New to ShortSpan? We distil the AI-security research that matters into practitioner takeaways — edited by Ben Williams (NCC Group).Get the weekly email
TempJail shows timed subtitles can jailbreak Large Vision-Language Models. By turning a harmful query into a dialogue and optimising each subtitle’s on‑screen duration with black‑box search, the attack drives high success, beating prior video methods. It exposes a stealthy, timing‑based prompt channel that today’s defences largely ignore.
Video AI was meant to be harder to trick than chatbots. More context, more signals, more safety overhead. TempJail, a new attack on Large Vision-Language Models (LVLMs), shows the opposite: you can steer these systems with nothing more than subtitles and a stopwatch.
The core claim is simple and, frankly, overdue. We have obsessed over what text says, not when it appears. TempJail exploits that blind spot. It feeds a model a short video with benign visuals and carefully scheduled subtitles that unfold as a dialogue. The words themselves are not novel; the timing is. The attacker controls the order and on‑screen duration of each line so the model digests a helpful context before the banned bit lands. That temporal choreography turns guardrails into tissue paper.
How the attack lands
The pipeline is black box. No model internals, no weights. A substitute model rewrites the original harmful request into a series of question–answer turns to build coherent context. A scene planner plus a text‑to‑video generator produces an innocuous background carrier. The attacker then treats the subtitle schedule as an optimisation problem: split the video (typically 5 seconds) into N slots, allocate durations to each subtitle, and search for the timing pattern that elicits a harmful response. They use Covariance Matrix Adaptation Evolution Strategy to do that efficiently. Target LVLMs are queried by sampling frames (commonly 4 FPS) across the clip. If any response satisfies the harmful intent, that video is counted as a success.
Why timing beats content
Experiments back the claim that time matters as much as semantics. Dialogue context that precedes the harmful ask boosts success compared with showing the ask alone, and optimising the timing slots yields the biggest gains. In controlled tests, temporal scheduling alone raised average attack success on one proprietary model labelled GPT-5 from 11% to 71%. Across two safety datasets, the full TempJail pipeline hit roughly 89% and 90% average success, and it outperformed the strongest prior video baseline by 53 and 18 percentage points on GPT-5 and Gemini 3.5-Flash respectively. It was near‑perfect on some open models in the Qwen3 family. Performance was robust to decoding temperature but sensitive to how many frames you sample; moderate rates around 4–6 FPS captured the subtitle dynamics best.
Limitations exist. The study used two datasets with 50 examples each, four target models, fixed video lengths and frame rates, and an automated judge. Those choices can inflate or deflate scores. But quibbling the decimals misses the point. Subtitle streams are a prompt channel, and timing is part of the payload. If your mental model of multimodal safety stops at “filter the text,” you are defending the wrong interface. The uncomfortable read is the correct one: content‑only guardrails will keep failing while attackers schedule around them.
Additional analysis of the original ArXiv paper
📋Original Paper Title and Abstract
TempJail: Temporal Jailbreak Attack against Large Vision-Language Models via Subtitle Scheduling
Authors: Ling Zhou, Yihao Huang, Jingling Sun, Zhiwen Tian, Yi Zeng, Qihe Liu, and Shijie Zhou
Large vision-language models (LVLMs) have achieved remarkable progress in video understanding and reasoning. Despite extensive studies on text- and image-based jailbreaks, video jailbreaks against LVLMs remain largely unexplored. Existing video jailbreak methods mainly manipulate textual content embedded in videos, while overlooking how such information is organized over time. Our analysis reveals that jailbreak effectiveness depends not only on the semantics of textual information but also on its temporal presentation, including duration and timing-slot allocation. Motivated by this finding, we use subtitles, which are common in real-world videos and allow semantic content to be presented under precise temporal control without appearing visually intrusive, as a natural attack medium. Based on this insight, we propose TempJail, a black-box video-based jailbreak framework that constructs query-aligned dialogue-style subtitle sequences and optimizes their temporal scheduling to exploit temporal vulnerabilities in LVLMs and elicit responses that satisfy the harmful intent of the source query. Extensive experiments on four representative LVLMs and two datasets demonstrate that TempJail achieves the highest attack success rate across all evaluated model--dataset settings, outperforming the strongest baseline by 53 and 18 percentage points in dataset-averaged ASR on GPT-5 and Gemini 3.5-Flash, respectively.
🔍ShortSpan Analysis of the Paper
Problem
The paper examines how large vision-language models (LVLMs) can be coaxed into producing harmful outputs when presented with video inputs that include timed textual content. Prior jailbreak research focused on static text or image overlays and on what content is shown. This work argues that how textual content is organised in time across a video timeline is a distinct attack surface. Subtitles are highlighted as a realistic, low-visibility vector because they allow precise temporal control of semantics without adding visually intrusive elements.
Approach
TempJail is a black-box video jailbreak framework that constructs dialogue-style subtitle sequences aligned to a harmful query, synthesises a benign background video, and optimises the display durations of subtitle segments to maximise attack success. Subtitle sequences are produced by decomposing the original harmful query into related question-answer turns using a substitute model to yield coherent dialogue context. A scene planner and text-to-video generator produce a benign visual carrier. The temporal scheduling of N subtitle segments over a fixed total duration (typically 5 seconds) is treated as a black-box optimisation problem and solved with Covariance Matrix Adaptation Evolution Strategy (CMA-ES). Videos are evaluated by sampling frames (commonly 4 FPS) and querying target LVLMs multiple times; success is judged automatically if at least one response fulfils the harmful intent.
Key Findings
Temporal presentation strongly influences jailbreak effectiveness. Relevant dialogue preceding the harmful query substantially increases attack success compared with query-only subtitles, and timing-slot allocation matters even with fixed content.
Optimising subtitle timing yields large gains. Temporal scheduling alone raised averaged ASR on GPT-5 from 11% to 71% in controlled tests; the full TempJail pipeline produced dataset-averaged ASRs of 89.0% on VLJailbreakBench and 90.0% on HADES.
TempJail outperforms prior video jailbreak baselines across models. On proprietary models TempJail achieved 70% and 72% ASR on GPT-5 and 90% and 94% on Gemini 3.5-Flash across the two datasets; it also reached near-perfect rates on Qwen3 family models.
Ablation shows the main contributors are coherent dialogue construction and timing optimisation. Adding a generated semantic background gives a modest additional gain, and optimisation converges quickly within a few CMA-ES iterations.
Performance is robust to decoding temperature and sensitive to frame-sampling rate; moderate sampling (4–6 FPS) captures dynamic subtitle cues best.
Limitations
Experiments used two safety datasets with 50 sampled examples each and four target LVLMs, which may limit generalisability. Evaluation employed an automated judge and substitute models in the pipeline; these choices could bias measured success. Video duration, frame rates, and CMA-ES settings were fixed in most tests, and semantic background generation produced model-dependent effects, offering no improvement on some targets.
Implications
Attackers who can control subtitle text and timing could induce harmful outputs from LVLMs without model access, exploiting a stealthy channel that looks benign to human viewers. This expands the attack surface for video platforms, content moderation pipelines, and any system that ingests subtitles alongside video. The results indicate a need for temporal robustness testing and integrity checks of subtitle streams, since adversaries may weaponise scheduling to bypass defences.
- It reveals a practical, new way to jailbreak text-to-video models by exploiting temporal consistency, a weakness not fully covered by prior methods....
- It uncovers a new stealthy jailbreak: even prompts that look harmless can trigger the model to invent harmful intermediate video frames, bypassing t...
IDEATOR shows an automated way to jailbreak vision-language models by letting the models themselves generate jailbreak prompts paired with diffusion-g...
A quick take: this shows a new way to jailbreak LVLMs by splitting a harmful instruction into a chain of seemingly harmless image inputs guided by a c...
- Why it matters: It shows a stealthy way to jailbreak text-to-video models by using cross-modal, implicit cues rather than obvious prompts. The attac...
- It shows a new way to break safety guards in vision-language models by jointly tweaking both images and text prompts, making harmful outputs more li...
This paper exposes a new, scalable jailbreak for text-to-video models built on splitting a harmful prompt into scenes and composing them to slip past ...
- Why it matters: It uncovers how multimodal LLM safety can be bypassed with carefully crafted prompts, and it proposes a concrete four-axis way to me...
- Why it’s relevant: It uncovers a practical OCR-based jailbreaking technique (Text-DJ) that defeats LVLM safety filters by converting prompts into im...
- It demonstrates a black-box, bimodal jailbreak that can push vision-language models to produce toxic outputs by embedding malicious features into be...
Get the weekly digest
The few AI-security papers that matter, with the practitioner takeaway. No spam.
