VII: Visual Instruction Injection for Jailbreaking Image-to-Video Generation Models

Bowen Zheng; Yongli Xiang; Ziming Hong; Zerong Lin; Chaojian Yu; Tongliang Liu; Xinge You

cs.CVFeb 24, 2026

VII: Visual Instruction Injection for Jailbreaking Image-to-Video Generation Models

Authors: Bowen Zheng, Yongli Xiang, Ziming Hong, Zerong Lin, Chaojian Yu, Tongliang Liu, Xinge You

Organizations: National Anti-Counterfeit Engineering Research Center, Huazhong University of Science and Technology · School of Electronic Information and Communications, Huazhong University of Science and Technology · Sydney AI Centre, The University of Sydney

Abstract

Image-to-Video (I2V) generation models, which condition video generation on reference images, have shown emerging visual instruction-following capability, allowing certain visual cues in reference images to act as implicit control signals for video generation. However, this capability also introduces a previously overlooked risk: adversaries may exploit visual instructions to inject malicious intent through the image modality. In this work, we uncover this risk by proposing Visual Instruction Injection (VII), a training-free and transferable jailbreaking framework that intentionally disguises the malicious intent of unsafe text prompts as benign visual instructions in the safe reference image. Specifically, VII coordinates a Malicious Intent Reprogramming module to distill malicious intent from unsafe text prompts while minimizing their static harmfulness, and a Visual Instruction Grounding module to ground the distilled intent onto a safe input image by rendering visual instructions that preserve semantic consistency with the original unsafe text prompt, thereby inducing harmful content during I2V generation. Empirically, our extensive experiments on four state-of-the-art commercial I2V models (Kling-v2.5-turbo, Gemini Veo-3.1, Seedance-1.5-pro, and PixVerse-V5) demonstrate that VII achieves Attack Success Rates of up to 83.5% while reducing Refusal Rates to near zero, significantly outperforming existing baselines.

Figures & tables

Figure 1: I2V model equipped with multi-modal safety mechanisms (e.g., visual and text-based safeguards) typically refuses or generates only safe content when (a): a safe image is paired with an unsafe text prompt, or (b): an unsafe image is paired with any text prompt. (c) The proposed VII successfully bypass multi-modal safety mechanisms and induces unsafe video generation.

Figure 2: The framework of Visual Instruction Injection (VII). (a) Malicious Intention Reprogramming (MIR): distilling unsafe prompts into benign synonyms and reprogramming them into executable typographic descriptions. (b) Visual Instruction Grounding (VIG): grounding the distilled intent onto the safe image by rendering auxiliary visual symbols and embedding typographic descriptions. (c) I2V Generation: the I2V model interprets the visual instructions and dynamically reconstructs the malicious content.

Dataset	Eval	Method	Metric	Kling-v2.5-turbo					Seedance-1.5-pro					Veo-3.1					PixVerse-V5
Dataset	Eval	Method	Metric	Sex	Vio	Hat	Ill	Avg	Sex	Vio	Hat	Ill	Avg	Sex	Vio	Hat	Ill	Avg	Sex	Vio	Hat	Ill	Avg
COCO-I2VSafetyBench	VBench++	Unsafe Text Prompt	ASR ( $\uparrow$ )	22.0	70.0	28.0	24.0	36.0	26.0	68.0	28.0	16.0	34.5	0.0	64.0	12.0	22.0	24.5	6.0	70.0	22.0	18.0	29.0
		Unsafe Text Prompt	RR ( $\downarrow$ )	6.0	2.0	0.0	4.0	3.0	16.0	6.0	10.0	12.0	11.0	100.0	30.0	76.0	22.0	57.0	80.0	0.0	0.0	40.0	30.0
		Typographic Attack	ASR ( $\uparrow$ )	38.0	68.0	38.0	24.0	42.0	30.0	66.0	36.0	26.0	39.5	0.0	60.0	52.0	48.0	40.0	30.0	74.0	26.0	22.0	38.0
		Typographic Attack	RR ( $\downarrow$ )	6.0	0.0	0.0	0.0	1.5	14.0	16.0	22.0	8.0	15.0	100.0	26.0	34.0	18.0	44.5	0.0	0.0	0.0	0.0	0.0
		VII (Ours)	ASR ( $\uparrow$ )	66.0	90.0	88.0	82.0	81.5	40.0	74.0	50.0	40.0	51.0	14.0	86.0	62.0	50.0	53.0	80.0	92.0	90.0	72.0	83.5

Table 1: We compare our VII method with baselines the COCO-I2VSafetyBench and ConceptRisk datasets across four I2V models. Purple text indicates ASR (higher is better), black text indicates RR (lower is better). Purple columns highlight the method with the highest ASR in each category within its respective dataset.

Figure 3: Visualization of generated videos. Our proposed VII method successfully jailbreaks the I2V models and produces harmful videos, whereas the Unsafe Text Prompt attack fails to jailbreak, resulting in benign generations.

Method	Metric	Kling	Seedance	Veo	PixVerse
Dataset: COCO-I2VSafetyBench
Unsafe Text Prompt	$\text{CLIP}_{\text{p2c}}$ ( $\uparrow$ )	0.5397	0.4872	0.2402	0.3898
Unsafe Text Prompt	$\text{CLIP}_{\text{p2i}}$ ( $\uparrow$ )	0.2508	0.2252	0.1011	0.1708
Typographic Attack	$\text{CLIP}_{\text{p2c}}$ ( $\uparrow$ )	0.5571	0.4899	0.3273	0.5556
Typographic Attack	$\text{CLIP}_{\text{p2i}}$ ( $\uparrow$ )	0.2553	0.2285	0.1381	0.2596
VII (Ours)	$\text{CLIP}_{\text{p2c}}$ ( $\uparrow$ )	0.5679	0.5539	0.4415	0.5692

Table 2: Quantitative results for semantic consistency. Purple backgrounds highlight the best.

Eval	Method	Metric	Kling-v2.5-turbo					Seedance-1.5-pro					Veo-3.1					PixVerse-V5
Eval	Method	Metric	Sex	Vio	Hat	Ill	Avg	Sex	Vio	Hat	Ill	Avg	Sex	Vio	Hat	Ill	Avg	Sex	Vio	Hat	Ill	Avg
VBench++	VII w/o typography description	ASR ( $\uparrow$ )	46.0	78.0	70.0	54.0	62.0	32.0	76.0	44.0	36.0	47.0	4.0	60.0	40.0	52.0	39.0	48.0	80.0	52.0	44.0	56.0
	VII w/o typography description	RR ( $\downarrow$ )	8.0	0.0	0.0	0.0	2.0	12.0	10.0	18.0	4.0	11.0	94.0	32.0	48.0	16.0	47.5	12.0	0.0	6.0	0.0	4.5
	VII w/o visual symbols	ASR ( $\uparrow$ )	24.0	68.0	40.0	20.0	38.0	16.0	68.0	22.0	14.0	30.0	0.0	50.0	16.0	20.0	21.5	16.0	62.0	38.0	14.0	32.5
	VII w/o visual symbols	RR ( $\downarrow$ )	4.0	0.0	0.0	0.0	1.0	12.0	8.0	16.0	8.0	11.0	92.0	36.0	60.0	16.0	51.0	12.0	0.0	6.0	0.0	4.5
	VII (Ours)	ASR ( $\uparrow$ )	66.0	90.0	88.0	82.0	81.5	40.0	74.0	50.0	40.0	51.0	14.0	86.0	62.0	50.0	53.0	80.0	92.0	90.0	72.0	83.5

Table 3: We investigate the impact of typographic descriptions and visual symbols on the COCO-I2VSafetyBench. Purple text indicates ASR, black text indicates RR. Pink columns highlight the best result (highest ASR).

Panel of Figure 4 — Figure 4: Hyperparameter analysis on Kling-v2.5-turbo (top row) and PixVerse-V5 (bottom row). Left column (language): Comparison of VII-EN (English), VII-CN (Chinese), and VII-JP (Japanese). Middle column (font): Comparison of VII-Arial, VII-Times (Times New Roman), and VII-Courier (Courier New). Right column (position): Comparison of VII-Border (Border Padding) and VII-Inner (Inner Inpainting). Visualizations of VII generated images under various configurations are in Appendix F .

Panel of Figure 5 — Figure 5: Prefix-based defense.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 6 — Figure 6: COCO-I2VSafetyBench: Harmful Behavior List. For each harmful category, there are 20 candidate harmful behaviors.

Panel of Figure 7 — Figure 7: COCO-I2VSafetyBench: Harmful Video Prompt Generation Template. Given an input image and its original caption, we use an LLM to synthesize a harmful video prompt by rewriting the caption under the guidance of the harmful behavior library.

Figure 8: Examples of COCO-I2VSafetyBench. Italic gray text indicates the harmful components embedded in the prompts.

Panel of Figure 9 — Figure 9: Comparison between VII (full and variants) and baselines. Left: Sexual Content; Right: Violence and Threat. Each row shows representative key frames sampled from the generated videos for (a) Unsafe Text Prompt, (b) Typographic Attack, (c) VII w/o Typograpy, (d) VII w/o Visual Instr., and (e) full VII.

Panel of Figure 10 — Figure 10: Sexual Content on COCO-I2VSafetyBench.

Panel of Figure 12 — Figure 12: Violence and Threat on COCO-I2VSafetyBench.

Panel of Figure 14 — Figure 14: Hate and Extremism on COCO-I2VSafetyBench.

Panel of Figure 16 — Figure 16: Illegal Activity on COCO-I2VSafetyBench.

Panel of Figure 18 — Figure 18: Visual comparison of typographic descriptions across different languages. The structural symbols remain consistent while the semantic directives are successfully localized.

Panel of Figure 19 — Figure 19: Visual comparison of adversarial images rendered with different font types.

Panel of Figure 20 — Figure 20: Visual comparison of instruction placement strategies. Border padding explicitly isolates the instructions, avoiding visual occlusion on the safe image.

Prompt Injection

Prompt injection is the manipulation of language-model instructions through untrusted text, images, or tool outputs to redirect model behavior.

See all 15 papers

TempJail: Temporal Jailbreak Attacks against Image-to-Video Generation Models
Aug 27, 2026Qi Lu, Zehui Guo, David Yuanda Gan +4Jailbreak Attacks Image-to-Video Generation
School of Cyber Science and Engineering, Huazhong University of Science and Technology · School of Mathematical Sciences, Peking University · School of Software and engineering, Huazhong University of Science and Technology +1
VPA-Guard: Defending and Benchmarking Image-to-Video Generation Against Visual Prompt Attacks
Jun 24, 2026Yining Sun, Haoyu Kang, Jiajun Wu +7Image-to-Video Generation Video Generation
1Tsinghua University · 3Central South University · 4South China Normal University +3
Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation
Jul 1, 2026Yeonghwan Song, Chanhui Lee, Jinsoo Park +1Image-to-Video Generation Adversarial Examples
GIST · POSTECH

Aug 27, 2026J/K move · Enter open · S save

TempJail: Temporal Jailbreak Attacks against Image-to-Video Generation Models

Qi Lu, Zehui Guo, David Yuanda Gan, Zijing Li+3

School of Cyber Science and Engineering, Huazhong University of Science and Technology · School of Mathematical Sciences, Peking University · School of Software and engineering, Huazhong University of Science and Technology+1

Jailbreak Attacks Image-to-Video Generation Video Diffusion Models

Open paper AskPDF arXiv

In recent years, image-to-video (I2V) generation models have made remarkable progress in subject consistency and temporal coherence, enabling high quality video synthesis. However, these advances also introduce new safety risks. Existing studies mainly focus on jailbreak attacks involving single frame violations, while largely overlooking the temporal dimension unique to video generation models. In this paper, we investigate three attack scenarios and uncover a temporal vulnerability in I2V systems: unsafe semantics may emerge not from a single frame, but from semantic composition over time. We further identify two key challenges in such attacks: temporal abstraction and semantic camouflage. To address these issues, we propose TempJail, a novel temporal jailbreak framework for I2V systems. For temporal abstraction, we decompose a target malicious caption into an initial frame visual condition and a temporal text instruction. For semantic camouflage, on the image side we model semantic injection as controlled latent perturbation in diffusion sampling and introduce gradient guidance from pretrained encoders. On the text side, we rewrite the caption into an innocuous ``subject-action-scene'' template that bypasses safety filters while preserving temporal guidance. In the black-box inference phase, these two modalities jointly enable malicious semantics to be gradually triggered over time. Experiments on closed-source commercial models, including Kling, Seedance, Veo and PixVerse, show that TempJail improves attack success rate over prior state-of-the-art methods by 23.3% under GPT-5.2 evaluation and 22.0% under human evaluation. Our codes are available at GitHub.

Abstract

Prompt Injection

Explore similar work

TempJail: Temporal Jailbreak Attacks against Image-to-Video Generation Models

VPA-Guard: Defending and Benchmarking Image-to-Video Generation Against Visual Prompt Attacks

Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation