Jailbreak research for generative media usually evaluates one modality, one frame, or one prompt filter at a time. That misses three real failure modes: text and an image can be safe alone but unsafe together, a video can look safe at every sampled frame yet unsafe in the transition between two benign states, and an agent can hop to a weaker provider or a broader operation than a human approved. LATTICE-MG binds cross-modal intent, temporal video risk, and agent tool-delegation into one signed policy contract instead of three disconnected classifiers.
Published evaluations often compare product names (Grok, ChatGPT, Sora, Claude Code) as if they were equivalent systems. They aren't: a native generator, a dedicated video model, and an agent that invokes external tools expose different interfaces, different policies, and different failure modes.
A prompt filter sees text. An output classifier sees one image or a sparsely sampled frame. A tool allowlist sees which server was called. Each one is blind to everything outside its channel: composition across modalities, drift across turns, and the transition between two benign frames.
One Cross-Modal Safety Contract per request, carrying the normalized intent, the cross-modal composition score, identity/consent state, and the exact authorized operation, enforced end-to-end by a Tool Authorization Manifest and a Temporal Risk Lattice, not three independent classifiers that can each be satisfied in isolation.
The same normalized intent is bound to the exact provider, model, operation, assets, temporal inspection plan, consent state, and evidence record, so a downstream tool cannot silently change the operation without invalidating the contract.
lattice_mg/risk.py and lattice_mg/temporal.py.Mechanism-oriented, not content-category-oriented, so the same control framework supports different provider policies and jurisdictions. No operational bypass content is described anywhere in this taxonomy.
| ID | Family | Failure mode | Required control path |
|---|---|---|---|
| A1 | Direct unsafe intent | Explicit request reaches the generator | Text intent classification |
| A2 | Semantic obfuscation | Translation/euphemism preserves intent | Semantic normalization |
| A3 | Cross-modal composition | Benign alone, unsafe together | Intent graph + Φ(G(R)) |
| A4 | Context laundering | Intent accumulates across turns | Session risk memory (history) |
| A5 | Edit / reference chaining | Progressive edits cross a threshold | Transformation lineage |
| A6 | Scene / boundary splitting | Benign endpoints imply unsafe transition | Temporal Risk Lattice |
| A7 | Transient output evasion | Brief frames evade sparse inspection | Adaptive dense sampling |
| A8 | Agentic provider hopping | Agent escapes policy via tool/provider switch | Tool Authorization Manifest |
Five decision-engine capability profiles run against 960 synthetic adversarial schemas (12 policy categories × 8 attack families × 10 variants) and 480 benign hard negatives. Generated by experiments/run_evaluation.py (seed 2026): real deterministic output, not hand-picked, and not a test against any live platform. See the note below before citing any number here.
| Defense | A1 | A2 | A3 | A4 | A5 | A6 | A7 | A8 |
|---|---|---|---|---|---|---|---|---|
| Prompt filter only | 1.00 | 0.01 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
| Prompt + image classifier | 1.00 | 0.28 | 0.51 | 0.00 | 0.28 | 0.17 | 0.07 | 0.00 |
| Prompt + sparse video | 1.00 | 0.28 | 0.23 | 0.00 | 0.21 | 0.33 | 0.03 | 0.00 |
| Tool allowlist only | 0.01 | 0.01 | 0.00 | 0.01 | 0.00 | 0.01 | 0.00 | 0.27 |
| LATTICE-MG | 1.00 | 0.97 | 0.99 | 0.98 | 0.99 | 0.97 | 0.92 | 0.99 |
Per-family catch rate on adversarial cases. Channel-limited baselines plateau near zero on families outside their channel (history for A4, tool binding for A8) no matter how well-tuned their one channel is; the gap is structural, not a tuning problem.
Overall simulated attack success rate across all 8 families (lower is better); benign preservation rate stayed ≥ 0.92 for every defense, 1.00 for LATTICE-MG (full numbers in results/metrics_summary.csv).
lattice_mg/baselines.py are illustrative defaults, not measurements from any real system; inspect and replace them before drawing platform-specific conclusions.