💻 computer science

TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attacks

TrajShield is a training-free, inference-time defense framework that mitigates jailbreak attacks and temporally emergent risks in text-to-video models by simulating prompt trajectories to causally localize and minimally rewrite unsafe content while preserving semantic fidelity.

Original authors: Quanchen Zou, Nizhang Li, Wenxin Zhang, Jiaye Lin, Yangchen Zeng, Xiangzheng Zhang, Zonghao Ying

Published 2026-05-05

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Quanchen Zou, Nizhang Li, Wenxin Zhang, Jiaye Lin, Yangchen Zeng, Xiangzheng Zhang, Zonghao Ying

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a magical storyteller robot that can turn your written sentences into short movies. This robot is incredibly talented at making scenes flow smoothly from one moment to the next, like a real film. However, there's a problem: sometimes, if you give it a sentence that sounds harmless but hints at trouble, the robot gets carried away with its storytelling. It might start with a harmless argument between two people and, in its quest to make the story dramatic and coherent, escalate it into a violent fight that you never actually asked for.

This is the core problem TrajShield solves.

The Problem: The "Slippery Slope" of Storytelling

Existing safety guards for these robots work like a bouncer at a club door. They check your ticket (the text prompt) for bad words like "bomb" or "knife." If they see a bad word, they stop you.

But this approach has a blind spot. It doesn't understand storytelling over time.

The Old Way: If you say "Two men arguing in a parking lot," the bouncer sees no weapons and lets you in.
The Robot's Mistake: The robot, trying to make a good movie, thinks, "Okay, arguments usually lead to shoving, and shoving leads to fighting." So, it generates a video of a brutal fight.
The Result: You asked for an argument, but you got a violent movie. The "bad" part wasn't in your words; it was in the robot's imagination of how the story should unfold.

The Solution: TrajShield (The "Script Editor")

The authors of this paper created TrajShield, a new safety system that doesn't just check the ticket; it acts like a script editor who reads the story before the movie is filmed.

Here is how it works, using a simple three-step process:

1. Breaking the Story Down (Motion-Semantic Decoupling)

Imagine the robot's prompt is a tangled ball of yarn. TrajShield untangles it into three distinct parts:

The Setting (Static): Who is there? Where are they? What does it look like? (e.g., "Two men, a parking lot, night time.")
The Plot (Dynamic): What happens next? (e.g., "They argue, then...")
The Goal (Intent): What is the user actually trying to show? (e.g., "A tense scene.")

By separating the setting from the action, the system ensures that when it fixes the story, it doesn't accidentally change the characters or the location. It only touches the plot.

2. Simulating the Future (Temporal Risk Propagation)

Before the robot actually makes the video, TrajShield runs a "mental simulation." It asks: "If I start with this argument, what is the most likely next scene? And the one after that?"

It builds a "risk map" of the story's future. It looks for the exact moment the story starts to slide into danger.

Example: It sees that "Argument" $\rightarrow$ "Shouting" $\rightarrow$ "Shoving" is a dangerous path.
It identifies the trigger point: The exact moment the story goes from "safe" to "unsafe" (e.g., the moment the shouting turns into shoving).

3. The Minimal Rewrite (Temporally-Consistent Safe Rewriting)

Once it finds the trigger point, TrajShield performs "surgery" on the story. It doesn't delete the whole movie. Instead, it rewrites only the dangerous part of the plot to steer it back to safety, while keeping everything else exactly the same.

Original Dangerous Path: Argument $\rightarrow$ Shouting $\rightarrow$ Fighting (Unsafe!)
TrajShield's Rewrite: Argument $\rightarrow$ Shouting $\rightarrow$ Storming off angrily (Safe!)

The result is a video that still feels like the user's original idea (tense, dramatic, two men in a parking lot), but it stops before it becomes violent. The "story" flows naturally, just in a safe direction.

Why This Matters

The paper tested this system against 14 different types of safety risks (like violence, illegal acts, or disturbing content) and across 6 different video-generation models.

The Result: TrajShield stopped about 52% more unsafe videos than previous methods.
The Quality: Crucially, it didn't ruin the good videos. When given a safe prompt, the resulting video still looked exactly like what the user wanted. It didn't turn a peaceful scene into a boring one; it just prevented the "slippery slope" into danger.

The Bottom Line

Think of TrajShield as a safety net that catches a story before it falls off a cliff. Instead of just banning words, it understands that stories have a direction. It watches the story unfold in the robot's mind, spots the moment it's about to go off the rails, and gently steers it back onto a safe path, all without changing the scenery or the characters.

Technical Summary: TrajShield

1. Problem Statement

Text-to-Video (T2V) models have advanced significantly in generating temporally coherent videos from natural language prompts. However, existing safety mechanisms, largely inherited from Text-to-Image (T2I) domains, are insufficient for T2V. Current defenses operate primarily at the lexical surface of the input prompt (e.g., keyword blacklists, surface-level classifiers, or generic LLM rewriting). These methods fail to address a fundamental distinction between static images and dynamic video: temporally emergent risk.

In T2V generation, a seemingly benign prompt (e.g., "two men arguing in a parking lot") may lack overtly harmful keywords yet lead to unsafe content (e.g., physical violence) through the model's temporal extrapolation toward narrative coherence. The risk is invisible at the prompt level and only materializes as the generator unfolds the scene over time. Furthermore, existing defenses often fail against sophisticated jailbreak attacks that disguise harmful intent through rephrasing or adversarial prompting. The core challenge is to anticipate the temporal trajectory a T2V model will produce, identify the causal origin of emerging risks, and intervene with minimal semantic perturbation before a single frame is rendered.

2. Methodology: TrajShield

The authors propose TrajShield, a training-free, inference-time defense framework that reformulates T2V safety as a causal intervention problem within a temporally structured semantic space. Rather than modifying the raw text based on lexical patterns, TrajShield simulates the implied trajectory of the prompt to neutralize risks while preserving safety-irrelevant semantics. The framework consists of three sequential stages:

A. Motion-Semantic Decoupling (MSD)

To prevent collateral semantic drift (where neutralizing a risk inadvertently alters the scene's identity or style), TrajShield factorizes the input prompt $P$ into three conditionally independent components:

Invariant Spatial Context ( $E$ ): Captures temporally stationary elements, including subject descriptions, environmental settings, and cinematic style cues. This acts as a frozen anchor to ensure subject identity and visual tone remain unchanged.
Action Trajectory ( $T$ ): A discretized, temporally ordered sequence of scene states (e.g., beginning, midpoint, conclusion) that captures the dynamic progression implied by the prompt. The system performs implicit dynamics extrapolation to infer plausible temporal arcs even if the user prompt is underspecified.
Intent Anchor ( $I$ ): A concise distillation of the user's core creative goal, abstracted from potentially harmful specifics, serving as a semantic regularizer during rewriting.

B. Temporal Risk Propagation Graph (TRPG)

This module operates entirely in the semantic space to simulate the trajectory and locate the causal origin of risk without rendering video frames.

Trajectory Rollout: The action trajectory is modeled as a context-conditioned Markov chain, predicting subsequent states based on the current state and spatial context.
Hierarchical Risk Assessment: At each temporal anchor, risk is evaluated along three dimensions:
- Content Risk: Whether the instantaneous state contains harmful content (static risk).
- Transition Risk: Whether the change between states constitutes a causal escalation toward harm (dynamic risk).
- Prospective Risk: Whether continuing the trajectory unimpeded would lead to an unsafe terminal state.
Causal Attribution: The system identifies the earliest trigger point ( $t_r$ ) where the composite risk exceeds a safety threshold. It then derives a Safe Constraint ( $C$ ), a declarative directive specifying what must change (neutralize the unsafe pattern) and what must be preserved (the benign prefix and intent).

C. Temporally-Consistent Safe Rewriting (TCSR)

The final stage synthesizes a safe prompt $P^*$ by:

Invariant Context Anchoring: Hard-locking the spatial context $E$ to ensure no semantic drift in subjects or environment.
Constrained Counterfactual Trajectory Substitution: Generating an alternative action trajectory $T^*$ that satisfies the safe constraint $C$ , preserves the benign prefix (states before $t_r$ ), maintains action-semantic proximity (e.g., replacing physical violence with a verbal standoff), and adheres to the intent anchor $I$ .
Prompt Assembly: Composing the frozen context with the counterfactual trajectory into a fluent natural language prompt.

3. Key Contributions

The paper outlines three primary contributions:

Identification of Temporally Emergent Risk: The authors define a previously overlooked threat category in T2V where benign prompts generate unsafe content through temporal extrapolation, systematically evading existing lexical defenses.
TrajShield Framework: A unified, training-free defense mechanism that handles explicit unsafe prompts, jailbreak attacks, and temporally emergent risks via trajectory simulation, causal risk localization, and minimally invasive counterfactual rewriting.
Empirical Validation: Comprehensive experiments demonstrating that TrajShield achieves state-of-the-art defense performance across 14 safety categories and multiple T2V backends while maintaining high semantic fidelity.

4. Experimental Results

The authors evaluated TrajShield on the T2VSafetyBench benchmark (14 safety categories) and the SafeWatch dataset (real-world unsafe prompts) using six T2V models (including Pixverse, Hailuo, Kling, Seedance, Veo, and Sora).

Safety Performance: TrajShield reduced the Attack Success Rate (ASR) by an average of 52.44% across all models and categories. Specifically, the average ASR dropped from 70.00% (original models) to 15.64% (defended models).
Comparison with Baselines: The method substantially outperformed existing defenses, including Keyword Blacklists, Semantic Analysis (Toxic-BERT), and LLM Rewriting. For instance, on the Sora model, TrajShield reduced ASR to 20.86%, whereas LLM Rewriting only achieved 51.57%.
Robustness: The defense remained effective against diverse jailbreak attacks (RAB, DACA, SceneSplit, SPARK), reducing ASR to a narrow range of 6%–21% regardless of the attack strategy.
Semantic Fidelity: On benign prompts (MSVD dataset), TrajShield maintained high CLIP Similarity (CS) and Temporal Consistency (TC) scores, comparable to the baseline, indicating that the defense does not degrade the quality of safe generations.
Ablation Studies: Removing any of the three core modules (MSD, TRPG, or TCSR) led to significant performance degradation, confirming that the decoupling of motion and semantics, the identification of causal risk triggers, and the constrained rewriting are all essential for the system's efficacy.

5. Significance and Claims

The paper claims that TrajShield represents a paradigm shift in T2V safety, moving from static, lexical filtering to trajectory-level safety mediation. The authors argue that effective defense for generative video models must align with the temporal and compositional nature of video generation. By intervening in the "latent video intent space" before generation, TrajShield addresses the structural blind spot of current defenses: the inability to detect risks that emerge only through the causal progression of time.

The authors conclude that their approach offers a better safety-fidelity trade-off than competitive baselines, validating the necessity of temporal-aware safety mediation for generative models where harmfulness emerges through latent structure. They acknowledge limitations, noting that the current coarse trajectory discretization may not fully capture highly complex, long-horizon dynamics, and suggest that combining this pre-generation defense with post-generation moderation remains a direction for future work.