When Memory Becomes a Vulnerability: Towards Multi-turn Jailbreak Attacks against Text-to-Image Generation Systems

TL;DR

This paper proposes Inception, the first multi-turn jailbreak attack against real-world text-to-image generation systems that explicitly exploits their memory mechanisms, and introduces Segmentation, a semantic-preserving method that generates multi-round prompts.

Abstract

Modern text-to-image (T2I) generation systems (e.g., DALL$\cdot$E 3) exploit the memory mechanism, which captures key information in multi-turn interactions for faithful generation. Despite its practicality, the security analyses of this mechanism have fallen far behind. In this paper, we reveal that it can exacerbate the risk of jailbreak attacks. Previous attacks fuse the unsafe target prompt into one ultimate adversarial prompt, which can be easily detected or lead to the generation of non-unsafe images due to under- or over-detoxification. In contrast, we propose embedding the malice at the inception of the chat session in memory, addressing the above limitations. Specifically, we propose Inception, the first multi-turn jailbreak attack against real-world text-to-image generation systems that explicitly exploits their memory mechanisms. Inception is composed of two key modules: segmentation and recursion. We introduce Segmentation, a semantic-preserving method that generates multi-round prompts. By leveraging NLP analysis techniques, we design policies to decompose a prompt, together with its malicious intent, according to sentence structure, thereby evading safety filters. Recursion further addresses the challenge posed by unsafe sub-prompts that cannot be separated through simple segmentation. It firstly expands the sub-prompt, then invokes segmentation recursively. To facilitate multi-turn adversarial prompts crafting, we build VisionFlow, an emulation T2I system that integrates two-stage safety filters and industrial-grade memory mechanisms. The experiment results show that Inception successfully allures unsafe image generation, surpassing the SOTA by a 20.0\% margin in attack success rate. We also conduct experiments on the real-world commercial T2I generation platforms, further validating the threats of Inception in practice.

Figures (7)

• Figure 1: Illustration of Inception. It jailbreaks the memory mechanism of T2I generation systems by planting malice step by step. When one sub-prompt is blocked, Inception recursively segments it until evading the safety filters.
• Figure 4: Overall pipeline of Inception. The process consists of two operations: segmentation and recursion. Inception first applies NLP-based policies to divide an unsafe prompt into segments, which are sequentially submitted for feedback. Segments flagged as unsafe are expanded, rephrased, and recursively segmented until passing the safety filters or query budget is exhausted.
• Figure 5: Illustration of recursion. Inception recursively expands and segments the unsafe word into sub-queries until they all bypass the safety filter.
• Figure 6: One-time jailbreak performance of Inception against different memory mechanisms.
• Figure 7: One-time and re-use performance of Inception under different maximum query budgets.