TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attacks
Extracted source text · arXiv 2605.01761
\documentclass[lettersize,journal]{IEEEtran}
\usepackage{amsmath,amsfonts}
\usepackage{algorithmic}
\usepackage{algorithm}
\usepackage{array}
\usepackage[caption=false,font=normalsize,labelfont=sf,textfont=sf]{subfig}
\usepackage{textcomp}
\usepackage{stfloats}
\usepackage{url}
\usepackage{verbatim}
\usepackage{graphicx}
\usepackage{cite}
\hyphenation{op-tical net-works semi-conduc-tor IEEE-Xplore}
% updated with editorial comments 8/9/2021
\usepackage{multirow}
\usepackage{amsmath}
\usepackage{amsthm} % 引入定理宏包
% 定义 remark 环境
\theoremstyle{remark} % 设置风格为备注风格（通常是斜体标题，正文为正体）
\newtheorem{remark}{Remark} % 第一个参数是环境名，第二个是显示出来的名字
% \newtheorem{remark}{Remark}[section]
\usepackage{booktabs}
\usepackage{xspace}
\newcommand{\Tref}[1]{Tab.~\ref{#1}}
\newcommand{\Eref}[1]{Eq.~(\ref{#1})}
\newcommand{\Fref}[1]{Fig.~\ref{#1}}
\newcommand{\Sref}[1]{Sec.~\ref{#1}}
\newcommand{\Aref}[1]{Alg.~\ref{#1}}
\newcommand{\Asref}[1]{App.~\ref{#1}}
\newcommand{\el}{\textit{et al}.}
\newcommand{\ul}{\underline}
\newcommand{\eg}{\textit{e.g.}}
\newcommand{\ie}{\textit{i.e.}}
\newcommand{\etc}{\textit{etc.}}
\newcommand{\cf}{\textit{cf.}}
\newcommand{\wrt}{w.r.t.}
% === 投稿接 ===
\usepackage[colorlinks=true, citecolor=green, linkcolor=red, urlcolor=blue]{hyperref}
% === 最终版 ===
% \usepackage[colorlinks=false]{hyperref}
\newcommand{\method}{\textsc{TrajShield}\xspace}
\begin{document}
\title{TrajShield: Trajectory-Level Safety Mediation for Defending Text-to-Video Models Against Jailbreak Attacks}
\author{Quanchen Zou,~Nizhang Li,~Wenxin Zhang,~Jiaye Lin,~Yangchen Zeng,~Xiangzheng Zhang,~and Zonghao Ying%
\thanks{Q. Zou and X. Zhang are with 360 AI Security Lab, Beijing, China.}%
\thanks{N. Li is with the Macau University of Science and Technology, Macau, China.}%
\thanks{W. Zhang is with the University of Chinese Academy of Sciences, Beijing, China.}%
\thanks{J. Lin is with Tsinghua University, Beijing, China.}%
\thanks{Y. Zeng is with Southeast University, Wuxi, China.}%
\thanks{Z. Ying is with Beihang University, Beijing, China.}%
}
% The paper headers
\markboth{Journal of \LaTeX\ Class Files,~Vol.~14, No.~8, August~2021}%
{Shell \MakeLowercase{\textit{et al.}}: A Sample Article Using IEEEtran.cls for IEEE Journals}
%\IEEEpubid{0000--0000/00\$00.00~\copyright~2021 IEEE}
% Remember, if you use this you must call \IEEEpubidadjcol in the second
% column for its text to clear the IEEEpubid mark.
\maketitle
\begin{abstract}
Text-to-Video (T2V) models have demonstrated remarkable capability in generating temporally coherent videos from natural language prompts, yet they also risk producing unsafe content such as violence or explicit material. Existing prompt-level defenses are largely inherited from text-to-image safety and operate on the lexical surface of the input, making them vulnerable to jailbreak attacks that disguise harmful intent through rephrasing or adversarial prompting. Moreover, T2V generation introduces a distinctive challenge overlooked by prior work: \emph{temporally emergent risk}, where a seemingly benign prompt leads to unsafe content through the generator's temporal extrapolation toward narrative coherence. We propose \method{}, a training-free, inference-time defense framework that reformulates T2V safety as a causal intervention in a temporally structured semantic space. \method{} handles explicit unsafe prompts, jailbreak attacks, and temporally emergent risks in a unified manner by simulating the implied trajectory of a prompt, localizing the causal origin of potential risk, and applying a minimally invasive rewrite that neutralizes the risk while preserving safety-irrelevant semantics. Experiments on T2VSafetyBench across 14 safety categories and multiple T2V backends demonstrate that \method{} achieves state-of-the-art defenseive performance while maintaining high semantic fidelity, substantially outperforming existing defenses, with an average ASR reduction of 52.44\%.
\end{abstract}
\begin{IEEEkeywords}
Text-to-Video, Jailbreak Attack, Temporally Emergent Risk.
\end{IEEEkeywords}
\section{Introduction}
\label{sec:intro}
\begin{figure}[!t]
\centering
\includegraphics[width=\linewidth]{imgs/front.pdf}
\caption{Example of the defense effect of \method{}.}
\label{fig:front_example}
\end{figure}
Text-to-Video (T2V) generation \cite{wang2026customvideo,zhao2024ta2v} has advanced rapidly, with models such as Sora \cite{openai_sora}, Kling \cite{kling_ai}, and Seedance \cite{seedance2025seedance} capable of synthesizing temporally coherent, visually compelling videos from natural language prompts. As these systems become publicly accessible, ensuring the safety of their outputs has emerged as a critical and urgent challenge. This includes preventing the generation of violent, sexually explicit, or otherwise harmful content \cite{miao2024t2vsafetybench}.
Existing safety mechanisms for generative models fall into two broad categories. \emph{Post-hoc} defenses apply classifiers or filters to the generated output, rejecting or blurring unsafe frames after the computationally expensive generation process has already completed \cite{chen2024safewatch}. \emph{Prompt-level} defenses intervene before generation by analyzing or modifying the input text, offering substantially lower computational cost \cite{liang2026t2vshield,Detoxify}. However, current prompt-level approaches overwhelmingly rely on \emph{lexical} safety signals: they match against blacklists of unsafe keywords, train classifiers on surface-level textual features, or apply generic large language model (LLM) rewriting to sanitize the prompt. These methods were originally developed for text-to-image (T2I) safety and have been carried over to the video setting with minimal adaptation \cite{zhao2023multi,ye2023recurrent,cheng2022vision}.
This direct transfer overlooks a fundamental distinction between image and video generation. An image is a \emph{static} snapshot; all safety-relevant content must be present in the prompt's explicit semantics. A video, by contrast, is a \emph{temporal process} \cite{ji2024t2vbench}. A T2V model does not merely render a scene. It must \emph{extrapolate a plausible causal trajectory} over time to produce temporally coherent motion. This extrapolation introduces a category of risk that has no counterpart in image generation: \emph{temporally emergent risk}. A prompt such as ``two men in a heated argument in a parking lot'' contains no overtly harmful language and would pass any keyword filter or text classifier. Yet a T2V model, in service of narrative coherence, will plausibly escalate the depicted interaction. It may show raised voices and aggressive gestures, and it may eventually depict physical contact. This can generate unsafe frames that were never explicitly specified in the input. The risk is \emph{invisible at the prompt level} and only materializes through the generator's temporal unfolding.
Temporally emergent risk exposes a structural blind spot in the current defense paradigm. Lexical defenses cannot detect what is not written. Post-hoc filters can catch the resulting unsafe frames but only after the full generation cost has been incurred, and they provide no mechanism to \emph{redirect} the generation toward safe content. What is needed is a defense that can \emph{anticipate} the temporal trajectory a T2V model will produce and \emph{identify} the causal origin of the emerging risk within that trajectory. It must also \emph{intervene} with minimal perturbation, all before a single frame is rendered.
In this paper, we propose \method{}, a training-free, inference-time defense framework that reformulates T2V safety as a \emph{causal intervention} problem in a temporally structured semantic space. Rather than operating on the lexical surface of the prompt, \method{} \emph{simulates} the implied temporal trajectory of the input, \emph{localizes} the earliest point at which the trajectory diverges toward unsafe content, and \emph{rewrites} only the necessary portion of the trajectory while preserving all safety-irrelevant semantics. To this end, the framework decomposes the prompt into static scene context and dynamic action trajectory, performs hierarchical risk assessment along the trajectory to identify the causal origin of the risk, and generates a minimally invasive counterfactual trajectory that neutralizes the identified risk while rigidly preserving the original scene and creative intent. The entire pipeline operates purely at the prompt level, requires no access to generator internals or additional training. As illustrated in \Fref{fig:front_example}, the absence of a defense mechanism can lead to the generation of unsafe video content, particularly in the later frames. In contrast, \method{} effectively suppresses such unsafe video outcomes.
We evaluate \method{} on the T2VSafetyBench benchmark \cite{miao2024t2vsafetybench} across 14 safety-sensitive categories, using 6 T2V models. Experimental results demonstrate that \method{} achieves state-of-the-art defense performance, reducing the ASR by up to 54.36\% compared to existing prompt-level baselines, while maintaining high semantic fidelity to the original creative intent.
Our main contributions are summarized as follows:
\begin{itemize}
\item We identify \emph{temporally emergent risk} as a distinctive and previously overlooked threat in T2V generation, where seemingly benign prompts produce unsafe video content through the generator's temporal extrapolation toward narrative coherence. We show that this category of risk systematically evades existing prompt-level defenses.
\item We propose \method{}, a training-free, inference-time defense framework that unifies the handling of explicit unsafe prompts, jailbreak attacks, and temporally emergent risks. \method{} achieves this through temporal trajectory simulation, causal risk localization, and minimally invasive counterfactual rewriting, neutralizing unsafe semantics while preserving safety-irrelevant content.
\item We demonstrate through comprehensive experiments on T2VSafetyBench across 14 safety categories and multiple T2V models that \method{} substantially outperforms existing defenses in safety rate while maintaining high semantic fidelity, and validate the contribution of each component through detailed ablation studies.
\end{itemize}
\section{Related Work}
\label{sec:related_work}
\subsection{Text-to-Video Generation}
The field of T2V generation has witnessed remarkable progress with the advent of large-scale diffusion models \cite{chung2024style,kwon2026hierarchicalprune} and transformer architectures \cite{vaswani2017attention}. Early approaches primarily relied on adapting Text-to-Image (T2I) models, such as Stable Diffusion \cite{rombach2022high}, by introducing temporal layers to model motion dynamics \cite{blattmann2023stable,wang2023modelscope}. Subsequent works improved temporal coherence and resolution through latent diffusion frameworks \cite{ho2022video,singer2022make}. More recently, unified architectures like Sora \cite{brooks2024video} and commercial models (\eg, Seedance \cite{gao2025seedance}, Veo \cite{deepmind_veo_model_card}) have demonstrated exceptional capabilities in simulating complex physical world dynamics and long-range temporal dependencies. Despite these strides in generation quality, the safety alignment of these models has significantly lagged behind \cite{miao2024t2vsafetybench}. While T2I safety has been extensively studied, the unique spatiotemporal nature of video generation remains a largely unexplored frontier. In video generation, semantics evolve causally over time, posing new challenges for defense mechanisms.
\subsection{Safety in Generative Models}
As generative models become more prevalent, ensuring their safety against jailbreak attacks and misuse has become a critical research focus. In the T2I domain, defenses typically fall into two categories: training-based methods, such as concept erasing \cite{chen2025trce,lu2024mace} and safety fine-tuning \cite{lei2025personalized}, and inference-time interventions, such as safety guidance \cite{li2025detect,qi2025safeguider} and prompt rewriting \cite{yang2024guardt2i}. However, directly adapting these T2I defenses to the T2V domain is suboptimal. Existing T2V safety measures are currently limited, with T2VShield being the only comprehensive framework designed to mitigate jailbreak threats in text-to-video models \cite{liang2026t2vshield}. T2VShield introduces prompt rewriting and multi-scope detection mechanisms to mitigate risks in text-to-video generation. These modules fail to account for \textit{temporally emergent risks}, where harmful content arises from the causal progression of events rather than explicit static tokens. Recent studies have begun to expose the vulnerability of T2V models to jailbreak attacks \cite{liu2025t2v,lee2025jailbreaking,ying2025veil}, yet a structured defense framework capable of reasoning over temporal dynamics remains absent.
\section{Problem Formulation}
\label{subsec:problem_formulation}
Let $\mathcal{G}$ denote a T2V generator that maps a textual prompt $\mathcal{P}$ to a video $\mathcal{V} = \{v_1, v_2, \dots, v_T\}$ of $T$ frames. We identify two structurally distinct categories of safety risk. The distinction is based on where the risk is observable, either at the prompt level or only after temporal unfolding.
\subsection{Explicit Risk}
The prompt $\mathcal{P}$ contains overtly unsafe semantic content. This includes references to graphic violence, NSFW material, or dangerous activities. From such content, one can directly infer that the generated video will contain harmful frames without reasoning about temporal dynamics. We capture this with a \emph{static} safety predicate $\mathcal{S}_{\text{stat}}: \mathbb{V} \to \{0,1\}$ that flags per-frame violations:
\begin{equation}
\label{eq:static_risk}
R_{\text{stat}}(\mathcal{V}) \;=\; \max_{t \in [1,T]}\; \mathcal{S}_{\text{stat}}(v_t).
\end{equation}
Such risks are, in principle, detectable by inspecting $\mathcal{P}$ alone, and existing keyword- or classifier-based defenses are designed primarily for this category.
\subsection{Temporally Emergent Risk}
The prompt $\mathcal{P}$ appears benign or ambiguous on its surface, yet the T2V model in producing a temporally coherent video, naturally evolves the depicted scene along a plausible causal trajectory that culminates in unsafe content. For instance, ``two men in a heated argument in a parking lot'' contains no explicitly harmful language. However, a T2V model may plausibly escalate the interaction to maintain narrative coherence. It can depict raised voices and aggressive gestures, and it may eventually show physical contact. This process can generate unsafe frames that were never overtly specified. We formalize this with a \emph{dynamic} safety predicate $\mathcal{S}_{\text{dyn}}: \mathbb{V}^{+} \to \{0,1\}$ that evaluates temporal subsequences:
\begin{equation}
\label{eq:dynamic_risk}
R_{\text{dyn}}(\mathcal{V}) \;=\; \max_{1 \le t_1 < t_2 \le T}\; \mathcal{S}_{\text{dyn}}(v_{t_1:t_2}).
\end{equation}
The defining characteristic of this category is that the risk is \emph{invisible at the prompt level} and only materializes through the generator's temporal extrapolation. This makes it fundamentally harder to defend against: the harmful content is not written by the user but generated by the model in service of temporal coherence. It is precisely this category that existing prompt-level defenses systematically fail to address.
\subsection{Defense objective}
A video is deemed unsafe if either risk type is present: $R_{\text{stat}}(\mathcal{V}) = 1 \lor R_{\text{dyn}}(\mathcal{V}) = 1$. We seek a prompt-level intervention $f_{\text{shield}}$ that produces
\begin{equation}
\label{eq:defense_objective}
\mathcal{P}^* = f_{\text{shield}}(\mathcal{P}), \quad \text{s.t.}\;\; R_{\text{stat}}\!\bigl(\mathcal{G}(\mathcal{P}^*)\bigr) = 0 \;\wedge\; R_{\text{dyn}}\!\bigl(\mathcal{G}(\mathcal{P}^*)\bigr) = 0,
\end{equation}
while minimizing the semantic divergence between $\mathcal{P}^*$ and the benign communicative intent of $\mathcal{P}$. Since materializing the temporally emergent risk requires actually running $\mathcal{G}$, which is computationally prohibitive at defense time, \method{} instead \emph{simulates} the implied temporal trajectory entirely in the semantic space and intervenes \emph{prior to} generation.
\section{Methodology}
\label{sec:method}
\begin{figure*}[!t]
\centering
\includegraphics[width=\linewidth]{imgs/main.pdf}
\caption{The overall pipeline of our proposed \method{}, which consists of Motion-Semantic Decoupling, Temporal Risk Propagation Graph, and Temporally-Consistent Safe Rewriting to effectively defend T2V models against jailbreak attacks.}
\label{fig:pipeline}
\end{figure*}
\subsection{Overview}
\label{subsec:overview}
Existing prompt-level defenses primarily operate on the lexical surface of $\mathcal{P}$, such as keyword matching, token perturbation, or generic LLM-based rewriting. This design limits their ability to capture risks that are \emph{lexically latent yet temporally emergent}, where a prompt contains no explicit harmful words but implicitly specifies an action trajectory that becomes unsafe as the video evolves over time. \method{} bridges this gap by casting T2V safety as a \emph{causal intervention} in a temporally structured semantic space.
The core idea is to \emph{simulate} the implied temporal trajectory of a prompt \emph{before} generation, \emph{localize} the earliest causal origin of the risk within that trajectory, and \emph{intervene} on the trajectory with surgically minimal perturbation.
As illustrated in \Fref{fig:pipeline}, the framework comprises three sequential stages:
\begin{enumerate}
\item \textbf{Motion-Semantic Decoupling (\Sref{subsec:msd})} factorizes $\mathcal{P}$ into three components. These include an invariant spatial context $\mathcal{E}$, a discretized action trajectory $\mathcal{T}$, and an intent anchor $\mathcal{I}$. This decomposition separates \emph{what the scene looks like} from \emph{what happens over time}.
\item \textbf{Temporal Risk Propagation (\Sref{subsec:trpg})} unrolls $\mathcal{T}$ in the semantic space, applies hierarchical risk assessment at each temporal anchor, and identifies the earliest risk trigger point $t_r$ together with a declarative safe constraint $\mathcal{C}$.
\item \textbf{Temporally-Consistent Safe Rewriting (\Sref{subsec:tcsr})} generates a counterfactual trajectory that branches away from the unsafe escalation at $t_r$ while rigidly preserving $\mathcal{E}$ and $\mathcal{I}$, and assembles the final safe prompt $\mathcal{P}^*$.
\end{enumerate}
The complete algorithmic flow is given in \Aref{alg:pipeline}.
\subsection{Motion-Semantic Decoupling (MSD)}
\label{subsec:msd}
\paragraph{Motivation.}
T2V prompts entangle static scene attributes (\eg, subjects, environment, cinematography) with temporal dynamics (\eg, actions, interactions, state changes) in a single unstructured sentence. A defense that edits such a sentence holistically risks \emph{collateral semantic drift}: neutralizing a risky action may inadvertently alter character identities or visual atmosphere. MSD prevents this by factorizing $\mathcal{P}$ into conditionally independent components so that downstream modules can intervene on dynamics \emph{alone}.
\paragraph{Structural decomposition.}
MSD parses $\mathcal{P}$ into a structured triplet:
\begin{equation}
\label{eq:msd}
\bigl(\mathcal{E},\;\mathcal{T},\;\mathcal{I}\bigr) \;=\; f_{\text{MSD}}(\mathcal{P}).
\end{equation}
\noindent\textit{(i) Invariant spatial context} $\mathcal{E} = (E_{\text{sub}},\, E_{\text{env}},\, E_{\text{sty}})$ captures all temporally stationary elements: subject descriptions ($E_{\text{sub}}$), environmental setting ($E_{\text{env}}$), and cinematic style cues ($E_{\text{sty}}$). By isolating $\mathcal{E}$ as a \emph{frozen anchor}, we guarantee that subject identity, scene layout, and visual tone remain invariant under any downstream rewriting.
\noindent\textit{(ii) Action trajectory} $\mathcal{T} = (s_0,\, s_1,\, \dots,\, s_N)$ is a temporally ordered sequence of $N{+}1$ scene states that captures the dynamic progression implied by $\mathcal{P}$.
T2V prompts are frequently \emph{temporally underspecified}: a user may write ``two men arguing'' without articulating the intermediate escalation or terminal outcome. Yet the generator must hallucinate the full progression. Dynamic risks emerge precisely in these \emph{unwritten} segments. MSD therefore performs \emph{implicit dynamics extrapolation}. It infers a plausible temporal arc and discretizes it into ordered states.
We use $N{=}2$ throughout, yielding a beginning--midpoint--conclusion structure:
\begin{equation}
\label{eq:trajectory}
\mathcal{T} = \bigl(s_0^{[\text{init}]},\; s_1^{[\text{mid}]},\; s_2^{[\text{end}]}\bigr).
\end{equation}
This granularity matches the typical duration of current T2V outputs while keeping downstream risk propagation tractable.
\noindent\textit{(iii) Intent anchor} $\mathcal{I}$ is a concise distillation of the user's core creative goal, abstracted away from potentially harmful specifics (\eg, ``depict a tense interpersonal confrontation''). $\mathcal{I}$ serves as a semantic regularizer during rewriting: the safe prompt $\mathcal{P}^*$ must remain faithful to $\mathcal{I}$.
\paragraph{Relation to static risk.}
MSD also facilitates early static risk detection. The structured fields $E_{\text{sub}}$ and $E_{\text{env}}$ surface explicitly unsafe entities (\eg, weapons, NSFW descriptors) in an interpretable format, enabling fast screening that corresponds to $\mathcal{S}_{\text{stat}}$ in \Eref{eq:static_risk} before the more expensive temporal analysis.
\subsection{Temporal Risk Propagation Graph (TRPG)}
\label{subsec:trpg}
TRPG takes the decoupled representation $(\mathcal{E}, \mathcal{T}, \mathcal{I})$ and determines (i)~\emph{whether} the trajectory entails unsafe content and (ii)~\emph{where} the risk causally originates. The entire analysis is conducted in the semantic space. No video frames are rendered.
\subsubsection{Trajectory Rollout}
\label{subsubsec:rollout}
TRPG models the action trajectory as a context-conditioned Markov chain. Starting from $s_0$, each subsequent state is predicted as:
\begin{equation}
\label{eq:rollout}
\hat{s}_k = f_{\text{roll}}\!\bigl(\hat{s}_{k-1},\;\mathcal{E}\bigr), \quad k = 1, \dots, N,
\end{equation}
where $f_{\text{roll}}$ infers the most probable next state given the current state and spatial context. When MSD has already extracted fully specified states, TRPG adopts them directly ($\hat{s}_k = s_k$); when the trajectory is underspecified, TRPG completes it via additional rollout.
\subsubsection{Hierarchical Risk Assessment}
\label{subsubsec:risk_scoring}
At each temporal anchor $k$, TRPG evaluates risk along three complementary dimensions that jointly cover the full spectrum of safety violations:
\begin{itemize}
\item \textbf{Content risk} $r_k^{(c)} \in [0,1]$: whether the instantaneous state $\hat{s}_k$ contains or implies harmful content in isolation (\eg, explicit violence, NSFW material), corresponding to $\mathcal{S}_{\text{stat}}$.
\item \textbf{Transition risk} $r_k^{(t)} \in [0,1]$: whether the directed change $\hat{s}_{k-1} \to \hat{s}_k$ constitutes a causal escalation toward harm, even if neither endpoint is independently unsafe. This directly operationalizes $\mathcal{S}_{\text{dyn}}$.
\item \textbf{Prospective risk} $r_k^{(p)} \in [0,1]$ measures whether the trajectory, if continued unimpeded from $\hat{s}_k$, would reach an unsafe terminal state. It provides forward-looking threat anticipation.
\end{itemize}
The composite risk at anchor $k$ is defined as the maximum over the three dimensions:
\begin{equation}
\label{eq:risk_aggregation}
r_k \;=\; \max\!\bigl(r_k^{(c)},\; r_k^{(t)},\; r_k^{(p)}\bigr).
\end{equation}
The max-aggregation reflects a \emph{conservative} safety posture: a state is flagged as risky if \emph{any} individual dimension signals danger. This is parameter-free. It is also aligned with the principle that safety violations along different axes are non-compensatory. A low content risk should not offset a high escalation risk.
The predecessor state $\hat{s}_{k-1}$ in the transition risk $r_k^{(t)}$ is essential for detecting \emph{escalation} patterns invisible to per-state analysis. The transition from ``heated verbal argument'' to ``physical shoving'' may appear benign at each endpoint individually but constitutes a dangerous causal progression when viewed as a directed change.
\subsubsection{Causal Attribution and Trigger Identification}
\label{subsubsec:attribution}
A trajectory is flagged as unsafe when any temporal anchor's composite risk exceeds the safety threshold $\tau$. The \emph{risk trigger point} is the earliest such anchor:
\begin{equation}
\label{eq:trigger}
t_r \;=\; \min\bigl\{k \in \{0, 1, \dots, N\} \mid r_k \ge \tau\bigr\}.
\end{equation}
If no anchor exceeds $\tau$, the prompt is classified as safe and forwarded to $\mathcal{G}$ unmodified, avoiding unnecessary intervention on benign inputs. The trigger point $t_r$ provides an interpretable \emph{causal attribution}: it pinpoints the earliest moment at which the trajectory departs from safety, rather than issuing an opaque binary rejection.
\subsubsection{Safe Constraint Derivation}
\label{subsubsec:constraint}
Upon identifying $t_r$, TRPG derives a declarative \emph{safe constraint} $\mathcal{C}$ that encodes the minimal counterfactual intervention required to neutralize the risk:
\begin{equation}
\label{eq:constraint}
\mathcal{C} = \Psi\!\bigl(\hat{s}_{t_r},\;\hat{s}_{t_r-1},\;\mathcal{E},\;\mathcal{I}\bigr),
\end{equation}
where $\Psi$ analyzes the causal mechanism of the flagged transition and produces a structured directive with two components: (a)~\emph{what must change}: the specific unsafe behavioral pattern to be neutralized, such as ``physical contact must be avoided'', and (b)~\emph{what must be preserved}: the benign trajectory prefix $\hat{\mathcal{T}}_{<t_r}$, the intent $\mathcal{I}$, and the narrative tone. The constraint $\mathcal{C}$ thus defines a \emph{safe behavioral envelope}: the space of trajectory continuations that satisfy safety requirements while remaining maximally faithful to the original narrative.
\subsection{Temporally-Consistent Safe Rewriting (TCSR)}
\label{subsec:tcsr}
TCSR takes the trigger point $t_r$, the safe constraint $\mathcal{C}$, and the decoupled representation $(\mathcal{E}, \mathcal{T}, \mathcal{I})$, and synthesizes a safe prompt $\mathcal{P}^*$. The central challenge is to neutralize the identified risk without inducing \emph{semantic drift}. Such drift includes unintended changes to subject identity, visual atmosphere, or narrative coherence that degrade generation quality. TCSR addresses this through two complementary mechanisms: invariant context anchoring and constrained counterfactual trajectory substitution.
\subsubsection{Invariant Context Anchoring}
\label{subsubsec:anchoring}
The spatial context $\mathcal{E} = (E_{\text{sub}}, E_{\text{env}}, E_{\text{sty}})$ is \emph{hard-locked} as immutable during rewriting. All subject identities, environmental details, and stylistic specifications are carried over verbatim into $\mathcal{P}^*$. This anchoring eliminates the primary source of semantic drift in existing rewriting approaches. It ensures that the safe prompt describes the \emph{same scene}. Only the temporal progression changes.
\subsubsection{Constrained Counterfactual Trajectory Substitution}
\label{subsubsec:substitution}
TCSR generates an alternative action trajectory $\mathcal{T}^* = (s_0^*, s_1^*, \dots, s_N^*)$ that satisfies four jointly enforced constraints:
\begin{enumerate}
\item \textbf{Safety compliance:} $\mathcal{T}^*$ must satisfy the safe constraint $\mathcal{C}$, ensuring all flagged risk patterns are neutralized.
\item \textbf{Prefix preservation:} $s_k^* = s_k$ for all $k < t_r$. The benign trajectory prefix is retained exactly, confining modifications to the minimal necessary suffix.
\item \textbf{Action-semantic proximity:} the substituted states preserve the interaction type, genre conventions, and spatial configuration of the original trajectory wherever consistent with safety. For example, a physical altercation is replaced with an intense verbal standoff rather than an unrelated peaceful scene.
\item \textbf{Intent fidelity:} $\mathcal{T}^*$ remains semantically compatible with the intent anchor $\mathcal{I}$, ensuring the user's core creative goal is respected.
\end{enumerate}
These constraints collectively define a \emph{minimal counterfactual}: the resulting trajectory departs from the original only where causally necessary to prevent the safety violation, and nowhere else.
\subsubsection{Prompt Assembly}
\label{subsubsec:assembly}
The safe prompt is assembled by composing the frozen spatial context with the counterfactual trajectory:
\begin{equation}
\label{eq:assembly}
\mathcal{P}^* = f_{\text{assemble}}\!\bigl(\mathcal{E},\;\mathcal{T}^*\bigr).
\end{equation}
The assembly function produces a fluent natural language prompt suitable for the target T2V model, ensuring $\mathcal{P}^*$ reads as a coherent scene description rather than a mechanical concatenation of fragments.
\begin{algorithm}[t]
\caption{\method{} Defense Pipeline}
\label{alg:pipeline}
\begin{algorithmic}[1]
\REQUIRE Input prompt $\mathcal{P}$, T2V generator $\mathcal{G}$, risk threshold $\tau$
\ENSURE Safe video $\mathcal{V}^*$
\STATE \textbf{--- Stage 1: Motion-Semantic Decoupling ---}
\STATE $(\mathcal{E},\;\mathcal{T},\;\mathcal{I}) \leftarrow f_{\text{MSD}}(\mathcal{P})$
\hfill $\triangleright$ $\mathcal{E}{=}(E_{\text{sub}}, E_{\text{env}}, E_{\text{sty}})$;\; $\mathcal{T}{=}(s_0, \dots, s_N)$
\STATE
\STATE \textbf{--- Stage 2: Temporal Risk Propagation ---}
\FOR{$k = 0$ \TO $N$}
\STATE Evaluate content risk $r_k^{(c)}$, transition risk $r_k^{(t)}$, prospective risk $r_k^{(p)}$
\STATE $r_k \leftarrow \max\!\bigl(r_k^{(c)},\; r_k^{(t)},\; r_k^{(p)}\bigr)$
\ENDFOR
\STATE $t_r \leftarrow \min\{k \mid r_k \ge \tau\}$
\IF{$t_r$ is undefined}
\RETURN $\mathcal{G}(\mathcal{P})$ \hfill $\triangleright$ Benign prompt; pass through
\ENDIF
\STATE $\mathcal{C} \leftarrow \Psi\!\bigl(\hat{s}_{t_r},\;\hat{s}_{t_r-1},\;\mathcal{E},\;\mathcal{I}\bigr)$ \hfill $\triangleright$ Safe constraint
\STATE
\STATE \textbf{--- Stage 3: Temporally-Consistent Safe Rewriting ---}
\STATE Lock $\mathcal{E}$ as immutable context \hfill $\triangleright$ Invariant anchoring
\STATE Generate $\mathcal{T}^*$ subject to $\mathcal{C}$, prefix preservation, and intent fidelity
\STATE $\mathcal{P}^* \leftarrow f_{\text{assemble}}\!\bigl(\mathcal{E},\;\mathcal{T}^*\bigr)$
\RETURN $\mathcal{G}(\mathcal{P}^*)$
\end{algorithmic}
\end{algorithm}
\section{Experiments}
\label{sec:experiments}
\subsection{Experimental Setup}
\label{subsec:exp_setup}
\subsubsection{Datasets}
\label{subsubsec:datasets}
We evaluate \method{} using two unsafe prompt sets and one benign prompt set. The unsafe prompts are drawn from T2VSafetyBench \cite{miao2024t2vsafetybench} and SafeWatch \cite{chen2024safewatch}, covering both benchmarked safety categories and real-world unsafe scenarios, while the benign prompts are sampled from MSVD \cite{chen2011collecting} to assess generation quality preservation on safe inputs.
Specifically, from T2VSafetyBench we select 50 naive unsafe prompts per category across its 14 safety-critical categories (700 prompts in total), following prior work \cite{ying2025veil,lee2025jailbreaking,liu2025t2v}. This choice avoids confounding effects introduced by adversarially obfuscated prompts and enables a controlled evaluation of defense effectiveness. To further assess robustness under realistic conditions, we additionally sample 50 prompts from SafeWatch, which contains naturally occurring unsafe content. For benign evaluation, we randomly sample 300 prompts from MSVD, consisting of everyday activities without safety concerns, to measure whether \method{} preserves semantic fidelity on legitimate requests.
\subsubsection{Evaluation Metrics}
\label{subsubsec:metrics}
We adopt four evaluation metrics to separately assess \emph{safety efficacy} on unsafe prompts and \emph{generation quality preservation} on benign prompts. For safety evaluation, we report Attack Success Rate measured by both an automated MLLM-as-a-Judge protocol (ASR) and human annotations (ASR-H). ASR reflects whether generated videos are judged to contain harmful content corresponding to the intended risk category, while ASR-H, obtained via majority voting from three independent annotators, serves as the gold-standard metric to validate the reliability of automated judgments.
To evaluate generation quality on benign prompts, we measure semantic alignment and temporal coherence of the generated videos. Specifically, we use CLIP Similarity (CS) \cite{radford2021learning} to assess prompt–video semantic consistency, and Temporal Consistency (TC) \cite{varghese2020unsupervised} to evaluate the smoothness and coherence of video content along the time dimension. Detailed evaluation protocols for these metrics are provided in supplementary material.
An effective defense is expected to achieve low ASR and ASR-H while maintaining high CS and TC.
\subsubsection{Compared Methods}
\label{subsubsec:baselines}
We evaluate \method{} under both attack and defense settings. For robustness evaluation, we consider a diverse set of representative jailbreak attack methods covering both T2I and T2V scenarios, including RAB \cite{tsai2023ring}, DACA \cite{deng2023divide}, SceneSplit \cite{lee2025jailbreaking}, and SPARK \cite{ying2025veil}. These methods span different attack paradigms such as prompt perturbation, intent decomposition, and structural manipulation.
On the defense side, we compare \method{} against three representative baselines from different design paradigms: a rule-based Keyword Blacklist approach \cite{yang2024sneakyprompt}, a classifier-based Semantic Analysis method using Toxic-BERT \cite{Detoxify}, and a generation-based LLM Rewriting strategy that attempts to sanitize unsafe prompts while preserving their original intent.
\begin{figure*}[!t]
\centering
\subfloat[Aspect: Disturbing Content]{\includegraphics[width=0.32\textwidth]{imgs/demo1.pdf}\label{fig:sub_a}}
\hfill
\subfloat[Aspect: Illegal Activities]{\includegraphics[width=0.32\textwidth]{imgs/demo2.pdf}\label{fig:sub_b}}
\hfill
\subfloat[Aspect: Dynamic Variation]{\includegraphics[width=0.32\textwidth]{imgs/demo3.pdf}\label{fig:sub_c}}
\caption{Qualitative comparison of video generation before and after applying \method{}. We randomly select prompts from three unsafe categories in T2VSafetyBench to demonstrate the effectiveness of our defense.}
\label{fig:three_subfigs}
\end{figure*}
\subsubsection{Target Models}
\label{subsubsec:target_models}
We evaluate \method{} across 6 popular T2V models, including both commercial and open-source systems, to demonstrate its generalizability. Specifically, our target models are Pixverse 5.5 \cite{pixverse_platform}, Hailuo 2.3 \cite{hailuo23}, Kling 2.1 \cite{kling_ai}, Seedance 1.5 Pro \cite{seedance2025seedance}, as well as Veo 3.1 \cite{google_veo3.1_generate_preview_2026} and Sora 2 \cite{openai_sora2_2025}.
\subsubsection{Implementation Details}
\label{subsubsec:impl_details}
In our method, DeepSeek-V3 \cite{liu2024deepseek} is used as the default backbone LLM, and GPT-4o \cite{hurst2024gpt} is used as the default MLLM, unless otherwise stated. The temporal trajectory is discretized into three distinct stages ($N=2$) to balance computational efficiency with temporal granularity. Comprehensive implementation details are provided in supplementary material.
\subsection{Main Results on T2VSafetyBench}
\begin{table*}[!t]
\centering
\caption{Performance comparison of different models under direct attack and our defense scenarios in T2VSafetyBench.}
\label{tab:main}
\small % 稍微缩小字体以显得更加精致
\resizebox{\textwidth}{!}{
\begin{tabular}{@{} l *{6}{c} *{6}{c} @{}}
\toprule
\multirow{2}{*}{Aspect} & \multicolumn{6}{c}{Attack (\%)} & \multicolumn{6}{c}{Defense (\%)} \\
\cmidrule(lr){2-7} \cmidrule(l){8-13}
& Pixverse & Hailuo & Kling & Seedance & Veo & Sora & Pixverse & Hailuo & Kling & Seedance & Veo & Sora \\
\midrule
Pornography & 80.00 & 68.00 & 88.00 & 88.00 & 44.00 & 96.00 & 12.00 & 14.00 & 10.00 & 10.00 & 18.00 & 18.00 \\
Borderline Pornography & 74.00 & 60.00 & 58.00 & 74.00 & 66.00 & 82.00 & 10.00 & 24.00 & 14.00 & 16.00 & 20.00 & 28.00 \\
Violence & 94.00 & 80.00 & 56.00 & 86.00 & 88.00 & 92.00 & 26.00 & 22.00 & 22.00 & 28.00 & 24.00 & 16.00 \\
Gore & 82.00 & 98.00 & 92.00 & 100.00 & 92.00 & 100.00 & 28.00 & 14.00 & 20.00 & 18.00 & 16.00 & 32.00 \\
Disturbing Content & 82.00 & 86.00 & 74.00 & 82.00 & 88.00 & 88.00 & 10.00 & 26.00 & 18.00 & 28.00 & 14.00 & 22.00 \\
Public Figures & 48.00 & 22.00 & 16.00 & 24.00 & 84.00 & 92.00 & 12.00 & 16.00 & 10.00 & 22.00 & 10.00 & 22.00 \\
Discrimination & 48.00 & 66.00 & 42.00 & 62.00 & 54.00 & 82.00 & 28.00 & 34.00 & 20.00 & 20.00 & 22.00 & 24.00 \\
Political Sensitivity & 68.00 & 78.00 & 68.00 & 70.00 & 80.00 & 88.00 & 16.00 & 20.00 & 24.00 & 12.00 & 12.00 & 20.00 \\
Copyright & 30.00 & 26.00 & 12.00 & 36.00 & 12.00 & 74.00 & 4.00 & 16.00 & 14.00 & 20.00 & 14.00 & 14.00 \\
Illegal Activities & 80.00 & 94.00 & 74.00 & 80.00 & 92.00 & 94.00 & 16.00 & 24.00 & 20.00 & 18.00 & 18.00 & 18.00 \\
Misinformation & 80.00 & 86.00 & 50.00 & 76.00 & 78.00 & 94.00 & 14.00 & 12.00 & 28.00 & 26.00 & 8.00 & 28.00 \\
Sequential Action & 62.00 & 54.00 & 28.00 & 56.00 & 66.00 & 92.00 & 18.00 & 12.00 & 12.00 & 12.00 & 18.00 & 14.00 \\
Dynamic Variation & 76.00 & 74.00 & 20.00 & 68.00 & 70.00 & 98.00 & 13.00 & 10.00 & 20.00 & 10.00 & 16.00 & 22.00 \\
Coherent Contextual & 76.00 & 72.00 & 42.00 & 76.00 & 70.00 & 98.00 & 12.00 & 10.00 & 14.00 & 16.00 & 14.00 & 14.00 \\
\midrule
\textbf{Avg.} & \textbf{70.00} & \textbf{68.86} & \textbf{51.43} & \textbf{69.86} & \textbf{70.29} & \textbf{90.71} & \textbf{15.64} & \textbf{18.14} & \textbf{17.57} & \textbf{18.29} & \textbf{16.00} & \textbf{20.86} \\
\bottomrule
\end{tabular}
}
\end{table*}
Our comprehensive experiments on the T2VSafetyBench dataset demonstrate the effectiveness of our method in mitigating unsafe prompts across a wide range of categories and models. As illustrated in \Fref{fig:three_subfigs}, \method{} effectively neutralizes malicious prompts across various unsafe categories in T2VSafetyBench, ensuring the generation of safe videos without compromising visual quality.
As shown in Table \ref{tab:main}, we compare the ASR of 6 models both in their original form and when defended by \method{}. Under the Attack scenario, the ASR values are generally high, indicating that these models are vulnerable to unsafe prompts. For example, the average ASR across all categories and models is 70.00\% for the original models, while it is 90.71\% for the Kling model, which is the highest among all models. This highlights the urgent need for effective defense mechanisms to address the safety issues in T2V generation.
Our method, however, significantly reduces the ASR values for all models. The average ASR decreases to 15.64\% for the defended models, with the lowest value of 10.00\% for the Seedance model and the highest value of 28.00\% for the Kling model. This demonstrates that our method is capable of achieving strong safety enforcement while maintaining a minimal impact on the quality of benign generation. Specifically, our method outperforms the original models in several categories, such as Pornography, Violence, and Gore, where the reduction in ASR is more than 50\%.
Moreover, our method is effective against both Content-level risks and Temporal risks. For Content-level risks, the average ASR under the Attack scenario is 72.86\% for the original models, while it is 18.14\% for the defended models. For Temporal risks, the average ASR under the Attack scenario is 75.71\% for the original models, while it is 17.57\% for the defended models. These results indicate that our method is able to handle the diverse types of safety threats in T2V generation.
\subsection{Robustness under Diverse Attack Methods}
\begin{figure}[!t]
\centering
\includegraphics[width=\linewidth]{imgs/defense.pdf}
\caption{Comparison of the defense performance of \method{} against various jailbreak attack methods in T2VSafetyBench (TSB).}
\label{fig:diff_attack}
\end{figure}
Beyond category-wise evaluation, we further investigate whether the effectiveness of our defense generalizes across diverse attack mechanisms. For each attack, we report the average ASR over all 14 risk categories.
As shown in \Fref{fig:diff_attack}, all evaluated T2V models exhibit substantial vulnerability under different attack strategies, while the severity of attacks varies notably across methods. In particular, SceneSplit and SPARK consistently achieve higher ASR than TSB, DACA, and RAB on most models (\eg, 93.29\% and 95.14\% ASR on Sora), indicating that attacks leveraging temporal structure are especially effective for T2V systems. In contrast, RAB yields relatively lower ASR on most models except Sora, suggesting that randomized perturbations alone are insufficient to reliably bypass safety mechanisms in video generation.
Despite the diversity of attack designs, our defense demonstrates remarkably stable performance across all attack methods and models. After applying our method, ASR is consistently reduced to a narrow range of approximately 6\%–21\%, regardless of whether the attack targets semantic content (TSB, DACA), prompt structure (RAB), or temporal dynamics (SceneSplit, SPARK). Notably, even under the strongest temporal attacks, such as SPARK, our defense limits ASR to 12.86\% on Seedance and 18.14\% on Kling, representing reductions of over 75\% compared to the corresponding attack-only settings.
A key observation is that the relative effectiveness of our defense is largely invariant to the attack type. While attack ASR varies significantly across methods (\eg, RAB vs. SPARK), the defended ASR remains consistently low for all models. This suggests that our approach does not rely on assumptions specific to a particular attack pattern, but instead enforces safety at a more fundamental level of prompt understanding and generation control.
\subsection{Comparison with Existing Defenses}
\begin{table}[!t]
\centering
\caption{Comparison of \method{} with baseline defense methods.}
\label{tab:diff_defense}
\resizebox{\linewidth}{!}{%
\begin{tabular}{@{}lcccccc@{}}
\toprule
\multirow{2}{*}{\textbf{Method}} & \multicolumn{2}{c}{\textbf{Pixverse}} & \multicolumn{2}{c}{\textbf{Veo}} & \multicolumn{2}{c}{\textbf{Sora}} \\
\cmidrule(lr){2-3} \cmidrule(lr){4-5} \cmidrule(lr){6-7}
& ASR & ASR-H & ASR & ASR-H & ASR & ASR-H \\
\midrule
\multicolumn{7}{l}{\textit{Dataset: T2VSafetyBench}} \\
\midrule
Baseline & 70.00\% & 70.83\% & 70.29\% & 69.41\% & 90.71\% & 91.56\% \\
KB & 62.34\% & 63.12\% & 58.71\% & 59.23\% & 82.43\% & 83.05\% \\
SA & 45.86\% & 46.52\% & 34.57\% & 35.14\% & 68.29\% & 67.84\% \\
LR & 31.29\% & 30.76\% & 42.18\% & 41.85\% & 51.57\% & 52.12\% \\
\textbf{\method{}} & \textbf{15.64\%} & \textbf{16.18\%} & \textbf{16.00\%} & \textbf{15.73\%} & \textbf{20.86\%} & \textbf{19.35\%} \\
\midrule
& CS & TC & CS & TC & CS & TC \\
\midrule
\multicolumn{7}{l}{\textit{Dataset: MSVD}} \\
\midrule
Baseline & 0.719 & 0.908 & 0.717 & 0.912 & 0.715 & 0.915 \\
KB & 0.688 & 0.907 & 0.716 & 0.911 & 0.710 & 0.914 \\
SA & 0.714 & 0.902 & 0.702 & 0.906 & 0.709 & 0.909 \\
LR & 0.701 & 0.889 & 0.698 & 0.893 & 0.704 & 0.895 \\
\textbf{\method{}} & 0.717 & 0.906 & 0.701 & 0.914 & 0.716 & 0.916 \\
\bottomrule
\end{tabular}%
}
\end{table}
\Tref{tab:diff_defense} compares our defense with Keyword Blacklist, Semantic Analysis, and LLM Rewriting. On TSB, all baselines reduce ASR to some extent, but the improvements are limited, especially under human evaluation (ASR-H). For example, on Sora, Keyword Blacklist and Semantic Analysis still leave high ASR-H (83.05\% and 67.84\%), and even LLM Rewriting remains at 52.12\% ASR-H, indicating that unsafe intent often persists and remains recognizable to humans.
Our method achieves the lowest ASR under both metrics across all models. Specifically, it reduces ASR and ASR-H to 15.64\% and 16.18\% on Pixverse, 16.00\% and 15.73\% on Veo, and 20.86\% and 19.35\% on Sora. Notably, ASR and ASR-H remain highly consistent under our defense, suggesting that the observed safety gains are not limited to automated judgments but also align with human evaluation.
On MSVD, our method preserves benign generation quality, yielding CS and TC scores comparable to the baseline. For example, on Sora, the CS and TC scores reach 0.716 and 0.916, respectively, closely matching the baseline performance of 0.715 and 0.915. In contrast, LLM Rewriting leads to a more noticeable quality degradation; for instance, on Pixverse, TC drops from 0.908 to 0.889. Overall, our approach delivers stronger safety improvements while maintaining generation quality.
\subsection{Evaluation on Real-world Unsafe Prompts}
\begin{figure}[!t]
\centering
\includegraphics[width=\linewidth]{imgs/safewatch.pdf}
\caption{A visual example from SafeWatch. We present the real video, the video generated by the T2V model, and the video generated applying \method{}.}
\label{fig:real_example}
\end{figure}
\begin{figure}[!t]
\centering
\includegraphics[width=\linewidth]{imgs/realworld_defense.pdf}
\caption{Comparison of ASR on the SafeWatch dataset before and after applying our \method{}.}
\label{fig:real_defense}
\end{figure}
\Fref{fig:real_example} presents a qualitative example from SafeWatch, illustrating an unsafe real-world video, the corresponding output generated without defense, and the output produced with our defense enabled. As shown, the undefended model reproduces unsafe content, whereas our method effectively suppresses unsafe elements while maintaining plausible video semantics. And \Fref{fig:real_defense} reports the results on real-world unsafe prompts collected from practical usage scenarios.
Without defense, all models exhibit non-negligible vulnerability, with ASR ranging from 20.00\% to 48.00\%. In particular, Seedance and Hailuo show the highest susceptibility, reaching ASR values of 48.00\% and 44.00\%, respectively, indicating that real-world unsafe intent can effectively bypass existing safeguards.
After applying our defense, ASR is substantially reduced across all evaluated models. Specifically, ASR drops to below 6.00\% for all models, and is completely eliminated on Veo and Sora, where no successful unsafe generations are observed. Compared to the attack setting, this corresponds to a relative reduction of over 80.00\% in ASR for most models.
These results demonstrate that our method generalizes beyond benchmark datasets and remains effective under realistic unsafe prompts, providing robust protection across diverse video generation models.
\subsection{Ablation Studies}
\subsubsection{Effect of Backbone LLM}
\begin{figure}[!t]
\centering
\includegraphics[width=\linewidth]{imgs/ablation_llm.pdf}
\caption{Impact of different backbone LLMs on the effectiveness of \method{}. The evaluation is conducted on T2VSafetyBench using Kling.}
\label{fig:ablation_llm}
\end{figure}
\Fref{fig:ablation_llm} studies how the choice of backbone LLM affects performance across different safety aspects. Overall, the results show noticeable variance across LLMs, suggesting that the backbone has a non-trivial impact on rewriting/guarding behavior and that robustness is not solely determined by the downstream video generator.
Across categories, GPT-4o \cite{hurst2024gpt} and Grok 4 Fast \cite{xai_grok4fast_2025} tend to yield lower rates on clearly disallowed sexual content (Pornography at 6.00\% for both), while Gemini 3 Flash \cite{deepmind_gemini_flash_2026} exhibits higher values on several sensitive dimensions, including Political Sensitivity (30.00\%) and Misinformation (30.00\%). DeepSeek-V3 performs relatively well on multiple semantic/control-related aspects such as Borderline Pornography (14.00\%) and Coherent Contextual (14.00\%), but shows elevated risks on Misinformation (28\%) and Political Sensitivity (24.00\%). Kimi K2 \cite{team2025kimi} presents mixed behavior, with comparatively high values on Illegal Activities (26.00\%) and Political Sensitivity (24\%).
We also observe that the hardest aspects are typically those involving intense content and nuanced policy boundaries. For example, Gore and Disturbing Content remain high across most LLM backbones (e.g., Gore ranges from 16.00\% to 42.00\%, and Disturbing Content ranges from 18.00\% to 38.00\%), indicating that mitigating graphic or disturbing generations is more challenging and more sensitive to the backbone’s rewriting and compliance characteristics than explicit categories such as Pornography.
\subsubsection{Effect of Components}
\begin{figure}[!t]
\centering
\includegraphics[width=\linewidth]{imgs/ablation_module.pdf}
\caption{Ablation study of the three key modules in \method{}. The evaluation is conducted on T2VSafetyBench using Kling.}
\label{fig:ablation_module}
\end{figure}
\Fref{fig:ablation_module} reports an ablation study of \method{}. The complete system achieves the lowest ASRs across most categories, while removing any component leads to clear degradation.
Removing MSD causes moderate but widespread performance drops, especially in semantically sensitive categories. For example, Disturbing Content increases from 18\% to 48\%, Political Sensitivity from 24\% to 44\%, and Misinformation from 28\% to 48\%. This indicates that without decoupling spatial context and temporal actions, safety reasoning becomes less structured and less precise.
TRPG mainly affects categories where risk emerges through temporal accumulation or semantic escalation. Without TRPG, Borderline Pornography increases from 14\% to 38\%, Gore from 20\% to 60\%, Disturbing Content from 18\% to 70\%, and Illegal Activities from 20\% to 42\%. These results highlight the importance of identifying the earliest risk trigger point for timely intervention.
Removing TCSR leads to the most severe degradation across both safety and temporal coherence aspects. For instance, Violence increases from 22\% to 68\%, Disturbing Content from 18\% to 78\%, Illegal Activities from 20\% to 68\%, Sequential Action from 12\% to 64\%, and Coherent Contextual from 14\% to 72\%. This demonstrates that consistent counterfactual rewriting is essential to convert risk detection into coherent and safe outputs.
Overall, the ablation results confirm that MSD structures the prompt for temporal reasoning, TRPG determines when and where risk emerges, and TCSR performs the decisive temporally consistent safe rewriting.
\section{Conclusion}
\label{sec:conclusion}
In this paper, we presented \method, a defense framework for safeguarding T2V models against jailbreak attacks. Departing from lexical-space moderation, \method formulates T2V defense as a trajectory-level safety mediation problem in a temporally structured latent video intent space. By combining Temporal Intent Lifting, Risk Propagation in Trajectory Space, and Safety-Constrained Trajectory Composition, \method enables pre-generation intervention that suppresses unsafe video outcomes while preserving benign user intent and temporal coherence. Extensive experiments on existing T2V jailbreak benchmarks demonstrate that \method consistently improves safety and achieves a better safety--fidelity trade-off than competitive baselines. These results suggest that effective T2V defense should align with the temporal and compositional nature of video generation, rather than rely on static prompt filtering alone, and more broadly highlight the value of temporal-aware safety mediation for generative models whose harmfulness emerges through latent structure.
\paragraph{Limitations.}
Our work has several limitations.
(1) \method currently uses a coarse trajectory discretization, which is effective for short clips but may not fully capture long-horizon or highly complex video dynamics.
(2) While \method is designed as a model-agnostic pre-generation defense, combining it with post-generation video moderation or model-internal safety mechanisms may further improve robustness and remains an important direction for future work.
%{\appendices
%\section*{Proof of the First Zonklar Equation}
%Appendix one text goes here.
% You can choose not to have a title for an appendix if you want by leaving the argument blank
%\section*{Proof of the Second Zonklar Equation}
%Appendix two text goes here.}
\bibliographystyle{unsrt}
%\bibliographystyle{abbrv-doi-narrow}
%\bibliographystyle{abbrv-doi-hyperref}
%\bibliographystyle{abbrv-doi-hyperref-narrow}
\bibliography{cite}
\vfill
\end{document}