Modern text-to-image (T2I) models can now render legible, paragraph-length text, enabling a fundamentally new class of misuse. We identify and formalize the inscriptive jailbreak, where an adversary coerces a T2I system into generating images containing harmful textual payloads (e.g., fraudulent documents) embedded within visually benign scenes. Unlike traditional depictive jailbreaks that elicit visually objectionable imagery, inscriptive attacks weaponize the text-rendering capability itself. Because existing jailbreak techniques are designed for coarse visual manipulation, they struggle to bypass multi-stage safety filters while maintaining character-level fidelity. To expose this vulnerability, we propose Etch, a black-box attack framework that decomposes the adversarial prompt into three functionally orthogonal layers: semantic camouflage, visual-spatial anchoring, and typographic encoding. This decomposition reduces joint optimization over the full prompt space to tractable sub-problems, which are iteratively refined through a zero-order loop. In this process, a vision-language model critiques each generated image, localizes failures to specific layers, and prescribes targeted revisions. Extensive evaluations across 7 models on the 2 benchmarks demonstrate that Etch achieves an average attack success rate of 65.57% (peaking at 91.00%), significantly outperforming existing baselines. Our results reveal a critical blind spot in current T2I safety alignments and underscore the urgent need for typography-aware defense multimodal mechanisms.

翻译：现代文本到图像（T2I）模型已能生成可读的段落长度文本，从而引发了一类全新的滥用行为。我们识别并形式化了“铭文式越狱”攻击：攻击者迫使T2I系统在视觉上无害的场景中生成包含有害文本载荷（例如欺诈性文档）的图像。与诱发视觉上令人反感图像的传统“描绘式越狱”不同，铭文式攻击利用了模型自身的文本渲染能力。由于现有越狱技术针对粗粒度的视觉操控设计，它们难以在突破多阶段安全过滤器的同时保持字符级保真度。为揭示这一漏洞，我们提出了Etch——一种黑盒攻击框架，它将对抗性提示分解为三个功能正交的层级：语义伪装、视觉空间锚定和字体编码。这种分解将完整提示空间上的联合优化简化为可处理的子问题，并通过零阶循环迭代优化。在此过程中，视觉语言模型对每张生成图像进行评判，将失败定位到特定层级，并指定针对性的修正。在2个基准测试集上的7个模型上进行的广泛评估表明，Etch的平均攻击成功率达65.57%（峰值达91.00%），显著优于现有基线。我们的结果揭示了当前T2I安全对齐中的关键盲点，并凸显了开发具有字体感知能力的防御多模态机制的紧迫性。