JANUS：通过分布优化越狱文本到图像模型的轻量级框架
JANUS: A Lightweight Framework for Jailbreaking Text-to-Image Models via Distribution Optimization
把越狱攻击建模为在 T2I 系统端到端黑盒奖励下优化结构化提示词分布，用低维混合策略替代高容量 RL 生成器，为红队测试扩散模型安全过滤器提供了一个轻量、可复用的攻击基线，也提示防御方需针对分布级攻击设计分布感知的防护。
原文依据 formulates jailbreak as optimizing a structured prompt distribution under a black-box, end-to-end reward from the T2I system and its safety filters
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论尽管部署了安全过滤器，Stable Diffusion 和 DALLE 等文本到图像（T2I）模型在越狱攻击下仍易生成有害或不宜工作（NSFW）内容。现有越狱攻击要么依赖代理损失优化而非真正的端到端目标，要么依赖大规模且昂贵的强化学习训练生成器。针对这些局限，我们提出 JANUS，一个轻量级框架，将越狱建模为在 T2I 系统及其安全过滤器提供的黑盒端到端奖励下优化结构化提示词分布。JANUS 用两个语义锚定提示词分布上的低维混合策略替代高容量生成器，在保持目标语义的同时实现高效探索。在现代 T2I 模型上，我们优于最优越狱方法，在 Stable Diffusion 3.5 Large Turbo 上将 ASR-8 从 25.30% 提升至 43.15%，并具有持续更高的 CLIP 与 NSFW 分数。JANUS 在开源与商业模型上均取得成功。这些发现揭示了当前 T2I 安全流程中的结构性弱点，并推动更强的分布感知防御。警告：本文包含可能具有冒犯性的模型输出。
英文原文摘要 1241 字符
Text-to-image (T2I) models such as Stable Diffusion and DALLE remain susceptible to generating harmful or Not-Safe-For-Work (NSFW) content under jailbreak attacks despite deployed safety filters. Existing jailbreak attacks either rely on proxy-loss optimization instead of the true end-to-end objective, or depend on large-scale and costly RL-trained generators. Motivated by these limitations, we propose JANUS , a lightweight framework that formulates jailbreak as optimizing a structured prompt distribution under a black-box, end-to-end reward from the T2I system and its safety filters. JANUS replaces a high-capacity generator with a low-dimensional mixing policy over two semantically anchored prompt distributions, enabling efficient exploration while preserving the target semantics. On modern T2I models, we outperform state-of-the-art jailbreak methods, improving ASR-8 from 25.30% to 43.15% on Stable Diffusion 3.5 Large Turbo with consistently higher CLIP and NSFW scores. JANUS succeeds across both open-source and commercial models. These findings expose structural weaknesses in current T2I safety pipelines and motivate stronger, distribution-aware defenses. Warning: This paper contains model outputs that may be offensive.