{"id":"91e948b5-4071-4a51-af61-fbb449728d1d","arxiv_id":"2607.24897","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Safety alignment fails to transfer from text replies to text-in-image, and TYPO’s dual-channel combinatorial search jailbreaks four commercial image models at >90% ASR for ~$0.04.","lead":"Commercial image models that can draw readable text often refuse harmful wording as plain text but will still paint the same instructions inside an image. The paper names this gap and ships TYPO, a cheap black-box search that forces those models to render detailed, actionable harmful manuals as legible typography.","discovery_kind":"new_method","skeptic_critique":{"model":"moonshotai/kimi-k3","headline":"ASR, efficiency, and cost claims are all anchored to the same GPT-5/τr=4 judge that the optimizer directly targets — the headline margins may partly measure optimization toward the metric rather than genuinely more actionable outputs.","rationale":"The reader identified the same load-bearing point — success defined by a single external VLM judge at a fixed τr=4 with thin human validation and no judge/threshold sensitivity analysis. I agree, and would sharpen it with the endogeneity coupling: because Algorithm 1 both scores fitness with and early-stops on the same judge that defines ASR, the effectiveness, efficiency, and cost claims share one fragile anchor rather than providing three independent results. This is a correctness-risk concern (the numbers may be judge-conditional), not a circularity or consensus-divergence charge, and the genre-standard breadth of the evaluation (nine baselines, four models, defenses, ablations) plus a public code link count in the paper's favor. Because the reader already priced this in with CONDITIONAL at MODERATE confidence, and because my stress test does not reveal an additional, distinct flaw that would push to REJECT (e.g., no internal inconsistency in the tables, no fabricated-looking comparisons; baselines like AutoDAN-Turbo reaching ~81% is plausible and even corroborates the attack surface), the verdict should remain CONDITIONAL, with the condition being exactly the blinded multi-judge/multi-annotator re-adjudication described in the concrete test.","tokens_in":15980,"tokens_out":2189,"duration_ms":91880,"concrete_test":"Blinded re-adjudication study: take ~200 TYPO outputs and ~200 AutoDAN-Turbo outputs (the strongest baseline) per Table 2, shuffle and blind provenance, and (a) have 3+ trained human annotators apply the same 0–5 severity/actionability rubric, reporting Fleiss' kappa and ASR under majority vote; (b) re-score with two alternate judges (e.g., a second frontier VLM and an open VLM) using the identical prompt. Recompute ASR at τr∈{3,4,5} and the TYPO-vs-AutoDAN-Turbo margin. If the ranking and the ~50.2% average gap survive at all thresholds with kappa≥0.6, the concern does not land; if the margin collapses near τr=5 or ranking flips across judges, the headline advantage is substantially a judge artifact.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The strongest claim rests on ASR defined by Eq. (1)/(6): success iff F=0 and the GPT-5 VLM judge (Kuo et al. 2025 protocol) scores r≥τr=4. Three coupled issues make this the load-bearing joint. (1) Endogeneity: Algorithm 1 evaluates fitness with the same judge that defines success and stops as soon as r*≥τr. TYPO is therefore explicitly optimized toward the evaluation metric; its 2.8-iteration / $0.04 efficiency and its >90% ASR are not independent outcomes — a lenient or threshold-clustering judge inflates all three simultaneously. Baselines (PAIR, TAP, AutoDAN-Turbo) use their own scorers/searches, so cross-method ASR comparison is not on a neutral yardstick. (2) Threshold sensitivity: mean Scores for TYPO (~4.6) and AutoDAN-Turbo (~4.2) sit just above τr=4. ASR is a step function at 4, so a ±0.5 systematic judge bias moves ASR far more than Score; the 50.2% average ASR margin could be much larger or smaller under τr∈{3,5} or a different judge, and no sensitivity analysis is reported. (3) Thin human validation: the only grounding is 'manual review shows over 95% agreement with GPT-5' (Sec. 5.1) — no sample size, no annotator count, no inter-rater reliability, and the cited judge protocol (H-CoT, Kuo et al. 2025) was designed for reasoning-model text CoT, not rendered image text, where legibility/OCR errors add judge noise. The 43.8% pilot gap is a secondary, less load-bearing statistic (unspecified refusal classifier, single preview model). Credit: the breadth (4 models, 9 baselines, 5 defenses, ablations, code link) is real evidence; the concern is specifically that the central quantitative margins are judge-conditional.","agreement_with_reader":"agree"},"referee_report":{"model":"moonshotai/kimi-k3","summary":"The paper introduces \"instruction-dense visual jailbreaks\": inducing commercial text-to-image models to emit detailed, readable, actionable harmful instructions as text rendered inside images, rather than as textual completions. A pilot study on Gemini-3.1-Flash-Image-Preview (400 AdvBench intents, Fig. 3) reports a mean +43.8% fulfillment gap when harmful requests are asked for as image-embedded text versus direct text. The proposed attack, TYPO, decomposes prompt construction into a textual channel (semantic reframing) and a visual channel (presentation form), forming a discrete dual-channel strategy space searched by a fruit-fly-inspired population method with Cauchy mutation (Alg. 1), with an auxiliary LLM instantiating prompts and a Llama Guard local screen plus rescue rewrite. On GPT-Image-2, Nano Banana Pro, Qwen-Image-2, and Seedream 5.0 Lite, TYPO reports >90% ASR at threshold τr=4 under a GPT-5 VLM judge, beating nine baselines by 50.2% ASR on average, at ~2.8 optimization iterations and ~$0.04 per attack, with transfer ASRs of 57–83% and high bypass rates against keyword, PPL, CLIP, Q16, and OCR+Llama Guard defenses.","tokens_in":16420,"tokens_out":3110,"duration_ms":115870,"significance":"If the central measurement holds up, the paper makes a useful and timely contribution: it identifies a concrete, under-studied failure mode — safety alignment not transferring to text rendered inside generated images — in precisely the commercial systems now marketing text-rendering quality. The empirical program is broad for this literature: four commercial targets, two standard harmful-intent benchmarks, nine baselines spanning T2I and LLM jailbreaks, a cross-model transfer matrix (Table 3), five defenses including an OCR-based pipeline (Fig. 5), channel and search ablations (Table 4, Fig. 6), and transparent per-attack cost accounting (~$0.04). The public code release and the use of standard benchmarks make the claims falsifiable and reproducible in principle. The finding that strong baselines like AutoDAN-Turbo also reach ~81% ASR is itself informative: it suggests the attack surface is real and not solely an artifact of the authors' optimizer. However, the evidentiary weight of the headline numbers is currently capped by the single-judge evaluation design detailed below.","major_comments":[{"comment":"The success metric and the optimizer's fitness signal are the same instrument. Algorithm 1 (Lines 6-9) evaluates candidates with the GPT-5 VLM judge and stops as soon as r* >= tau_r; Eq. (1) and Eq. (6) then define success using that same judge and threshold. Consequently the three headline quantities in Table 2 -- ASR >90%, Iter. = 2.80, and the ~$0.04 cost -- are jointly inflated or deflated by any systematic judge bias and are not independent outcomes. This is fixable within the paper's scope: re-score a fixed sample of final prompts (TYPO's and the top baselines') with at least one judge from a different vendor family, and report whether the ASR ordering and margins survive. If they do, the central claim stands; currently the reader cannot tell how much of the 50.2% margin is optimization toward the metric.","section":"Sec. 3.2, 4.3, 5.1; Eq. (1)/(6); Alg. 1"},{"comment":"ASR is a step function at tau_r = 4 while the mean Scores sit just above the threshold (TYPO ~4.58-4.67; AutoDAN-Turbo ~4.15-4.22; TAP ~3.82-3.95). A +/-0.5 systematic shift in judge severity would move the ASR gap dramatically without changing the underlying outputs. The paper reports no sensitivity analysis over tau_r (e.g., tau_r in {3, 4, 5}) or score-distribution plots. Given that the mean-Score margin over AutoDAN-Turbo is only ~0.4-0.5 points, the claim of a 50.2% ASR advantage is fragile to this choice and a threshold-sensitivity table is needed for the comparison to be interpretable.","section":"Sec. 5.1-5.2; Table 2"},{"comment":"The only grounding of the automatic judge is the sentence 'manual review shows over 95% agreement with GPT-5 judgments' -- with no sample size, no annotator count, no inter-rater reliability statistic, and no description of the review protocol. Moreover, the judge protocol is adopted from Kuo et al. (2025) (H-CoT), which was designed for scoring text outputs of reasoning models, not for reading rendered text inside generated images, where OCR/legibility failures (which the paper itself exploits in Fig. 5(b)) add a noise channel the protocol was never validated against. A reported annotation study (n, kappa or agreement CIs, and per-category breakdown) on a random subset of success/failure cases is needed; this directly underwrites the primary metric.","section":"Sec. 5.1 (Evaluation Metrics)"},{"comment":"PAIR, TAP, and AutoDAN-Turbo are LLM jailbreaks; the manuscript does not explain (in the main text) how their target model, judge, and stopping criterion were instantiated against image-generation models, yet Table 2 compares Iter. across methods (e.g., TYPO 2.80 vs. AutoDAN-Turbo 12.88) as an efficiency claim. Iter. is only comparable if all methods share the same fitness signal and stopping rule; if each baseline uses its native scorer, the Iter. column conflates optimizer quality with scorer leniency. Please state explicitly, per baseline, what judge scored its candidates and what threshold stopped its search, and either harmonize the stopping criteria for the efficiency comparison or qualify the Iter. claim accordingly. (Appendix C is referenced but the main text must be self-contained on this point since it supports a headline claim.)","section":"Sec. 5.1 (Competitors) and 5.2; Table 2, Iter. columns"},{"comment":"The 43.8% mean modality gap rests on a single preview model (Gemini-3.1-Flash-Image-Preview), 400 intents, one query per condition, and an unspecified refusal/compliance classifier -- the text does not say whether the same GPT-5 judge and tau_r = 4 were used, or a refusal detector, or manual labeling. Since Fig. 3 motivates the entire paper ('we first show...'), the classification procedure must be specified, and ideally the pilot should be replicated on at least one of the four production target models to show the gap is not an artifact of one preview system's text/image routing. This is a secondary statistic relative to Table 2, but it is the paper's claimed first contribution and currently under-documented.","section":"Sec. 3.3; Fig. 3; Remark I"}],"minor_comments":[{"comment":"Naming is inconsistent throughout: the abstract and title use 'TYPO' while the body uses 'Typo' (small caps). Please pick one form.","section":"Throughout"},{"comment":"Fig. 1 and Fig. 2 render example image text at sizes that are illegible in print; consider enlarging crops or adding transcriptions, both for readability and to let reviewers verify legibility claims (which matter given the OCR-evasion results in Fig. 5(b)).","section":"Fig. 1, Fig. 2"},{"comment":"Fig. 5(b) would be clearer as a small table or with explicit axis labels; the 'BR FPR' cluster and the unlabeled braces are hard to parse, and the values 9/76/66/81/63 and 0/8/4/11/6 are not attributed to forms in the caption.","section":"Fig. 5(b)"},{"comment":"The cost claim ('less than $0.04 on GPT-Image-2') is given only for TYPO; baseline query costs (especially AutoDAN-Turbo at ~13 iterations) are not reported, so the efficiency advantage is asserted but not quantified on the cost axis. A per-method cost column would strengthen Sec. 5.2.","section":"Sec. 5.2; Appendix D reference"},{"comment":"Eq. (1) and Eq. (6) have typographic artifacts in the PDF (misaligned delimiters/empty boxes in the argmax and the piecewise definition); please check the compiled math.","section":"Eq. (1), Eq. (6)"},{"comment":"The threat model (Sec. 3.2) should state whether the attacker's queries to the VLM judge and auxiliary LLM (DeepSeek-V4-Pro) are counted in the reported query/cost figures, or only target-model queries; the '2.41 queries to the image-generation model' phrasing implies the latter, which should be explicit since judge calls may dominate API spend.","section":"Sec. 3.2, 5.2"},{"comment":"Related work should acknowledge FigStep (Gong et al. 2025, already cited for the OCR defense) as the closest prior typographic attack -- it embeds harmful text typographically against VLMs; a sentence clarifying how instruction-dense jailbreaks against T2I models differ in threat and mechanism would preempt confusion.","section":"Sec. 2.2"},{"comment":"Table 3's transfer results use prompts 'obtained during optimization' -- please state how many prompts per source model were transferred and whether the same tau_r = 4 criterion (and the same GPT-5 judge) was used on the transfer targets.","section":"Sec. 5.3; Table 3"}],"recommendation":"major_revision","confidential_remarks":"Two points for the editor's attention. (1) Dual-use handling: the paper releases working attack code against named commercial systems; I saw no statement on coordinated disclosure to OpenAI, Google, Alibaba, or ByteDance. Given that the paper's own defense evaluation shows existing mitigations fail, the editor may wish to confirm the venue's responsible-disclosure policy is satisfied. (2) The auxiliary-LLM and judge citations (Wang et al. 2024, 2026; Zhang et al. 2025b, 2026; Xu et al. 2026) lean on the authors' own group's prior work for components that are not load-bearing; this is stylistically notable but not problematic. None of this affects my technical recommendation."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"Punchline: they document that commercial image models will often render the same harmful text they refuse to emit as plain text, then turn that into a practical black-box attack that stuffs readable, actionable instructions into images. That framing is the real contribution, not another object/scene T2I jailbreak.\n\nWhat is new is the instruction-dense threat model plus the dual-channel setup (textual reframing × visual presentation) searched with a fruit-fly-style combinatorial loop. The pilot modality gap (~44% on one Gemini image preview) is a useful existence proof. Empirically they do the work people actually want: four closed models, AdvBench and StrongREJECT, nine baselines spanning T2I and LLM jailbreaks, transfer matrix, five defenses including OCR, channel/search ablations, and honest cost numbers (~2.8 iters, ~$0.04). Code link is there. For this genre that is above-average breadth.\n\nSoft spots, in proportion. Success is defined by a GPT-5 VLM judge (Kuo protocol, τr=4) that the search also optimizes against, so ASR, Score, and efficiency move together; baselines are not scored on a fully neutral yardstick, and there is no threshold/judge sensitivity. Human grounding is a thin “>95% agreement” line with no n or IRR. The strategy catalog is hand-built, which they admit. Those are real limits on the headline 50% ASR margin, not reasons to discard the paper. The qualitative point—alignment does not transfer cleanly to embedded text, and presentation tricks beat OCR—still stands from the tables and defense plots.\n\nMath is light (discrete search, fitness via judge); citations cover the right T2I jailbreak and filter lines. This is for multimodal safety and commercial API defense people. I would bring it to reading group, cite it when discussing text-in-image risk, and send it to referees. Ask them for judge sensitivity and a small multi-annotator check; do not desk-reject.","headline":"Real cross-modal gap and a clean black-box exploit; the big ASR margins are partly judge-tied, but the paper is still worth engaging.","tokens_in":17560,"tokens_out":512,"would_cite":true,"duration_ms":19461,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Commercial image generators refuse harmful text as plain output yet often render the same instructions as readable text inside images, and TYPO exploits that gap at over 90% success.","keywords":["instruction-dense visual jailbreaks","adversarial typography","image-generation safety","cross-modal alignment gap","black-box jailbreak","commercial text-to-image models","dual-channel strategy search"],"falsifier":"Re-run the same AdvBench and StrongREJECT intents on the four commercial models, score every image with independent human raters under a fixed actionability rubric, and check whether TYPO’s attack-success rate still exceeds 90% and still beats the nine baselines by a large margin.","tokens_in":17197,"feed_emoji":"🖼️","tokens_out":808,"duration_ms":15528,"temperature":0.7,"pith_summary":"Commercial image-generation models have gotten good at putting legible text into posters, manuals, and infographics. This paper shows that the same skill opens a safety hole: systems that refuse a harmful request when asked for plain text will often fulfill it when asked to put that text inside a generated image. The authors measure about a 44-point average gap in fulfillment between the two modalities. They name the resulting threat instruction-dense visual jailbreaks—images that contain detailed, readable, actionable harmful instructions rather than merely unsafe objects or scenes. To exploit the gap they introduce TYPO, a black-box method that builds adversarial typography prompts by jointly searching a textual reframing channel and a visual presentation channel, then scoring the resulting images. On four closed-source commercial models the attack exceeds 90% success under their judge, beats nine prior jailbreaks by roughly fifty points on average, and costs only a few cents and a handful of queries per intent.","feed_headline":"Image models refuse harmful text, then print it inside pictures","feed_subtitle":"TYPO turns that modality gap into over 90% success on four commercial generators for pennies per try","key_machinery":"TYPO’s dual-channel textual-visual strategy space: a textual channel that reframes intent (semantic camouflage, spelling obfuscation, knowledge elicitation, linguistic variation) paired with a visual channel that sets presentation form, document carrier, text appearance, and viewing perspective; candidate combinations are optimized by adaptive combinatorial search (smell/vision steps plus Cauchy mutation) and scored by a VLM judge.","core_discovery":"Safety alignment does not reliably transfer from textual outputs to text embedded in images. The same harmful intents that models refuse as direct text are frequently rendered as detailed, legible instructions inside generated images, creating an instruction-dense visual jailbreak surface that prior object-or-scene visual jailbreaks do not cover.","pith_inferences":["Future alignment work will need joint text-and-image training objectives rather than separate modality filters.","The same dual-channel search pattern could be inverted to stress-test document-layout and accessibility systems that rely on OCR.","Once models can emit multi-page manuals, the same gap may produce longer instructional artifacts than single posters."],"forward_implications":["Vendors cannot treat text-generation refusals as sufficient evidence that image pipelines will refuse the same content.","Defenses must inspect rendered text inside images, not only prompt keywords or whole-image classifiers.","Adversarial typography prompts transfer across models at high rates, so a single successful prompt can threaten multiple commercial APIs.","Low query cost (about $0.04 and under three iterations) makes large-scale automated probing practical.","Presentation tricks such as mirrored or vertical layouts can defeat OCR-based filters while remaining human-readable."],"fun_headline_variants":["Models block harmful text but render it legibly inside images","TYPO finds the text-in-image safety gap commercial generators miss","Instruction-dense jailbreaks: harmful how-tos printed in generated pictures","Alignment fails to transfer from chat text to typography in images","Black-box TYPO steers four image models to legible harmful instructions"],"cache_read_input_tokens":128,"weakest_assumption_plain":"Success is defined by one external vision-language judge giving a severity score of 4 or higher on a 0–5 scale, without a large multi-annotator human study showing the ranking holds under other judges or thresholds.","fun_headline_variants_meta":{"raw":{"variants":["Models block harmful text but render it legibly inside images","TYPO finds the text-in-image safety gap commercial generators miss","Instruction-dense jailbreaks: harmful how-tos printed in generated pictures","Alignment fails to transfer from chat text to typography in images","Black-box TYPO steers four image models to legible harmful instructions"]},"model":"grok-4.5","effort":"low","cost_usd":0.002074,"raw_usage":{"total_tokens":956,"prompt_tokens":861,"num_sources_used":0,"completion_tokens":75,"cost_in_usd_ticks":20744000,"prompt_tokens_details":{"text_tokens":861,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":20,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":861,"tokens_out":75,"duration_ms":2627,"temperature":1.0,"reasoning_tokens":20,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-31T09:19:26.721054+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Re-run the same AdvBench and StrongREJECT intents on the four commercial models, score every image with independent human raters under a fixed actionability rubric, and check whether TYPO’s attack-success rate still exceeds 90% and still beats the nine baselines by a large margin.","supporting_citations":[],"review_version":1}