{"id":"b045e4e3-90de-4a49-9195-3f9850510a41","arxiv_id":"2608.00973","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"Zero-query jailbreak attacks on text-to-image systems that exploit filter-generator discrepancy reach 29-33% average success and beat baselines on six pipelines and GPT-image-2.","lead":"A text-to-image jailbreak method exploits mismatches between safety filters and image generators to build prompts that pass the filter but still trigger unsafe images. The attack needs no queries to the target service and beats five baselines on most tested pipelines, including a commercial image API.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Appendix B validates the tokenization gate on a BERT WordPiece tokenizer, but the stated surrogate is DistilRoBERTa byte-level BPE, which never emits [UNK]; Eq. (4) cannot be computed as written.","rationale":"The reader's weakest_assumption concerns transferability of surrogate-observed asymmetries to unknown target filters. My concern is more specific and more immediate: the surrogate-side tokenization gate, one of the two instantiations of FGD, is validated and specified against a tokenizer family different from the actual surrogate. This is not just a missing robustness check; it is an internal inconsistency in the method as written. The paper's central claim is that FGD is a transferable mechanism, and Eq. (4) is one of its two observable pillars. If the stated surrogate cannot emit [UNK], then either the implementation used an unstated tokenizer (possibly the target's, which would break the zero-query premise) or the reported Q_tok screening is computed from a different signal than described. The Appendix B experiment is the only direct evidence for the [UNK]-erasure mechanism, and it demonstrably uses a BERT WordPiece tokenizer for the independent variable while evaluating on a DistilRoBERTa byte-level BPE model. A quick tokenizer check can settle this. I did not select the single-seed/no-significance issue as primary because, while important for the exact effect sizes, it is a standard robustness concern rather than an inconsistency in the mechanism itself. The reader already conditions the verdict on similar grounds, so I recommend keeping the CONDITIONAL verdict; if the tokenizer check confirms the mismatch, the condition should explicitly require correcting the surrogate specification and re-validating Eq. (4).","tokens_in":23381,"tokens_out":11214,"duration_ms":123829,"concrete_test":"Load the tokenizer of michelleli99/NSFW_text_classifier and tokenize the 20 'UNK group' homoglyph variants used in Appendix B (e.g., variants of 'naked', 'sex', 'fucked'). Count how many of those 20 variants actually produce the [UNK] token. If 0/20 produce [UNK], Eq. (4) cannot fire with the stated surrogate and Appendix B's UNK/non-UNK comparison is invalid; if some do, report the exact count and re-run the Appendix B evasion-rate comparison using that tokenizer to see whether the 63.3%/6.4% split reproduces.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's tokenization-level FGD rule, Eq. (4), depends on g_tok = 1 when the filter tokenizer maps a homoglyph variant to an [UNK] sequence. The zero-query construction has only the surrogate filter's tokenizer available, and the named surrogate is Bert-NSFW, referenced to the HuggingFace model michelleli99/NSFW_text_classifier, which is a DistilRoBERTa-base model. RoBERTa uses byte-level BPE, the same tokenizer family as CLIP, and does not emit [UNK] for arbitrary Unicode: every byte sequence has a byte-level fallback. If the surrogate's tokenizer is used, g_tok is effectively 0 for all variants, so the token-level screening repository and the claimed Q_tok scores cannot be produced. Appendix B nevertheless defines its 'UNK group' using 'the BERT tokenizer' and reports 63.3% vs 6.4% evasion on the surrogate. This validates a different tokenizer from the one used in the pipeline. If instead the authors computed g_tok using a known BERT/WordPiece target tokenizer such as DistilBert-NSFW's, then the gate uses target-specific information not available for an unknown commercial filter, contradicting the zero-query/unknown-target premise. Either way, the central FGD tokenization mechanism, as described and validated, is not connected to the surrogate signal the paper claims to use. The ablation shows this matters: removing Q_tok costs about 4.5 pp average ASR-4, and the theoretical framing explicitly rests on the [UNK] asymmetry.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FGD-Jail, a zero-query jailbreak framework for safety-gated text-to-image (T2I) systems. It formalizes a Filter-Generator Discrepancy (FGD) between prompt-level safety filters and downstream generators, instantiates it as tokenization-level and semantic-level screening rules for candidate perturbations, and then applies a surrogate-ensemble evolutionary search that uses a worst-case dual-surrogate risk and CLIP-based preservation scoring. Experiments are reported on six local black-box pipelines (two prompt filters × three generators) and on the commercial GPT-image-2 service, with ASR measured by two image safety detectors. The main empirical claim is consistent improvement over four baselines, e.g., 29.2% vs. 21.8% MHSC ASR-4 and 33.3% vs. 21.8% Q16 ASR-4 on average, with additional gains on the online service.","tokens_in":23769,"tokens_out":6528,"duration_ms":70332,"significance":"If the empirical claims hold, the paper would make a useful contribution by turning the filter/generator representation gap into actionable screening criteria and by showing that a zero-query transfer attack can outperform query-based or white-box baselines. The paper has clear strengths: a clean conceptual framework (Eqs. 2–5), a two-stage screening design that is ablated separately, a commercial online evaluation with an undisclosed pipeline, detailed appendices describing the repositories and evolutionary operators, and a fixed-seed reproducibility statement. The main risks are the correctness of the tokenization-level gate with the stated surrogate, the lack of any variance estimates for the headline numbers, and the closeness between surrogate families and target filter families, which weakens the transferability claim.","major_comments":[{"comment":"The tokenization-level gate g_tok is central to the paper's mechanism, but as written it cannot be computed with the stated surrogate. The method text says g_tok=1 when the filter tokenizer maps a variant to [UNK], and Appendix A says token-level candidates are screened with 'the surrogate filter's tokenizer (an [UNK] check)'. The only classifier surrogate, Bert-NSFW (michelleli99/NSFW_text_classifier), is a fine-tuned DistilRoBERTa model, which uses byte-level BPE and never emits [UNK] for arbitrary Unicode; every byte sequence has a byte-level fallback. Thus g_tok would be 0 for all candidates. Appendix B's validation (63.3% vs. 6.4% evasion) is performed with 'the BERT tokenizer', i.e., a WordPiece tokenizer that is neither the surrogate's nor, as far as the paper states, the target's. This is a load-bearing mismatch: the token-level screening repository, the Q_tok score, and the abla","section":"Eq. (4), Appendix A, Appendix B"},{"comment":"All reported results come from a single fixed random seed (seed=42), with no confidence intervals, bootstrap intervals, or significance tests. The main differences between methods are often 8–12 percentage points on 150 prompts; with n=150, the standard error of a proportion near 30% is about 3.7 pp, so a 95% CI is roughly ±7 pp. The ablation differences are much smaller — e.g., Table 3 shows MHSC ASR-4 of 29.22% (full) vs. 25.67% (w/o both), and Table 4 shows Q16 ASR-4 of 33.34% vs. 32.23% for R_LLM-only — and these are well within noise at the stated sample size. The fixed-seed statement is not a substitute for repeated-seed or bootstrap uncertainty quantification. Without this, the strength of the empirical claims, especially the ablations and the ensemble comparison, cannot be assessed.","section":"Tables 1, 3, 4; Appendix D 'Reproducibility'"},{"comment":"The transferability claim is only weakly tested because the target filters are deliberately drawn from the same two families as the surrogates: DistilBert-NSFW vs. the DistilRoBERTa-based Bert-NSFW, and ShieldGemma vs. Qwen-Guard. This is not circular in a logical sense, but it means the reported six-pipeline averages may overstate transfer to filters outside these families. The commercial GPT-image-2 evaluation is a better out-of-family test and should be expanded (with sample size and repeated runs). In addition, CLIP is used both as the generator-side surrogate during search and as the semantic-consistency scoring metric during evaluation, so SC is not independent of the optimization objective. ASR is judged by MHSC/Q16, so it is not directly inflated, but the paper should report SC with a different embedding model to confirm that the preservation claim is not an artifact of optimizin","section":"Experiments: target/surrogate families; Eq. (6); SC metric"}],"minor_comments":[{"comment":"The running text refers to 'Table 6' and 'Table 7' for the ablation results, but the corresponding appendix tables are numbered 10 and 11. Fix the cross-references.","section":"Appendix F"},{"comment":"The GPT-image-2 benchmark does not state the number of prompts used. The text says 'sampled online benchmark' but no N is given, so the reported BR/ASR values cannot be interpreted with uncertainty in mind.","section":"Table 2"},{"comment":"The access-level alignment is described in prose, but Table 1 does not mark the two pipelines where SneakyPrompt and MMA-Diffusion use Stable Diffusion v1.5 as a white-box/query-based generator. A footnote or symbol on those columns would help readers discount those comparisons appropriately.","section":"Appendix E"},{"comment":"The formal notation C(x), c, and recognizability A_M(x,c) is introduced but not used in the subsequent instantiations. Either connect these objects to g and P explicitly or simplify the formalization to avoid an unused layer of notation.","section":"Method, Eq. (2)"},{"comment":"The responsible-release statement says code will be released 'upon publication.' For a reproducibility-focused claim, an anonymized artifact or a detailed configuration listing (exact tokenizer versions, model revisions, seed usage) would strengthen the manuscript now.","section":"Appendix H"}],"recommendation":"major_revision","confidential_remarks":"The tokenizer mismatch is the most serious issue: it directly affects one of the two screening rules and its ablation, and it is not a presentation problem. That said, the overall framework is potentially salvageable — replacing the classifier surrogate with a WordPiece-based model or restricting the tokenization-level claim to WordPiece filters would address the core concern, though it may require re-running the experiments. The statistical issue is more than cosmetic: a single fixed seed with no variance estimates is not sufficient for the fine-grained ablation claims. The paper's central idea is worth further review after these experiments are redone."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a real paper with a genuinely new organizing idea. The Filter-Generator Discrepancy is a useful way to think about transferable prompt attacks, and the authors make it operational with screening rules plus a dual-surrogate evolutionary search.\n\nWhat it does well: the evaluation is more careful than most attack papers. It tests six black-box pipelines and a commercial service, reports both bypass rate and ASR, and runs ablations that show the screening rules matter. It also discloses that MMA-Diffusion and SneakyPrompt effectively get white-box/query access on two pipelines, which is honest and makes the comparison conservative. Appendix B's controlled test of [UNK]-triggering homoglyphs is the right kind of mechanistic validation to want.\n\nThe problem: that validation doesn't fit the stated surrogate. The paper says the tokenization gate relies on the filter tokenizer emitting [UNK], and that the classifier surrogate is Bert-NSFW, which is a DistilRoBERTa model with byte-level BPE and no [UNK] fallback. Appendix B validates the gate using a BERT WordPiece tokenizer, not the surrogate's. If the authors used the target tokenizer to build Q_tok, that leaks target information and breaks the zero-query premise. If they used the surrogate, g_tok is always zero and Eq. (4) can't be computed. Either way, the central tokenization mechanism is not connected to the surrogate signal the paper claims. The ablation says removing Q_tok costs a few points of ASR, so this is load-bearing, not decorative.\n\nMinor issues: single fixed seed, no error bars or significance tests; the GPT-image-2 sample is small; beta in Eq. (5) is unspecified; code and the curated repositories are withheld. None of these sink the semantic-level FGD or the dual-surrogate ensemble, which look plausible and are supported by the ShieldGemma pattern.\n\nVerdict: the idea deserves a real referee and a revision. Ask for a tokenization mechanism that works with a true zero-query surrogate, plus multi-seed runs with error bars. The paper is likely fixable, but the numbers as reported should not be cited as established.","headline":"Worth a serious referee: the FGD framing is genuinely new and the evaluation is unusually careful, but the tokenization gate as written doesn't connect to the stated surrogate, and the single-seed design leaves the effect sizes provisional.","tokens_in":24293,"tokens_out":5842,"would_cite":true,"duration_ms":65739,"reading_group":"yes","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that prompt-level safety filters in T2I systems can be bypassed without target queries by exploiting the representational gap between the filter and the generator, and demonstrates a framework (FGD-Jail) that raises attack","keywords":["text-to-image safety","jailbreak attack","zero-query attack","filter-generator discrepancy","surrogate ensemble","evolutionary search","prompt-level safety filter","NSFW content"],"falsifier":"Run FGD-Jail against a prompt-level filter built on a byte-level BPE tokenizer that never emits [UNK], paired with the same generator; if the attack's ASR edge over baselines does not collapse, the tokenization gate is not the operative mechanism. Separately, replace the LLM filter with one explicitly trained to be negation-robust; if semantic-level screening stops contributing, the negation-asymmetry claim would be falsified.","tokens_in":23222,"feed_emoji":"🖼️","tokens_out":6615,"duration_ms":61091,"temperature":0.7,"pith_summary":"This paper claims that the safety filter and the image generator in a text-to-image pipeline read the same prompt in mismatched ways, and that this mismatch—the Filter-Generator Discrepancy (FGD)—can be turned into a reusable zero-query jailbreak. The authors propose FGD-Jail, which screens prompt perturbations with two observable consequences of the gap (how the filter's tokenizer handles Unicode variants, and how an LLM filter's negation-aware reasoning contrasts with the generator encoder's bag-of-words behavior) and then evolves candidates with an evolutionary search that consults only public surrogate filters. On six black-box pipelines built from two filter types and three generators, FGD-Jail raises average attack success to 29.2% (MHSC) and 33.3% (Q16), about 8 and 12 percentage points above the strongest baseline, and it also leads on an undisclosed commercial service. A careful reader should care because, if the transfer holds, the standard filter-first architecture is vulnerable without any query to the deployed system.","feed_headline":"Zero-query jailbreak hits 33% attack success on six pipelines","feed_subtitle":"FGD-Jail exploits the gap between safety filters and image generators, topping baselines by 8-12 points with no target queries.","key_machinery":"The central object is the Filter-Generator Discrepancy (FGD), formalized as $Q(\\delta; x, c) = g(\\delta) P(x, x_\\delta)$, a gate-and-preservation score. Tokenization-level instantiation: $g_{tok}=1$ when the filter's WordPiece tokenizer maps a perturbed word to an [UNK] sequence while CLIP's byte-level BPE retains recoverable subword evidence, and preservation is $P_{tok} = r(w, \\tilde{w}) \\cdot \\cos(E(w), E(\\tilde{w}))$. Semantic-level instantiation: $g_{sem} = \\mathbf{1}[R_{LLM}(x_\\delta) < R_{LLM}(x)]$, with $P_{sem} = \\cos(E(x), E(x_\\delta)) - \\beta R_{LLM}(x_\\delta)$, exploiting CLIP's insensitivity to negation. The evolutionary search combines the worst-case dual-surrogate risk $R = \\m","core_discovery":"FGD-Jail is built on a single observation: in safety-gated T2I pipelines, the prompt filter and the generator read the same prompt under different objectives and representations, so a perturbation can make a prompt unrecognizable to the filter while leaving the visual concept intact for the generator. The paper formalizes this as Filter-Generator Discrepancy (FGD) with the scoring $Q(\\delta; x, c) = g(\\delta) P(x, x_\\delta)$, where $g$ is a gate that requires filter-side risk reduction and $P$ is a preservation factor that retains generator-side semantics. It instantiates the gate twice: tokenization-level (WordPiece filters map Unicode variants to [UNK] while CLIP's byte-level BPE preserves","pith_inferences":["Editorial inference: the same representation-level mismatch could generalize to other conditional generators (text-to-video, text-to-3D, or VLM-based pipelines) that pair a classifier-style filter with a frozen text encoder; the paper does not test these.","Editorial inference: a target filter that uses a byte-level BPE tokenizer with no [UNK] would remove the tokenization gate's advantage; a natural extension is to build the gate from the actual tokenizer family or add a euphemism-only tier.","Editorial inference: the absolute ASR numbers come from a fixed 150-prompt benchmark; a more portable claim is the relative gain of discrepancy screening over unscreened evolutionary search, which could be probed on other benchmarks and updated filters.","Editorial inference: FGD suggests a defensive metric—measure the divergence between a proposed filter's decisions and the generator text encoder's similarity on Unicode and negation perturbations, and require filters to reduce that divergence."],"forward_implications":["FGD-Jail's screened search means an attacker needs zero queries to the target, so monitoring-based defenses that detect repeated probing are bypassed by construction.","The ablations show the two screening rules and the dual-surrogate risk are complementary: removing either lowers ASR, and single-surrogate variants overfit to one filter family.","A high bypass rate does not imply jailbreak success; candidates that lose generator-side concept retention pass the filter but produce no unsafe image, so evaluations should report both filter bypass and image-level ASR.","If FGD is real, defenses that treat prompt filtering and generation as independent components are structurally exposed; the paper's conclusion suggests aligning filter and generator representations or coordinating protection across the full pipeline.","The attack transfers to a commercial service with undisclosed moderation, indicating that the discrepancy mechanism is not an artifact of the specific open-source filter choices."],"supporting_citations":[{"why":"Provides WordPiece tokenization that maps out-of-vocabulary tokens to [UNK]; this is the operative mechanism for the tokenization-level gate.","marker":"(Devlin et al. 2019)"},{"why":"CLIP's byte-level BPE never emits [UNK] and retains recoverable subword evidence; also supplies the generator-side encoder used in preservation scores.","marker":"(Radford et al. 2021)"},{"why":"Bert-NSFW is the classifier-type surrogate filter used to estimate $R_{CLS}$.","marker":"(Li 2022)"},{"why":"Qwen-Guard is the LLM-type surrogate filter used to estimate $R_{LLM}$ and to validate the semantic-level gate.","marker":"(Zhao et al. 2025)"},{"why":"DistilBert-NSFW is one of the two target prompt-level filters in the six black-box pipelines.","marker":"(Khader et al. 2024)"},{"why":"ShieldGemma is the LLM-based target filter used to test transfer to intent-reasoning filters.","marker":"(Zeng et al. 2024)"},{"why":"Documents CLIP's bag-of-words behavior, the generator-side asymmetry exploited by semantic-level screening.","marker":"(Yuksekgonul et al. 2023)"},{"why":"Shows vision-language models do not understand negation, supporting the semantic discrepancy behind $g_{sem}$.","marker":"(Alhamoud et al. 2025)"},{"why":"Provides the UnsafeDiffusion prompts and the MHSC image-safety detector used for evaluation.","marker":"(Qu et al. 2023)"},{"why":"Provides the Q16 image-safety detector used as the second evaluation metric for attack success.","marker":"(Schramowski, Tauchmann, and Kersting 2022)"}],"fun_headline_variants":["No queries needed: jailbreaking T2I via filter-generator gap","Zero-query jailbreak exploits filter-generator mismatch","33% attack success without querying the target","The gap between filter and generator enables zero-query jailbreak","FGD: punching through safety filters with zero queries"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The load-bearing premise is that the unseen target filter behaves enough like the public surrogate filters—same tokenizer family and same reliance on negation-sensitive intent reasoning—that the offline screening rules generalize to it without any target queries.","fun_headline_variants_meta":{"raw":{"variants":["No queries needed: jailbreaking T2I via filter-generator gap","Zero-query jailbreak exploits filter-generator mismatch","33% attack success without querying the target","The gap between filter and generator enables zero-query jailbreak","FGD: punching through safety filters with zero queries"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000185,"raw_usage":{"total_tokens":1190,"prompt_tokens":806,"completion_tokens":384,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":550,"completion_tokens_details":{"reasoning_tokens":303}},"tokens_in":550,"tokens_out":384,"duration_ms":3582,"temperature":1.0,"reasoning_tokens":303,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T00:35:26.388938+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run FGD-Jail against a prompt-level filter built on a byte-level BPE tokenizer that never emits [UNK], paired with the same generator; if the attack's ASR edge over baselines does not collapse, the tokenization gate is not the operative mechanism. Separately, replace the LLM filter with one explicitly trained to be negation-robust; if semantic-level screening stops contributing, the negation-asymmetry claim would be falsified.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Documents CLIP's bag-of-words behavior, the generator-side asymmetry exploited by semantic-level screening."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the Q16 image-safety detector used as the second evaluation metric for attack success."}],"review_version":1}