{"id":"9dac7701-1e24-48b3-8388-6cd8f5a253fc","arxiv_id":"2509.22292","paper_version":2,"verdict":"CONDITIONAL","confidence":"LOW","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"SceneSplit jailbreaks text-to-video models by fragmenting harmful narratives into benign scenes that collectively constrain output to unsafe videos, reporting average attack success rates above 68% on five commercial T2V systems.","lead":"This paper introduces SceneSplit, a black-box attack that splits a harmful video prompt into multiple individually safe scenes whose sequence forces the model to output unsafe content. A smart generalist might read it to see how current safety filters in text-to-video AI can be bypassed by exploiting story structure rather than single prompts.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"ASR gains may stem from iterative queries and pattern reuse rather than scene splitting alone","rationale":"Reader correctly flags the cross-scene context assumption as central to the proposed mechanism, but the load-bearing empirical claim is the magnitude of improvement over baselines. Without controlling for iteration count, the numerical superiority could be an artifact of extra attempts rather than the narrative-splitting insight. This keeps the verdict at CONDITIONAL with low confidence until query budgets are equalized.","tokens_in":1880,"tokens_out":281,"duration_ms":38290,"concrete_test":"Re-run the five reported baselines with the same per-prompt query limit and reuse library as SceneSplit (e.g., up to 5 iterative refinements); if average ASR gap falls below 15 points on any model, the outperformance claim is not robust to equalized evaluation budget.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline claim of 68-84% ASR significantly outperforming baselines depends on SceneSplit's iterative scene manipulation (to bypass filters inside the narrowed unsafe region) plus a strategy library that reuses successful patterns. If baselines were run as single forward passes without equivalent query budget or reuse, the reported gap cannot be attributed cleanly to the core splitting mechanism. The abstract provides no explicit statement that all methods received identical numbers of model calls or optimization steps per prompt.","agreement_with_reader":"partial"},"referee_report":{"model":"grok-4.3","summary":"The manuscript introduces SceneSplit, a black-box jailbreak method for Text-to-Video (T2V) models. It works by fragmenting a harmful narrative into multiple individually benign scenes whose sequential combination narrows the generative output space to an unsafe region. This core splitting mechanism is augmented by iterative scene manipulation to bypass filters within the constrained region and a strategy library that reuses successful attack patterns. Evaluation on 11 safety categories from T2VSafetyBench reports average Attack Success Rates (ASRs) of 77.2% on Luma Ray2, 84.1% on Hailuo, 78.2% on Veo2, 78.6% on Kling V1.0, and 68.6% on Sora2, significantly outperforming existing baselines.","tokens_in":1970,"tokens_out":592,"duration_ms":41304,"significance":"If the performance gains are cleanly attributable to the scene-splitting mechanism rather than differences in query budget, the work addresses a clear gap in T2V safety research by demonstrating vulnerabilities to narrative-structure attacks. The concrete ASR numbers across five models and 11 categories provide a useful empirical benchmark for the community. The paper ships no machine-checked proofs or parameter-free derivations, but the direct evaluation against external model APIs is a strength of the empirical approach.","major_comments":[{"comment":"Abstract and §4 (Experiments): The headline claim that SceneSplit 'significantly outperforming the existing baselines' depends on the iterative scene manipulation and strategy library. The manuscript does not state whether baseline methods received an equivalent number of model calls or optimization steps per prompt. If baselines were run as single forward passes, the reported ASR gap (68–84%) cannot be attributed cleanly to the core splitting mechanism; this is load-bearing for the central empirical claim.","section":"Abstract and §4"},{"comment":"§4 (Experiments): The reported ASR values (e.g., 77.2% on Luma Ray2) are given without error bars, confidence intervals, or statistical significance tests. Given the stochastic nature of T2V generation and potential selection effects from the post-hoc strategy library, this omission makes it difficult to assess the reliability and reproducibility of the cross-model and cross-category gains.","section":"§4"}],"minor_comments":[{"comment":"The abstract lists five models but does not explicitly confirm the exact model versions or API endpoints used; adding this detail in §4 would improve reproducibility.","section":"Abstract"},{"comment":"Clarify in §3.2 whether the strategy library is populated before or during evaluation on the test set, as this affects claims of robustness.","section":"§3.2"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"Thank you for the opportunity to respond to the referee's comments. We address the major concerns point by point below. We will update the manuscript to incorporate clarifications and additional analyses where indicated to strengthen the presentation of our results.","responses":[{"response":"We appreciate this observation on ensuring fair comparison of methods. Our evaluation followed the standard practices for black-box attacks, where each baseline was implemented according to its original description, typically involving a single prompt per attack attempt unless the method itself includes iterations. To address the concern about query budget, we will add a detailed table in the revised §4 specifying the number of API calls or optimization steps for SceneSplit and each baseline. If the budgets differ, we will perform additional experiments to normalize them and report the results, allowing the contribution of the scene splitting strategy to be more clearly isolated.","revision_made":"yes","referee_comment":"[Abstract and §4] Abstract and §4 (Experiments): The headline claim that SceneSplit 'significantly outperforming the existing baselines' depends on the iterative scene manipulation and strategy library. The manuscript does not state whether baseline methods received an equivalent number of model calls or optimization steps per prompt. If baselines were run as single forward passes, the reported ASR gap (68–84%) cannot be attributed cleanly to the core splitting mechanism; this is load-bearing for the central empirical claim."},{"response":"We agree that incorporating measures of variability would improve the robustness of our empirical claims. In the revised manuscript, we will report ASR values with standard deviations computed over multiple independent runs (e.g., 3-5 seeds per prompt) for key results. We will also include a discussion of the strategy library's selection process and how it was applied consistently across methods to mitigate concerns about post-hoc effects. Statistical significance tests, such as paired t-tests between methods, will be added where appropriate to support the reported performance differences.","revision_made":"yes","referee_comment":"[§4] §4 (Experiments): The reported ASR values (e.g., 77.2% on Luma Ray2) are given without error bars, confidence intervals, or statistical significance tests. Given the stochastic nature of T2V generation and potential selection effects from the post-hoc strategy library, this omission makes it difficult to assess the reliability and reproducibility of the cross-model and cross-category gains."}],"tokens_in":1617,"tokens_out":511,"duration_ms":41858,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main point is that SceneSplit breaks a harmful narrative into several individually safe scenes, then uses iterative manipulation inside the narrowed output space plus a library of reused patterns to push T2V models into generating the bad content anyway. It reports average ASRs between 68% and 84% across Luma Ray2, Hailuo, Veo2, Kling, and Sora2 on the 11 categories from T2VSafetyBench, and beats the baselines they tried.","headline":"Scene splitting plus iterative tweaks produces high ASR numbers on T2V models, but the reported gains over baselines are hard to attribute cleanly to the splitting step itself.","tokens_in":2488,"tokens_out":173,"would_cite":true,"duration_ms":31817,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":{"model":"grok-4.3","evidence":[],"headline":"Scene splitting for T2V jailbreaks has no relation to RS distinction-forcing or J-cost machinery","alignment":"orthogonal","rationale":"The paper's core mechanism (fragmenting narratives into benign scenes that mutually constrain generative output space, plus iterative manipulation and strategy reuse) operates entirely within AI safety/adversarial ML. It invokes no recognition cost J(x), golden-ratio identities, 8-tick periodicity, ratio-symmetric forcing, or any theorem from the RS Lean corpus (e.g., reality_from_one_distinction, washburn_uniqueness_aczel, or AlexanderDuality circle-linking). RS has no opinion on T2V filter bypasses.","tokens_in":57298,"confidence":"high","tokens_out":155,"duration_ms":12116,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Splitting a harmful video prompt into separate safe scenes forces text-to-video models to generate unsafe content by narrowing their output space.","keywords":["jailbreak attack","text-to-video models","safety vulnerabilities","scene splitting","adversarial prompts","generative AI safety","narrative manipulation","output space constraint"],"falsifier":"A direct test would show whether a model rejects or accepts a full sequence of individually safe scene prompts that together describe a harmful video when the model is asked to combine them.","tokens_in":2780,"feed_emoji":"🎬","tokens_out":611,"duration_ms":31764,"temperature":0.7,"pith_summary":"The paper presents SceneSplit as a way to jailbreak text-to-video models by breaking one harmful narrative into several short scenes. Each scene by itself stays within a broad safe output region where most results are harmless. Presenting the scenes in sequence uses their combination to shrink the possible outputs down to a narrow unsafe region that produces the original harmful video. The approach adds iterative tweaks to the scenes and a library of past successful splits to make the bypass more reliable. This reveals that current safety systems for these models check prompts one at a time and miss the larger story they form together.","feed_headline":"Scene splitting bypasses safety in text-to-video models","feed_subtitle":"Breaking harmful stories into separate safe scenes forces models to generate unsafe videos by limiting output options.","key_machinery":"the scene splitting strategy that uses sequential benign scenes as a collective constraint to restrict the generative output space from broad safe outcomes to a targeted unsafe outcome.","core_discovery":"SceneSplit fragments a harmful narrative into multiple scenes, each individually benign. This manipulates the generative output space by treating the sequential combination of scenes as a constraint that narrows the wide safe space into an unsafe region. Iterative scene manipulation bypasses the safety filter inside this region, and a strategy library reuses successful patterns to raise overall effectiveness.","pith_inferences":["Safety training for video models would benefit from simulating the combined narrative that split scenes would produce.","The same splitting tactic could apply to other generation systems that handle long stories through repeated short inputs.","Adding checks for narrative coherence across a prompt history might block this attack while leaving normal use unaffected."],"forward_implications":["Safety filters fail when harmful intent is distributed across multiple prompts rather than stated in one.","Iterative adjustments within the constrained unsafe region raise the chance of bypassing filters.","Reusing patterns from earlier successful splits makes attacks more consistent across different prompts.","The same pattern of narrowing output space through sequential inputs applies to multiple commercial text-to-video systems."],"fun_headline_variants":["Scene splitting forces unsafe text-to-video outputs","Fragmented benign scenes narrow generative space","SceneSplit narrows safe outputs to harmful videos","Combining scenes bypasses T2V model safety filters"],"cache_read_input_tokens":64,"weakest_assumption_plain":"Safety filters evaluate each scene prompt in isolation without enough memory of prior scenes to spot an overall harmful narrative.","fun_headline_variants_meta":{"raw":{"variants":["Scene splitting forces unsafe text-to-video outputs","Fragmented benign scenes narrow generative space","SceneSplit narrows safe outputs to harmful videos","Combining scenes bypasses T2V model safety filters"]},"model":"grok-4.3","cost_usd":0.005724,"raw_usage":{"total_tokens":2705,"prompt_tokens":777,"num_sources_used":0,"completion_tokens":55,"cost_in_usd_ticks":57240500,"prompt_tokens_details":{"text_tokens":777,"audio_tokens":0,"image_tokens":0,"cached_tokens":64},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1873,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":777,"tokens_out":55,"duration_ms":22785,"temperature":1.0,"reasoning_tokens":1873,"cache_read_input_tokens":64,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-05-21T22:16:40.825555+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A direct test would show whether a model rejects or accepts a full sequence of individually safe scene prompts that together describe a harmful video when the model is asked to combine them.","supporting_citations":[],"review_version":1}