Image-to-Video (I2V) generation models, which condition video generation on reference images, have shown emerging visual instruction-following capability, allowing certain visual cues in reference images to act as implicit control signals for video generation. However, this capability also introduces a previously overlooked risk: adversaries may exploit visual instructions to inject malicious intent through the image modality. In this work, we uncover this risk by proposing Visual Instruction Injection (VII), a training-free and transferable jailbreaking framework that intentionally disguises the malicious intent of unsafe text prompts as benign visual instructions in the safe reference image. Specifically, VII coordinates a Malicious Intent Reprogramming module to distill malicious intent from unsafe text prompts while minimizing their static harmfulness, and a Visual Instruction Grounding module to ground the distilled intent onto a safe input image by rendering visual instructions that preserve semantic consistency with the original unsafe text prompt, thereby inducing harmful content during I2V generation. Empirically, our extensive experiments on four state-of-the-art commercial I2V models (Kling-v2.5-turbo, Gemini Veo-3.1, Seedance-1.5-pro, and PixVerse-V5) demonstrate that VII achieves Attack Success Rates of up to 83.5% while reducing Refusal Rates to near zero, significantly outperforming existing baselines.

翻译：图像到视频（I2V）生成模型能够以参考图像为条件生成视频，已展现出新兴的视觉指令跟随能力，使得参考图像中的某些视觉线索可作为视频生成的隐式控制信号。然而，这种能力也引入了一个先前被忽视的风险：攻击者可能通过图像模态利用视觉指令来注入恶意意图。在本工作中，我们通过提出视觉指令注入（VII）揭示了这一风险。VII是一种无需训练且可迁移的越狱框架，其有意将不安全文本提示的恶意意图伪装成安全参考图像中的良性视觉指令。具体而言，VII协调一个恶意意图重编程模块，从不安全文本提示中提取恶意意图，同时最小化其静态危害性；以及一个视觉指令接地模块，通过渲染与原始不安全文本提示保持语义一致性的视觉指令，将提取的意图锚定到安全输入图像上，从而在I2V生成过程中诱导有害内容。实证方面，我们在四种最先进的商用I2V模型（Kling-v2.5-turbo、Gemini Veo-3.1、Seedance-1.5-pro和PixVerse-V5）上进行的广泛实验表明，VII实现了高达83.5%的攻击成功率，同时将拒绝率降至接近零，显著优于现有基线方法。