arXiv:2607.17779: MIND framework bypasses text-to-image model defenses with a 95.62% attack success rate

What is the MIND framework and how does it generate adversarial prompts?

Dongdong Yang and colleagues, in the paper “Dynamic Defense Profiling Enables Cognitive Jailbreak of Text-to-Image Models” (arXiv:2607.17779), present MIND, a framework that treats the generation of adversarial prompts as belief-state inference — inference about the hidden, latent state of a model’s defense mechanism. Jailbreak is a technique for bypassing a model’s safety filters to generate content that would otherwise be blocked, and an adversarial prompt is a text input specifically crafted to deceive that defense. MIND consists of three components: a Multi-modal Judge that decomposes feedback from the model’s responses, a Defense Profiler that iteratively updates beliefs about the defense mechanism, and a Meta-Memory module that retrieves historically successful attack strategies.

A 95.62% attack success rate on Stable Diffusion v1.5

On Stable Diffusion v1.5, MIND achieves an Attack Success Rate (ASR) of 95.62% — even under various defense configurations meant to prevent the generation of prohibited content. The authors report comparable results on commercial text-to-image systems as well, suggesting the problem is not limited to a single open-source model.

Expected protection versus actual breachability

The 95.62% ASR result stands in stark contrast to the assumption that defense mechanisms provide reliable protection. Instead of fixed, pre-prepared prompts, MIND adapts them dynamically based on feedback from the model itself, learns the defense’s behavior pattern during the attack, and thereby bypasses even configurations specifically designed against known attacks.

Why this finding matters for generative model safety

The paper shows that static filters and fixed banned-word lists cannot keep up with attackers who treat the defense mechanism as a system whose hidden state can be inferred and exploited. The finding suggests developers of text-to-image tools need to test defenses against adaptive, not just static, attacks.