CollageAttack: Exploiting Cross-Modal Alignment Flaws in T2I Models through Spatial Text Composition
CollageAttack is a black-box jailbreak for text-to-image systems that hides harmful intent in a seemingly less explicit prompt by spreading semantically loaded text fragments across scene-grounded visual elements, letting the generated image “assemble” the unsafe meaning spatially. The interesting bit is that it exploits a gap between prompt-level safety filtering and image-level semantic composition, reportedly beating prior baselines across open and commercial models, though the evidence in the abstract leaves open how robust the attack is beyond the tested prompts/models and how reliably defenses or human evaluation handle these collage-like cases.
Abstract
Text-to-image (T2I) models have substantially improved in language understanding, in-image text rendering, and visual composition, while their safety mechanisms do not always keep pace with these capabilities. This creates a cross-modal attack surface in which harmful semantics can remain inconspicuous in a serialized prompt yet emerge through image-level composition. We propose CollageAttack, an automated single-prompt black-box jailbreak that shifts semantic assembly into the image plane by combining context-relevant scenes, scene-grounded textual carriers, and spatially distributed text fragments. Experiments across multiple open-weight and commercial T2I models show that CollageAttack achieves attack success rates of up to 86.0%, outperforming the strongest baseline on the same model by 18.5 percentage points, while consistently producing more harmful outputs and preserving the source intent. We further find that distributed textual fragments can reconstruct the intended semantics after generation, with visual composition producing stronger communicative impact than text alone. These results reveal a cross-modal safety gap in which harmful meaning emerges from the composition of individually less explicit elements.