SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense

Dacheng Tao; Jiaxing Huang; Junfeng Fang; Rong-Cheng Tu; Siyuan Liang; Yupeng Qiu

REVIEW 3 major objections 5 minor 49 references

SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SafeCA detects jailbreak prompts by reading the cross-attention trace and gating anomalous activations, cutting attack success by about 20% over the previous best defense at 0.1 seconds of added inference.

desk verdict A plausible T2V jailbreak defense with a genuinely new empirical observation, but the headline gain is selected in-sample and the evaluation lacks seeds, code, and a held-out partition. read the letter →

arxiv 2608.10933 v1 pith:GW37JKEO submitted 2026-08-11 cs.CV

Siyuan Liang , Yupeng Qiu , Junfeng Fang , Rong-Cheng Tu , Jiaxing Huang , Dacheng Tao This is my paper · ORCID

classification cs.CV

keywords text-to-videojailbreakdefensecross-attentionregularizationdiffusionmodelsafetyattentionlocalizationattacksemanticconsistencyinference-timefeature-level

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that text-to-video jailbreak attacks leave a detectable trace in the cross-attention feature space: anomalous semantics accumulate during diffusion and become linearly separable from clean prompts. On that basis it proposes SafeCA, a weight-free inference-time defense that localizes the most separable steps and attention blocks, then gates the key-value pairs to suppress anomalous activations while preserving clean semantics. It claims to cut the attack success rate (ASR) by about 20% relative to the strongest prior defense—from 29.53% to 23.41% on Open-Sora and 34.29% to 27.56% on CogVideo—while adding only 0.1 seconds of overhead and maintaining text-video semantic consistency. A sympathetic reader would care because a deployable, low-latency, architecture-level defense could replace slow input-filtering and reconstruction methods.

What carries the argument

The central object is a per-key gating vector applied to cross-attention key/value pairs at selected steps and blocks: $\tilde{K}^b_t = K^b_t \odot G^b_t$ and $\tilde{V}^b_t = V^b_t \odot G^b_t$, with $G^b_t = \mathrm{clip}_{[s_{\min},1]}(G^{b,(1)}_t \odot G^{b,(2)}_t \odot G^{b,(3)}_t)$. Hierarchical Attention Localization (HAL) first selects the first 60 diffusion steps and the 16 cross-attention blocks with the largest clean-versus-jailbreak separability, and builds a clean reference from 128 clean prompts: per-location mean $\mu^b_t$, variance $\mathrm{var}^b_t$, a PCA principal subspace $U^b_t$, and an 85% quantile threshold $\tau^b_t$. Cross-Attention Regularization (CAR) then suppresses anything that deviates from this reference: attention masking applies exponential decay to keys whose normalized offset exceeds $\tau^b_t$, energy normalization clips attention amplitude to a mean-centered $k$-$\sigma$ neighborhood, and a semantic adapter retracts the whole distribution toward the clean subspace when its estimated deviation exceeds the threshold. The argument is that this reference captures normal cross-modal alignment, so gating the attention toward it removes jailbreak-induced semantic drift without altering model weights.

What would settle it

Run SafeCA on a held-out set of clean prompts drawn from a different distribution than the 128 reference prompts, with parameters frozen, and record whether benign generations are flagged and whether the semantic distance D_semantic rises; separately, adversarially optimize a jailbreak prompt to keep its cross-attention normalized offsets below the 85% quantile threshold and test whether it still produces unsafe video.

Watch

Extended reading notes

Core claim

The paper's central claim is that the cross-attention pathway is the critical route through which jailbreak semantics invade text-to-video generation, and that this invasion is not diffuse: it accumulates step by step and concentrates in deep attention blocks, so it can be localized and regulated without touching model weights. The paper reports two empirical findings—a cumulative separation effect and progressively increasing linear separability between clean and jailbreak prompts—and a three-part regularization operator applied to the key/value pairs of cross-attention. The defense constructs a clean reference distribution from a single set of 128 clean prompts, identifies the first 60 diffusion steps and the 16 most separable attention blocks, and then attenuates any activation that deviates beyond the 85% quantile threshold. It also back-propagates the anomaly signal to input tokens, enabling prompt-level flagging and rewriting in black-box commercial systems.

Load-bearing premise

The load-bearing premise is that a clean-reference distribution built once from 128 clean prompts transfers to all future benign prompts, so any deviation beyond the 85% quantile threshold reliably signals an attack; if a user's normal phrasing falls outside that reference, the defense would suppress ordinary content or miss true attacks.

Editorial extensions

If this is right

A weight-free, 0.1-second-per-video defense can be inserted into existing T2V pipelines, making real-time safety filtering feasible where reconstruction-based defenses such as T2VShield take roughly 17 seconds.
The back-propagated token anomaly signal gives a black-box prompt-refinement path: unsafe cue words can be rewritten before generation, as demonstrated on the commercial Sora.
Because the mechanism targets cross-attention rather than specific words or models, it transfers across Open-Sora, CogVideo, and commercial systems without per-model retraining.
The reported reductions under five attack types indicate that jailbreak risk can be cut by more than half while preserving utility, supporting the paper's claim that cross-attention is the load-bearing pathway for jailbreak semantics.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: the separability finding suggests a general diagnostic—monitoring cross-attention statistics could serve as an attack detector independent of SafeCA, for example to triage prompts before generation.
Editorial inference: an adaptive attacker could try to keep the cross-attention normalized offsets below the 85% quantile threshold, so the defense's robustness would need re-testing against attacks that minimize the anomaly signal rather than maximize harm.
Editorial inference: the same clean-reference localization approach could transfer to text-to-image or other multimodal generation models with cross-attention, although the step and block selection would need recalibration for each architecture.
Editorial inference: the paper's own limitation—limited coverage of long-range temporal implicit semantics—points to a natural extension where temporal attention or recurrent anomaly tracking would be needed rather than per-step gating.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Worth a look for the empirical claim alone: jailbreak prompts produce cross-attention patterns that separate from clean ones cumulatively over diffusion steps, and the separation grows with depth. That is a new observation for T2V models, and it is well motivated. The defense itself—energy-normalized masking plus a semantic adapter on cross-attention—is a sensible engineering response, and the ablations show each piece contributes. The reported ASR drops (roughly 20% relative over T2VShield on two open-source models) are consistent across attack types, and the overhead claim (+0.1s) is plausible for the operations described.

The soft spots are real, and they cluster around selection and evaluation. The 60 diffusion steps and 16 cross-attention blocks are chosen by measuring separability on 128 jailbreak prompts from T2V and SafeWatch, and the headline numbers are then computed on T2VSafetyBench and SafeWatch. That is in-sample selection of the most discriminative locations. The paper even says in Section 4.4 that SafeWatch results are obtained 'without re-calibrating the parameters,' but the selection step already saw SafeWatch prompts. If the configuration is overfit to the benchmark distribution, the generalization claim is weaker than stated. No error bars, no seeds, no code or data, and the commercial-model evidence is one qualitative Sora example. The notation in Eqs. 7 and 10 also mixes z and a inconsistently, which makes the method harder to reimplement.

None of this kills the core idea. A defense that monitors cross-attention statistics against a clean reference is a reasonable approach, and the mechanism does not reduce to a tautology. The central empirical finding—cumulative separation—is worth testing independently. But the paper needs a held-out attack partition, seed variation, and ideally code before the ~20% claim is taken at face value. The authors should also clarify whether HAL selection ever touches the evaluation set.

For a reader: someone working on T2V safety will want to know this paper exists; it is a candidate for the next reading group. I would not cite it yet. A serious referee should see it; the right outcome is likely major revision, not acceptance as is.

Referee Report

3 major / 5 minor

Summary. The paper proposes SafeCA, a feature-level defense for text-to-video (T2V) diffusion models that operates on cross-attention statistics. The authors first report an empirical study showing a cumulative separation effect and increasing linear separability between clean and jailbreak prompts in cross-attention, then use this to build a Hierarchical Attention Localization (HAL) module that selects the first 60 diffusion steps and 16 most discriminative cross-attention blocks. A Cross-Attention Regularization (CAR) module applies attention masking, energy normalization, and a semantic adapter to gate key/value activations. Experiments on Open-Sora and CogVideo, plus a qualitative commercial-model example, report ASR reductions of about 20% relative to the T2VShield defense, an added inference cost of only 0.1 seconds, and preserved clean generation quality.

Significance. If the central claims hold, SafeCA is a meaningful contribution: it identifies a concrete, testable mechanism for jailbreak propagation in T2V models, proposes a weight-free inference-time defense that is substantially faster than T2VShield, and the ablation study shows that each of the three regularization components contributes to the safety/utility trade-off. The paper also gives the community a falsifiable hypothesis about cross-attention separability that could inform future defenses. However, the evaluation protocol currently leaves the main generalization claim vulnerable to in-sample selection of the defense's key locations, and the clean-metric definitions in Tables 3 and 5 are confusing enough that the 'maintains semantic consistency' claim is not yet established.

major comments (3)

[§3.2–3.3, Tables 1–4] The 60-step/16-block configuration of HAL is selected using separability measured on 128 jailbreak prompts drawn from T2VSafetyBench and SafeWatch (§3.2), and the headline ASR reductions in Tables 1–4 are computed on the same benchmark families. Since no held-out attack partition, no seed variation, and no confidence intervals are reported, the claimed ~20% relative improvement over T2VShield may be inflated by in-sample selection of the most discriminative steps and blocks. Cross-model transfer (Table 4) does not resolve this concern because the prompt distribution is unchanged. Please add a disjoint hold-out split for selecting steps/blocks, report multi-seed or bootstrap intervals, and show the ASR with a fixed a-priori configuration.
[§3.4, Eqs. (7), (10)–(12)] The notation is inconsistent. Eq. (7) defines z_t^b as an aggregate over value vectors V_t^b, but Eq. (10) uses z_t^b for a normalized offset of a_t^b, and a_t^b is never defined. Moreover, Eq. (9) gates the key/value pair with G_t^b, while the three gating mechanisms in Eqs. (11), (12), and (14) are computed from attention-level quantities; the exact relationship between the attention statistics and the per-key gating vector applied to K and V is unspecified. Please define a_t^b explicitly, reconcile the two uses of z_t^b, and state how the attention-level thresholds map to the key/value gating.
[Tables 3 and 5, §4.1] The clean metrics are difficult to interpret. The 'No Defense' row reports D_semantic=0 and SSIM=1, which suggests these metrics measure distance or similarity relative to the undefended model's own output rather than semantic fidelity to the input prompt. Under that reading, SafeCA's SSIM of 0.3449 is a large drop from the no-defense baseline of 1, which conflicts with the abstract's claim of 'maintains good text-video semantic consistency.' Please specify the reference video for SSIM/Temporal LPIPS and the exact computation of D_semantic, and report a prompt-based semantic fidelity measure (e.g., CLIP similarity between the prompt and generated video) so that the utility claim can be assessed.

minor comments (5)

[Abstract, Section 1, Table 3] The 'about 20%' reduction is not uniform across benchmarks: on SafeWatch (Table 3) the relative ASR reduction over T2VShield is only 10.9%. Please clarify that the headline figure refers to an average over specific tables or specify the aggregation.
[Throughout] There are several typographical and formatting issues: 'WhereTdenotes' in Section 3.1 lacks spacing, 'Which' in Section 3.5 is capitalized mid-sentence, and the commercial model name is written as both 'Keling' and 'Kling'.
[References] References [48] and [49] are duplicate entries for the same Open-Sora technical report; please merge them.
[Section 4.5, Figure 4] The commercial-model evidence is a single qualitative example. Please consider adding quantitative black-box metrics (e.g., token-level detection rates or human evaluation on a small set of commercial-model prompts) if the authors wish to support the 'deployability in commercial models' claim.
[Section 4.1] No code, checkpoint, or reproducibility statement is provided. Including a link to an implementation would strengthen the paper and help readers verify the reported 0.1-second overhead.

Circularity Check

1 steps flagged · score 5.0 of 10

ASR improvement is partly in-sample: the 60-step/16-block HAL configuration is selected on T2VSafetyBench/SafeWatch prompts and then evaluated on the same benchmark families, with no held-out split.

fitted input called prediction [Section 3.2–3.3 (HAL selection) vs Section 4.1–4.4 (evaluation)]
"The experiments use 128 jailbreak prompts from T2V and SafeWatch, and 128 clean prompts ... for the experiment, we take the first 60 diffusion steps and select the 16 cross-attention blocks with the largest differences."

The defense's only tunable locations (first 60 diffusion steps, top-16 cross-attention blocks) are chosen to maximize jailbreak-vs-clean separability on 128 jailbreak prompts drawn from T2VSafetyBench and SafeWatch. The reported ASR reductions (e.g., 29.53% to 23.41% on Open-Sora, 34.29% to 27.56% on CogVideo; ~20% relative in the abstract) are then measured on the same benchmark families (T2VSafetyBench's 280 prompts and SafeWatch's 300 prompts). With no held-out attack split or seed variation, the headline gain is partly a fitted result of selecting the most discriminative locations on the evaluation distribution, not an independent prediction.

full rationale

SafeCA's internal mechanism (cross-attention masking, energy normalization, semantic adapter) is not definitionally circular: it is an anomaly detector using a clean reference, and the empirical 'cumulative separation effect' is an observation. The circularity is in the selection/evaluation loop. HAL's key defensive regions—first 60 diffusion steps and the 16 blocks with largest differences—are selected using 128 jailbreak prompts 'from T2V and SafeWatch' (Section 3.2–3.3), and the headline ASR numbers (Tables 1–4, abstract) are computed on T2VSafetyBench and SafeWatch (Section 4.1). No disjoint split, bootstrap, or seed variation is reported, and Section 4.4's statement that SafeWatch results are obtained 'without re calibrating the parameters for SafeWatch' is inconsistent with Section 3.2's use of SafeWatch prompts during selection. The ~20% relative ASR reduction therefore partly reduces to the supervised selection of the most discriminative locations on the same benchmark families. This is a fitted-input-called-prediction pattern, not a full definitional collapse, so the score is 5 rather than 8–10. No load-bearing self-citation was found; citations to the authors' prior T2VShield/T2V-OptJail work are contextual baselines/attacks, not proofs of this paper's claims.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

No new physical or mathematical entities are introduced. The 'anomalous semantic subspace' is a descriptive construct used to explain the gating mechanism, but it is not an independent entity with a falsifiable handle outside the paper.

free parameters (7)

gamma (attention masking suppression strength) = 0.7
Exponential decay coefficient in Eq. 11; controls how strongly anomalous keys are suppressed; hand-set and not justified by a separate validation set.
k (energy normalization bandwidth) = 0.2
Clip range in Eq. 12 that bounds local attention energy; chosen by hand.
eta (semantic adapter retraction step) = 0.05
Retraction factor in Eq. 14 that pulls attention back toward the clean subspace; hand-set.
s_min (gating lower bound) = 1e-3
Lower bound in Eq. 15 to avoid over-suppression; hand-set.
tau_t^b threshold quantile = 85% quantile
Adaptive threshold computed from clean-sample offsets in Section 3.3; a data-derived statistic that determines what counts as anomalous.
selected diffusion steps and blocks = first 60 steps, top-16 blocks
HAL picks these spatiotemporal locations based on separability of the analysis set; they are load-bearing for the defense and appear tuned to the benchmark.
clean prompt set size = 128 (stable around 64)
The clean reference distribution depends on the specific clean prompts used; Figure 5(c) shows performance varies with sample size.

assumptions (5)

domain assumption Cross-attention is the primary pathway for jailbreak semantic propagation; self-attention and FFN have limited influence.
Stated in Section 3.1 as the 'Motivated assumption'; if false, the defense targets the wrong module and would not reduce ASR.
domain assumption A clean reference distribution computed from 128 clean prompts generalizes to all benign prompts at inference.
HAL builds reference statistics in Section 3.3; the paper does not test on prompts unlike the reference set.
domain assumption The attacker cannot access model parameters or internal representations.
Threat model in Section 3.1; the defense assumes a black-box text interface only.
domain assumption The separability observed on 128 jailbreak and 128 clean prompts is representative and stable across diffusion steps.
Empirical findings in Section 3.2 are reported without significance tests or cross-validation.
domain assumption GPT-4o Score and Human ASR are valid proxies for video harmfulness.
Used as the main safety metrics in Section 4 without independent validation.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense." pith.science (2026). https://pith.science/paper/GW37JKEO

@misc{pith2026260810933,
  author       = {Pith},
  title        = {Pith review of: SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GW37JKEO}},
  note         = {Machine review of arXiv:2608.10933}
}

read the original abstract

Text-to-Video (T2V) generative models are vulnerable to jailbreak attacks in real-world deployment, leading them to produce harmful or inappropriate content. Existing defense approaches mainly rely on input filtering or reconstruction, which not only incur high computational latency but also tend to distort semantics. To address these issues, we experimentally and systematically analyze the differences between clean and jailbreak samples in the cross-attention feature space, revealing for the first time a cumulative separation effect and a progressively increasing trend of linear separability between the two during the diffusion process. Based on this insight, we propose SafeCA, a feature-level defense mechanism for safe cross-attention localization and regularization. Firstly, we identify key defensive regions and values through attention stability analysis using cross-attention features collected from clean prompts within a single inference. Secondly, SafeCA mitigates anomalous activations via attention masking with energy normalization and introduces a lightweight semantic-space adapter to redirect abnormal semantic flows. Furthermore, we detect and suppress potentially malicious tokens by back-propagating feature anomaly signals to the input cue words, thereby enhancing the deployability of the defense in commercial models. Experimental results show that SafeCA reduces the jailbreak success rate by about 20% on mainstream T2V models, adds almost no inference overhead (+0.1s), and maintains good text-video semantic consistency. Overall, SafeCA provides an architecture-level, deployable protection paradigm for T2V generation models.

Figures

Figures reproduced from arXiv: 2608.10933 by the authors.

**Figure 2.** (a) Layer-wise separability at step 99 with a spatio [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** framework illustration. where µ b t and varb t are the mean and variance of the clean features, respectively; Ub t is the principal semantic subspace extracted by PCA; and τ b t is the adaptive threshold, which is obtained by counting the normalized offsets for all the clean samples and taking the high quartile (such as the 85% quantile). Together, these statistics constitute a clean reference distribution across a… view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: We identify unsafe tokens and guide the Sora model to [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: (a) Effect of different step selections. (b) Effect of varying top-block numbers. (c) Impact of clean prompt size on feature [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 20 canonical work pages

[1]

luma dream machine, 2024

Luma. luma dream machine, 2024. URL https://lumalabs.ai/dream-machine. 2

work page 2024
[2]

Frozen in time: A joint video and image encoder for end-to-end retrieval, 2021

Max Bain, Arsha Nagrani, G ¨ul Varol, and Andrew Zisser- man. Frozen in time: A joint video and image encoder for end-to-end retrieval, 2021. 6

work page 2021
[3]

Stable video diffusion: Scaling latent video diffusion models to large datasets.arXiv preprint arXiv:2311.15127, 2023

Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram V oleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets.arXiv preprint arXiv:2311.15127, 2023. 1

arXiv 2023
[4]

Transformer inter- pretability beyond attention visualization.arXiv preprint, arXiv:2012.09838, 2020

Hila Chefer, Shir Gur, and Lior Wolf. Transformer inter- pretability beyond attention visualization.arXiv preprint, arXiv:2012.09838, 2020. 3

arXiv 2012
[5]

Transformer inter- pretability beyond attention visualization

Hila Chefer, Shir Gur, and Lior Wolf. Transformer inter- pretability beyond attention visualization. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 782–791, 2021. 3

work page 2021
[6]

Videocrafter2: Overcoming data limitations for high-quality video diffu- sion models

Haoxin Chen, Yong Zhang, Xiaodong Cun, Menghan Xia, Xintao Wang, Chao Weng, and Ying Shan. Videocrafter2: Overcoming data limitations for high-quality video diffu- sion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7310– 7320, 2024. 1

work page 2024
[7]

Safewatch: An efficient safety-policy following video guardrail model with transparent explanations.arXiv preprint arXiv:2412.06878, 2024

Zhaorun Chen, Francesco Pinto, Minzhou Pan, and Bo Li. Safewatch: An efficient safety-policy following video guardrail model with transparent explanations.arXiv preprint arXiv:2412.06878, 2024. 6

arXiv 2024
[8]

Jailbreaking text-to-image models with llm- based agents.arXiv preprint arXiv:2408.00523, 1, 2024

Yingkai Dong, Zheng Li, Xiangtao Meng, Ning Yu, and Shanqing Guo. Jailbreaking text-to-image models with llm- based agents.arXiv preprint arXiv:2408.00523, 1, 2024. 1

arXiv 2024

Show all 49 references

[9]

Not what you’ve signed up for: Compromising real-world llm-integrated ap- plications with indirect prompt injection

Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated ap- plications with indirect prompt injection. InProceedings of the 16th ACM workshop on artificial intellige...

2023
[10]

Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast.arXiv preprint arXiv:2402.08567, 2024

Xiangming Gu, Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Ye Wang, Jing Jiang, and Min Lin. Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast.arXiv preprint arXiv:2402.08567, 2024. 1

2024 arXiv
[11]

Novo: Norm voting off hallucinations with attention heads in large language models.arXiv preprint, arXiv:2410.08970, 2024

Zheng Yi Ho, Siyuan Liang, Sen Zhang, Yibing Zhan, and Dacheng Tao. Novo: Norm voting off hallucinations with attention heads in large language models.arXiv preprint, arXiv:2410.08970, 2024. 3

2024 arXiv
[12]

Baseline defenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614,

Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Gold- stein. Baseline defenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614,

arXiv
[13]

Cogmorph: Cognitive morphing attacks for text-to-image models.arXiv preprint arXiv:2501.11815, 2025

Zonglei Jing, Zonghao Ying, Le Wang, Siyuan Liang, Ais- han Liu, Xianglong Liu, and Dacheng Tao. Cogmorph: Cognitive morphing attacks for text-to-image models.arXiv preprint arXiv:2501.11815, 2025. 1

2025 arXiv
[14]

Videopoet: A large language model for zero-shot video gen- eration.arXiv preprint arXiv:2312.14125, 2023

Dan Kondratyuk, Lijun Yu, Xiuye Gu, Jos ´e Lezama, Jonathan Huang, Grant Schindler, Rachel Hornung, Vigh- nesh Birodkar, Jimmy Yan, Ming-Chang Chiu, et al. Videopoet: A large language model for zero-shot video gen- eration.arXiv preprint arXiv:2312.14125, 2023. 1

2023 arXiv
[15]

Hunyuanvideo: A systematic framework for large video generative models.arXiv preprint arXiv:2412.03603, 2024

Weijie Kong, Qi Tian, Zijian Zhang, Rox Min, Zuozhuo Dai, Jin Zhou, Jiangfeng Xiong, Xin Li, Bo Wu, Jianwei Zhang, et al. Hunyuanvideo: A systematic framework for large video generative models.arXiv preprint arXiv:2412.03603, 2024. 1

2024 arXiv
[16]

Bridg- ing text and video generation: A survey.arXiv preprint arXiv:2510.04999, 2025

Nilay Kumar, Priyansh Bhandari, and G Maragatham. Bridg- ing text and video generation: A survey.arXiv preprint arXiv:2510.04999, 2025. 1

2025
[17]

Semantic mirror jailbreak: Genetic algorithm based jailbreak prompts against open-source llms

Xiaoxia Li, Siyuan Liang, Jiyi Zhang, Han Fang, Aishan Liu, and Ee-Chien Chang. Semantic mirror jailbreak: Genetic algorithm based jailbreak prompts against open-source llms. arXiv preprint arXiv:2402.14872, 2024. 1

2024 arXiv
[18]

Safellm: Unlearning harmful outputs from large language models against jailbreak attacks.arXiv preprint arXiv:2508.15182, 2025

Xiangman Li, Xiaodong Wu, Qi Li, Jianbing Ni, and Rongx- ing Lu. Safellm: Unlearning harmful outputs from large language models against jailbreak attacks.arXiv preprint arXiv:2508.15182, 2025. 2

2025 arXiv
[19]

Exploring inconsistent knowledge distil- lation for object detection with data augmentation

Jiawei Liang, Siyuan Liang, Aishan Liu, Ke Ma, Jingzhi Li, and Xiaochun Cao. Exploring inconsistent knowledge distil- lation for object detection with data augmentation. InPro- ceedings of the 31st ACM International Conference on Mul- timedia, 2023. 1

2023
[20]

A large-scale multiple- objective method for black-box attack against object detec- tion

Siyuan Liang, Longkang Li, Yanbo Fan, Xiaojun Jia, Jingzhi Li, Baoyuan Wu, and Xiaochun Cao. A large-scale multiple- objective method for black-box attack against object detec- tion. InEuropean Conference on Computer Vision, 2022

2022
[21]

Imitated detectors: Stealing knowl- edge of black-box object detectors

Siyuan Liang, Aishan Liu, Jiawei Liang, Longkang Li, Yang Bai, and Xiaochun Cao. Imitated detectors: Stealing knowl- edge of black-box object detectors. InProceedings of the 30th ACM International Conference on Multimedia, 2022

2022
[22]

Badclip: Dual- embedding guided backdoor attack on multimodal con- trastive learning

Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. Badclip: Dual- embedding guided backdoor attack on multimodal con- trastive learning. InProceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, pages 24645–24654, 2024

2024
[23]

Re- visiting backdoor attacks against large vision-language mod- els from domain shift

Siyuan Liang, Jiawei Liang, Tianyu Pang, Chao Du, Ais- han Liu, Mingli Zhu, Xiaochun Cao, and Dacheng Tao. Re- visiting backdoor attacks against large vision-language mod- els from domain shift. InProceedings of the Computer Vi- sion and Pattern Recognition Conference, pages 9...

2025
[24]

T2vshield: Model-agnostic jailbreak defense for text- to-video models.arXiv preprint arXiv:2504.15512, 2025

Siyuan Liang, Jiayang Liu, Jiecheng Zhai, Tianmeng Fang, Rongcheng Tu, Aishan Liu, Xiaochun Cao, and Dacheng Tao. T2vshield: Model-agnostic jailbreak defense for text- to-video models.arXiv preprint arXiv:2504.15512, 2025. 1, 2

2025 arXiv
[25]

T2v-optjail: Discrete prompt optimization for text-to-video jailbreak attacks.arXiv preprint arXiv:2505.06679, 2025

Jiayang Liu, Siyuan Liang, Shiqian Zhao, Rongcheng Tu, Wenbo Zhou, Aishan Liu, Dacheng Tao, and Siew Kei Lam. T2v-optjail: Discrete prompt optimization for text-to-video jailbreak attacks.arXiv preprint arXiv:2505.06679, 2025. 2

2025 arXiv
[26]

Sora: A review on background, technology, 9 limitations, and opportunities of large vision models.arXiv preprint arXiv:2402.17177, 2024

Yixin Liu, Kai Zhang, Yuan Li, Zhiling Yan, Chujie Gao, Ruoxi Chen, Zhengqing Yuan, Yue Huang, Hanchi Sun, Jian- feng Gao, et al. Sora: A review on background, technology, 9 limitations, and opportunities of large vision models.arXiv preprint arXiv:2402.17177, 2024. 1, 2

2024 arXiv
[27]

T2vsafetybench: Evaluating the safety of text-to-video generative models.Advances in Neural In- formation Processing Systems, 37:63858–63872, 2024

Yibo Miao, Yifan Zhu, Lijia Yu, Jun Zhu, Xiao-Shan Gao, and Yinpeng Dong. T2vsafetybench: Evaluating the safety of text-to-video generative models.Advances in Neural In- formation Processing Systems, 37:63858–63872, 2024. 2, 3, 6

2024
[28]

Openvid-1m: A large-scale high-quality dataset for text-to- video generation.arXiv preprint arXiv:2407.02371, 2024

Kepan Nan, Rui Xie, Penghao Zhou, Tiehan Fan, Zhen- heng Yang, Zhijie Chen, Xiang Li, Jian Yang, and Ying Tai. Openvid-1m: A large-scale high-quality dataset for text-to- video generation.arXiv preprint arXiv:2407.02371, 2024. 1

2024 arXiv
[29]

T2veval: Benchmark dataset and objective evaluation method for t2v-generated videos.Displays, page 103178,

Zelu Qi, Ping Shi, Shuqi Wang, Chaoyang Zhang, Fei Zhao, Zefeng Ying, Da Pan, Xi Yang, Zheqi He, and Teng Dai. T2veval: Benchmark dataset and objective evaluation method for t2v-generated videos.Displays, page 103178,
[30]

Make-a-video: Text-to-video generation without text-video data.arXiv preprint arXiv:2209.14792,

Uriel Singer, Adam Polyak, Thomas Hayes, Xi Yin, Jie An, Songyang Zhang, Qiyuan Hu, Harry Yang, Oron Ashual, Oran Gafni, et al. Make-a-video: Text-to-video generation without text-video data.arXiv preprint arXiv:2209.14792,

arXiv
[31]

Kling-omni technical report, 2025

Kling Team, Jialu Chen, Yuanzheng Ci, Xiangyu Du, Zipeng Feng, Kun Gai, Sainan Guo, Feng Han, Jingbin He, Kang He, et al. Kling-omni technical report, 2025. 2

2025
[32]

Videotetris: Towards compositional text-to-video generation.Advances in Neural Information Processing Sys- tems, 37:29489–29513, 2024

Ye Tian, Ling Yang, Haotian Yang, Yuan Gao, Yufan Deng, Jingmin Chen, Xintao Wang, Zhaochen Yu, Xin Tao, Pengfei Wan, et al. Videotetris: Towards compositional text-to-video generation.Advances in Neural Information Processing Sys- tems, 37:29489–29513, 2024. 2

2024
[33]

Manipulating multimodal agents via cross-modal prompt injection.arXiv preprint arXiv:2504.14348, 2025

Le Wang, Zonghao Ying, Tianyuan Zhang, Siyuan Liang, Shengshan Hu, Mingchuan Zhang, Aishan Liu, and Xiang- long Liu. Manipulating multimodal agents via cross-modal prompt injection.arXiv preprint arXiv:2504.14348, 2025. 1

2025 arXiv
[34]

Jail- broken: How does llm safety training fail?Advances in neu- ral information processing systems, 36:80079–80110, 2023

Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jail- broken: How does llm safety training fail?Advances in neu- ral information processing systems, 36:80079–80110, 2023. 1

2023
[35]

Defensive prompt patch: A robust and generalizable defense of large language models against jailbreak attacks

Chen Xiong, Xiangyu Qi, Pin-Yu Chen, and Tsung-Yi Ho. Defensive prompt patch: A robust and generalizable defense of large language models against jailbreak attacks. InFind- ings of the Association for Computational Linguistics: ACL 2025, pages 409–437, 2025. 2

2025
[36]

Video- eraser: Concept erasure in text-to-video diffusion models

Naen Xu, Jinghuai Zhang, Changjiang Li, Zhi Chen, Chunyi Zhou, Qingming Li, Tianyu Du, and Shouling Ji. Video- eraser: Concept erasure in text-to-video diffusion models. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 5965–5994, 2025. 2

2025
[37]

Cogvideox: Text-to-video diffusion models with an expert transformer.arXiv preprint arXiv:2408.06072, 2024

Zhuoyi Yang, Jiayan Teng, Wendi Zheng, Ming Ding, Shiyu Huang, Jiazheng Xu, Yuanming Yang, Wenyi Hong, Xiao- han Zhang, Guanyu Feng, et al. Cogvideox: Text-to-video diffusion models with an expert transformer.arXiv preprint arXiv:2408.06072, 2024. 1, 2

2024 arXiv
[38]

Jailbreak attacks and defenses against large language models: A survey.arXiv preprint arXiv:2407.04295, 2024

Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Ji- axing Song, Ke Xu, and Qi Li. Jailbreak attacks and defenses against large language models: A survey.arXiv preprint arXiv:2407.04295, 2024. 1, 2

2024 arXiv
[39]

Jailbreak vision language models via bi-modal adversarial prompt

Zonghao Ying, Aishan Liu, Tianyuan Zhang, Zhengmin Yu, Siyuan Liang, Xianglong Liu, and Dacheng Tao. Jailbreak vision language models via bi-modal adversarial prompt. arXiv preprint arXiv:2406.04031, 2024

2024 arXiv
[40]

Pushing the limits of safety: A tech- nical report on the atlas challenge 2025.arXiv preprint arXiv:2506.12430, 2025

Zonghao Ying, Siyang Wu, Run Hao, Peng Ying, Shixuan Sun, Pengyu Chen, Junze Chen, Hao Du, Kaiwen Shen, Shangkun Wu, et al. Pushing the limits of safety: A tech- nical report on the atlas challenge 2025.arXiv preprint arXiv:2506.12430, 2025

2025 arXiv
[41]

Reasoning- augmented conversation for multi-turn jailbreak attacks on large language models.arXiv preprint arXiv:2502.11054,

Zonghao Ying, Deyue Zhang, Zonglei Jing, Yisong Xiao, Quanchen Zou, Aishan Liu, Siyuan Liang, Xiangzheng Zhang, Xianglong Liu, and Dacheng Tao. Reasoning- augmented conversation for multi-turn jailbreak attacks on large language models.arXiv preprint arXiv:2502.11054,

arXiv
[42]

Safree: Training-free and adaptive guard for safe text-to-image and video generation.arXiv preprint arXiv:2410.12761, 2024

Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to-image and video generation.arXiv preprint arXiv:2410.12761, 2024. 1

2024 arXiv
[43]

Safree: Training-free and adaptive guard for safe text-to-image and video generation

Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to-image and video generation. InThe Thir- teenth International Conference on Learning Representa- tions, 2025. 2

2025
[44]

Language model beats diffusion–tokenizer is key to visual generation.arXiv preprint arXiv:2310.05737, 2023

Lijun Yu, Jos ´e Lezama, Nitesh B Gundavarapu, Luca Ver- sari, Kihyuk Sohn, David Minnen, Yong Cheng, Vighnesh Birodkar, Agrim Gupta, Xiuye Gu, et al. Language model beats diffusion–tokenizer is key to visual generation.arXiv preprint arXiv:2310.05737, 2023. 1

arXiv
[45]

Badrobot: Jailbreaking llm-based embodied ai in the physical world.arXiv preprint arXiv:2407.20242, 3:1, 2024

Hangtao Zhang, Chenyu Zhu, Xianlong Wang, Ziqi Zhou, Shengshan Hu, and Leo Yu Zhang. Badrobot: Jailbreaking llm-based embodied ai in the physical world.arXiv preprint arXiv:2407.20242, 3:1, 2024. 1

2024 arXiv
[46]

Jbshield: Defending large lan- guage models from jailbreak attacks through activated con- cept analysis and manipulation

Shenyi Zhang, Yuchen Zhai, Keyan Guo, Hongxin Hu, Shengnan Guo, Zheng Fang, Lingchen Zhao, Chao Shen, Cong Wang, and Qian Wang. Jbshield: Defending large lan- guage models from jailbreak attacks through activated con- cept analysis and manipulation. InUSENIX Security 25 (pre- ...

2025
[47]

Prefix guidance: A steering wheel for large language models to defend against jailbreak attacks.arXiv preprint arXiv:2408.08924, 2024

Jiawei Zhao, Kejiang Chen, Xiaojian Yuan, and Weiming Zhang. Prefix guidance: A steering wheel for large language models to defend against jailbreak attacks.arXiv preprint arXiv:2408.08924, 2024. 2

2024 arXiv
[49]

Open-sora: Democratizing efficient video production for all.arXiv preprint arXiv:2412.20404, 2024

Zangwei Zheng, Xiangyu Peng, Tianji Yang, Chenhui Shen, Shenggui Li, Hongxin Liu, Yukun Zhou, Tianyi Li, and Yang You. Open-sora: Democratizing efficient video production for all.arXiv preprint arXiv:2412.20404, 2024. 1

2024 arXiv
[50]

Universal and transferable ad- versarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023

Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable ad- versarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023. 1 10

2023 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

luma dream machine, 2024

Luma. luma dream machine, 2024. URL https://lumalabs.ai/dream-machine. 2

work page 2024

[2] [2]

Frozen in time: A joint video and image encoder for end-to-end retrieval, 2021

Max Bain, Arsha Nagrani, G ¨ul Varol, and Andrew Zisser- man. Frozen in time: A joint video and image encoder for end-to-end retrieval, 2021. 6

work page 2021

[3] [3]

Stable video diffusion: Scaling latent video diffusion models to large datasets.arXiv preprint arXiv:2311.15127, 2023

Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram V oleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets.arXiv preprint arXiv:2311.15127, 2023. 1

arXiv 2023

[4] [4]

Transformer inter- pretability beyond attention visualization.arXiv preprint, arXiv:2012.09838, 2020

Hila Chefer, Shir Gur, and Lior Wolf. Transformer inter- pretability beyond attention visualization.arXiv preprint, arXiv:2012.09838, 2020. 3

arXiv 2012

[5] [5]

Transformer inter- pretability beyond attention visualization

Hila Chefer, Shir Gur, and Lior Wolf. Transformer inter- pretability beyond attention visualization. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 782–791, 2021. 3

work page 2021

[6] [6]

Videocrafter2: Overcoming data limitations for high-quality video diffu- sion models

Haoxin Chen, Yong Zhang, Xiaodong Cun, Menghan Xia, Xintao Wang, Chao Weng, and Ying Shan. Videocrafter2: Overcoming data limitations for high-quality video diffu- sion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7310– 7320, 2024. 1

work page 2024

[7] [7]

Safewatch: An efficient safety-policy following video guardrail model with transparent explanations.arXiv preprint arXiv:2412.06878, 2024

Zhaorun Chen, Francesco Pinto, Minzhou Pan, and Bo Li. Safewatch: An efficient safety-policy following video guardrail model with transparent explanations.arXiv preprint arXiv:2412.06878, 2024. 6

arXiv 2024

[8] [8]

Jailbreaking text-to-image models with llm- based agents.arXiv preprint arXiv:2408.00523, 1, 2024

Yingkai Dong, Zheng Li, Xiangtao Meng, Ning Yu, and Shanqing Guo. Jailbreaking text-to-image models with llm- based agents.arXiv preprint arXiv:2408.00523, 1, 2024. 1

arXiv 2024