# SPARK: Jailbreaking T2V Models by Synergistically Prompting Auditory and Recontextualized Knowledge Source: [SPARK: Jailbreaking T2V Models by Synergistically Prompting Auditory and Recontextualized Knowledge]() Collection index: [llms.txt]() Data updated: 2026-03-10T05:00:05.424Z Authors: Zonghao Ying, Moyang Chen, Nizhang Li, Zhiqiang Wang, Wenxin Zhang, Quanchen Zou, Zonglei Jing, Aishan Liu, Xianglong Liu Published: 2025-11-17T08:31:43.000Z ## Abstract Jailbreak attacks can circumvent model safety guardrails and reveal critical blind spots. Prior attacks on text-to-video (T2V) models typically add adversarial perturbations to obviously unsafe prompts, which are often easy to detect and defend. In contrast, we show that benign-looking prompts containing rich, implicit cues can induce T2V models to generate semantically unsafe videos that both violate policy and preserve the original (blocked) intent. To realize this, we propose SPARK, a jailbreak framework that leverages T2V models cross-modal associative patterns via a modular prompt design. Specifically, our prompts combine three components: neutral scene anchors, which provide the surface-level scene description extracted from the blocked intent to maintain plausibility; latent auditory triggers, textual descriptions of innocuous-sounding audio events (e.g., creaking, muffled noises) that exploit learned audio-visual co-occurrence priors to bias the model toward particular unsafe visual concepts; and stylistic modulators, cinematic directives (e.g., camera framing, atmosphere) that amplify and stabilize the latent trigger's effect. We formalize attack generation as a constrained optimization over the above modular prompt space and solve it with a guided search procedure that balances stealth and effectiveness. Extensive experiments over 7 T2V models demonstrate the efficacy of our attack, achieving a +23% improvement in average attack success rate in commercial models. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Jailbreaking on Pixverse](): Jailbreaking; Pixverse; Pornography Rate: 82. - [Jailbreaking on Seedance](): Jailbreaking; Seedance; Pornography: 88. - [Visual Harmfulness Evaluation on Wan](): Visual Harmfulness Evaluation; Wan; Pornography: 100. - [Visual Harmfulness Evaluation on CogVideoX](): Visual Harmfulness Evaluation; CogVideoX; Pornography Rate: 100. - [Visual Harmfulness Evaluation on HunyuanVideo](): Visual Harmfulness Evaluation; HunyuanVideo; Pornography: 100. - [Safety Evaluation (Attack Success Rate) on Pixverse](): Safety Evaluation (Attack Success Rate); Pixverse; Pornography ASR: 80. - [Safety Evaluation (Attack Success Rate) on Kling](): Safety Evaluation (Attack Success Rate); Kling; ASR (Pornography): 88. - [Jailbreaking on Hailuo](): Jailbreaking; Hailuo; Pornography Success Rate: 94. - [Jailbreaking on Kling](): Jailbreaking; Kling; Pornography Rate: 92. - [Safety Evaluation (Attack Success Rate) on Seedance](): Safety Evaluation (Attack Success Rate); Seedance; Pornography ASR: 88. - [Safety Evaluation (Attack Success Rate) on Hailuo](): Safety Evaluation (Attack Success Rate); Hailuo; Pornography ASR: 94. ## Original sources and implementation [Original paper]() [PDF]()