CollageAttack spatial text fragmentation jailbreaks FLUX.2 [dev] at 85.5% ASR via cross-modal composition

Auto-published from arXiv:2609.38253 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.82, flags: [no-prompt-excerpt, possible-zero-day])

Category

multimodal

Model

FLUX.2 [dev] (32B rectified-flow transformer)

Surface

T2I generation API (open-weight model, local or hosted inference)

Setup

A fixed LLM template generates a single black-box prompt composed of three COMMAND blocks from a source harmful intent: COMMAND1 constructs a context-relevant scene without reproducing the harmful statement; COMMAND2 identifies scene-consistent text-bearing surfaces (posters, signs, banners, labels) described as blank before content assignment; COMMAND3 divides the harmful expression into 3–4 phrase-level fragments distributed across those carriers with specified placement and presentation styles. No iterative optimization or model access is required. Paper does not reproduce a verbatim example prompt; structure is described in the methodology section.

Reproduction anchor

code: https://anonymous.4open.science/r/T2I_CollageAttack-334F (anonymous release); benchmark: 200 source intents evaluated per model

Observed behavior

FLUX.2 [dev] generates images in which spatially distributed text fragments — each individually less explicit — collectively reconstruct the full harmful meaning through visual composition. Attack success rate: 85.5% (171/193). Mean GPT-4.1-scored harmfulness across models ranged 5.38–6.85/10, consistently exceeding baselines.

Expected behavior

The model should refuse or produce safe, non-harmful images when the aggregate prompt encodes harmful content, even when that content is fragmented across spatial carriers.

Reproducibility

medium

Threat model

Automated generation of harmful imagery at scale using a pipeline that costs only one LLM call per attack. T2I safety filters that analyse the literal text of a prompt cannot detect intent assembled in the image plane from fragments, enabling bad actors to reliably produce content (e.g. weapon fabrication visuals, extremist propaganda) that passes text-level content moderation.

Novelty

First systematic demonstration that harmful meaning can be fully assembled in the image plane from individually innocuous phrase-level fragments, creating a cross-modal attack surface that defeats text-only safety checks in state-of-the-art T2I models.

Source

• arXiv: 2609.38253
• PDF: https://arxiv.org/pdf/2609.38253
• Categories: cs.CR, cs.AI
• Authors: Zhiyi Mou, Yao Lu, Wangze Ni, Di Hong, Dakun Shen, Haoyang Li, Chen Jason Zhang, Alexander Zhou, Kui Ren

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Demonstrates CollageAttack, a concrete black-box jailbreak against multiple commercial and open-weight T2I models with 86% success rates; specific reproducible attack mechanism and failure instances across models. No vendor disclosure statement in abstract.

─────────────────────────────────────────────────────────────────────