Abstract
Various (text) prompt filters and (image) safety checkers have been implemented to mitigate the misuse of Text-to-Image (T2I) models in creating Not-Safe-For-Work (NSFW) this http URL order to expose potential security vulnerabilities of such safeguards, multimodal jailbreaks have been this http URL, existing jailbreaks are limited to prompt-specific and image-specific perturbations, which suffer from poor scalability and time-consuming this http URL address these limitations, we propose Universally Unfiltered and Unseen (U3)-Attack, a multimodal jailbreak attack method against T2I this http URL, U3-Attack optimizes an adversarial patch on the image background to universally bypass safety checkers and optimizes a safe paraphrase set from a sensitive word to universally bypass prompt filters while eliminating redundant this http URL experimental results demonstrate the superiority of our U3-Attack on both open-source and commercial T2I this http URL example, on the commercial Runway-inpainting model with both prompt filter and safety checker, our U3-Attack achieves $~4\times$ higher success rates than the state-of-the-art multimodal jailbreak attack, this http URL Warning: This paper includes examples of NSFW content.
Abstract (translated)
为了减少文本到图像（Text-to-Image，T2I）模型被滥用以生成不适合工作的内容（Not-Safe-For-Work，NSFW），已经实施了多种文本提示过滤器和图像安全检查措施。然而，为揭示这些防护措施的安全漏洞，多模态越狱攻击已经被提出。现有的越狱攻击方法局限于针对特定提示或特定图像的扰动处理，这导致了可扩展性差且耗时的问题。 为了克服这些问题，我们提出了一个名为“Universally Unfiltered and Unseen (U3)-Attack”的新多模态越狱攻击方法。该方法通过优化背景中的对抗贴图来普遍绕过安全检查器，并从敏感词汇中优化出一个无害的同义替换集合以普遍避开提示过滤器，同时消除了冗余。 实验结果显示，在开源和商用的文本到图像模型上，我们的U3-Attack表现出了优越性。例如，在使用了提示过滤器和安全性检查器的商用Runway-inpainting模型中，我们的U3-Attack比当前最先进的多模态越狱攻击方法获得了高出约4倍的成功率。 **警告：该论文包含不适合工作的内容示例。**
URL
https://arxiv.org/abs/2508.05658
