Pith. sign in

REVIEW 4 major objections 4 minor 32 references

Two individually safe prompts can make a text-to-video model render harmful frames in between, and the authors show this attack is cheap enough for black-box use.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 18:29 UTC pith:VPO2DKGK

load-bearing objection The paper demonstrates a real and cheap jailbreak against four commercial T2V models using benign start/end prompts, but it never shows that temporal interpolation is the mechanism — that gap is load-bearing for the novelty claim. the 4 major comments →

arxiv 2607.17279 v1 pith:VPO2DKGK submitted 2026-07-19 cs.CR cs.AIcs.MM

Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models

Xingkai Peng , Jun Jiang , Jiayang Liu , Kejiang Chen , Weiming Zhang This is my paper
classification cs.CR cs.AIcs.MM
keywords text-to-video jailbreaktemporal consistencyboundary-state attackMonte Carlo Tree Searchblack-box attacksafety filtersattack success ratemultimodal safety
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that text-to-video (T2V) models have a safety blind spot along the time axis: a prompt that describes only a safe beginning and a safe ending can induce the model to generate harmful frames in between, because video models are trained to keep consecutive frames consistent. The authors propose BSB, a framework that turns a harmful request into two individually benign boundary prompts and then searches for boundary pairs whose interpolation is most likely to cross into unsafe content. The search runs mostly in text space with Monte Carlo Tree Search; video generation is used only sparingly to recalibrate, giving an average of about 2.5 video queries per attack. On four commercial T2V models, BSB reports attack success rates of roughly 60–70%, an 18.6% relative improvement over the strongest baseline. If this holds, safety filters that inspect the prompt and isolated frames will miss attacks that live in the transition between frames.

Core claim

On the paper's own terms, the central discovery is that temporal consistency is an exploitable attack surface. Given a harmful target prompt, BSB isolates the harmful event and replaces it with two descriptions of the states just before and just after that event; each description is safe on its own and can pass text filters. Because the model denoises the whole video as a joint latent tensor under a single condition encoding both boundaries, the authors argue the model is encouraged to evolve smoothly from the first state to the second, so the semantics of the omitted harmful event can re-emerge in intermediate frames. The attack succeeds when an external evaluator flags those intermediate f

What carries the argument

The mechanism is the boundary pair d=(p−,p+): two safe prompts, one describing the state before the harmful event and one after, fused into a single text input through a canonical temporal template. The authors' generative argument is that joint denoising of the latent video tensor (equation 1) makes each frame depend on both boundaries, so the model interpolates rather than picks one side. Around that mechanism, BSB builds a search loop: an LLM decomposes the harmful intent into boundary states; MCTS rewrites candidate pairs in text space, guided by a reward that combines filter-passing, semantic relevance, and inferred harmfulness; and sparse video generation on the top-k leaves re-anchors

Load-bearing premise

The load-bearing premise is that conditioning a black-box T2V model on a single text string encoding two safe boundary states forces genuine semantic interpolation between them, so that intermediate frames traverse the harmful region; if models instead hard-cut, default to one boundary, or hallucinate unrelated content, the attack's mechanism collapses into ordinary prompt-level jailbreaking.

What would settle it

Generate videos for BSB boundary pairs and label every sampled frame for harmfulness. If harmful content appears abruptly in a single frame or matches one boundary rather than emerging gradually, or if the same boundary pairs succeed on a video model without joint temporal denoising (e.g., frame-by-frame generation), the interpolation explanation is refuted.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the mechanism holds, current T2V safety filters—which check the prompt and sample frames independently—are insufficient; defenses must score the semantic trajectory across time.
  • The attack's cost (~2.5 video generations per attempt) makes it practical in paid black-box APIs where heavy query optimization is infeasible.
  • The boundary-pair trick transfers to any video model that denoises the clip as one joint spatio-temporal tensor; models that generate frames independently would not share the vulnerability.
  • Reported gains concentrate in event categories (violence, gore, illegal activities), suggesting that attacks built from before/after states are harder for filters to catch than those requiring recognizable identities or trademarks.
  • The same temporal reasoning could be inverted into a defense: a detector that flags videos whose intermediate frames jump through forbidden semantics between benign start and end states.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's mechanism claims are stronger than its evidence: ASR alone does not show that frames evolve gradually from one boundary to the other, so a frame-level trajectory analysis would test the interpolation premise directly.
  • The two-tier search recipe (cheap textual proxy plus sparse expensive verification) is a general attack template for any black-box generative model with a high query cost, not just T2V systems.
  • If the interpolation claim is correct, the boundary-pair idea could also be used constructively—steering a video model to produce a desired transition by specifying only the first and last frames in text.
  • The dependence on an LLM for decomposition makes the LLM's ability to find natural pre/post states an upper bound on attack transferability; different LLMs should yield different ASR.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes BSB, a black-box jailbreak framework for text-to-video (T2V) models. The core idea is to replace a harmful target prompt with two individually benign boundary prompts (a pre-event prompt p− and a post-event prompt p+), which are concatenated into a single text condition via a "canonical temporal template." The authors argue that temporal consistency in video diffusion models forces the generated trajectory to interpolate between these two boundary states, so intermediate frames can contain harmful content even though both boundary prompts pass safety filters. BSB searches for effective boundary pairs using Monte Carlo Tree Search in a text proxy space, with periodic sparse video-based calibration. Experiments on Veo 3.1, Sora 2, Seedance, and Kling v1 report average attack success rates of 69.6%, 60.4%, 61.3%, and 64.6%, respectively, an 18.6% average relative improvement over the strongest baseline, at roughly 2.5 video queries per attack. Ablations on Veo 3.1 show that removing temporal boundary decomposition drops ASR from 69.6% to 45.2%.

Significance. If the claims hold, BSB identifies a genuinely understudied attack surface: temporal consistency as a mechanism for generating policy-violating content from safe boundary conditions. The paper has concrete strengths: it evaluates on multiple commercial black-box T2V APIs, demonstrates a query-efficient search design (~2.5 video queries per attack), and includes component ablations showing that the boundary-pair construction and MCTS search both contribute to the reported ASR. The empirical gains over T2I-adapted and scene-splitting baselines are large in several high-risk categories. However, the central mechanistic claim—that harmless boundary prompts cause the model to interpolate through harmful intermediate states—is not directly verified, and the evaluation has statistical and evaluator-coupling concerns. The significance is therefore conditional: the paper would be a valuable contribution if the interpolation mechanism and independent evaluation were established, but in its current form the novelty and reported success rates are not fully supported.

major comments (4)
  1. [§3.2, Eq. (1)] The central mechanism is asserted rather than demonstrated. Immediately after Eq. (1), the paper claims that conditioning on d=(p−,p+) 'encourages' the model to generate a temporally coherent sequence that 'implicitly explores the semantic space between the two boundary states.' This interpolation premise is load-bearing: it is what distinguishes BSB from earlier scene-composition or prompt-level jailbreaks. Yet no frame-level trajectory analysis is provided. The w/o TBD ablation (Table 2) shows that boundary pairs help ASR, but not that harm emerges smoothly during a transition; it could arise from a hard cut, from the model defaulting to the terminal boundary p+, or from unrelated hallucination. The operationalization of d through a 'canonical temporal template' is deferred to a supplementary not included in v1, so the actual conditioning is not inspectable. A concrete fix: for success
  2. [§3.3 Eq. (5), §4.1] There is a partial reward–evaluator circularity. The text-side reward Rharm(p′) in Eq. (5) uses an LLM harmfulness score to guide the search, and the final ASR is measured by GPT-5 safety judgment on sampled frames (§4.1). The auxiliary LLM for rewriting and reward is GPT-5.2, i.e., the same model family as the evaluator. The attack is therefore partly tuned to the same judgment function that scores success. This is not full circularity—success still requires real video output from commercial APIs—but it can inflate ASR. Please report the specific model versions, and re-evaluate with an independent judge (e.g., an open-weight moderation model or human annotation) for either the search reward or the final metric, and quantify the difference.
  3. [Table 1] The statistical evidence for 'consistently highest' ASR is weak. Each cell is based on 50 prompts, and no confidence intervals, error bars, significance tests, or random-seed control are reported. At n=50, a binomial 95% CI at 50% is roughly ±14 percentage points, so several reported gaps are within noise. For example, on Sora 2, Sequential Action is 54% (BSB) vs 68% (SceneSplit); on Seedance, Misinformation is 56% vs 58%; on Kling v1, Misinformation is 62% vs 66%. The 18.6% average relative gain over the strongest baseline is dominated by large gains in a subset of categories and does not establish uniform superiority. Report per-category confidence intervals or significance tests, and clarify how many random seeds / prompt samples underlie each number.
  4. [§3.4, Table 2] The query-efficiency claim is not compared against baselines. The paper reports that BSB uses 2.46 video queries per attack but does not report the query cost of TSB, DACA, or SceneSplit under the same budget, nor ASR-at-fixed-budget curves. Without this comparison, the claim that BSB is 'more feasible' or 'query-efficient' in practical black-box settings is not established against the strongest baseline. Additionally, the termination criterion 'If a successful attack is detected... the procedure terminates' and the thresholds for promoting candidates to the calibration set are stated only by reference to an absent supplementary; please specify them explicitly.
minor comments (4)
  1. [Figure 4] Two consecutive paragraphs both say 'Figure 4 illustrates...' for different hyperparameter sweeps (MCTS budget and text candidate width). Label the panels as (a) and (b) and reference them distinctly.
  2. [Notation, Eq. (6) and Fig. 2] Fig. 2 writes the reward as R(a) = ℒ_filter(λ_r ℒ_ref + λ_h ℒ_harm), while Eq. (6) defines R(s,a) with R_filter·(...). Align the notation to avoid confusion between the indicator R_filter and the weighting expression.
  3. [Eq. (1)] The notation pθ(z_{0:Td−1}|d) with subscript Td is not defined. Clarify whether Td is the number of denoising steps or the video length, and fix the indexing if needed.
  4. [General] The running author header reads 'Trovato et al.', which does not match the listed authors. Please correct this template artifact before resubmission.

Circularity Check

0 steps flagged

No significant circularity: ASR is grounded in real video output; the interpolation premise is asserted rather than derived, which is an evidence gap, not a circular reduction.

full rationale

The paper's central mechanism—that conditioning on two safe boundary prompts p−, p+ makes the T2V model 'implicitly explore the semantic space between the two boundary states' (§3.2, after Eq. 1)—is an empirical assumption about how commercial T2V models behave, not a consequence of any equation in the paper. Eq. (1) is the standard joint-denoising factorization and does not by itself define semantic interpolation; the 'canonical temporal template' is deferred to a missing supplementary. That is a gap in evidence/proof, but not circularity: no output quantity is definitionally equal to an input quantity. The MCTS reward (Eqs. 5–6, 9–10) does use an LLM harmfulness score, and final ASR is judged by GPT-5, so there is evaluator alignment; however, success additionally requires generated videos from Veo 3.1/Sora 2/Seedance/Kling that bypass LlamaGuard/VideoLLaMA2 filters and contain visible harmful frames (Fig. 3). ASR is not defined as the reward, so the attack is not equivalent to its search signal. References [13,14] have overlapping authors but are used as related work/baselines, not as load-bearing support for the interpolation claim; no uniqueness theorem or external derivation is imported. The w/o TBD ablation shows component importance but not the interpolation mechanism, a validity concern rather than circularity.

Axiom & Free-Parameter Ledger

5 free parameters · 6 axioms · 2 invented entities

The paper's contribution rests on a handful of hand-set constants (λ, c, MCTS budget, candidate width) and on domain assumptions that are hard to verify from the text alone: the interpolation premise, the fidelity of the temporal template, the surrogate filters for unknown commercial defenses, and the validity of the GPT-5 harmfulness oracle. The invented entities are analytical constructs rather than physical ones, but each carries a measurement burden the paper does not fully discharge.

free parameters (5)
  • reward weights λ_r, λ_h = 0.5, 0.5
    Hand-chosen balance between semantic relevance and harmfulness in Eqs. (6) and (10); no sensitivity analysis shown.
  • UCT exploration coefficient c = 1.4
    Hand-set constant in Eq. (2); no ablation.
  • MCTS search budget = 30 simulations
    Selected from the Fig. 4 ablation on Veo 3.1 to maximize the ASR/query trade-off; tuned on a model that also appears in the main results.
  • candidate width / top-k / stages = k=3, branching factor 4, 3 stages
    'Default settings' deferred to the supplementary, which is absent from v1.
  • prompts per category = 50 (700 total)
    Sample-size choice; with no error bars or replication, this determines the resolution of all ASR differences.
axioms (6)
  • domain assumption T2V latent diffusion conditioned on a text sequence encoding (p−, p+) semantically interpolates between the two boundary states during generation.
    The core mechanism premise; asserted in §3.2 following Eq. (1), supported only indirectly by the w/o-TBD ablation.
  • ad hoc to paper A 'canonical temporal template' can faithfully encode two boundary prompts into the single-prompt interface of black-box T2V models.
    Introduced in §3.2; details deferred to a supplementary not present in v1.
  • domain assumption GPT-5-family LM judgments of harmfulness are a valid ground-truth proxy for content-policy violation.
    Used both as search reward (Eqs. 5, 9) and as the final ASR judge (§4.1); no human or independent verification.
  • domain assumption LlamaGuard3-8b and VideoLLaMA2-7B are adequate surrogates for the unknown text/video filters of commercial models.
    Instantiated in §4.1 to approximate F_text and F_video in Eqs. (3),(7); misalignment would misdirect the search.
  • domain assumption Uniform random 50-prompt sampling per category is representative of the safety benchmark.
    §4.1 dataset construction; affects the generality of the ASR claims.
  • standard math UCT selection, cosine text similarity, and joint-denoising factorization (Eq. 1) are standard background results used as tools.
    Background machinery in §3.2–3.3.
invented entities (2)
  • Boundary-state pair (p−, p+) no independent evidence
    purpose: Two individually benign prompts that bracket a harmful event in time; the attack's central construct.
    An analytical decomposition device; its only evidence is the paper's own ASR and ablation. No external falsifiable prediction is offered.
  • Implicit intermediate state p' / 'implicit bridge of harmful intent' no independent evidence
    purpose: LLM-inferred midpoint used to compute rewards (Eqs. 4–5) and to explain why harmful content emerges mid-video.
    Internal to the reward pipeline; never grounded in a direct measurement of the generated narrative (no frame-level trajectory analysis).

pith-pipeline@v1.3.0-alltime-deepseek · 15347 in / 18690 out tokens · 168703 ms · 2026-08-01T18:29:21.868958+00:00 · methodology

0 comments
read the original abstract

Recently, text-to-video (T2V) models have been widely deployed, sparking growing concerns over their robustness against jailbreak attacks. Existing jailbreak methods, mostly adapted from text-to-image attacks, suffer notable drawbacks when applied to T2V systems. They fail to fully leverage temporal consistency, an inherent characteristic of video generation. Besides, these methods demand heavy video query optimization, which is infeasible in practical black-box scenarios. Their adversarial prompt search is also driven by heuristic local signals, lacking principled structured exploration strategies. To tackle these limitations, we propose BSB, a structured, query-efficient jailbreak framework for T2V models. BSB harnesses temporal consistency by encoding harmful intent as the transition between two individually harmless boundary states. Under this paradigm, the attack targets boundary-state pairs whose interpolation tends to produce unsafe intermediate frames during video generation. Directly evaluating all candidate pairs within the video space incurs prohibitive computation cost. Instead, BSB conducts Monte Carlo Tree Search (MCTS) in a cheaper textual proxy space and regularly calibrates search outcomes with sparse video-level evaluations. We conduct comprehensive experiments on mainstream commercial T2V models including Veo 3.1, Sora 2, Seedance and Kling v1. Results show BSB surpasses all existing jailbreak baselines, delivering an average 18.6% relative gain in attack success rate over the strongest competitor across evaluated models. Our findings identify temporal consistency as an understudied yet vital attack surface for T2V models and verify that structured search facilitates effective vulnerability discovery under constrained query budgets.

Figures

Figures reproduced from arXiv: 2607.17279 by Jiayang Liu, Jun Jiang, Kejiang Chen, Weiming Zhang, Xingkai Peng.

Figure 1
Figure 1. Figure 1: Illustration of BSB. Given a harmful intent, BSB [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of BSB, a temporal jailbreak framework for text-to-video models. BSB exploits temporal consistency [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Visualization of video jailbreaking performance [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: ASR and average video query costs under differ [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

32 extracted references · 1 canonical work pages · 1 internal anchor

  1. [1]

    Zhongjie Ba, Jieming Zhong, Jiachen Lei, Peng Cheng, Qinglong Wang, Zhan Qin, Zhibo Wang, and Kui Ren. 2024. SurrogatePrompt: Bypassing the Safety Filter of Text-to-Image Models via Substitution. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS 2024, Salt Lake City, UT, USA, October 14-18, 2024, Bo Luo, Xiaoj...

    arXiv 2024

  2. [2]

    Andreas Blattmann, Robin Rombach, Huan Ling, Tim Dockhorn, Seung Wook Kim, Sanja Fidler, and Karsten Kreis. 2023. Align Your Latents: High-Resolution Video Synthesis with Latent Diffusion Models. InIEEE/CVF Conference on Com- puter Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023. IEEE, 22563–22575. doi:10.1109/CVPR52729....

    arXiv 2023

  3. [3]

    Haoxin Chen, Yong Zhang, Xiaodong Cun, Menghan Xia, Xintao Wang, Chao Weng, and Ying Shan. 2024. VideoCrafter2: Overcoming Data Limitations for High-Quality Video Diffusion Models. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, W A, USA, June 16-22, 2024. IEEE, 7310–7320. doi:10.1109/CVPR52733.2024.00698

    arXiv 2024

  4. [4]

    Zesen Cheng, Sicong Leng, Hang Zhang, Yifei Xin, Xin Li, Guanzheng Chen, Yongxin Zhu, Wenqi Zhang, Ziyang Luo, Deli Zhao, and Lidong Bing. 2024. VideoLLaMA 2: Advancing Spatial-Temporal Modeling and Audio Understanding in Video-LLMs. arXiv:2406.07476 [cs.CV] https://arxiv.org/abs/2406.07476

    Pith/arXiv arXiv 2024

  5. [5]

    Lakshay Chhabra. 2020. Nsfw image classifier on GitHub. https://github.com/ lakshaychhabra/NSFW-Detection-DL

    2020

  6. [6]

    Yimo Deng and Huangxun Chen. 2023. Divide-and-Conquer Attack: Harnessing the Power of LLM to Bypass the Censorship of Text-to-Image Generation Model. CoRRabs/2312.07130 (2023). arXiv:2312.07130 doi:10.48550/ARXIV.2312.07130

    Pith/arXiv arXiv doi:10.48550/arxiv.2312.07130 2023

  7. [7]

    Rojit George. 2020. Nsfw words list on GitHub. https://github.com/rrgeorge- pdcontributions/NSFW-Words-List/blob/master/nsfw_list.txt

    2020

  8. [8]

    Gritsenko, Diederik P

    Jonathan Ho, William Chan, Chitwan Saharia, Jay Whang, Ruiqi Gao, Alexey A. Gritsenko, Diederik P. Kingma, Ben Poole, Mohammad Norouzi, David J. Fleet, and Tim Salimans. 2022. Imagen Video: High Definition Video Generation with Diffusion Models.CoRRabs/2210.02303 (2022). arXiv:2210.02303 doi:10.48550/ ARXIV.2210.02303

    Pith/arXiv arXiv doi:10.48550/arxiv.2210.02303 2022

  9. [9]

    Wenyi Hong, Ming Ding, Wendi Zheng, Xinghan Liu, and Jie Tang. 2023. CogVideo: Large-scale Pretraining for Text-to-Video Generation via Transform- ers. InThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net

    2023

  10. [10]

    Levon Khachatryan, Andranik Movsisyan, Vahram Tadevosyan, Roberto Henschel, Zhangyang Wang, Shant Navasardyan, and Humphrey Shi. 2023. Text2Video-Zero: Text-to-Image Diffusion Models are Zero-Shot Video Genera- tors. InIEEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023. IEEE, 15908–15918. doi:10.1109/ICCV5107...

    arXiv 2023

  11. [11]

    Massine El Khader, Elias Al Bouzidi, Abdellah Oumida, Mohammed Sbaihi, Eliott Binard, Jean-Philippe Poli, Wassila Ouerdane, Boussad Addad, and Katarzyna Kapusta. 2025. DiffGuard: Text-Based Safety Checker for Diffusion Models. arXiv:2412.00064 [cs.CV] https://arxiv.org/abs/2412.00064

    Pith/arXiv arXiv 2025

  12. [12]

    Wonjun Lee, Haon Park, Doehyeon Lee, Bumsub Ham, and Suhyun Kim. 2025. Jailbreaking on Text-to-Video Models via Scene Splitting Strategy.CoRR abs/2509.22292 (2025). arXiv:2509.22292 doi:10.48550/ARXIV.2509.22292

    Pith/arXiv arXiv doi:10.48550/arxiv.2509.22292 2025

  13. [13]

    Siyuan Liang, Jiayang Liu, Jiecheng Zhai, Tianmeng Fang, Rongcheng Tu, Aishan Liu, Xiaochun Cao, and Dacheng Tao. 2025. T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Models.CoRRabs/2504.15512 (2025). arXiv:2504.15512 doi:10.48550/ARXIV.2504.15512

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2504.15512 2025

  14. [14]

    Jiayang Liu, Siyuan Liang, Shiqian Zhao, Rongcheng Tu, Wenbo Zhou, Ais- han Liu, Dacheng Tao, and Siew Kei Lam. 2025. T2V-OptJail: Discrete Prompt Optimization for Text-to-Video Jailbreak Attacks. arXiv:2505.06679 [cs.CV] https://arxiv.org/abs/2505.06679

    Pith/arXiv arXiv 2025

  15. [15]

    AI @ Meta Llama Team. 2024. The Llama 3 Herd of Models. arXiv:2407.21783 [cs.AI] https://arxiv.org/abs/2407.21783

    Pith/arXiv arXiv 2024

  16. [16]

    Yibo Miao, Yifan Zhu, Lijia Yu, Jun Zhu, Xiao-Shan Gao, and Yinpeng Dong. 2024. T2VSafetyBench: Evaluating the Safety of Text-to-Video Generative Models. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024, Amir Globersons, Les...

    2024

  17. [17]

    Xiangyu Peng, Zangwei Zheng, Chenhui Shen, Tom Young, and Xinying Guo et al. 2025. Open-Sora 2.0: Training a Commercial-Level Video Generation Model in $200k.CoRRabs/2503.09642 (2025). arXiv:2503.09642 doi:10.48550/ARXIV. 2503.09642

    Pith/arXiv arXiv doi:10.48550/arxiv.2503.09642 2025

  18. [18]

    Yiting Qu, Xinyue Shen, Yixin Wu, Michael Backes, Savvas Zannettou, and Yang Zhang. 2025. UnsafeBench: Benchmarking Image Safety Classifiers on Real-World and AI-Generated Images. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS 2025, Taipei, Taiwan, October 13-17, 2025, Chun-Ying Huang, Jyh-Cheng Chen, Shiuh-Py...

    arXiv 2025

  19. [19]

    Team Seedance, Heyi Chen, Siyan Chen, Xin Chen, Yanfei Chen, Ying Chen, and Zhuo Chen et al. 2025. Seedance 1.5 pro: A Native Audio-Visual Joint Generation Foundation Model.CoRRabs/2512.13507 (2025). arXiv:2512.13507 doi:10.48550/ARXIV.2512.13507

    Pith/arXiv arXiv doi:10.48550/arxiv.2512.13507 2025

  20. [20]

    Uriel Singer, Adam Polyak, Thomas Hayes, Xi Yin, Jie An, Songyang Zhang, Qiyuan Hu, Harry Yang, Oron Ashual, Oran Gafni, Devi Parikh, Sonal Gupta, and Yaniv Taigman. 2023. Make-A-Video: Text-to-Video Generation without Text- Video Data. InThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net

    2023

  21. [21]

    Aaditya Singh, Adam Fry, Adam Perelman, and Adam Tart et al. 2025. GPT-5. arXiv:2601.03267 [cs.CL] https://arxiv.org/abs/2601.03267

    Pith/arXiv arXiv 2025

  22. [22]

    Kling Team. 2025. Kling-Omni Technical Report.CoRRabs/2512.16776 (2025). arXiv:2512.16776 doi:10.48550/ARXIV.2512.16776

    Pith/arXiv arXiv doi:10.48550/arxiv.2512.16776 2025

  23. [23]

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia-You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. 2024. Ring-A-Bell! How Reliable are Concept Removal Methods For Diffusion Models?. InThe Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11,

    2024

  24. [24]

    Ruben Villegas, Mohammad Babaeizadeh, Pieter-Jan Kindermans, Hernan Moraldo, Han Zhang, Mohammad Taghi Saffar, Santiago Castro, Julius Kunze, and Dumitru Erhan. 2023. Phenaki: Variable Length Video Generation from Open Domain Textual Descriptions. InThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023...

    2023

  25. [25]

    Ang Wang, Baole Ai, Bin Wen, Chaojie Mao, and Chen-Wei Xie et al. 2025. Wan: Open and Advanced Large-Scale Video Generative Models.CoRRabs/2503.20314 (2025). arXiv:2503.20314 doi:10.48550/ARXIV.2503.20314

    Pith/arXiv arXiv doi:10.48550/arxiv.2503.20314 2025

  26. [26]

    Songping Wang, Rufan Qian, Yueming Lyu, Qinglong Liu, Linzhuang Zou, Jie Qin, Songhua Liu, and Caifeng Shan. 2025. RunawayEvil: Jailbreaking the Image- to-Video Generative Models.CoRRabs/2512.06674 (2025). arXiv:2512.06674 doi:10.48550/ARXIV.2512.06674

    doi:10.48550/arxiv.2512.06674 2025

  27. [27]

    Wenhao Wang and Yi Yang. 2024. VidProM: A Million-scale Real Prompt-Gallery Dataset for Text-to-Video Diffusion Models. InAdvances in Neural Informa- tion Processing Systems 38: Annual Conference on Neural Information Process- ing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024, Amir Globersons, Lester Mackey, Danielle Belgrave, ...

    2024

  28. [28]

    Thaddäus Wiedemer, Yuxuan Li, Paul Vicol, Shixiang Shane Gu, Nick Matarese, Kevin Swersky, Been Kim, Priyank Jaini, and Robert Geirhos et al. 2025. Video models are zero-shot learners and reasoners.CoRRabs/2509.20328 (2025). arXiv:2509.20328 doi:10.48550/ARXIV.2509.20328 Trovato et al

    Pith/arXiv arXiv doi:10.48550/arxiv.2509.20328 2025

  29. [29]

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. 2024. SneakyPrompt: Jailbreaking Text-to-image Generative Models. InIEEE Sym- posium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024. IEEE, 897–912

    2024

  30. [30]

    Zonghao Ying, Moyang Chen, Nizhang Li, Zhiqiang Wang, Wenxin Zhang, Quanchen Zou, Zonglei Jing, Aishan Liu, and Xianglong Liu. 2026. SPARK: Jailbreaking T2V Models by Synergistically Prompting Auditory and Recontex- tualized Knowledge. arXiv:2511.13127 [cs.CV] https://arxiv.org/abs/2511.13127

    arXiv 2026

  31. [31]

    Jiawei Zhao, Kejiang Chen, Weiming Zhang, and Nenghai Yu. 2025. SQL Injection Jailbreak: A Structural Disaster of Large Language Models. InFindings of the As- sociation for Computational Linguistics: ACL 2025, Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar (Eds.). Association for Compu- tational Linguistics, Vienna, Austria, 6...

    doi:10.18653/v1/2025.findings- 2025

  32. [32]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023. Univer- sal and Transferable Adversarial Attacks on Aligned Language Models.CoRR abs/2307.15043 (2023). arXiv:2307.15043 doi:10.48550/ARXIV.2307.15043

    Pith/arXiv arXiv doi:10.48550/arxiv.2307.15043 2023