Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking
This research highlights a critical, video-specific safety vulnerability in T2V models for developers and users, demonstrating how models can autonomously generate harmful content even with benign-looking prompts.
This paper identifies a temporal trajectory infilling vulnerability in text-to-video (T2V) models where specifying only start and end frames can lead to the generation of harmful intermediate frames. The proposed Two Frames Matter (TFM) framework exploits this by converting unsafe requests into temporally sparse two-frame extractions, achieving up to a 12% increase in attack success rate on commercial T2V systems.
Recent text-to-video (T2V) models can synthesize complex videos from lightweight natural language prompts, raising urgent concerns about safety alignment in the event of misuse in the real world. Prior jailbreak attacks typically rewrite unsafe prompts into paraphrases that evade content filters while preserving meaning. Yet, these approaches often still retain explicit sensitive cues in the input text and therefore overlook a more profound, video-specific weakness. In this paper, we identify a temporal trajectory infilling vulnerability of T2V systems under fragmented prompts: when the prompt specifies only sparse boundary conditions (e.g., start and end frames) and leaves the intermediate evolution underspecified, the model may autonomously reconstruct a plausible trajectory that includes harmful intermediate frames, despite the prompt appearing benign to input or output side filtering. Building on this observation, we propose TFM. This fragmented prompting framework converts an originally unsafe request into a temporally sparse two-frame extraction and further reduces overtly sensitive cues via implicit substitution. Extensive evaluations across multiple open-source and commercial T2V models demonstrate that TFM consistently enhances jailbreak effectiveness, achieving up to a 12% increase in attack success rate on commercial systems. Our findings highlight the need for temporally aware safety mechanisms that account for model-driven completion beyond prompt surface form.