# Red-Teaming Text-to-Image Systems by Rule-based Preference Modeling Source: [Red-Teaming Text-to-Image Systems by Rule-based Preference Modeling]() Collection index: [llms.txt]() Data updated: 2025-10-26T04:49:02.530Z Authors: Yichuan Cao, Yibo Miao, Xiao-Shan Gao, Yinpeng Dong Published: 2025-05-27T12:00:19.000Z ## Abstract Text-to-image (T2I) models raise ethical and safety concerns due to their potential to generate inappropriate or harmful images. Evaluating these models' security through red-teaming is vital, yet white-box approaches are limited by their need for internal access, complicating their use with closed-source models. Moreover, existing black-box methods often assume knowledge about the model's specific defense mechanisms, limiting their utility in real-world commercial API scenarios. A significant challenge is how to evade unknown and diverse defense mechanisms. To overcome this difficulty, we propose a novel Rule-based Preference modeling Guided Red-Teaming (RPG-RT), which iteratively employs LLM to modify prompts to query and leverages feedback from T2I systems for fine-tuning the LLM. RPG-RT treats the feedback from each iteration as a prior, enabling the LLM to dynamically adapt to unknown defense mechanisms. Given that the feedback is often labeled and coarse-grained, making it difficult to utilize directly, we further propose rule-based preference modeling, which employs a set of rules to evaluate desired or undesired feedback, facilitating finer-grained control over the LLM's dynamic adaptation process. Extensive experiments on nineteen T2I systems with varied safety mechanisms, three online commercial API services, and T2V models verify the superiority and practicality of our approach. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [T2V Safety Attack Success Rate on Luma Ray2](): T2V Safety Attack Success Rate; Luma Ray2; ASR (Pornography): 5. - [T2V Safety Attack Success Rate on Veo 2](): T2V Safety Attack Success Rate; Veo 2; Pornography ASR: 15. - [T2V Safety Attack Success Rate on Kling v1.0](): T2V Safety Attack Success Rate; Kling v1.0; Pornography ASR: 25. - [T2V Safety Attack Success Rate on Sora 2](): T2V Safety Attack Success Rate; Sora 2; ASR: Pornography: 0. - [Safety Evaluation (Attack Success Rate) on Hailuo](): Safety Evaluation (Attack Success Rate); Hailuo; Pornography ASR: 20. ## Original sources and implementation [Original paper]() [PDF]()