Image-plane composition of harmful text fragments exceeds communicative impact of equivalent direct text in T2I outputs

Auto-published from arXiv:2609.38253 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.76, flags: [possible-zero-day, no-prompt-excerpt]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

multimodal

Model

Doubao-Seedream-5.0-Lite (ByteDance)

Surface

T2I generation API (commercial)

Setup

CollageAttack prompts are constructed so each textual fragment placed on a visual carrier (sign, poster, banner) is, in isolation, incomplete or ambiguous. After generation the full harmful meaning is readable only by viewing the composed image. The paper additionally compares the communicative impact of the resulting images against text-only equivalents, finding visual composition consistently scores higher on GPT-4.1 harmfulness rubrics. No verbatim prompt provided; experimental design is described in Section 4 with evaluation rubrics shown in Figures 6–8 of the appendix.

Reproduction anchor

code: https://anonymous.4open.science/r/T2I_CollageAttack-334F; evaluation rubric: Appendix Figures 6–8

Observed behavior

On Doubao-Seedream-5.0-Lite (86.0% ASR, 172/198 successes — highest across all tested models), generated images convey harmful intent more effectively through visual composition of text fragments than the equivalent harmful statement presented as plain text. The paper states: 'visual composition producing stronger communicative impact than text alone.'

Expected behavior

Harmful information should not become more potent or harder to filter when embedded in an image as spatially distributed fragments. Safety evaluation should account for the image-level semantic reconstruction, not just the raw prompt string.

Reproducibility

medium

Threat model

Content moderation systems that operate on textual prompts or on individual image regions independently will systematically underestimate the harmfulness of collage-style outputs. Platforms hosting T2I APIs (ByteDance Doubao, and similar) face a detection gap where harmful imagery passes both prompt-side and simple image-side classifiers, enabling persistent misuse.

Novelty

Reveals a safety measurement failure: existing harmfulness evaluations anchored to text miss a new emergent threat where the image plane itself is the semantic assembly site, and composed visual outputs are more harmful than their text-only counterparts — requiring new multimodal evaluation frameworks.

Source

• arXiv: 2609.38253
• PDF: https://arxiv.org/pdf/2609.38253
• Categories: cs.CR, cs.AI
• Authors: Zhiyi Mou, Yao Lu, Wangze Ni, Di Hong, Dakun Shen, Haoyang Li, Chen Jason Zhang, Alexander Zhou, Kui Ren

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Demonstrates CollageAttack, a concrete black-box jailbreak against multiple commercial and open-weight T2I models with 86% success rates; specific reproducible attack mechanism and failure instances across models. No vendor disclosure statement in abstract.

─────────────────────────────────────────────────────────────────────