Pith. sign in

REVIEW 5 major objections 8 minor 77 references

Commercial image generators refuse harmful text as plain output yet often render the same instructions as readable text inside images, and TYPO exploits that gap at over 90% success.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 09:19 UTC pith:PHB7EHB3

load-bearing objection Real cross-modal gap and a clean black-box exploit; the big ASR margins are partly judge-tied, but the paper is still worth engaging. the 5 major comments →

arxiv 2607.24897 v1 pith:PHB7EHB3 submitted 2026-07-27 cs.CR

TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models

Meng Xie , Li Zeng , Hangtao Zhang , Xianlong Wang , Ziqi Zhou , Pengpeng Qiao , Zhetao Li This is my paper
classification cs.CR
keywords instruction-dense visual jailbreaksadversarial typographyimage-generation safetycross-modal alignment gapblack-box jailbreakcommercial text-to-image modelsdual-channel strategy search
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Commercial image-generation models have gotten good at putting legible text into posters, manuals, and infographics. This paper shows that the same skill opens a safety hole: systems that refuse a harmful request when asked for plain text will often fulfill it when asked to put that text inside a generated image. The authors measure about a 44-point average gap in fulfillment between the two modalities. They name the resulting threat instruction-dense visual jailbreaks—images that contain detailed, readable, actionable harmful instructions rather than merely unsafe objects or scenes. To exploit the gap they introduce TYPO, a black-box method that builds adversarial typography prompts by jointly searching a textual reframing channel and a visual presentation channel, then scoring the resulting images. On four closed-source commercial models the attack exceeds 90% success under their judge, beats nine prior jailbreaks by roughly fifty points on average, and costs only a few cents and a handful of queries per intent.

Core claim

Safety alignment does not reliably transfer from textual outputs to text embedded in images. The same harmful intents that models refuse as direct text are frequently rendered as detailed, legible instructions inside generated images, creating an instruction-dense visual jailbreak surface that prior object-or-scene visual jailbreaks do not cover.

What carries the argument

TYPO’s dual-channel textual-visual strategy space: a textual channel that reframes intent (semantic camouflage, spelling obfuscation, knowledge elicitation, linguistic variation) paired with a visual channel that sets presentation form, document carrier, text appearance, and viewing perspective; candidate combinations are optimized by adaptive combinatorial search (smell/vision steps plus Cauchy mutation) and scored by a VLM judge.

Load-bearing premise

Success is defined by one external vision-language judge giving a severity score of 4 or higher on a 0–5 scale, without a large multi-annotator human study showing the ranking holds under other judges or thresholds.

What would settle it

Re-run the same AdvBench and StrongREJECT intents on the four commercial models, score every image with independent human raters under a fixed actionability rubric, and check whether TYPO’s attack-success rate still exceeds 90% and still beats the nine baselines by a large margin.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Vendors cannot treat text-generation refusals as sufficient evidence that image pipelines will refuse the same content.
  • Defenses must inspect rendered text inside images, not only prompt keywords or whole-image classifiers.
  • Adversarial typography prompts transfer across models at high rates, so a single successful prompt can threaten multiple commercial APIs.
  • Low query cost (about $0.04 and under three iterations) makes large-scale automated probing practical.
  • Presentation tricks such as mirrored or vertical layouts can defeat OCR-based filters while remaining human-readable.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Future alignment work will need joint text-and-image training objectives rather than separate modality filters.
  • The same dual-channel search pattern could be inverted to stress-test document-layout and accessibility systems that rely on OCR.
  • Once models can emit multi-page manuals, the same gap may produce longer instructional artifacts than single posters.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 8 minor

Summary. The paper introduces "instruction-dense visual jailbreaks": inducing commercial text-to-image models to emit detailed, readable, actionable harmful instructions as text rendered inside images, rather than as textual completions. A pilot study on Gemini-3.1-Flash-Image-Preview (400 AdvBench intents, Fig. 3) reports a mean +43.8% fulfillment gap when harmful requests are asked for as image-embedded text versus direct text. The proposed attack, TYPO, decomposes prompt construction into a textual channel (semantic reframing) and a visual channel (presentation form), forming a discrete dual-channel strategy space searched by a fruit-fly-inspired population method with Cauchy mutation (Alg. 1), with an auxiliary LLM instantiating prompts and a Llama Guard local screen plus rescue rewrite. On GPT-Image-2, Nano Banana Pro, Qwen-Image-2, and Seedream 5.0 Lite, TYPO reports >90% ASR at threshold τr=4 under a GPT-5 VLM judge, beating nine baselines by 50.2% ASR on average, at ~2.8 optimization iterations and ~$0.04 per attack, with transfer ASRs of 57–83% and high bypass rates against keyword, PPL, CLIP, Q16, and OCR+Llama Guard defenses.

Significance. If the central measurement holds up, the paper makes a useful and timely contribution: it identifies a concrete, under-studied failure mode — safety alignment not transferring to text rendered inside generated images — in precisely the commercial systems now marketing text-rendering quality. The empirical program is broad for this literature: four commercial targets, two standard harmful-intent benchmarks, nine baselines spanning T2I and LLM jailbreaks, a cross-model transfer matrix (Table 3), five defenses including an OCR-based pipeline (Fig. 5), channel and search ablations (Table 4, Fig. 6), and transparent per-attack cost accounting (~$0.04). The public code release and the use of standard benchmarks make the claims falsifiable and reproducible in principle. The finding that strong baselines like AutoDAN-Turbo also reach ~81% ASR is itself informative: it suggests the attack surface is real and not solely an artifact of the authors' optimizer. However, the evidentiary weight of the headline numbers is currently capped by the single-judge evaluation design detailed below.

major comments (5)
  1. [Sec. 3.2, 4.3, 5.1; Eq. (1)/(6); Alg. 1] The success metric and the optimizer's fitness signal are the same instrument. Algorithm 1 (Lines 6-9) evaluates candidates with the GPT-5 VLM judge and stops as soon as r* >= tau_r; Eq. (1) and Eq. (6) then define success using that same judge and threshold. Consequently the three headline quantities in Table 2 -- ASR >90%, Iter. = 2.80, and the ~$0.04 cost -- are jointly inflated or deflated by any systematic judge bias and are not independent outcomes. This is fixable within the paper's scope: re-score a fixed sample of final prompts (TYPO's and the top baselines') with at least one judge from a different vendor family, and report whether the ASR ordering and margins survive. If they do, the central claim stands; currently the reader cannot tell how much of the 50.2% margin is optimization toward the metric.
  2. [Sec. 5.1-5.2; Table 2] ASR is a step function at tau_r = 4 while the mean Scores sit just above the threshold (TYPO ~4.58-4.67; AutoDAN-Turbo ~4.15-4.22; TAP ~3.82-3.95). A +/-0.5 systematic shift in judge severity would move the ASR gap dramatically without changing the underlying outputs. The paper reports no sensitivity analysis over tau_r (e.g., tau_r in {3, 4, 5}) or score-distribution plots. Given that the mean-Score margin over AutoDAN-Turbo is only ~0.4-0.5 points, the claim of a 50.2% ASR advantage is fragile to this choice and a threshold-sensitivity table is needed for the comparison to be interpretable.
  3. [Sec. 5.1 (Evaluation Metrics)] The only grounding of the automatic judge is the sentence 'manual review shows over 95% agreement with GPT-5 judgments' -- with no sample size, no annotator count, no inter-rater reliability statistic, and no description of the review protocol. Moreover, the judge protocol is adopted from Kuo et al. (2025) (H-CoT), which was designed for scoring text outputs of reasoning models, not for reading rendered text inside generated images, where OCR/legibility failures (which the paper itself exploits in Fig. 5(b)) add a noise channel the protocol was never validated against. A reported annotation study (n, kappa or agreement CIs, and per-category breakdown) on a random subset of success/failure cases is needed; this directly underwrites the primary metric.
  4. [Sec. 5.1 (Competitors) and 5.2; Table 2, Iter. columns] PAIR, TAP, and AutoDAN-Turbo are LLM jailbreaks; the manuscript does not explain (in the main text) how their target model, judge, and stopping criterion were instantiated against image-generation models, yet Table 2 compares Iter. across methods (e.g., TYPO 2.80 vs. AutoDAN-Turbo 12.88) as an efficiency claim. Iter. is only comparable if all methods share the same fitness signal and stopping rule; if each baseline uses its native scorer, the Iter. column conflates optimizer quality with scorer leniency. Please state explicitly, per baseline, what judge scored its candidates and what threshold stopped its search, and either harmonize the stopping criteria for the efficiency comparison or qualify the Iter. claim accordingly. (Appendix C is referenced but the main text must be self-contained on this point since it supports a headline claim.)
  5. [Sec. 3.3; Fig. 3; Remark I] The 43.8% mean modality gap rests on a single preview model (Gemini-3.1-Flash-Image-Preview), 400 intents, one query per condition, and an unspecified refusal/compliance classifier -- the text does not say whether the same GPT-5 judge and tau_r = 4 were used, or a refusal detector, or manual labeling. Since Fig. 3 motivates the entire paper ('we first show...'), the classification procedure must be specified, and ideally the pilot should be replicated on at least one of the four production target models to show the gap is not an artifact of one preview system's text/image routing. This is a secondary statistic relative to Table 2, but it is the paper's claimed first contribution and currently under-documented.
minor comments (8)
  1. [Throughout] Naming is inconsistent throughout: the abstract and title use 'TYPO' while the body uses 'Typo' (small caps). Please pick one form.
  2. [Fig. 1, Fig. 2] Fig. 1 and Fig. 2 render example image text at sizes that are illegible in print; consider enlarging crops or adding transcriptions, both for readability and to let reviewers verify legibility claims (which matter given the OCR-evasion results in Fig. 5(b)).
  3. [Fig. 5(b)] Fig. 5(b) would be clearer as a small table or with explicit axis labels; the 'BR FPR' cluster and the unlabeled braces are hard to parse, and the values 9/76/66/81/63 and 0/8/4/11/6 are not attributed to forms in the caption.
  4. [Sec. 5.2; Appendix D reference] The cost claim ('less than $0.04 on GPT-Image-2') is given only for TYPO; baseline query costs (especially AutoDAN-Turbo at ~13 iterations) are not reported, so the efficiency advantage is asserted but not quantified on the cost axis. A per-method cost column would strengthen Sec. 5.2.
  5. [Eq. (1), Eq. (6)] Eq. (1) and Eq. (6) have typographic artifacts in the PDF (misaligned delimiters/empty boxes in the argmax and the piecewise definition); please check the compiled math.
  6. [Sec. 3.2, 5.2] The threat model (Sec. 3.2) should state whether the attacker's queries to the VLM judge and auxiliary LLM (DeepSeek-V4-Pro) are counted in the reported query/cost figures, or only target-model queries; the '2.41 queries to the image-generation model' phrasing implies the latter, which should be explicit since judge calls may dominate API spend.
  7. [Sec. 2.2] Related work should acknowledge FigStep (Gong et al. 2025, already cited for the OCR defense) as the closest prior typographic attack -- it embeds harmful text typographically against VLMs; a sentence clarifying how instruction-dense jailbreaks against T2I models differ in threat and mechanism would preempt confusion.
  8. [Sec. 5.3; Table 3] Table 3's transfer results use prompts 'obtained during optimization' -- please state how many prompts per source model were transferred and whether the same tau_r = 4 criterion (and the same GPT-5 judge) was used on the transfer targets.

Circularity Check

0 steps flagged

No derivation circularity: empirical attack paper measures external models; judge-as-fitness is standard evaluation design, not a self-definitional prediction.

full rationale

TYPO is an empirical black-box jailbreak framework, not a first-principles derivation. The load-bearing claims are measured outcomes against external commercial APIs (GPT-Image-2, Nano Banana Pro, Qwen-Image-2, Seedream 5.0 Lite), public benchmarks (AdvBench, StrongREJECT), and nine external baselines. The 43.8% modality gap (Sec. 3.3, Fig. 3) is a direct pilot comparison of two prompt templates on the same intents. Dual-channel strategies (Tab. 1) and adaptive combinatorial search (Alg. 1, Eqs. 2–6) are engineering choices whose success is reported as ASR/Score/SC/Iter., not as theoretically forced predictions. Fitness r and success threshold τr=4 use the same VLM judge by design (Eqs. 1, 6)—standard for optimization-based jailbreaks and an evaluation-validity concern, not circular reduction of a claimed derivation to its inputs. No uniqueness theorem, self-citation chain, or fitted parameter is relabeled as an independent prediction. Related-work self-citations are non-load-bearing. Score 0; steps empty.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 3 invented entities

Load-bearing content is mostly methodological and evaluative rather than axiomatic physics/math. The claim rests on a hand-built discrete strategy space, an external VLM success oracle with a chosen threshold, black-box API behavior at a snapshot in time, and standard assumptions that refusal/compliance labels and OCR/filter bypass rates are meaningful safety proxies. No deep formal derivation; free choices are search hyperparameters and strategy inventories.

free parameters (4)
  • success threshold τr = 4
    Binary ASR is defined by judge score r≥τr; paper sets τr=4 on a 0–5 scale following Kuo et al., which directly controls reported ASR.
  • dual-channel strategy option catalog (St × Sv) = 8 strategy families; options not fully enumerated in main text
    Four textual and four visual strategies with discrete option sets are designer-chosen; the attack’s expressivity and OCR robustness depend on this hand-built space (Table 1, limitation in §6).
  • search hyperparameters (Np, T, Δℓ,k, βℓ schedule, Cauchy mutation) = average ~2.8 iterations in main results; specifics partly in Appendix B
    Population size, iteration cap, smell-search radius, vision-search attraction schedule, and mutation controls govern exploration/exploitation and reported Iter./query cost.
  • local safety guard + one-step rescue rewrite policy
    Llama Guard screening and auxiliary-LLM rewrite decide which candidates ever hit the target API, affecting both ASR and query count (Fig. 6a).
axioms (5)
  • domain assumption Black-box commercial image APIs expose only prompt in and image/rejection out; gradients, logits, and filter rules are inaccessible (Threat Model §3.2).
    Defines the attacker capability under which TYPO is claimed practical.
  • domain assumption A VLM judge score r∈[0,5] on severity/actionability is a valid proxy for attack success when r≥τr (§3.2, §5.1).
    Central evaluation metric; without it ASR tables are undefined.
  • domain assumption Safety filters can be modeled as a binary decision F(M,p)∈{0,1} at prompt and/or image stage (§3.1).
    Standard abstraction for jailbreak success constraints in Eq. 1.
  • ad hoc to paper Fruit-fly-inspired smell/vision search plus Cauchy mutation is an adequate combinatorial optimizer over the discrete strategy space (§4.3, Alg. 1).
    Algorithmic design choice justified by ablation vs GA/random search, not derived from first principles.
  • domain assumption AdvBench and StrongREJECT harmful intents are representative enough to support general claims about commercial model vulnerability (§5.1).
    Standard benchmark assumption in jailbreak literature; limits external validity if distributions differ.
invented entities (3)
  • instruction-dense visual jailbreak no independent evidence
    purpose: Name the attack class where models emit detailed actionable harmful instructions as readable in-image text rather than banned objects/scenes.
    Core conceptual contribution; operationalized via figures and ASR protocol, not an external natural kind with independent measurement outside this framing.
  • adversarial typography prompt no independent evidence
    purpose: Prompt object that steers the image model to produce document-style images carrying the harmful intent as legible text.
    Defined in §3.1 as the optimization target p⋆; exists as an engineering artifact of the method.
  • dual-channel textual–visual strategy space S=St×Sv no independent evidence
    purpose: Factor prompt construction into semantic reframing and visual presentation options for combinatorial search.
    Invented factorization (Table 1); effectiveness is internal to TYPO experiments.

pith-pipeline@v1.2.0-grok45-kimik3 · 20331 in / 4032 out tokens · 87271 ms · 2026-07-31T09:19:26.721054+00:00 · methodology

0 comments
read the original abstract

Recent commercial image-generation models can generate high-quality images with readable text (e.g., posters, infographics, and manuals), attracting considerable attention. Yet we first show that this same capability also introduces a previously unreported safety vulnerability: these systems may refuse to generate harmful text directly, yet permit the same content when rendered as text within generated images, i.e., safety alignment does not reliably transfer from textual outputs to text embedded in images. In this paper, unlike existing visual jailbreaks against image-generation models, which primarily induce models to generate harmful visual objects or scenes, we introduce the concept of instruction-dense visual jailbreaks, in which image-generation models produce detailed, readable, and actionable harmful instructions within images. Such outputs can amplify harm because the rendered instructions can be readily read and widely spread. To instantiate this threat, we propose TYPO, a black-box framework that exploits this safety gap by automatically generating adversarial TYPOgraphy prompts, which covertly steer image-generation models to express harmful intent as highly legible, typographically structured text. Specifically, TYPO decomposes prompt generation into two channels: a textual channel for reframing the target intent, and a visual channel for specifying its presentation form. We formulate these two channels as a dual-channel textual-visual strategy space and optimize candidate strategy combinations through an adaptive combinatorial search. Extensive experiments across four commercial models (i.e., GPT-Image-2, Nano Banana Pro, Qwen-Image-2, and Seedream 5.0 Lite) show that TYPO substantially outperforms nine representative jailbreak attacks by 50.2% in ASR on average, while incurring an average query cost of only $0.04.

Figures

Figures reproduced from arXiv: 2607.24897 by Hangtao Zhang, Li Zeng, Meng Xie, Pengpeng Qiao, Xianlong Wang, Zhetao Li, Ziqi Zhou.

Figure 1
Figure 1. Figure 1: Examples of our instruction-dense visual jailbreaks. Columns show five textual-visual presentation forms ( [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Prior jailbreaks targeting image-generation models [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Comparison of harmful request fulfillment rates [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Pipeline of our Typo. Given a harmful intent, Typo uses adaptive combinatorial optimization to search a dual-channel textual-visual strategy space for effective adversarial typography prompts. 4 Methodology 4.1 Overview Guided by the above insight, we propose Typo, a black￾box framework that automatically generates adversarial ty￾pography prompts for instruction-dense visual jailbreaks. As shown in [PITH_… view at source ↗
Figure 5
Figure 5. Figure 5: Defense evaluation against Typo on AdvBench using GPT-Image-2. (a) Text- and image-level filters. (b) OCR detection across different presentation forms [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

77 extracted references · 16 linked inside Pith

  1. [1]

    T.; Kljun, M.; Quigley, A.; C opi c Pucihar, K.; Grubert, J.; Biener, V.; Leiva, L

    Attygalle, N. T.; Kljun, M.; Quigley, A.; C opi c Pucihar, K.; Grubert, J.; Biener, V.; Leiva, L. A.; Yoneyama, J.; Toniolo, A.; Miguel, A.; et al. 2025. Text-to-image generation for vocabulary learning using the keyword method. In Proceedings of the 30th International Conference on Intelligent User Interfaces (IUI'25), 1381--1397

    2025

  2. [2]

    Boreiko, V.; Panfilov, A.; Voracek, V.; Hein, M.; and Geiping, J. 2025. An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks. In Proceedings of the 42nd International Conference on Machine Learning (ICML'25), volume 267 of Proceedings of Machine Learning Research, 5017--5044. PMLR

    2025

  3. [3]

    ByteDance Seed Team . 2026. Deeper Thinking, More Accurate Generation: Introducing Seedream 5.0 Lite. https://seed.bytedance.com/en/blog/deeper-thinking-more-accurate-generation-introducing-seedream-5-0-lite. Official ByteDance Seed blog. Accessed: 2026-06-23

    2026

  4. [5]

    Chen, J.; Huang, Y.; Lv, T.; Cui, L.; Chen, Q.; and Wei, F. 2023. TextDiffuser: Diffusion Models as Text Painters. In Advances in Neural Information Processing Systems (NeurIPS'23), volume 36, 9353--9387

    2023

  5. [8]

    Dong, Y.; Meng, X.; Yu, N.; Li, Z.; and Guo, S. 2025. Fuzz-testing meets llm-based agents: An automated and efficient framework for jailbreaking text-to-image generation models. In 2025 IEEE Symposium on Security and Privacy (S&P'25), 373--391. IEEE

    2025

  6. [9]

    Fortin, A.; and Raisinghani, N. 2025. Build with Nano Banana Pro, our Gemini 3 Pro Image model. https://blog.google/innovation-and-ai/technology/developers-tools/gemini-3-pro-image-developers/. Google Blog. Accessed: 2026-06-23

    2025

  7. [10]

    Gong, Y.; Ran, D.; Liu, J.; Wang, C.; Cong, T.; Wang, A.; Duan, S.; and Wang, X. 2025. FigStep : Jailbreaking Large Vision-Language Models via Typographic Visual Prompts. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI'25), volume 39, 23951--23959

    2025

  8. [11]

    Huang, Y.; Liang, L.; Li, T.; Jia, X.; Wang, R.; Miao, W.; Pu, G.; and Liu, Y. 2025. Perception-guided jailbreak against text-to-image models. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI'25), volume 39, 26238--26247

    2025

  9. [12]

    Inan, H.; Upasani, K.; Chi, J.; Rungta, R.; Iyer, K.; Mao, Y.; Tontchev, M.; Hu, Q.; Fuller, B.; Testuggine, D.; and Khabsa, M. 2023. Llama Guard : LLM -Based Input-Output Safeguard for Human- AI Conversations. arXiv preprint arXiv:2312.06674

    Pith/arXiv arXiv 2023

  10. [13]

    Jaided AI . 2020. EasyOCR : Ready-to-Use Optical Character Recognition. https://github.com/JaidedAI/EasyOCR. Software repository

    2020

  11. [14]

    Kuo, M.; Zhang, J.; Ding, A.; Wang, Q.; DiValentin, L.; Bao, Y.; Wei, W.; Li, H.; and Chen, Y. 2025. H-CoT : Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models. arXiv preprint arXiv:2502.12893

    Pith/arXiv arXiv 2025

  12. [15]

    Liu, R.; Khakzar, A.; Gu, J.; Chen, Q.; Torr, P.; and Pizzati, F. 2024 a . Latent Guard: A Safety Framework for Text-to-Image Generation. In Computer Vision -- ECCV 2024, 93--109. Springer

    2024

  13. [16]

    Liu, T.; Lai, Z.; Wang, J.; Zhang, G.; Chen, S.; Torr, P.; Demberg, V.; Tresp, V.; and Gu, J. 2025. Multimodal Pragmatic Jailbreak on Text-to-Image Models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL'25) (Volume 1: Long Papers), 4681--4720. Association for Computational Linguistics

    2025

  14. [17]

    Liu, V.; and Chilton, L. B. 2022. Design guidelines for prompt engineering text-to-image generative models. In Proceedings of the 2022 CHI conference on human factors in computing systems, 1--23

    2022

  15. [19]

    Ma, J.; Deng, Y.; Chen, C.; Du, N.; Lu, H.; and Yang, Z. 2025. GlyphDraw2: Automatic Generation of Complex Glyph Posters with Diffusion Models and Large Language Models. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI'25), volume 39, 5955--5963

    2025

  16. [21]

    OpenAI . 2026. GPT Image 2 Model . https://developers.openai.com/api/docs/models/gpt-image-2. OpenAI API model documentation. Accessed: 2026-06-23

    2026

  17. [22]

    Pan, W.-T. 2012. A new Fruit Fly Optimization Algorithm: Taking the financial distress model as an example. Knowledge-Based Systems, 26: 69--74

    2012

  18. [23]

    W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; Krueger, G.; and Sutskever, I

    Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; Krueger, G.; and Sutskever, I. 2021. Learning Transferable Visual Models From Natural Language Supervision. In Proceedings of the 38th International Conference on Machine Learning (ICML'21), volume 139 of Proceedings of Machine Learning ...

    2021

  19. [26]

    Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-Resolution Image Synthesis with Latent Diffusion Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22), 10684--10695

    2022

  20. [28]

    Schramowski, P.; Brack, M.; Deiseroth, B.; and Kersting, K. 2023. Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'23), 22522--22531

    2023

  21. [29]

    Schramowski, P.; Tauchmann, C.; and Kersting, K. 2022. Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content? In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, 1350--1361. ACM

    2022

  22. [30]

    Souly, A.; Lu, Q.; Bowen, D.; Trinh, T.; Hsieh, E.; Pandey, S.; Abbeel, P.; Svegliato, J.; Emmons, S.; Watkins, O.; et al. 2024. A StrongREJECT for Empty Jailbreaks. In Proceedings of the 38th International Conference on Neural Information Processing Systems (NeurIPS'24), 125416--125440

    2024

  23. [32]

    Tuo, Y.; Xiang, W.; He, J.-Y.; Geng, Y.; and Xie, X. 2024. Anytext: Multilingual visual text generation and editing. In International Conference on Learning Representations (ICLR'24), volume 2024, 56783--56799

    2024

  24. [34]

    Wang, Y.; Zhang, H.; Pan, H.; Zhou, Z.; Wang, X.; Guo, P.; Xue, L.; Hu, S.; Li, M.; and Zhang, L. Y. 2026. Advedm: Fine-grained adversarial attack against vlm-based embodied agents. Advances in Neural Information Processing Systems, 38: 136551--136575

    2026

  25. [37]

    Yang, Y.; Hui, B.; Yuan, H.; Gong, N.; and Cao, Y. 2024. Sneakyprompt: Jailbreaking text-to-image generative models. In 2024 IEEE symposium on security and privacy (S&P'24), 897--912. IEEE

    2024

  26. [39]

    Yu, J.; and Zhang, S. 2009. A differential evolution algorithm with Cauchy mutation. Applied Mathematics and Computation, 210(2): 634--641

    2009

  27. [41]

    Zhang, H.; Zhao, Y.; Liu, S.; Zhou, Z.; Ye, Z.; Wan, W.; Li, M.; Hu, S.; Zhang, Y.; Liu, Y.; and Zhang, L. Y. 2026. Defending Jailbreak Attacks on Large Language Models via Manifold Trajectory Kinetics. In 35th USENIX Security Symposium (USENIX Security 26)

    2026

  28. [42]

    Zhang, H.; Zhu, C.; Wang, X.; Zhou, Z.; Yin, C.; Li, M.; Xue, L.; Wang, Y.; Hu, S.; Liu, A.; et al. 2025 b . BadRobot: Jailbreaking Embodied LLM Agents in the Physical World. In Proceedings of the Thirteenth International Conference on Learning Representations

    2025

  29. [43]

    Zhao, B.; Wu, C.; Li, D.; Meng, H.; Li, J.; Zhang, J.; Zhou, J.; Lin, J.; Gao, K.; Cao, K.; et al. 2026. Qwen-Image-2.0 Technical Report . arXiv preprint arXiv:2605.10730

    Pith/arXiv arXiv 2026

  30. [46]

    2026 , howpublished =

    Gemini 3.1 Flash Image Model Card , author =. 2026 , howpublished =

    2026

  31. [47]

    arXiv preprint arXiv:2307.15043 , year=

    Universal and transferable adversarial attacks on aligned language models , author=. arXiv preprint arXiv:2307.15043 , year=

    Pith/arXiv arXiv

  32. [48]

    Proceedings of the 38th International Conference on Neural Information Processing Systems (NeurIPS'24) , pages=

    A StrongREJECT for Empty Jailbreaks , author=. Proceedings of the 38th International Conference on Neural Information Processing Systems (NeurIPS'24) , pages=

  33. [49]

    2025 IEEE Symposium on Security and Privacy (S&P'25) , pages=

    Fuzz-testing meets llm-based agents: An automated and efficient framework for jailbreaking text-to-image generation models , author=. 2025 IEEE Symposium on Security and Privacy (S&P'25) , pages=. 2025 , organization=

    2025

  34. [50]

    arXiv preprint arXiv:2312.07130 , year=

    Harnessing LLM to Attack LLM-Guarded Text-to-Image Models , author=. arXiv preprint arXiv:2312.07130 , year=

    Pith/arXiv arXiv

  35. [51]

    2024 IEEE symposium on security and privacy (S&P'24) , pages=

    Sneakyprompt: Jailbreaking text-to-image generative models , author=. 2024 IEEE symposium on security and privacy (S&P'24) , pages=. 2024 , organization=

    2024

  36. [52]

    Knowledge-Based Systems , volume=

    A new Fruit Fly Optimization Algorithm: Taking the financial distress model as an example , author=. Knowledge-Based Systems , volume=. 2012 , doi=

    2012

  37. [53]

    Proceedings of the AAAI Conference on Artificial Intelligence (AAAI'25) , volume=

    Perception-guided jailbreak against text-to-image models , author=. Proceedings of the AAAI Conference on Artificial Intelligence (AAAI'25) , volume=

  38. [54]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22) , pages=

    High-Resolution Image Synthesis with Latent Diffusion Models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22) , pages=

  39. [55]

    arXiv preprint arXiv:2204.06125 , year=

    Hierarchical Text-Conditional Image Generation with CLIP Latents , author=. arXiv preprint arXiv:2204.06125 , year=

    Pith/arXiv arXiv

  40. [56]

    arXiv preprint arXiv:2205.11487 , year=

    Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding , author=. arXiv preprint arXiv:2205.11487 , year=

    Pith/arXiv arXiv

  41. [57]

    Advances in Neural Information Processing Systems (NeurIPS'23) , volume=

    TextDiffuser: Diffusion Models as Text Painters , author=. Advances in Neural Information Processing Systems (NeurIPS'23) , volume=

  42. [58]

    arXiv preprint arXiv:2411.15245 , year=

    Anytext2: Visual text generation and editing with customizable attributes , author=. arXiv preprint arXiv:2411.15245 , year=

    Pith/arXiv arXiv

  43. [59]

    arXiv preprint arXiv:2505.18979 , year=

    GhostPrompt: Jailbreaking Text-to-Image Generative Models based on Dynamic Optimization , author=. arXiv preprint arXiv:2505.18979 , year=

    Pith/arXiv arXiv

  44. [60]

    arXiv preprint arXiv:2303.17870 , year=

    GlyphDraw: Seamlessly Rendering Text with Intricate Spatial Structures in Text-to-Image Generation , author=. arXiv preprint arXiv:2303.17870 , year=

    Pith/arXiv arXiv

  45. [61]

    arXiv preprint arXiv:2504.20376 , year=

    Inception: Jailbreak the Memory Mechanism of Text-to-Image Generation Systems , author=. arXiv preprint arXiv:2504.20376 , year=

    arXiv

  46. [62]

    arXiv preprint arXiv:2210.04610 , year=

    Red-Teaming the Stable Diffusion Safety Filter , author=. arXiv preprint arXiv:2210.04610 , year=

    Pith/arXiv arXiv

  47. [63]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'23) , pages=

    Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'23) , pages=

  48. [64]

    Computer Vision -- ECCV 2024 , pages=

    Latent Guard: A Safety Framework for Text-to-Image Generation , author=. Computer Vision -- ECCV 2024 , pages=. 2024 , publisher=

    2024

  49. [65]

    arXiv preprint arXiv:2503.17987 , year=

    Metaphor-based Jailbreaking Attacks on Text-to-Image Models , author=. arXiv preprint arXiv:2503.17987 , year=

    arXiv

  50. [66]

    arXiv preprint arXiv:2310.08419 , year=

    Jailbreaking Black Box Large Language Models in Twenty Queries , author=. arXiv preprint arXiv:2310.08419 , year=

    Pith/arXiv arXiv

  51. [67]

    arXiv preprint arXiv:2312.02119 , year=

    Tree of Attacks: Jailbreaking Black-Box LLMs Automatically , author=. arXiv preprint arXiv:2312.02119 , year=

    Pith/arXiv arXiv

  52. [68]

    arXiv preprint arXiv:2410.05295 , year=

    AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs , author=. arXiv preprint arXiv:2410.05295 , year=

    Pith/arXiv arXiv

  53. [69]

    Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency , pages =

    Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content? , author =. Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency , pages =. 2022 , publisher =

    2022

  54. [70]

    arXiv preprint arXiv:2309.10253 , year=

    GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts , author=. arXiv preprint arXiv:2309.10253 , year=

    Pith/arXiv arXiv

  55. [71]

    International Conference on Learning Representations (ICLR'24) , volume=

    Anytext: Multilingual visual text generation and editing , author=. International Conference on Learning Representations (ICLR'24) , volume=

  56. [72]

    Proceedings of the AAAI Conference on Artificial Intelligence (AAAI'25) , volume=

    GlyphDraw2: Automatic Generation of Complex Glyph Posters with Diffusion Models and Large Language Models , author=. Proceedings of the AAAI Conference on Artificial Intelligence (AAAI'25) , volume=. 2025 , doi=

    2025

  57. [73]

    2026 , howpublished =

    2026

  58. [74]

    2025 , howpublished =

    Fortin, Alisa and Raisinghani, Naina , title =. 2025 , howpublished =

    2025

  59. [75]

    Zhao, Bing and Wu, Chenfei and Li, Deqing and Meng, Hao and Li, Jiahao and Zhang, Jie and Zhou, Jingren and Lin, Junyang and Gao, Kaiyuan and Cao, Kuan and others , journal =

  60. [76]

    Deeper Thinking, More Accurate Generation: Introducing Seedream 5.0 Lite , year =

  61. [77]

    arXiv preprint arXiv:2505.02527 , year=

    Text to image generation and editing: A survey , author=. arXiv preprint arXiv:2505.02527 , year=

    Pith/arXiv arXiv

  62. [78]

    Proceedings of the 30th International Conference on Intelligent User Interfaces (IUI'25) , pages=

    Text-to-image generation for vocabulary learning using the keyword method , author=. Proceedings of the 30th International Conference on Intelligent User Interfaces (IUI'25) , pages=

  63. [79]

    Proceedings of the 2022 CHI conference on human factors in computing systems , pages=

    Design guidelines for prompt engineering text-to-image generative models , author=. Proceedings of the 2022 CHI conference on human factors in computing systems , pages=

    2022

  64. [80]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL'25) (Volume 1: Long Papers) , pages =

    Multimodal Pragmatic Jailbreak on Text-to-Image Models , author =. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL'25) (Volume 1: Long Papers) , pages =. 2025 , publisher =

    2025

  65. [81]

    Proceedings of the 42nd International Conference on Machine Learning (ICML'25) , pages =

    An Interpretable N-gram Perplexity Threat Model for Large Language Model Jailbreaks , author =. Proceedings of the 42nd International Conference on Machine Learning (ICML'25) , pages =. 2025 , publisher =

    2025

  66. [82]

    Proceedings of the 38th International Conference on Machine Learning (ICML'21) , pages =

    Learning Transferable Visual Models From Natural Language Supervision , author =. Proceedings of the 38th International Conference on Machine Learning (ICML'21) , pages =. 2021 , publisher =

    2021

  67. [83]

    2020 , howpublished =

    2020

  68. [84]

    2025 , doi =

    Gong, Yichen and Ran, Delong and Liu, Jinyuan and Wang, Conglei and Cong, Tianshuo and Wang, Anyu and Duan, Sisi and Wang, Xiaoyun , booktitle =. 2025 , doi =

    2025

  69. [85]

    Inan, Hakan and Upasani, Kartikeya and Chi, Jianfeng and Rungta, Rashi and Iyer, Krithika and Mao, Yuning and Tontchev, Michael and Hu, Qing and Fuller, Brian and Testuggine, Davide and Khabsa, Madian , journal =

  70. [86]

    Kuo, Martin and Zhang, Jianyi and Ding, Aolin and Wang, Qinsi and DiValentin, Louis and Bao, Yujia and Wei, Wei and Li, Hai and Chen, Yiran , journal =

  71. [87]

    Applied Mathematics and Computation , volume=

    A differential evolution algorithm with Cauchy mutation , author=. Applied Mathematics and Computation , volume=. 2009 , publisher=

    2009

  72. [88]

    Proceedings of the Ninth International Conference on Document Analysis and Recognition (ICDAR'07) , volume =

    An Overview of the Tesseract OCR Engine , author =. Proceedings of the Ninth International Conference on Document Analysis and Recognition (ICDAR'07) , volume =. 2007 , publisher =

    2007

  73. [89]

    arXiv preprint arXiv:2606.19348 , year=

    Deepseek-v4: Towards highly efficient million-token context intelligence , author=. arXiv preprint arXiv:2606.19348 , year=

    arXiv

  74. [90]

    35th USENIX Security Symposium (USENIX Security 26) , year =

    Defending Jailbreak Attacks on Large Language Models via Manifold Trajectory Kinetics , author =. 35th USENIX Security Symposium (USENIX Security 26) , year =

  75. [91]

    Advances in Neural Information Processing Systems , volume=

    Advedm: Fine-grained adversarial attack against vlm-based embodied agents , author=. Advances in Neural Information Processing Systems , volume=

  76. [92]

    arXiv preprint arXiv:2411.11683 , year=

    Trojanrobot: Physical-world backdoor attacks against vlm-based robotic manipulation , author=. arXiv preprint arXiv:2411.11683 , year=

    arXiv

  77. [93]

    Proceedings of the Thirteenth International Conference on Learning Representations , year=

    BadRobot: Jailbreaking Embodied LLM Agents in the Physical World , author=. Proceedings of the Thirteenth International Conference on Learning Representations , year=