{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T23:16:50Z","timestamp":1781047010044,"version":"3.54.1"},"reference-count":76,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["SHF-1901242,SHF-1910300"],"award-info":[{"award-number":["SHF-1901242,SHF-1910300"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,19]]},"DOI":"10.1109\/iccv51701.2025.01528","type":"proceedings-article","created":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T19:45:49Z","timestamp":1777491949000},"page":"16461-16471","source":"Crossref","is-referenced-by-count":1,"title":["JailbreakDiffBench: A Comprehensive Benchmark for Jailbreaking Diffusion Models"],"prefix":"10.1109","author":[{"given":"Xiaolong","family":"Jin","sequence":"first","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zixuan","family":"Weng","sequence":"additional","affiliation":[{"name":"University of Notre Dame"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hanxi","family":"Guo","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chenlong","family":"Yin","sequence":"additional","affiliation":[{"name":"Pennsylvania State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Siyuan","family":"Cheng","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guangyu","family":"Shen","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiangyu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Stable diffusion 2,","author":"AI","journal-title":"Stable Diffusion 2"},{"key":"ref2","article-title":"Stability AI","volume-title":"Stable diffusion 3 medium"},{"key":"ref3","article-title":"Stable diffusion 3.5 large,","author":"AI","journal-title":"Stable Diffusion 3.5 Large"},{"key":"ref4","article-title":"Stable diffusion 3.5 large turbo,","author":"AI","journal-title":"Stable Diffusion 3.5 Large Turbo"},{"key":"ref5","article-title":"Stable diffusion 3.5 medium,","author":"AI","journal-title":"Stable Diffusion 3.5 Medium"},{"key":"ref6","article-title":"Stable diffusion xl base 0.9,","author":"AI","journal-title":"Stable Diffusion XL Base 0.9"},{"key":"ref7","article-title":"AIML-TUDA","volume-title":"Llavaguard v1.2\u20137b-ov. LlavaGuard v1.2\u20137B-OV"},{"key":"ref8","article-title":"Microsoft Azure","volume-title":"Microsoft azure content moderator","year":"2024"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.88"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02161"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00019"},{"key":"ref12","article-title":"Prompting4debugging: Redteaming text-to-image diffusion models by finding problematic prompts","volume-title":"International Conference on Machine Learning","author":"Chin","year":"2024"},{"key":"ref13","volume-title":"Civitai","year":"2024"},{"key":"ref14","article-title":"DistilRoberta NSFW Classifier","volume-title":"distilroberta","year":"2024"},{"key":"ref15","article-title":"DistilBERT NSFW Text Classifier","volume-title":"distilbert-nsfw-textclassifier","year":"2024"},{"key":"ref16","article-title":"Google Cloud","volume-title":"google text moderation","year":"2024"},{"key":"ref17","article-title":"CompVis","volume-title":"Safety checker nested in stable diffusion","year":"2021"},{"key":"ref18","article-title":"Stable diffusion safety checker (hugging face)","volume-title":"Stable Diffusion Safety Checker (Hugging Face)","year":"2024"},{"key":"ref19","article-title":"Harnessing llm to attack llm-guarded text-to-image models","author":"Deng","year":"2023","journal-title":"arXiv e-prints"},{"key":"ref20","article-title":"Jailbreaking text-to-image models with 11 m based agents","author":"Dong","year":"2024","journal-title":"arXiv preprint"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00230"},{"key":"ref22","article-title":"Hts-attack: Heuristic token search for jailbreaking text-to-image models","author":"Gao","year":"2024","journal-title":"arXiv preprint"},{"key":"ref23","article-title":"Deepseek-coder: When the large language model meets programming-the rise of code intelligence","author":"Guo","year":"2024","journal-title":"arXiv preprint"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2025.112916"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i25.34821"},{"key":"ref26","article-title":"Distillation","author":"Hunyuan","journal-title":"Distillation"},{"key":"ref27","article-title":"Gpt-4o system card","author":"Hurst","year":"2024","journal-title":"arXiv preprint"},{"key":"ref28","article-title":"Llama guard: Llm-based input-output safeguard for human-ai conversations","author":"Inan","year":"2023","journal-title":"arXiv preprint"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2425"},{"key":"ref30","article-title":"Multiverse: Exposing large language model alignment problems in diverse worlds","author":"Jin","year":"2024","journal-title":"arXiv preprint"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.02074"},{"key":"ref32","article-title":"Flux.1-dev. FLUX.1-dev","volume-title":"7"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.52202\/075280-3067"},{"key":"ref34","article-title":"Art: Automatic red-teaming for text-to-image models to protect benign users","author":"Li","year":"2024","journal-title":"arXiv preprint"},{"key":"ref35","author":"Li","year":"2024","journal-title":"Nsfw text classifier (hugging face)"},{"key":"ref36","article-title":"Examining post-training quantization for mixture-of-experts: A benchmark","author":"Li","year":"2024","journal-title":"arXiv preprint"},{"key":"ref37","article-title":"Safegen: Mitigating unsafe content generation in text-to-image models","author":"Li","year":"2024","journal-title":"arXiv eprints"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01972"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73347-5_6"},{"key":"ref40","article-title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","volume-title":"The Twelfth International Conference on Learning Representations","author":"Liu","year":"2024"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.00722"},{"key":"ref42","first-page":"60335","article-title":"Coljailbreak: Collaborative generation and editing for jailbreaking text-to-image deep generation","volume":"37","author":"Ma","year":"2025","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref43","article-title":"Microsoft","volume-title":"Azure image moderation api. Azure Image Moderation API"},{"key":"ref44","volume-title":"openai moderation","year":"2024"},{"key":"ref45","article-title":"Stable diffusion v1.5","author":"Paine","journal-title":"Stable Diffusion v1.5"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1609\/icwsm.v14i1.7354"},{"key":"ref47","first-page":"40200","article-title":"Upam: Unified prompt attack in text-to-image generation models against both textual filters and visual checkers","volume-title":"International Conference on Machine Learning 2024","author":"Peng","year":"2024"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73668-1_20"},{"key":"ref49","article-title":"Safe text-to-image generation: Simply sanitize the prompt embedding","author":"Qiu","year":"2024","journal-title":"arXiv preprint"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616679"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3719027.3765088"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3630106.3658913"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3630106.3658913"},{"key":"ref54","first-page":"8821","article-title":"Zero-shot text-to-image generation","volume-title":"International conference on machine learning","author":"Ramesh","year":"2021"},{"key":"ref55","article-title":"Red-teaming the stable diffusion safety filter","volume-title":"NeurIPS ML Safety Workshop","author":"Rando"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.679"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3531146.3533192"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3531146.3533192"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02157"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02157"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00103"},{"key":"ref63","first-page":"5823","article-title":"Prompt stealing attacks against \\{Text-to-Image\\} generation models","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Shen","year":"2024"},{"key":"ref64","article-title":"Cogview4","volume-title":"CogView4"},{"key":"ref65","article-title":"Ring-a-bell! how reliable are concept removal methods for diffusion models?","volume-title":"The Twelfth International Conference on Learning Representations","author":"Tsai"},{"key":"ref66","article-title":"A comprehensive survey in 11 m (-agent) full stack safety: Data, training and deployment","author":"Wang","year":"2025","journal-title":"arXiv preprint"},{"key":"ref67","article-title":"Aeiou: A unified defense framework against nsfw prompts in text-to-image models","author":"Wang","year":"2024","journal-title":"arXiv preprint"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.51"},{"key":"ref69","article-title":"Foot-in-the-door: A multi-turn jailbreak for 11 ms","author":"Weng","year":"2025","journal-title":"arXiv preprint"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2024.3365804"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.00748"},{"key":"ref72","article-title":"Guardt2i: Defending text-to-image models from adversarial prompts","volume-title":"The Thirty-eighth Annual Conference on Neural Information Processing Systems","author":"Yang"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.00739"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00123"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2024.102701"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72998-0_22"}],"event":{"name":"2025 IEEE\/CVF International Conference on Computer Vision (ICCV)","location":"Honolulu, HI, USA","start":{"date-parts":[[2025,10,19]]},"end":{"date-parts":[[2025,10,25]]}},"container-title":["2025 IEEE\/CVF International Conference on Computer Vision (ICCV)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11443115\/11443287\/11444358.pdf?arnumber=11444358","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T04:51:54Z","timestamp":1777611114000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11444358\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,19]]},"references-count":76,"URL":"https:\/\/doi.org\/10.1109\/iccv51701.2025.01528","relation":{},"subject":[],"published":{"date-parts":[[2025,10,19]]}}}