TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models

arXiv:2607.24897 · cs.CR · Submitted 2026-07-27 · Read on arXiv

Meng Xie, Li Zeng, Hangtao Zhang, Xianlong Wang, Ziqi Zhou, Pengpeng Qiao, Zhetao Li

cs.CR

Submitted: 2026-07-27

Code: https://github.com/Heart-Meng/TYPO

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Diffusion Model — 5× in this paper · explained in 8 episodes
• Diffusion Models — 5× in this paper · explained in 6 episodes
• Transferability — 4× in this paper · explained in 4 episodes
• Ablation — 3× in this paper · explained in 1 episode
• Alignment — 3× in this paper · explained in 1 episode
• Generative Model — 3× in this paper · explained in 2 episodes
• Generative Models — 3× in this paper · explained in 2 episodes
• Ablation study — 2× in this paper · explained in 1 episode
• Actionability — 2× in this paper · explained in 3 episodes
• Combinatorial Optimization — 2× in this paper · explained in 2 episodes
• Consistency — 2× in this paper · explained in 3 episodes
• Fidelity — 2× in this paper · explained in 2 episodes
• Genetic Algorithm — 2× in this paper
• Perplexity — 2× in this paper · explained in 3 episodes
• Ablation Studies — 1× in this paper · explained in 1 episode
• Accountability — 1× in this paper · explained in 2 episodes
• Adaptive Strategy — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Attack Success Rate — 1× in this paper
• Attack Success Rate (ASR) — 1× in this paper · explained in 2 episodes
• Benchmark — 1× in this paper · explained in 2 episodes
• Cross-Model Transfer — 1× in this paper · explained in 2 episodes
• Decoupling — 1× in this paper · explained in 2 episodes
• Large Language Model (LLM) — 1× in this paper · explained in 3 episodes
• Latent Diffusion Model — 1× in this paper · explained in 2 episodes
• Latent Diffusion Models — 1× in this paper · explained in 2 episodes
• Modality Gap — 1× in this paper · explained in 4 episodes
• Prompt Engineering — 1× in this paper · explained in 4 episodes
• Reinforcement Learning — 1× in this paper · explained in 4 episodes
• Robustness — 1× in this paper · explained in 5 episodes
• Score and Semantic Consistency — 1× in this paper

Sources

• Jailbreaking Black Box Large Language Models in Twenty Queries
• Dynamic Optimization and Safety Indicator Injection for Jailbreaking Text-to-Image Models with Multimodal Safety Filters
• Harnessing LLM to Attack LLM-Guarded Text-to-Image Models
• Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
• H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking
• AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs
• Tree of Attacks: Jailbreaking Black-Box LLMs Automatically
• Hierarchical Text-Conditional Image Generation with CLIP Latents
• Red-Teaming the Stable Diffusion Safety Filter
• Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding
• AnyText2: Visual Text Generation and Editing With Customizable Attributes
• Robot Collapse: Supply Chain Backdoor Attacks Against VLM-based Robotic Manipulation
• DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence
• Text to Image Generation and Editing: A Survey
• GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts
• Reason2Attack: Jailbreaking Text-to-Image Models via LLM Reasoning
• Qwen-Image-2.0 Technical Report
• When Memory Becomes a Vulnerability: Towards Multi-turn Jailbreak Attacks against Text-to-Image Generation Systems
• Universal and Transferable Adversarial Attacks on Aligned Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs