SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense

2026-08-11

AI Summary

This work addresses the vulnerability of text-to-video generation models to jailbreak attacks, which existing defenses often mitigate at the cost of high latency or semantic distortion. The study reveals, for the first time, a cumulative separation effect between jailbreak and benign samples in the cross-attention feature space during diffusion. Building on this insight, the authors propose an architecture-level defense paradigm that incurs no additional inference overhead: it identifies critical regions via cross-attention stability analysis and integrates attention masking, energy normalization, and a lightweight semantic adapter to enforce feature-level protection, while detecting malicious tokens through feature anomaly backpropagation. Evaluated on mainstream models, the method reduces jailbreak success rates by approximately 20%, adds only 0.1 seconds to inference time, and preserves strong text-video semantic consistency.

Abstract

Text-to-Video (T2V) generative models are vulnerable to jailbreak attacks in real-world deployment, leading them to produce harmful or inappropriate content. Existing defense approaches mainly rely on input filtering or reconstruction, which not only incur high computational latency but also tend to distort semantics. To address these issues, we experimentally and systematically analyze the differences between clean and jailbreak samples in the cross-attention feature space, revealing for the first time a cumulative separation effect and a progressively increasing trend of linear separability between the two during the diffusion process. Based on this insight, we propose SafeCA, a feature-level defense mechanism for safe cross-attention localization and regularization. Firstly, we identify key defensive regions and values through attention stability analysis using cross-attention features collected from clean prompts within a single inference. Secondly, SafeCA mitigates anomalous activations via attention masking with energy normalization and introduces a lightweight semantic-space adapter to redirect abnormal semantic flows. Furthermore, we detect and suppress potentially malicious tokens by back-propagating feature anomaly signals to the input cue words, thereby enhancing the deployability of the defense in commercial models. Experimental results show that SafeCA reduces the jailbreak success rate by about 20% on mainstream T2V models, adds almost no inference overhead (+0.1s), and maintains good text-video semantic consistency. Overall, SafeCA provides an architecture-level, deployable protection paradigm for T2V generation models.

Problem

• Text-to-Video
• jailbreak attacks
• harmful content
• defense
• cross-attention

Innovation

• cross-attention analysis
• feature-level defense
• attention masking
• semantic-space adapter
• jailbreak detection