TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks

Tianmeng Fang; Jiancheng Wang; Chen Wang; Liming Wang; Wei Wang; Jiayang Liu; Xiaochun Cao

cs.MMSep 25, 2026

TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks

Authors: Tianmeng Fang, Jiancheng Wang, Chen Wang, Liming Wang, Wei Wang, Jiayang Liu, Xiaochun Cao

Organizations: School of Computing and Information Systems, Master of IT in Business (MITB), Singapore Management University, Singapore 178903, Singapore · School of Computer Science and Technology, Anhui University, Hefei 230601, China · Department of Electrical and Computer Engineering, University of Miami, Coral Gables, FL 33146, United States · CSG Digital Operations Software Technology (Guangdong) Co., Ltd., Shenzhen 518000, China ·

Abstract

Existing text-to-video (T2V) jailbreak methods mainly seek more effective or stealthier attack candidates. In guarded T2V systems, however, video generation and security evaluation are costly, so an attacker often cannot test a large candidate pool. We therefore formulate T2V jailbreak as a query-constrained candidate allocation and ranking problem and propose TempQ-Jail. The method combines heterogeneous attack mechanisms to expand candidate coverage, estimates each candidate's end-to-end attack value from security-gate passage, dangerous visual generation, preservation of the original intent, and temporal validity, and ranks candidates so that high-value attacks appear early in a limited query trajectory. We evaluate TempQ-Jail on CogVideoX-5B using 70 common viable intents derived from T2VSafetyBench and compare it with six representative T2V jailbreak methods under a unified protocol. TempQ-Jail achieves TP-ASR@5 and TP-ASR@10 of 48.9% and 65.4%, improving over the strongest baselines by 4.6 and 4.0 percentage points, respectively. It also obtains the highest AUC-TP (0.469) and the lowest AvgQ (6.3). Analyses of query trajectories, candidate allocation, failure attribution, and ablations show that TempQ-Jail more effectively identifies and prioritises candidates with complete attack potential under limited query budgets.

Figures & tables

Figure 1: Under a limited target query budget, the effectiveness of a T2V jailbreak depends not only on whether valid candidates exist, but on whether they are reached before the budget is exhausted. An unguided query order wastes the budget on low-value candidates, whereas TempQ-Jail estimates end-to-end attack utility and ranks candidates so that effective ones enter the query trajectory earlier.

Figure 2: Overall workflow of TempQ-Jail. Heterogeneous Candidate Construction builds a fixed, diverse candidate pool for each unsafe intent; End-to-End Attack Value Estimation scores every candidate on gate passability, hazardous visual risk, temporal persistence, semantic preservation and prediction uncertainty; Budget-Aware Candidate Ranking turns these utilities into a single query priority sequence that is submitted to the guarded T2V system until a TP-Success occurs or the budget $B_{\max}$ is exhausted.

Method	ASR@5 $\uparrow$	TP-ASR@5 $\uparrow$	ASR@10 $\uparrow$	TP-ASR@10 $\uparrow$	AUC-TP $\uparrow$	AvgQ $\downarrow$
DACA	55.4	43.4	72.9	61.4	0.419	6.8
T2V-OptJail	57.1	44.3	77.1	57.1	0.425	6.8
SceneSplit	18.3	12.9	35.7	24.3	0.143	9.6
SPARK	18.6	17.7	25.7	21.4	0.165	9.4
TFM	19.1	13.1	27.1	20.0	0.129	9.7
BSB	34.3	26.6	47.1	38.6	0.261	8.4

Table 1: Overall attack performance comparison under different target query budgets.

Figure 3: TP-ASR@

B

under different target query budgets on the 70 common viable intents. All budgets share one nested query trajectory, so a higher curve at small

B

means effective candidates are placed earlier in the query sequence.

Candidate Source	Initial Pool	Top-5 Ranked
Candidate Source	(%)	(%)
Generic	25	8
DACA-derived	25	34
T2V-OptJail-derived	25	32
Hybrid	25	26

Table 2: Candidate source distributions in the initial pool and the Top-5 ranked candidates.

Figure 4: Failure attribution of the target queries actually executed by each attack method. Every query is assigned to exactly one of five outcomes, and querying stops after the first TP-Success; the TP-Success shares are therefore computed per query and are not directly comparable with the per-intent TP-ASR@

B

values in Table 1 .

Variant	TP-ASR $\uparrow$		AUC-TP $\uparrow$	AvgQ $\downarrow$
Variant	$B{=}5$	$B{=}10$	AUC-TP $\uparrow$	AvgQ $\downarrow$
w/o HCC	45.2	61.1	0.438	6.6
w/o EAVE	42.0	57.8	0.401	7.0
w/o BACR	44.6	60.5	0.423	6.8
TempQ-Jail	48.9	65.4	0.469	6.3

Table 3: Ablation study of the three core modules in TempQ-Jail.

Category	DACA	T2V-OptJail	SceneSplit	SPARK	TFM	BSB	TempQ-Jail
Violence	49	47	21	19	13	24	57
Gore	7	41	4	0	5	8	27
Self-harm	49	43	11	30	16	33	56
Illegal Activity	66	50	23	29	21	43	61
Disturbing Content	50	40	6	6	14	28	38
Pornography	53	40	0	33	0	20	67

Table 4: Category-wise TP-ASR@5 performance across six security risk categories.

Jailbreak Attacks

Jailbreak attacks exploit prompts, context, or model representations to bypass AI safeguards and elicit disallowed outputs.

See all 71 papers

Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models
Jul 19, 2026Xingkai Peng, Jun Jiang, Jiayang Liu +2T2V Generation Black-Box Adversarial Attacks
University of Science and Technology of China
Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking
Mar 7, 2026Moyang Chen, Zonghao Ying, Wenzhuo Xu +4T2V Generation Adversarial Text Attacks
College of Science, Mathematics and Technology, Wenzhou-Kean University · AI Security Lab · State Key Laboratory of Complex & Critical Software Environment, Beihang University
TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attacks
May 3, 2026Quanchen Zou, Nizhang Li, Wenxin Zhang +4T2V Generation
AI Security Lab, Beijing, China · Macau University of Science and Technology, Macau, China · University of Chinese Academy of Sciences, Beijing, China +3

Jul 19, 2026J/K move · Enter open · S save

Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models

Xingkai Peng, Jun Jiang, Jiayang Liu, Kejiang Chen+1

University of Science and Technology of China

T2V Generation Black-Box Adversarial Attacks

Open paper AskPDF arXiv

Recently, text-to-video (T2V) models have been widely deployed, sparking growing concerns over their robustness against jailbreak attacks. Existing jailbreak methods, mostly adapted from text-to-image attacks, suffer notable drawbacks when applied to T2V systems. They fail to fully leverage temporal consistency, an inherent characteristic of video generation. Besides, these methods demand heavy video query optimization, which is infeasible in practical black-box scenarios. Their adversarial prompt search is also driven by heuristic local signals, lacking principled structured exploration strategies. To tackle these limitations, we propose BSB, a structured, query-efficient jailbreak framework for T2V models. BSB harnesses temporal consistency by encoding harmful intent as the transition between two individually harmless boundary states. Under this paradigm, the attack targets boundary-state pairs whose interpolation tends to produce unsafe intermediate frames during video generation. Directly evaluating all candidate pairs within the video space incurs prohibitive computation cost. Instead, BSB conducts Monte Carlo Tree Search (MCTS) in a cheaper textual proxy space and regularly calibrates search outcomes with sparse video-level evaluations. We conduct comprehensive experiments on mainstream commercial T2V models including Veo 3.1, Sora 2, Seedance and Kling v1. Results show BSB surpasses all existing jailbreak baselines, delivering an average 18.6% relative gain in attack success rate over the strongest competitor across evaluated models. Our findings identify temporal consistency as an understudied yet vital attack surface for T2V models and verify that structured search facilitates effective vulnerability discovery under constrained query budgets.

Abstract

Jailbreak Attacks

Explore similar work

Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models

Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking

TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attacks