quantitative headline claim is not currently auditable: the success oracle is the same objective being optimized, the human verification protocol is not described in sufficient detail, and no repeated-run variance or confidence intervals are reported. These issues prevent the paper from being accepted in its present form.","major_comments":[{"comment":"The success condition InValid(p,I) = (SC_t(p,I) < 0.5) ∧ (SC_r(p,I) > 0.5) is exactly the condition that the fitness function fitness(p,I) = SC_r(p,I) - SC_t(p,I) is designed to maximize. Consequently, every prompt the algorithm returns is, by construction, one that the surrogate SC_r flags as NSFW while the target checker does not. This is circular unless SC_r's assessment is independently validated as a proxy for actual NSFW content. The paper relies on human verification (Section IV-A5) to break this circularity, but the verification protocol is not auditable as described. Please provide independent evidence that SC_r accurately identifies NSFW images on held-out generations from the T2I models, e.g., by reporting SC_r's agreement with external raters on a sample of images, and describe the human-verification protocol in enough detail (number of raters, inter-rater agreement, number of images re-rated, and whether the raters were blind to the method that generated each prompt).","section":"Section IV-A5 and Table III"},{"comment":"The false-positive rates reported in Table III are computed using the same human review that is used to validate the success of TokenProber's outputs. Section IV-A5 states that two authors manually verified the images and that ambiguous cases were discussed, but it provides no inter-rater agreement statistic, no information on how many images were independently re-rated, and no evidence that the review process was blinded or that the authors did not have a stake in the outcome. Because the false-positive rate is a key argument for the quality of the cross-check oracle, it should be established with an auditable protocol: specify the number of images reviewed, the labeling instructions, the agreement metric (e.g., Cohen's kappa), and ideally include a third-party or crowd-sourced verification. Without this, the contrast between TokenProber's and SneakyPrompt's false-positive rates in Table III cannot be independently assessed.","section":"Section IV-B, Table I"},{"comment":"The central comparison — an average bypass-rate improvement of 0.54 over baselines — is reported as a point estimate from a single run of the experiment. Algorithm 1 contains multiple sources of randomness (random selection of dirty and discrepant words in Lines 5 and 8), and the seed prompt selection is also a sample. No repeated runs, confidence intervals, or statistical significance tests are reported for any entry in Table I. Given that the search is stochastic, the reported superiority across all 45 settings would be much more convincing if accompanied by variance estimates (e.g., standard deviations over 5–10 independent runs) or at least by a statement of the number of runs used to compute each rate. This is not a presentation nit: without variance information, the reader cannot tell whether the 0.54 improvement is robust or an artifact of a particular random seed.","section":"Section III-A and Section VI"},{"comment":"The key assumption of the method is that the surrogate safety checker SC_r, trained on images generated by the T2I models, approximates the T2I model's own decision boundary for NSFW content. The paper never directly validates this assumption. Section VI acknowledges the surrogate choice as a threat to validity and defers the investigation to future work, but the assumption is load-bearing: if SC_r is miscalibrated or overconfident on the particular models used (DreamLike, Stable-Diffusion-v1.4, v1.5), the fitness signal may simply exploit an arbitrary disagreement between two imperfect classifiers, and the 'NSFW maintenance' property would rest entirely on the human-verification step. Please provide a concrete validation, such as comparing SC_r's predictions against independent human labels on sampled images from each T2I model, and report its accuracy, calibration, or false-positive rate on images that are not part of the search process.","section":"Section IV-B, Table I (baseline comparisons)"}],"minor_comments":[{"comment":"The sentence 'most images are easily confirmed if NSFW content is included' is vague; please quantify the proportion of images that were 'easily confirmed' versus those that required discussion.","section":"Section IV-A5"},{"comment":"The phrase 'we encountered no such controversial examples where an agreement couldn’t be reached' is ambiguous — does it mean that for every image, the two authors agreed on first inspection, or that they always reached unanimous agreement after discussion? Please clarify and report how many images were discussed.","section":"Section IV-A5"},{"comment":"Figure 5 contains handwritten annotations ('Added for publication') that appear to be an editing artifact; please remove any such stray text before the final version.","section":"Section V, Figure 5"},{"comment":"The table header 'Q.N' is used without definition in the table caption; please define it in the caption (it is defined elsewhere in the text, but the caption should be self-contained).","section":"Section IV-B, Table II"},{"comment":"The text says 'an average improvement of 0.54' but does not state whether this average is over all datasets, checkers, and models, or only over the adversarial prompting baselines; please specify the exact aggregation used.","section":"Section IV-B, Table I"},{"comment":"In Definition 1, the notation ||M(p) − M(p′)|| < ε is used for semantic difference, but M is a stochastic diffusion model; please clarify whether the norm is over distributions of output images or over some embedding space, and how ε is chosen.","section":"Section II-C"}],"recommendation":"major_revision","confidential_remarks":"The paper's core idea is timely and the experimental breadth is commendable, but the verification of the central claim is not yet at a publishable standard. The circularity between the fitness function and the success oracle is a real concern that can be mitigated by (a) an independent, blinded human or crowd evaluation, (b) a direct validation of the surrogate safety checker against human labels, and (c) repeated-run statistics. I do not see the issues as unfixable within the scope of the paper, so I recommend major revision rather than rejection. I would also encourage the editor to ask the authors to share the full set of adversarial prompts and human-verification raw data with reviewers if they are available, as the current anonymized repository was not accessible for this review."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: TokenProber is a real step forward in T2I safety-checker red-teaming. The dirty/discrepant word distinction is new, and the ablations convincingly show that both mutation strategies earn their keep. The idea of using the surrogate-vs-target score gap as fitness is also sensible. I'd send this to review.\n\nWhat's good: the evaluation is broad (3 T2I models, 5 checkers, 324 seed prompts), the baselines are handled fairly (including the SneakyPrompt variant with a corrected oracle), and the paper ships code, data, and results. The efficiency gains are plausible and the parameter study is useful. The authors also explicitly discuss the surrogate limitation in Section VI, which is more honest than most.\n\nThe soft spots are exactly where the reader's stress test points. The surrogate SC_r is doing two jobs: it's the fitness signal and the success oracle. If SC_r is miscalibrated or simply disagrees with the T2I model's actual rendering behavior, the search can exploit that disagreement rather than preserve NSFW content. The human verification step is supposed to break that circularity, but it's two authors reviewing their own output, with no inter-rater agreement, no blinding, and no third-party audit. Table III's false-positive rates are computed with that same human review, so they don't independently validate the surrogate. The paper acknowledges the surrogate choice as a threat to validity but doesn't test it, e.g., by comparing SC_r decisions against human labels on a random sample.\n\nA second, smaller issue: Table I has no confidence intervals or repeated runs. The gaps are big enough that I suspect the main conclusions survive, but for a paper whose headline is a 0.54 improvement, absent error bars is sloppy.\n\nI don't think any of this sinks the paper. The mechanism is well motivated and the ablations support it. The absolute bypass rates may be optimistic, and the relative improvement over baselines could shrink under stricter verification, but the core finding—that non-dirty words can be mutated to systematically bypass safety checkers while preserving NSFW generation—is likely real. That is worth knowing.\n\nRecommendation: send to peer review. Ask the authors for (1) a surrogate validation study using human-labeled images, (2) blinded independent verification of a sample of bypass successes, and (3) confidence intervals for the main table. With those, this would be a solid contribution.","headline":"A genuinely new word-level attack mechanism with solid ablations, but the headline bypass rates depend on a surrogate doing double duty and on a human-verification step that isn't auditable.","tokens_in":21515,"tokens_out":3016,"would_cite":true,"duration_ms":31987,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TokenProber bypasses T2I safety checkers by mutating neutral 'discrepant' words while preserving dirty words.","keywords":["text-to-image safety","adversarial prompting","jailbreaking","differential testing","NSFW content","safety checker robustness","word-level sensitivity analysis","surrogate safety checker"],"falsifier":"Have an independent panel rate images produced by TokenProber's adversarial prompts and by random word mutations of the same prompts without knowing which is which; if the images are rated no more NSFW than the random mutations, or if the reported bypass rates collapse when the surrogate is replaced by a classifier trained on held-out human labels, the boundary-approximation premise is not doing the work.","tokens_in":20488,"feed_emoji":"🔓","tokens_out":7956,"duration_ms":76431,"temperature":0.7,"pith_summary":"TokenProber is a method for testing the safety filters of text-to-image models by automatically rewriting prompts so that they still produce not-safe-for-work images yet slip past the filter. The paper's central claim is that previous jailbreak tools fail because they edit the explicitly dirty words, which also removes the content that makes images NSFW. TokenProber instead separates prompts into dirty words, which must keep their sensitive meaning, and discrepant words, which are neutral but push the safety checker toward rejection. By replacing dirty words with close synonyms and discrepant words with distant alternatives, it aims to land prompts in the zone where the image generator and the safety checker disagree. Across three T2I models, five safety checkers, and 324 NSFW prompts, the paper reports an average 0.54 improvement in bypass rate over state-of-the-art adversarial prompting, with resulting images manually verified to contain NSFW content.","feed_headline":"TokenProber slips prompts past T2I NSFW filters 54% more often","feed_subtitle":"It keeps dirty words intact and mutates neutral discrepant words, so images stay NSFW while the checker passes them.","key_machinery":"The central machinery is the dirty word versus discrepant word dichotomy, driven by a surrogate safety checker $SC_r$ trained on images produced by the target T2I model. Dirty words are taken from a sensitive-word list and replaced only with the most semantically similar candidate, so the NSFW content survives; discrepant words are the top-$K$ words whose removal produces the largest positive gap $Dc(w)=SC_r(p\\setminus w,I)-SC_t(p\\setminus w,I)$, and they are replaced with the least similar candidate to weaken the target checker's rejection. The success oracle is the cross-check $SC_t(p,I)<0.5$ and $SC_r(p,I)>0.5$, and the fitness function maximized each iteration is $SC_r(p,I)-SC_t(p,I)$. Because the surrogate is trained on the generator's own outputs, it stands in for the T2I model's NSFW decision boundary, making the score difference a concrete handle on the inconsistency zone between generator and filter.","core_discovery":"The discovery is that the safety checkers in text-to-image systems can be bypassed systematically by attacking the mismatch between two decision boundaries rather than by hiding the sensitive content. A word that is not itself dirty, such as a neutral connector word, can still be discrepant in the sense that changing it pushes the target safety checker's score below its threshold while the image generator still renders the scene because the dirty word remains. TokenProber computes each word's discrepancy as the difference between a surrogate safety checker's score and the target checker's score after the word is removed, then mutates the most discrepant non-dirty words away from their original semantics and mutates dirty words only to semantically similar alternatives. A prompt counts as adversarial only when the target checker calls it safe and the surrogate calls it NSFW, i.e., when $SC_t(p,I)<0.5$ and $SC_r(p,I)>0.5$, and human verification of the final images is used to confirm the content is preserved. If taken at face value, this reframes jailbreaking T2I models from a word-substitution game into a differential-testing problem between the generator's approximate boundary and the filter's boundary.","pith_inferences":["The paper leaves implicit that discrepant words are likely checker-specific: since discrepancy is measured against one target checker, an adversarial prompt that works for one filter may not transfer to another, and an ensemble of checkers could blunt the attack even though no single checker does.","The reported 0.54 average improvement is tied to the surrogate being trained on images from the same T2I model under test; a model update that shifts the image distribution could make the surrogate stale, so periodically refreshing $SC_r$ is a natural extension the paper does not evaluate.","A direct test of the paper's mechanism would be to apply the same surrogate-difference objective to text-to-video or text-to-audio generators; the paper predicts generality but presents no experiments, so any claim about those domains remains an open hypothesis.","Because human verification of NSFW content is part of the reported rates, those numbers are judgments about content rather than pure classifier agreement; a public benchmark with pre-registered NSFW labels would make the human-verified comparison reproducible."],"forward_implications":["A text-based safety checker that relies on a sensitive-word list can be evaded by replacing dirty words with near-synonyms and by mutating neutral words that happen to push its score above threshold.","Image-based and text-image checkers are not inherently safer: the reported bypass rates are highest against the NSFW image classifier and Stable Diffusion's text-image filter, both of which score embeddings rather than keywords.","The cross-check oracle (target checker says safe, surrogate says NSFW) reduces false positives to roughly 0.03 to 0.04, compared with about 0.5 for the reinforcement-learning baseline, so automatic filtering of candidate adversarial prompts is feasible.","Because the mutation budget is small (one discrepant word and one dirty word per round), the average query count is about 25.5 on Stable Diffusion v1.4, suggesting the attack is cheap enough to run at scale.","The authors frame the method as differential testing, so the same two-phase scheme should transfer to other generative models with safety checkers, provided a surrogate boundary can be trained for them."],"supporting_citations":[{"why":"Supplies the 4chan and Lexica NSFW prompt datasets and the surrogate safety checker configuration used for $SC_r$.","marker":"[11]"},{"why":"The reinforcement-learning baseline whose false positives motivate the dirty-word-preservation goal; TokenProber is compared against it and against a corrected variant using the cross-check oracle.","marker":"[13]"},{"why":"The LLM substitution baseline for adversarial prompting that TokenProber is compared against.","marker":"[14]"},{"why":"Contributes the surrogate decision-boundary approximation idea on which the cross-check oracle is built.","marker":"[15]"},{"why":"Shows that the Stable Diffusion default safety filter can be bypassed by prompt edits and provides the Text-Image-SD safety checker used as a target.","marker":"[12]"},{"why":"Defines the Stable Diffusion architecture and its built-in text-image safety checker, the central system under test.","marker":"[2]"},{"why":"Stable Diffusion v1.4, the primary T2I model used in the evaluation and the model used for fair comparison with prior work.","marker":"[17]"},{"why":"Stable Diffusion v1.5, one of the additional T2I models used to test how well the method generalizes.","marker":"[19]"}],"fun_headline_variants":["Word-level attack beats T2I safety filters by 54%","TokenProber targets word impact to jailbreak T2I","Safety checker blind to word impact? TokenProber","Attack exploits word discrepancy in T2I filters","TokenProber: fine-grained word analysis bypasses NSFW filters"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the surrogate safety checker, trained on images the target model actually generates, is close enough to the model's own notion of NSFW that maximizing the surrogate-versus-target score gap preserves NSFW content rather than merely hiding it from the target checker.","fun_headline_variants_meta":{"raw":{"variants":["Word-level attack beats T2I safety filters by 54%","TokenProber targets word impact to jailbreak T2I","Safety checker blind to word impact? TokenProber","Attack exploits word discrepancy in T2I filters","TokenProber: fine-grained word analysis bypasses NSFW filters"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000144,"raw_usage":{"total_tokens":1253,"prompt_tokens":1098,"completion_tokens":155,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":714,"completion_tokens_details":{"reasoning_tokens":72}},"tokens_in":714,"tokens_out":155,"duration_ms":2283,"temperature":1.0,"reasoning_tokens":72,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:30:45.644369+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Have an independent panel rate images produced by TokenProber's adversarial prompts and by random word mutations of the same prompts without knowing which is which; if the images are rated no more NSFW than the random mutations, or if the reported bypass rates collapse when the surrogate is replaced by a classifier trained on held-out human labels, the boundary-approximation premise is not doing the work.","supporting_citations":[{"cited_title":"Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models,","cited_arxiv_id":null,"evidence_quote":"Supplies the 4chan and Lexica NSFW prompt datasets and the surrogate safety checker configuration used for $SC_r$."},{"cited_title":"Sneakyprompt: Jailbreaking text-to-image generative models,","cited_arxiv_id":null,"evidence_quote":"The reinforcement-learning baseline whose false positives motivate the dirty-word-preservation goal; TokenProber is compared against it and against a corrected variant using the cross-check oracle."},{"cited_title":"Latent imitator: Generating natural individual discriminatory instances for black-box fairness testing,","cited_arxiv_id":null,"evidence_quote":"Contributes the surrogate decision-boundary approximation idea on which the cross-check oracle is built."},{"cited_title":"CompVis/stable-diffusion-v1-4 · Hugging Face","cited_arxiv_id":null,"evidence_quote":"Stable Diffusion v1.4, the primary T2I model used in the evaluation and the model used for fair comparison with prior work."},{"cited_title":"bdsqlsz/stable-diffusion-v1-5 · Hugging Face","cited_arxiv_id":null,"evidence_quote":"Stable Diffusion v1.5, one of the additional T2I models used to test how well the method generalizes."}],"review_version":1}