Research map / Image generation / Text-to-image diffusion
Perception-Guided Jailbreak Against Text-to-Image Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PGJ, a model-free black-box jailbreak that uses an LLM to swap unsafe words in T2I prompts with perceptually similar but semantically safe phrases, bypassing text pre-checkers of commercial and open T2I models.
Problem
Text-to-image models' text safety checkers block NSFW prompts; existing jailbreaks either produce nonsensical adversarial tokens (white-box transfer) or require many queries to the target T2I model, making them unnatural or slow.
Approach
Find a safe phrase that is similar to the unsafe word in human visual perception but inconsistent in text semantics (the PSTSI principle), using an LLM with a carefully designed instruction that explains visual similarity with examples, and substitute it into the prompt without querying the T2I model.
Key results
- PGJ achieves average ASR of 0.915 across six T2I models versus DACA's 0.66, with ASR of 0.89 on DALL·E 2 and 1.00 on SDXL and Hunyuan.
- PGJ takes 5.51 seconds per prompt, versus 65.47 s for DACA, 278 s for SneakyPrompt, and 1809.66 s for MMA-Diffusion.
- PGJ attack prompts keep perplexity around 200, and GPT-4o detects only 43.8% of rewritten prompts as unsafe versus 12.2% of original prompts.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use PGJ instead of the strongest listed baseline, MMA-Diffusion | DALL·E 2 jailbreak · DALL·E 2 | ASR: 0.59 -> 0.89 | Helped |
| Use PGJ instead of DACA | DALL·E 3 jailbreak · DALL·E 3 | ASR: 0.84 -> 0.72 | Hurt |
| Use PGJ instead of DACA | Tongyiwanxiang jailbreak · Tongyiwanxiang | ASR: 0.98 -> 0.95 | Hurt |
| Use PGJ instead of MMA-Diffusion | SDXL jailbreak · SDXL | ASR: 1.00 -> 1.00 | No clear effect |
| Use PGJ instead of MMA-Diffusion | Hunyuan jailbreak · Hunyuan | ASR: 0.93 -> 1.00 | Helped |
| Use PGJ instead of MMA-Diffusion | Cogview3 jailbreak · Cogview3 | ASR: 0.85 -> 0.93 | Helped |
| Use PGJ rather than DACA to process prompts | T2I jailbreak methods · 100 prompts, five NSFW types | time (s): 65.47 -> 5.51 | Helped |
| Change the LLM used for unsafe-word selection and substitution among GPT3.5, GPT4o, and Tongyiqianwen (ablation) | PGJ on DALL·E 3 · discrimination, illegal, pornographic, privacy, and violent prompts | ASR: 0.830, 0.910, 0.890; 0.980, 0.980, 0.980; 0.485, 0.605, 0.795; 0.910, 0.905, 0.970; 0.645, 0.780, 0.855 | Mixed |
Surprising findings
- Naive instruction asking LLMs for visually similar but semantically different words yields orthographic matches (e.g., 'violet' for 'violent'), so explicit concept explanation and examples were required.
- Adding safe phrases to pre-checker unsafe word lists would break benign prompts, so the attack is hard to defend by simple list updates.
Limitations
- Only bypasses the text pre-checker; post-checker (image filter) is not targeted.
- Pornographic NSFW type has lower ASR on DALL·E 2 and DALL·E 3.
- Comparison with baselines uses only 100 prompts because baselines are slow.
Experimental setup
Datasets: GPT-4-generated NSFW prompts (1,000 prompts, five NSFW types)
Benchmarks: GPT-4-generated NSFW prompt set (1,000 prompts)
Metrics: attack success rate semantic consistency inception score prompt perplexity time per prompt
Baselines: SneakyPrompt MMA-Diffusion DACA Ring-a-Bell
Builds on: SneakyPrompt MMA-Diffusion DACA Ring-A-Bell
Closest papers by meaning
- T2V-OptJail: Discrete Prompt Optimization for Text-to-Video Jailbreak Attacks (NeurIPS 2025 · similarity 0.88)
- Jailbreaking Vision-Language Models Through the Visual Modality (ICML 2026 · similarity 0.88)
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.88)
- Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.88)
- ColJailBreak: Collaborative Generation and Editing for Jailbreaking Text-to-Image Deep Generation (NeurIPS 2024 · similarity 0.88)
- SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism (NeurIPS 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.