Jailbreaking Text-to-Image Models Through Cracks: Navigating Heterogeneous Safety Filters via Multi-Agent Debate
Kaiyan Wen, Shijie Zhang, Lu Yu, Guangdong Bai
cs.AI · cs.MM
Quick verdict
CRACK: multi-agent debate jailbreaks multi-layer T2I defenses (up to 99.63% ASR, 6 queries); compelling results, yet surrogate transfer unproven, stats thin.
Summary
The paper formalizes multi-layer T2I safety stacks as a 'Detection Surface': union of per-filter decision boundaries in a continuous prompt-representation space, whose joint safe region intersected with a semantic-fidelity set defines a sparse, non-convex evasion region. Three properties—cross-layer conflict (gradient misalignment), sparsity (probability bound decaying with layer count), and non-convexity (witness condition)—are stated with short propositions. Motivated by this, CRACK decomposes jailbreak search into a three-agent debate: an Attack Agent selects among five mutation strategies via a small RL policy; a Defense Agent approximates lexical, semantic, and cross-modal detection with its own three-tier surrogate, providing per-layer feedback; a Judge Agent fuses an LLM risk score with CLIPScore differentials into a reward (α=0.3, β=0.7). On SD 1.4 against text, image, and text-image filters, CRACK reaches up to 99.63% ASR-Q16 (re-use, text-c, I2P) using about six target queries, outperforming SneakyPrompt, MMA-Diffusion, JailFuzzer, DACA, Ring-A-Bell, and PGJ; on DALL·E 3 it roughly doubles the best baseline (43.57% one-time, I2P). Ablations attribute gains to per-layer diagnosis, the judge, RL, and strategy diversity. Main limitations: the layer-aware diagnosis derives from the attacker's own surrogate, whose transfer to real stacks is asserted rather than measured; ASR reporting lacks confidence intervals or seed variance, with prose-table mismatches in Sec. V-B1; and the fidelity threshold (CLIPScore ≥ 0.26) appears post hoc.
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- The joint evasion region of a heterogeneous T2I defense stack is sparse, non-convex, and shaped by cross-layer conflicts, formalized via the Detection Surface (Sec. III).
- CRACK's per-layer surrogate diagnosis plus judge-arbitrated reward enables strategy-level adaptation across conflicting layers, where prior black-box methods see only binary feedback (Sec. IV, Tab. I).
- CRACK achieves up to 99.63% ASR-Q16 (SD 1.4, text-c + built-in checker, re-use, I2P) in ~6 queries, including 83.01% one-time on the hardest text-image-c configuration, and generalizes to closed DALL·E 3 at 43.57% one-time (I2P).
- Empirically, feasible-prompt hit rate decays multiplicatively with filter count (12.3% → 2.7% → 0.4%, Tab. III) and only 15.6–23.5% of midpoint interpolations between feasible prompts remain feasible (Tab. IV).
- Stacking heterogeneous filters does not close the feasible region; defenses should co-design layers as a joint decision surface and audit against directed search (Sec. VI).
Strengths
First unified geometric framing of heterogeneous defense stacks
Defs 1–3 (Sec. III-B) model each filter as a zero level set of a continuous surrogate score and define the evasion region E* as the intersection of all safe regions with a semantic-fidelity set; Prop. 1–3 give operational statements of cross-layer conflict, sparsity, and non-convexity that each map to a concrete CRACK component.
Layer-aware feedback is a real capability delta over baselines
The Defense Agent's three-tier surrogate (regex/keyword, LLM semantic scorer, CLIPScore cross-modal, Sec. IV-B) emits per-layer risk reports R_t, versus the binary h(p)=max_k h_k(p) feedback of SneakyPrompt/JailFuzzer; Tab. I makes this comparison explicit rather than hand-waving it.
RQ2 validates the theory empirically, not just decoratively
Strong results on the hardest composite setting and a closed system
Component-resolved ablations
Weaknesses
Surrogate diagnosis transfer is asserted, never measured
Prose–table inconsistencies in the headline results paragraph
No uncertainty quantification anywhere
Fidelity threshold and reward representation overlap with evaluation filters
RL component underspecified; baseline re-use numbers anomalous
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper targets black-box jailbreak of T2I systems guarded by heterogeneous, multi-layer safety stacks. It contributes: (1) the **Detection Surface** formalism (Sec. III-B, Defs. 1–3), modeling each filter's decision boundary as the zero level set of a continuous surrogate score in a prompt-representation space; (2) three structural properties — cross-layer conflict (Prop. 1, gradient misalignment), sparsity (Prop. 2, Pr[x∈E*] ≤ min bound), non-convexity (Prop. 3, witness condition); (3) **CRACK** (Sec. IV), a three-agent debate (attack / defense / judge) with RL-guided strategy selection. Headline claims: up to 99.63% ASR-Q16 with ~6 queries under composite defenses (abstract, Tab. II), ~2× best baseline on closed DALL·E 3, and a defensive message that independently optimized layers leave exploitable 'cracks' (Sec. VI).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is CRACK and how does it jailbreak text-to-image models?
CRACK is a research attack framework that elicits NSFW images from guarded T2I systems using three LLM agents in a debate loop: an attacker mutates the prompt using one of five strategies, a defender estimates which safety layer (keyword, semantic, or cross-modal CLIP) would block it, and a judge scores progress to train a small reinforcement-learning strategy selector. It typically succeeds within about six queries to the target.
What attack success rate does CRACK achieve?
Up to 99.63% ASR-Q16 on Stable Diffusion 1.4 with a text-classifier filter stacked on the built-in checker (re-use setting, I2P dataset), 83.01% one-time on the hardest text-image cross-modal filter (I2P), and 43.57% one-time on the closed DALL·E 3 service (I2P), roughly double the strongest of six compared baselines.
What is the 'Detection Surface' in this paper?
A geometric abstraction: each safety filter's decision boundary is modeled as a surface in a continuous prompt-representation space. The intersection of all filters' safe regions with a semantic-fidelity constraint defines a sparse, non-convex region — the 'evasion region' — where a successful jailbreak prompt must land. The paper argues cross-layer conflicts make this region hard to search blindly.
Is code or data available for this paper?
The paper states the code is available in the supplementary material. Experiments used DeepSeek V3 as the LLM for all agents, a single A100 40GB GPU, public prompt datasets (I2P, UnsafeDiff, NSFW-200), and openly available safety filters, so an independent reproduction is technically possible but sensitive to LLM behavior drift.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The excerpt contains three '[...sampling gap...]' regions: part of Sec. II, the end of Sec. III-C into early Sec. IV, part of Sec. IV-D (the RL formulation), and portions of the RQ1/RQ5 narrative and references. All supplementary material (SDXL/Midjourney tables, strategy library details, sensitivity details, ethics statements if any) is referenced but not included — judgments about those parts are not possible from the provided text.
- The metadata abstract is cut mid-sentence at 'Extensive experiments across', but the in-body abstract (Sec. I) contains the completion ('...up to 99.63% under composite defenses, while requiring fewer queries...'), so no abstract content is actually missing.
- Contribution bullet 1 (Sec. I) appears garbled in the extraction ('...three structural properties (cross-layer conflict, sparsity, and non-convexity) that that decomposes jailbreak search into exploration...'); this was treated as a likely extraction artifact rather than a paper defect.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.