Organizations: National Anti-Counterfeit Engineering Research Center, Huazhong University of Science and Technology · School of Electronic Information and Communications, Huazhong University of Science and Technology · Sydney AI Centre, The University of Sydney
Image-to-Video (I2V) generation models, which condition video generation on reference images, have shown emerging visual instruction-following capability, allowing certain visual cues in reference images to act as implicit control signals for video generation. However, this capability also introduces a previously overlooked risk: adversaries may exploit visual instructions to inject malicious intent through the image modality. In this work, we uncover this risk by proposing Visual Instruction Injection (VII), a training-free and transferable jailbreaking framework that intentionally disguises the malicious intent of unsafe text prompts as benign visual instructions in the safe reference image. Specifically, VII coordinates a Malicious Intent Reprogramming module to distill malicious intent from unsafe text prompts while minimizing their static harmfulness, and a Visual Instruction Grounding module to ground the distilled intent onto a safe input image by rendering visual instructions that preserve semantic consistency with the original unsafe text prompt, thereby inducing harmful content during I2V generation. Empirically, our extensive experiments on four state-of-the-art commercial I2V models (Kling-v2.5-turbo, Gemini Veo-3.1, Seedance-1.5-pro, and PixVerse-V5) demonstrate that VII achieves Attack Success Rates of up to 83.5% while reducing Refusal Rates to near zero, significantly outperforming existing baselines.
Figures & tables
Figure 1: I2V model equipped with multi-modal safety mechanisms (e.g., visual and text-based safeguards) typically refuses or generates only safe content when (a): a safe image is paired with an unsafe text prompt, or (b): an unsafe image is paired with any text prompt. (c) The proposed VII successfully bypass multi-modal safety mechanisms and induces unsafe video generation.
Figure 2: The framework of Visual Instruction Injection (VII). (a) Malicious Intention Reprogramming (MIR): distilling unsafe prompts into benign synonyms and reprogramming them into executable typographic descriptions. (b) Visual Instruction Grounding (VIG): grounding the distilled intent onto the safe image by rendering auxiliary visual symbols and embedding typographic descriptions. (c) I2V Generation: the I2V model interprets the visual instructions and dynamically reconstructs the malicious content.
Dataset
Eval
Method
Metric
Kling-v2.5-turbo
Seedance-1.5-pro
Veo-3.1
PixVerse-V5
Sex
Vio
Hat
Ill
Avg
Sex
Vio
Hat
Ill
Avg
Sex
Vio
Hat
Ill
Avg
Sex
Vio
Hat
Ill
Avg
COCO-I2VSafetyBench
VBench++
Unsafe Text Prompt
ASR ( ↑ )
22.0
70.0
28.0
24.0
36.0
26.0
68.0
28.0
16.0
34.5
0.0
64.0
12.0
22.0
24.5
6.0
70.0
22.0
18.0
29.0
RR ( ↓ )
6.0
2.0
0.0
4.0
3.0
16.0
6.0
10.0
12.0
11.0
100.0
30.0
76.0
22.0
57.0
80.0
0.0
0.0
40.0
30.0
Typographic Attack
ASR ( ↑ )
38.0
68.0
38.0
24.0
42.0
30.0
66.0
36.0
26.0
39.5
0.0
60.0
52.0
48.0
40.0
30.0
74.0
26.0
22.0
38.0
RR ( ↓ )
6.0
0.0
0.0
0.0
1.5
14.0
16.0
22.0
8.0
15.0
100.0
26.0
34.0
18.0
44.5
0.0
0.0
0.0
0.0
0.0
VII (Ours)
ASR ( ↑ )
66.0
90.0
88.0
82.0
81.5
40.0
74.0
50.0
40.0
51.0
14.0
86.0
62.0
50.0
53.0
80.0
92.0
90.0
72.0
83.5
Table 1: We compare our VII method with baselines the COCO-I2VSafetyBench and ConceptRisk datasets across four I2V models. Purple text indicates ASR (higher is better), black text indicates RR (lower is better). Purple columns highlight the method with the highest ASR in each category within its respective dataset.
Figure 3: Visualization of generated videos. Our proposed VII method successfully jailbreaks the I2V models and produces harmful videos, whereas the Unsafe Text Prompt attack fails to jailbreak, resulting in benign generations.
Method
Metric
Kling
Seedance
Veo
PixVerse
Dataset: COCO-I2VSafetyBench
Unsafe Text Prompt
CLIPp2c ( ↑ )
0.5397
0.4872
0.2402
0.3898
CLIPp2i ( ↑ )
0.2508
0.2252
0.1011
0.1708
Typographic Attack
CLIPp2c ( ↑ )
0.5571
0.4899
0.3273
0.5556
CLIPp2i ( ↑ )
0.2553
0.2285
0.1381
0.2596
VII (Ours)
CLIPp2c ( ↑ )
0.5679
0.5539
0.4415
0.5692
Table 2: Quantitative results for semantic consistency. Purple backgrounds highlight the best.
Eval
Method
Metric
Kling-v2.5-turbo
Seedance-1.5-pro
Veo-3.1
PixVerse-V5
Sex
Vio
Hat
Ill
Avg
Sex
Vio
Hat
Ill
Avg
Sex
Vio
Hat
Ill
Avg
Sex
Vio
Hat
Ill
Avg
VBench++
VII w/o typography description
ASR ( ↑ )
46.0
78.0
70.0
54.0
62.0
32.0
76.0
44.0
36.0
47.0
4.0
60.0
40.0
52.0
39.0
48.0
80.0
52.0
44.0
56.0
RR ( ↓ )
8.0
0.0
0.0
0.0
2.0
12.0
10.0
18.0
4.0
11.0
94.0
32.0
48.0
16.0
47.5
12.0
0.0
6.0
0.0
4.5
VII w/o visual symbols
ASR ( ↑ )
24.0
68.0
40.0
20.0
38.0
16.0
68.0
22.0
14.0
30.0
0.0
50.0
16.0
20.0
21.5
16.0
62.0
38.0
14.0
32.5
RR ( ↓ )
4.0
0.0
0.0
0.0
1.0
12.0
8.0
16.0
8.0
11.0
92.0
36.0
60.0
16.0
51.0
12.0
0.0
6.0
0.0
4.5
VII (Ours)
ASR ( ↑ )
66.0
90.0
88.0
82.0
81.5
40.0
74.0
50.0
40.0
51.0
14.0
86.0
62.0
50.0
53.0
80.0
92.0
90.0
72.0
83.5
Table 3: We investigate the impact of typographic descriptions and visual symbols on the COCO-I2VSafetyBench. Purple text indicates ASR, black text indicates RR. Pink columns highlight the best result (highest ASR).
Figure 4: Hyperparameter analysis on Kling-v2.5-turbo (top row) and PixVerse-V5 (bottom row). Left column (language): Comparison of VII-EN (English), VII-CN (Chinese), and VII-JP (Japanese). Middle column (font): Comparison of VII-Arial, VII-Times (Times New Roman), and VII-Courier (Courier New). Right column (position): Comparison of VII-Border (Border Padding) and VII-Inner (Inner Inpainting). Visualizations of VII generated images under various configurations are in Appendix F .
Figure 5: Prefix-based defense.
Appendix figures & tables11 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 6: COCO-I2VSafetyBench: Harmful Behavior List. For each harmful category, there are 20 candidate harmful behaviors.
Figure 7: COCO-I2VSafetyBench: Harmful Video Prompt Generation Template. Given an input image and its original caption, we use an LLM to synthesize a harmful video prompt by rewriting the caption under the guidance of the harmful behavior library.
Figure 8: Examples of COCO-I2VSafetyBench. Italic gray text indicates the harmful components embedded in the prompts.
Figure 9: Comparison between VII (full and variants) and baselines. Left: Sexual Content; Right: Violence and Threat. Each row shows representative key frames sampled from the generated videos for (a) Unsafe Text Prompt, (b) Typographic Attack, (c) VII w/o Typograpy, (d) VII w/o Visual Instr., and (e) full VII.
Figure 10: Sexual Content on COCO-I2VSafetyBench.
Figure 12: Violence and Threat on COCO-I2VSafetyBench.
Figure 14: Hate and Extremism on COCO-I2VSafetyBench.
Figure 16: Illegal Activity on COCO-I2VSafetyBench.
Figure 18: Visual comparison of typographic descriptions across different languages. The structural symbols remain consistent while the semantic directives are successfully localized.
Figure 19: Visual comparison of adversarial images rendered with different font types.
Figure 20: Visual comparison of instruction placement strategies. Border padding explicitly isolates the instructions, avoiding visual occlusion on the safe image.
In recent years, image-to-video (I2V) generation models have made remarkable progress in subject consistency and temporal coherence, enabling high quality video synthesis. However, these advances also introduce new safety risks. Existing studies mainly focus on jailbreak attacks involving single frame violations, while largely overlooking the temporal dimension unique to video generation models. In this paper, we investigate three attack scenarios and uncover a temporal vulnerability in I2V systems: unsafe semantics may emerge not from a single frame, but from semantic composition over time. We further identify two key challenges in such attacks: temporal abstraction and semantic camouflage. To address these issues, we propose TempJail, a novel temporal jailbreak framework for I2V systems. For temporal abstraction, we decompose a target malicious caption into an initial frame visual condition and a temporal text instruction. For semantic camouflage, on the image side we model semantic injection as controlled latent perturbation in diffusion sampling and introduce gradient guidance from pretrained encoders. On the text side, we rewrite the caption into an innocuous ``subject-action-scene'' template that bypasses safety filters while preserving temporal guidance. In the black-box inference phase, these two modalities jointly enable malicious semantics to be gradually triggered over time. Experiments on closed-source commercial models, including Kling, Seedance, Veo and PixVerse, show that TempJail improves attack success rate over prior state-of-the-art methods by 23.3% under GPT-5.2 evaluation and 22.0% under human evaluation. Our codes are available at GitHub.
Qi Lu, Zehui Guo, David Yuanda Gan +4
School of Cyber Science and Engineering, Huazhong University of Science and Technology · School of Mathematical Sciences, Peking University · School of Software and engineering, Huazhong University of Science and Technology +1
Recent advancements in Image-to-Video (I2V) generation have transformed input images from simple appearance references into interactive control interfaces where visual cues such as arrows, sketches, and emojis orchestrate complex video dynamics with unprecedented controllability. However, these seemingly innocuous static cues can be interpreted by models as executable temporal instructions, unfolding into harmful actions in the generated videos. Despite the severity of this threat, existing safety benchmarks remain predominantly focused on text-based and content-only image-based jailbreaks, leaving implicit visual prompt attacks insufficiently explored. To bridge this gap, we present VVA-Bench, the first systematic benchmark for evaluating video generation safety under categorized vision-centric prompt attacks. Extensive experiments on VVA-Bench demonstrate that state-of-the-art models are highly susceptible to such attacks, with Attack Success Rates (ASR) reaching 100.0% on Wan 2.7 and 74.8% on Veo 3.1. To mitigate these risks, we propose VPA-Guard, a retrieval-augmented and self-evolving defense framework. By leveraging few-shot reasoning to identify latent malicious intents, our method reduces the attack ASR by 44.2% and the harmfulness score by 73.4% on average, while maintaining the model's utility for legitimate user edits. Our work provides both a rigorous benchmark and an effective defense strategy to advance safe and socially responsible multimodal generation.
Yining Sun, Haoyu Kang, Jiajun Wu +7
1Tsinghua University · 3Central South University · 4South China Normal University +3
Recent advances in Image-to-Video generation allow a single image to be animated into a convincing video under text guidance, raising serious copyright and privacy risks. We propose Anti-Prompt, an image protection approach that injects imperceptible perturbations into an image, inducing visible inconsistencies and structural failures in text-guided I2V generation. Our method is motivated by a simple empirical observation. When text guidance is removed from modern I2V models, generation quality degrades markedly, not only in motion realism but also in subject preservation, structural coherence, and temporal consistency. Building on this insight, Anti-Prompt exploits the model reliance on textual guidance by attenuating text-conditioned interactions during denoising while strengthening visual-only pathways. To further systematically evaluate protection effectiveness, we introduce a Video-LLM-assisted evaluation protocol that provides interpretable, frame-grounded analyses of generation artifacts and inconsistencies. Experiments on two representative I2V architectures demonstrate that our method achieves strong protection performance while improving efficiency and cross-model transferability.