Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filters

Ahmed B Mustafa; Zihan Ye; Yang Lu; Michael P Pound; Shreyank N Gowda

cs.CVApr 2, 2026

Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filters

Authors: Ahmed B Mustafa, Zihan Ye, Yang Lu, Michael P Pound, Shreyank N Gowda

Organizations: School of Computer Science, University of Nottingham, Wollaton Road, NG8 1BB · Department of Intelligent Science, Xi’an Jiaotong-Liverpool University, China, 215123 · School of Informatics, Xiamen University, Xiamen, 361005, China

Abstract

Text-to-image generative models are widely deployed in creative tools and online platforms. To mitigate misuse, these systems rely on safety filters and moderation pipelines that aim to block harmful or policy violating content. In this work we show that modern text-to-image models remain vulnerable to low-effort jailbreak attacks that require only natural language prompts. We present a systematic study of prompt-based strategies that bypass safety filters without model access, optimization, or adversarial training. We introduce a taxonomy of visual jailbreak techniques including artistic reframing, material substitution, pseudo-educational framing, lifestyle aesthetic camouflage, and ambiguous action substitution. These strategies exploit weaknesses in prompt moderation and visual safety filtering by masking unsafe intent within benign semantic contexts. We evaluate these attacks across several state-of-the-art text-to-image systems and demonstrate that simple linguistic modifications can reliably evade existing safeguards and produce restricted imagery. Our findings highlight a critical gap between surface-level prompt filtering and the semantic understanding required to detect adversarial intent in generative media systems. Across all tested models and attack categories we observe an attack success rate (ASR) of up to 74.47%.

Figures & tables

Figure 1: Illustration of low-effort prompt-based jailbreak attacks on text-to-image systems. Direct requests for unsafe content are typically blocked by safety filters, but simple prompt modifications can bypass moderation and produce restricted imagery. These attacks require no model access or technical expertise, highlighting the accessibility of jailbreak strategies in modern generative media systems.

Figure 2: Illustration of a typical moderation pipeline in text-to-image systems. Safety mechanisms are applied at multiple stages, including prompt filtering, semantic validation, image generation, and post-generation visual moderation.

Model	Method	SC		Q16		MHSC		AVG.
		ASR-4	ASR-1	ASR-4	ASR-1	ASR-4	ASR-1	ASR-4	ASR-1
SDv1.5	QF-Attack	27.88	12.55	26.57	10.94	19.68	7.58	24.71	10.36
	SneakyPrompt	44.82	24.80	35.18	19.06	33.68	16.81	37.89	20.22
	Ring-A-Bell	58.05	35.80	51.75	33.58	41.79	19.97	50.53	29.78
	UnlearnDiffAtk	75.03	58.26	74.22	55.29	70.57	51.33	73.27	54.96
	MMA-Diffusion	79.14	61.30	78.38	58.36	75.77	55.48	77.76	58.38

Table 1: Comparison of attack success rates (ASR) across different methods on SDv1.5 under multiple safety checkers.

Figure 3: Examples of images generated using Artistic Reframing Attacks (ARA), where unsafe content is embedded within artistic or historical contexts.

Figure 4: Examples of images generated using Lifestyle Subculture Aesthetic Attacks (LSAA), where unsafe elements are masked within stylistically rich prompts.

Figure 5: Examples of images generated using Pseudo-Educational Framing Attacks (PEFA), where unsafe content is presented in instructional or scientific formats.

Figure 6: Examples of images generated using Material Substitution Attacks (MSA), where benign material descriptors are used to bypass prompt filtering.

Figure 7: Examples of images generated using Ambiguous Action Substitution Attacks (AASA), where unsafe actions are embedded within benign narrative contexts.

Model	ARA	LSAA	PEFA	MSA	AASA
Gemini	62.00	50.67	50.00	71.33	59.33
SORA	66.67	49.33	54.67	74.00	62.33
Grok	69.33	54.00	56.67	73.67	63.00
Qwen	59.67	51.33	52.00	69.33	58.67

Table 2: Attack success rate (ASR) of the proposed prompt-based jailbreak strategies across different text-to-image models. ARA denotes Artistic Reframing Attack, LSAA denotes Lifestyle Subculture Aesthetic Attack, PEFA denotes Pseudo-Educational Framing Attack, MSA denotes Material Substitution Attack, and AASA denotes Ambiguous Action Substitution Attack.

Adversarial Attacks on VLMs

Adversarial attacks on vision-language models exploit images, text, and multimodal interactions to manipulate outputs, bypass safety, or degrade reliability.

See all 182 papers

Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems
Aug 2, 2026Wanguang Li, Zhaoxin Wang, Handing WangAdversarial Prompt Generation T2I Generation
School of Artificial Intelligence, Xidian University, Shaanxi, China
Dynamic Defense Profiling Enables Cognitive Jailbreak of Text-to-Image Models
Jul 20, 2026Dongdong Yang, Deyue Zhang, Zhao Liu +5Adversarial Prompt Generation Adversarial Examples
AI Security Lab, Beijing, China · School of Artificial Intelligence, Beihang University, Beijing, China
Jailbreaking Text-to-Image Models Through Cracks: Navigating Heterogeneous Safety Filters via Multi-Agent Debate
Sep 1, 2026Kaiyan Wen, Shijie Zhang, Lu Yu +1Adversarial Attacks on VLMs Multi-Agent Debate
College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China · Shenzhen MSU-BIT University, Shenzhen, China · City University of Hong Kong, Hong Kong, China

Aug 2, 2026J/K move · Enter open · S save

Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems

Wanguang Li, Zhaoxin Wang, Handing Wang

School of Artificial Intelligence, Xidian University, Shaanxi, China

Adversarial Prompt Generation T2I Generation Safety Filtering Multimodal Jailbreak Attacks Transfer-Based Adversarial Attacks Black-Box Adversarial Attacks

Open paper AskPDF arXiv

Text-to-image (T2I) systems typically have prompt-level safety filters before the generator to block unsafe requests, yet such systems remain vulnerable to malicious jailbreak prompts. Transfer-based attacks construct adversarial prompts offline without querying the target, but they tend to overfit to a single surrogate. Moreover, they explore a large search space in which semantic or perceptual similarity alone cannot guarantee both filter evasion and preservation of the unsafe generation intent, wasting effort on low-potential candidates. We observe that the filter and the generator process the same prompt under different objectives and representations, and term this gap the Filter-Generator Discrepancy (FGD), which allows a perturbation to reduce a prompt's perceived risk to the filter while preserving the visual concept needed by the generator. Building on FGD, we propose a zero-query jailbreak framework that screens perturbations into a high-potential candidate set via observable discrepancy rules at the tokenization and semantic stages, and then performs a surrogate-ensemble evolutionary search that requires no access to the target. Experiments on six black-box pipelines and a commercial online service show that our method consistently outperforms representative baselines, raising the average attack success rate to 29.2% (MHSC) and 33.3% (Q16) across the six pipelines and improving over the strongest baseline by about 8 and 12 percentage points, respectively.

Abstract

Adversarial Attacks on VLMs

Explore similar work

Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems

Dynamic Defense Profiling Enables Cognitive Jailbreak of Text-to-Image Models

Jailbreaking Text-to-Image Models Through Cracks: Navigating Heterogeneous Safety Filters via Multi-Agent Debate