Runaway Evil: Jailbreaking Image-to-Video Generative Models

RunawayEvil is an open-source security evaluation framework for Image-to-Video (I2V) generative models, designed to investigate jailbreak risks and model vulnerabilities under multimodal inputs. Built on a "Strategy–Tactic–Action" paradigm, it supports unified and reproducible security analysis and comparative evaluation across mainstream I2V models, providing an experimental foundation for red teaming, vulnerability research, and defense development.

🎯 Successful Jailbreak Demonstration

---

📋 Prerequisites

Hardware

• A multi-GPU setup is highly recommended. The code is configured to distribute models across several GPUs.
• High VRAM (e.g., 24GB+ per GPU) is necessary to run the suite of models.
• NVIDIA GPUs with CUDA support.

Software

• Python 3.9+
• Conda for environment management.
• PyTorch with CUDA support.

🛠️ Setup & Installation

1. Clone the Repository:

   git clone https://github.com/DeepSota/RunawayEvil.git
   cd RunawayEvil

2. Create a Conda Environment:

   conda create -n runawayevil python=3.10
   conda activate runawayevil

3. Install Dependencies:

   pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121
   pip install transformers accelerate bitsandbytes sentence-transformers
   pip install stable-baselines3[extra] gymnasium
   pip install diffusers lpips pandas opencv-python omegaconf

4. Download Models:

   Download the required models and place them in a designated models directory. You will need:

   • LLaVA-Next (e.g., llava-v1.6-mistral-7b-hf)
   • Qwen-VL (e.g., Qwen/Qwen2.5-7B-VL-Instruct and Qwen/Qwen2.5-32B-VL-Instruct)
   • FLUX-Kontext (black-forest-labs/FLUX.1-s-kontext)
   • CLIP (openai/clip-vit-base-patch32)
   • (Optional, for run_inference.py) The local weights for Wan2.2-Turbo.

5. Download Dataset:

   The code is configured to use the COCO dataset.

   • Download the COCO images (e.g., val2017).
   • Prepare corresponding .txt annotation files, where each file has the same name as its image and contains one or more caption strings, each on a new line.

⚙️ Configuration

Before running any script, you must configure the paths at the top of each file. Open stage1.py, stage2.py, and inference.py and fill in the empty string variables ("") with the absolute paths to your models, datasets, and output directories.

Example Configuration in stage1.py:

# In stage1.py, stage2.py, and inference.py
# (Ensure you fill these out in all relevant files)

# --- Model Paths ---
LLAVA_PATH = "/path/to/your/models/llava-v1.6-mistral-7b-hf"
QWEN_7B_VL_PATH = "/path/to/your/models/Qwen2.5-7B-VL-Instruct"
QWEN_32B_VL_PATH = "/path/to/your/models/Qwen2.5-32B-VL-Instruct" # Only for stage1
FLUX_MODEL_PATH = "/path/to/your/models/FLUX.1-s-kontext"

# --- Dataset Paths ---
COCO_IMAGE_DIR = "/path/to/your/datasets/coco/val2017"
COCO_ANNOTATION_DIR = "/path/to/your/datasets/coco/annotations_txt"

# --- Output & Log Paths ---
LOG_DIR = "/path/to/your/outputs/phase1_logs/"        # For stage1
PHASE2_LOG_DIR = "/path/to/your/outputs/phase2_logs/"  # For stage2 and inference

# --- (Optional) Wan2.2-Turbo Local Path ---
WAN22_PROJECT_DIR = "/path/to/your/Wan2.2-TI2V-5B-Turbo-main" # For stage1/stage2

🚀 Usage

Stage 1: Evolutionary Training

This stage trains the agent from scratch and evolves the attack tactics.

python stage1.py

The script will create a log directory (e.g., /path/to/your/outputs/phase1_logs/). Inside, it will save the PPO model (ppo_strategist_evolving.zip), the evolving tactics (evolving_tactics.json), and a memory of successes. The training will proceed in batches, analyzing successes and potentially adding new tactics between batches.

Stage 2: Fine-Tuning

This stage takes the evolved tactics from Stage 1 and fine-tunes the agent's policy.

1. Ensure the PHASE2_TACTICS_FILE in stage2.py points to the evolving_tactics.json generated by Stage 1.

2. Run the script:

   python stage2.py

This will load or create a fine-tuned PPO model and save checkpoints and logs in the specified PHASE2_LOG_DIR.

Inference: Evaluating the Trained Agent

This script uses the final, fine-tuned agent from Stage 2 to attack a set of test images.

1. Configure PPO_MODEL_PATH in inference.py to point to the model saved in Stage 2 (e.g., ppo_strategist_finetuned.zip).

2. Configure all other necessary model and data paths.

3. Run the script:

   python inference.py

The script will iterate through images in TEST_IMAGE_DIR, perform the multi-step attack, and save a detailed log of the results to OUTPUT_LOG_FILE.

⚠️ Ethical Considerations

This framework is intended for research purposes, specifically for evaluating and improving the safety and robustness of generative AI models (i.e., "red-teaming"). The unauthorized or malicious use of this code to generate harmful, unsafe, or inappropriate content is strictly prohibited. Users are expected to adhere to the terms of service of any models used and to employ this tool responsibly and ethically.

📝 Citation

If you find our work useful in your research, please consider citing:

@inproceedings{wang2026runawayevil,
  title={Runawayevil: Jailbreaking the image-to-video generative models},
  author={Wang, Songping and Qian, Rufan and Lyu, Yueming and Liu, Qinglong and Zou, Linzhuang and Qin, Jie and Liu, Songhua and Shan, Caifeng},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={9296--9305},
  year={2026}
}

🔗 Links

• Paper (arXiv)
• Project Page