🤖 AI

Jailbreaking on Text-to-Video Models via Scene Splitting Strategy

This paper introduces SceneSplit, a novel black-box jailbreak method that fragments harmful narratives into individually benign scenes to manipulate the generative output space of Text-to-Video models, achieving high attack success rates across multiple state-of-the-art systems and revealing critical vulnerabilities in their safety mechanisms.

Original authors: Wonjun Lee, Haon Park, Doehyeon Lee, Bumsub Ham, Suhyun Kim

Published 2026-05-20

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Wonjun Lee, Haon Park, Doehyeon Lee, Bumsub Ham, Suhyun Kim

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to sneak a dangerous object past a security guard at an airport. If you try to walk through the metal detector holding a giant, obvious sword, the alarm will go off immediately, and you'll be stopped. This is how current "Text-to-Video" AI models work: they have safety filters that scan your request (prompt) and block anything that looks like it could create harmful content, such as violence or nudity.

This paper introduces a clever trick called SceneSplit that bypasses these guards. Instead of trying to sneak the whole sword through at once, the attackers break the sword down into harmless-looking pieces, pass them through one by one, and then let the AI reassemble them into the dangerous object.

Here is how the method works, broken down into three simple steps:

1. The "Lego" Trick (Scene Splitting)

Imagine you want to generate a video of a violent fight. If you type "Two men fighting with knives," the AI's safety guard says, "No, that's dangerous," and blocks it.

SceneSplit takes that dangerous idea and chops it into 3 to 5 separate, tiny scenes that look completely innocent on their own:

Scene 1: "A man holding a shiny metal object." (Safe)
Scene 2: "A woman lying on a chair, looking relaxed." (Safe)
Scene 3: "A camera zooming in on a red liquid dripping onto the floor." (Safe)

Individually, none of these prompts trigger the alarm. They are like harmless Lego bricks. However, when the AI is told to play these scenes in order, it connects the dots. The "shiny object" becomes a knife, the "relaxed woman" becomes a victim, and the "red liquid" becomes blood. The combination forces the AI to create the violent video it was originally asked for, even though it never saw the dangerous words "fight" or "knife" in a single prompt.

2. The "Fine-Tuning" (Scene Manipulation)

Sometimes, even with the Lego bricks, the AI might still get confused and generate a safe video (like a man holding a spoon instead of a knife).

To fix this, the method uses a feedback loop. It looks at the video the AI made and asks, "Which specific scene caused the AI to get confused?" If the AI made a spoon instead of a knife, the system identifies that Scene 1 was too vague. It then asks a smart AI assistant to rewrite only that specific scene to be slightly more explicit, while keeping the other scenes the same. It keeps tweaking that one scene until the AI finally generates the harmful video, effectively "hunting" for the exact line where the safety filter fails.

3. The "Cheat Sheet" (Strategy Library)

Every time the researchers successfully trick the AI, they save the "recipe" they used. If they successfully broke a prompt about violence into 4 scenes using a specific type of wording, they save that pattern.

Next time they want to attack the AI with a different violent prompt, they look at their "Cheat Sheet." They see, "Oh, splitting it into 4 scenes worked last time," and they use that same strategy immediately. This makes the attack faster and more effective over time, as the system learns from its own successes.

What Did They Find?

The researchers tested this "Lego trick" on several major, commercial AI video generators (like Veo2, Hailuo, and Luma Ray2). They found that:

It works very well: The method successfully generated harmful videos about 77% to 84% of the time across different models.
Existing defenses are weak: The current safety filters are good at spotting obvious bad words, but they are terrible at understanding how a series of innocent-looking scenes can combine to tell a dangerous story.
The "Safety Gap": The paper concludes that while we have good guards for single sentences, we don't have good guards for sequences of events.

In short: The paper shows that you can trick video AI by breaking a bad idea into many small, good-looking pieces, letting the AI put them together, and then tweaking the pieces until the bad idea comes out. This reveals a significant hole in how we currently protect these AI systems.

Technical Summary: Jailbreaking Text-to-Video Models via Scene Splitting Strategy

Problem Statement

Recent advancements in Text-to-Video (T2V) models, such as Veo2, Luma Ray2, and Hailuo, have enabled the generation of high-quality, realistic videos from text prompts. However, these models face significant safety challenges, as they can be manipulated to generate illegal, unethical, or harmful content. While extensive research has explored jailbreak vulnerabilities in Large Language Models (LLMs), Vision Language Models (VLMs), and Text-to-Image (T2I) models, T2V models remain largely unexplored. Existing safety mechanisms often fail to address the unique vulnerabilities arising from the temporal nature of video generation, specifically the risk that individually benign events, when sequenced, can form a harmful narrative. This paper identifies a critical safety gap: the lack of robust defenses against attacks that exploit narrative structure and temporal sequencing in T2V models.

Methodology: SceneSplit

To address this gap, the authors propose SceneSplit, a novel black-box jailbreak method designed to bypass T2V safety filters. The core hypothesis is that safety filters are more likely to block prompts with high direct harmfulness. SceneSplit circumvents this by fragmenting a harmful narrative into a sequence of individually benign scenes. The method operates on the principle that while each individual scene corresponds to a wide, safe generative output space, their sequential combination acts as a powerful mutual constraint, narrowing the total output space to a region where the probability of generating a harmful video is high.

The methodology consists of three key components:

Scene Splitting:
- Process: A harmful prompt is transformed into a set of 2 to 5 procedural scenes.
- Techniques:
  - Scene Division: The narrative is broken down into a sequence of actions.
  - Paraphrasing: The language of each scene is rewritten to be more benign and less directly harmful, lowering the measurable harmfulness score of individual prompts.
- Mechanism: An LLM performs this transformation, optionally guided by a strategy retrieved from a library. The resulting set of scene prompts individually passes safety filters but collectively constrains the model to generate the original harmful intent.
Scene Manipulation:
- Purpose: To bypass post-processing visual safety filters if the initial split is insufficient or if the generated video is deemed safe.
- Process: This is an iterative process (inner loop) that modifies the prompt to search for an optimal attack point within the constrained generative space.
- Scene Selection: If a video is generated but deemed safe, a Video Understanding Model (VLM) analyzes the output to identify the "most influential scene"—the specific scene prompt whose visual representation most strongly correlates with the video's content. If the prompt is blocked by a filter, a scene is selected randomly.
- Iterative Modification: The LLM modifies only the selected influential scene based on feedback (e.g., safety reward scores). It performs a bi-directional search: making the expression more explicit if the attack was too weak, or more implicit if it was blocked. This continues for a set number of iterations ( $I$ ) to find a configuration that evades detection while maintaining the harmful narrative.
Strategy Update:
- Purpose: To enhance robustness and efficiency by reusing successful attack patterns (outer loop).
- Mechanism: A Strategy Library stores pairs of successful strategies and the embeddings of the original harmful prompts.
- Process: Before initiating a new attack, the system calculates the embedding of the current harmful prompt and compares it against the library. If a semantically similar past success is found (above a threshold $\lambda$ ), the corresponding splitting strategy is reused. Upon a successful attack, the new prompt sequence is summarized into a new strategy and added to the library. This allows the method to adapt to specific model vulnerabilities without manual intervention.

Key Contributions

The paper outlines three primary contributions:

Novel Methodology: The proposal of SceneSplit, the first black-box jailbreak method specifically designed for T2V models that leverages narrative fragmentation and scene splitting.
Vulnerability Identification: The identification of a specific vulnerability where the sequential combination of individually safe scene prompts constrains the T2V model's generative output space, forcing it to converge on a harmful narrative that bypasses standard safety filters.
Empirical Validation: Comprehensive experiments demonstrating that SceneSplit effectively bypasses safety filters across multiple commercial T2V models with high Attack Success Rates (ASR).

Experimental Results

The authors evaluated SceneSplit on 11 safety categories from the T2VSafetyBench across five commercial T2V models: Luma Ray2, Hailuo, Veo2, Kling V1.0, and Sora2.

Performance: SceneSplit achieved significantly higher ASRs compared to existing baselines (T2VSafetyBench and RPG-RT).
- Luma Ray2: 77.2% ASR
- Hailuo: 84.1% ASR
- Veo2: 78.2% ASR
- Kling V1.0: 78.6% ASR
- Sora2: 68.6% ASR
Ablation Studies:
- Scene Splitting: Combining scene division and paraphrasing yielded the highest ASR, proving that splitting the prompt is the key factor in constraining the output space.
- Scene Manipulation: Adding iterative manipulation increased ASR by ~18% over the one-shot splitting baseline.
- Strategy Update: Utilizing the strategy library improved ASR by ~9% and reduced the average number of attack attempts required.
Semantic Consistency: Despite the paraphrasing and splitting, the generated videos maintained high semantic similarity (average 0.53) to the original harmful prompts, confirming that the attack preserves the intended harmful narrative.

Significance and Claims

The paper claims that current T2V safety mechanisms are fundamentally vulnerable to attacks that exploit narrative structure and temporal sequencing. By demonstrating that individually benign scenes can be combined to generate harmful content, the authors argue that safety filters must evolve to assess contextual risks across scenes rather than just evaluating individual prompts or static frames.

The authors position this work as a proactive step toward improving AI safety. They assert that exposing this vulnerability is essential for researchers and developers to build more sophisticated safety mechanisms capable of understanding inter-scene context. While acknowledging the potential for misuse, the paper emphasizes that the vulnerability exists within the models regardless of the attack, and discovering it is a necessary prerequisite for securing the long-term trustworthiness and ethical deployment of T2V technology.