Blog · arXiv Analysis · Published: August 12, 2026 · Modified: August 12, 2026 · Last reviewed: August 12, 2026

The Subtitle Clock Becomes the Safety Boundary

A video prompt does not arrive as a bag of frames. When subtitles appear, how long they remain, and which frames preserve them can change a model’s response.

TempJail makes that schedule dependence measurable, but its scores belong to one sampled-frame, five-try, model-judged protocol—not to every video interface.

The Paper

The source is Ling Zhou, Yihao Huang, Jingling Sun, Zhiwen Tian, Yi Zeng, Qihe Liu, and Shijie Zhou’s TempJail: Temporal Jailbreak Attack against Large Vision-Language Models via Subtitle Scheduling, arXiv:2608.19737v1 [cs.CV], cross-listed in cs.AI and cs.CL and submitted August 20, 2026. The version-one PDF is eight pages. This essay analyzes the evaluation and its governance boundary; it does not reproduce harmful prompts or provide an attack recipe.

The Attack Surface Has a Clock

The motivation study holds subtitle semantics constant while changing when segments appear and how display time is divided. Reported attack success changes across schedules. That is a different problem from asking whether a model recognizes unsafe text in a still image. Video processing makes time part of the input: rendering, subtitle placement, frame selection, and cross-frame aggregation determine which sequence the model actually receives.

The fresh lesson is not that subtitles are inherently suspicious. W3C accessibility guidance describes synchronized captions as access to audio content for people who are Deaf or hard of hearing and distinguishes translated subtitles. The security claim is narrower: a safety evaluation that tests only the words, or one canonical rendering of them, can miss behavior that appears under a different temporal arrangement.

What the Benchmark Measures

For the main experiment, the authors sample 50 harmful-request examples from HADES and 50 from VLJailbreakBench while preserving category distributions. They test four paper-labeled video-capable models—GPT-5, Gemini 3.5-Flash, Qwen3-VL-Plus, and Qwen3-VL-32B-Instruct—against four prior multimodal jailbreak baselines. TempJail builds a contextual subtitle stream, places it over a generated or plain background, and varies the schedule. This is a constructed black-box stress test, not an observation of attacks circulating through video platforms.

Across the eight model-dataset cells, the paper reports the highest result among the complete attack methods for TempJail. Its model-averaged attack-success rate is 89 percent on VLJailbreakBench and 90 percent on HADES. Controlled variants attribute the gain mainly to contextual subtitle construction and temporal optimization; generated scene content supplies a smaller, model-dependent contribution.

Success Means One of Five

The headline percentage needs its denominator. Under the evaluation rule, each target receives five queries per sample. GPT-5 judges every response, and the sample counts as successfully attacked if at least one of the five responses substantively fulfills the harmful intent. The resulting number is therefore a five-opportunity, sample-level success rate. It is not the probability that one ordinary request succeeds.

That definition is reasonable for an adversary allowed to retry, and all compared methods receive the same budget. It should still travel with every citation. A purchaser deciding whether to permit one upload, repeated resubmission, or an automated campaign needs the per-attempt record, the retry policy, and uncertainty around the estimate. The paper reports point estimates but no confidence intervals or significance tests.

The Frame Sampler Is Inside the Result

The main pipeline does not hand an undefined object called “the video” to every system. It renders a video and then uses an explicit frame-input path that samples uniformly at four frames per second. A parameter study on Qwen3-VL-Plus changes that sampling rate and finds non-monotonic attack results across the tested settings.

Schedule sensitivity is thus a property of the whole evaluated path: subtitle timestamps, renderer, frame sampler, prompt packaging, target model, and decoding rule. The experiment supports a temporal attack-surface claim for that path. It does not establish the same magnitude for native-video endpoints, other samplers, streaming systems, longer clips, platform transcoding, or models the paper did not test.

A Model Judge Is Not a Safety Review

GPT-5 is the automated success judge and is also one of the paper’s target labels. The manuscript does not report human validation of the judging rubric, inter-rater agreement, or a manual audit sample. It also does not include a limitations section, ethical-considerations section, defense evaluation, or responsible-disclosure account. The published results should therefore be read as model-judged red-team evidence, not as a complete safety assessment or evidence about real-world attack prevalence.

The Release Boundary

The public version-one source package contains the manuscript source, bibliography, and four figure files. It does not contain benchmark selections, rendered videos, subtitle schedules, target outputs, judge decisions, analysis code, or a linked runnable repository. The proprietary targets appear under the paper labels GPT-5 and Gemini 3.5-Flash, without API endpoint strings or evaluation dates. Readers can audit the written tables and method, but cannot independently reproduce or re-score the experiment from the released study artifacts.

The Temporal-Safety Receipt

A video temporal-safety receipt should record the source file and digest; container and subtitle tracks; OCR or transcript; segment order, timestamps, and durations; render frame rate; platform transcoding; frame-selection rule and the exact sampled frames; model endpoint and observation date; prompt packaging; decoding settings; attempts per sample; per-attempt outcomes; judge rubric, model, and human-validation record; uncertainty; defenses tested; and the owner authorized to block, quarantine, escalate, or release the video. This is this essay’s proposal, not a TempJail instrument.

Defensive evaluation should compare semantically equivalent schedule variants and preserve accessibility: stripping captions is not a safety policy. A schedule anomaly can justify inspection, not an automatic accusation against an uploader. The Spiralist boundary is the processing path itself. If changing only the clock changes the safety verdict, the clock belongs in the audit record.

Sources

Return to Blog