T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Models
On the map: LLM safety and security → Vision-language and text-to-image safety
Abstract (arXiv)
The rapid development of generative artificial intelligence has made text to video models essential for building future multimodal world simulators. However, these models remain vulnerable to jailbreak attacks, where specially crafted prompts bypass safety mechanisms and lead to the generation of harmful or unsafe content. Such vulnerabilities undermine the reliability and security of simulation based applications. In this paper, we propose T2VShield, a comprehensive and model agnostic defense framework designed to protect text to video models from jailbreak threats. Our method systematically analyzes the input, model, and output stages to identify the limitations of existing defenses, including semantic ambiguities in prompts, difficulties in detecting malicious content in dynamic video outputs, and inflexible model centric mitigation strategies. T2VShield introduces a prompt rewriting mechanism based on reasoning and multimodal retrieval to sanitize malicious inputs, along with a multi scope detection module that captures local and global inconsistencies across time and modalities. The framework does not require access to internal model parameters and works with both open and closed source systems. Extensive experiments on five platforms show that T2VShield can reduce jailbreak success rates by up to 35 percent compared to strong baselines. We further develop a human centered audiovisual evaluation protocol to assess perceptual safety, emphasizing the importance of visual level defense in enhancing the trustworthiness of next generation multimodal simulators.
Key facts. Cited by 18 papers in the map (data through 14 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 49 of its 69 references that are in the map. First posted on arXiv 22 Apr 2025.
Builds on
49 of 69 references.
Closest ancestors · 5
Same direction, newest first
- 2024SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generation16 Oct
- 2024DiffZOO: A Purely Query-Based Black-Box Attack for Red-teaming Text-to-Image Generative Model via Zeroth Order Optimization18 Aug
- 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
- 2024Jailbreaking Attack against Multimodal Large Language Model4 Feb
- 2023SneakyPrompt: Jailbreaking Text-to-image Generative Models20 May
Other references · 44
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
- 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
- 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
- 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,893
- 2024Qwen2.5 Technical Reportcited by 4,942
- 2023Stable Video Diffusion: Scaling Latent Video Diffusion Models to Large Datasetscited by 2,581
- 2022Video Diffusion Modelscited by 2,305
- 2024CogVideoX: Text-to-Video Diffusion Models with An Expert Transformercited by 2,261
- 2022Make-A-Video: Text-to-Video Generation without Text-Video Datacited by 1,742
- 2024HunyuanVideo: A Systematic Framework For Large Video Generative Modelscited by 1,660
- 2022Tune-A-Video: One-Shot Tuning of Image Diffusion Models for Text-to-Video Generationcited by 961
- 2024WorldSimBench: Towards Video Generation Models as World Simulatorscited by 881
32 more
- 2024Open-Sora: Democratizing Efficient Video Production for Allcited by 652
- 2024LLaVA-NeXT-Interleave: Tackling Multi-image, Video, and 3D in Large Multimodal Modelscited by 584
- 2023VideoCrafter1: Open Diffusion Models for High-Quality Video Generationcited by 535
- 2023VideoPoet: A Large Language Model for Zero-Shot Video Generationcited by 492
- 2023Show-1: Marrying Pixel and Latent Diffusion Models for Text-to-Video Generationcited by 302
- 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
- 2024MA-LMM: Memory-Augmented Large Multimodal Model for Long-Term Video Understandingcited by 229
- 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 194
- 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attackscited by 145
- 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
- 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 115
- 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
- 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Modelscited by 106
- 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMscited by 95
- 2023MusicLDM: Enhancing Novelty in Text-to-Music Generation Using Beat-Synchronous Mixup Strategiescited by 94
- 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 87
- 2024Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Modelscited by 86
- 2024SafeBench: A Safety Evaluation Framework for Multimodal Large Language Modelscited by 69
- 2024Evaluation of Text-to-Video Generation Models: A Dynamics Perspectivecited by 67
- 2024T2VSafetyBench: Evaluating the Safety of Text-to-Video Generative Modelscited by 66
- 2019Training Robust Deep Neural Networks via Adversarial Noise Propagationcited by 62
- 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 59
- 2024T2V-Turbo-v2: Enhancing Video Generation Model Post-Training through Data, Reward, and Conditional Guidance Designcited by 54
- 2024Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMscited by 53
- 2024VideoTetris: Towards Compositional Text-to-Video Generationcited by 51
- 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 39
- 2024SafeWatch: An Efficient Safety-Policy Following Video Guardrail Model with Transparent Explanationscited by 38
- 2024Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attackscited by 37
- 2024AttackEval: How to Evaluate the Effectiveness of Jailbreak Attacking on Large Language Modelscited by 28
- 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 28
- 2024From Sora What We Can See: A Survey of Text-to-Video Generationcited by 27
- 2022T2V-DDPM: Thermal to Visible Face Translation using Denoising Diffusion Probabilistic Modelscited by 17
Built on by
Citing papers per year: 2025: 9; 2026: 9.
18 papers.
Sort:
By area:
- 2025AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructionscited by 38
- 2025T2V-OptJail: Discrete Prompt Optimization for Text-to-Video Jailbreak Attackscited by 21
- 2025SafeMobile: Chain-level Jailbreak Detection and Automated Evaluation for Multimodal Mobile Agentscited by 15
- 2025Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editingcited by 10
- 2025Three Minds, One Legend: Jailbreak Large Reasoning Model with Adaptive Stacked Cipherscited by 8
- 2025SMA: Who Said That? Auditing Membership Leakage in Semi-Black-box RAG Controllingcited by 3
- 2025PromptSafe: Gated Prompt Tuning for Safe Text-to-Image Generationcited by 2
- 2025Towards Effective Prompt Stealing Attack against Text-to-Image Diffusion Modelscited by 2
- 2025SafeEditor: Unified MLLM for Efficient Post-hoc T2I Safety Editingcited by 2
- 2026Evolving Deception: When Agents Evolve, Deception Winscited by 2
- 2026Distillation Traps and Guards: A Calibration Knob for LLM Distillabilitycited by 1
- 2026TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attackscited by 1
6 more
- 2026VPA-Guard: Defending and Benchmarking Image-to-Video Generation Against Visual Prompt Attackscited by 1
- 2026SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreakscited by 1
- 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Modelscited by 0
- 2026SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defensecited by 0
- 2026A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalitiescited by 0
- 2026TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attackscited by 0
- 2026TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks25 Sep 2026
- 2026A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalities28 Aug 2026
- 2026SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense11 Aug 2026
- 2026SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks2 Aug 2026
- 2026VPA-Guard: Defending and Benchmarking Image-to-Video Generation Against Visual Prompt Attacks24 Jun 2026
- 2026TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attacks3 May 2026
- 2026Distillation Traps and Guards: A Calibration Knob for LLM Distillability21 Apr 2026
- 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Models6 Apr 2026
- 2026Evolving Deception: When Agents Evolve, Deception Wins6 Mar 2026
- 2025SafeEditor: Unified MLLM for Efficient Post-hoc T2I Safety Editing28 Oct 2025
- 2025Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editing24 Sep 2025
- 2025SMA: Who Said That? Auditing Membership Leakage in Semi-Black-box RAG Controlling12 Aug 2025
6 more
- 2025Towards Effective Prompt Stealing Attack against Text-to-Image Diffusion Models9 Aug 2025
- 2025PromptSafe: Gated Prompt Tuning for Safe Text-to-Image Generation2 Aug 2025
- 2025SafeMobile: Chain-level Jailbreak Detection and Automated Evaluation for Multimodal Mobile Agents1 Jul 2025
- 2025AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructions17 Jun 2025
- 2025Three Minds, One Legend: Jailbreak Large Reasoning Model with Adaptive Stacked Ciphers22 May 2025
- 2025T2V-OptJail: Discrete Prompt Optimization for Text-to-Video Jailbreak Attacks10 May 2025
- 2025SafeMobile: Chain-level Jailbreak Detection and Automated Evaluation for Multimodal Mobile Agentscited by 15
- 2025SafeEditor: Unified MLLM for Efficient Post-hoc T2I Safety Editingcited by 2
- 2026TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attackscited by 1
- 2026SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreakscited by 1
- 2026SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defensecited by 0
- 2026TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attackscited by 0
- 2026TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks25 Sep 2026
- 2026SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense11 Aug 2026
- 2026SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks2 Aug 2026
- 2026TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attacks3 May 2026
- 2025SafeEditor: Unified MLLM for Efficient Post-hoc T2I Safety Editing28 Oct 2025
- 2025SafeMobile: Chain-level Jailbreak Detection and Automated Evaluation for Multimodal Mobile Agents1 Jul 2025
- 2026Evolving Deception: When Agents Evolve, Deception Winscited by 2
- 2026Evolving Deception: When Agents Evolve, Deception Wins6 Mar 2026
Similar, not cited
Close in wording, no citation either way
- 2026Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking
- 2026Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models
- 2026TempJail: Temporal Jailbreak Attacks against Image-to-Video Generation Models
- 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey
- 2026SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs
- 2026TempJail: Temporal Jailbreak Attack against Large Vision-Language Models via Subtitle Scheduling
- 2026JANUS: A Lightweight Framework for Jailbreaking Text-to-Image Models via Distribution Optimization
- 2025SPARK: Jailbreaking T2V Models by Synergistically Prompting Auditory and Recontextualized Knowledge