A new academic exploit shows that stacking multiple AI safety filters together doesn't make image generators safer - it just gives attackers more seams to pry open.
Researchers built a system called CRACK that jailbreaks text-to-image models guarded by multiple layers of safety filters - text filters, image classifiers, and cross-modal detectors stacked together. Instead of attacking the whole pipeline blindly, CRACK runs three AI agents that debate each attempt: one proposes prompt mutations to dodge the filters, a second flags which specific safety layer caught it, and a third arbitrates and scores the next move. The team frames the problem geometrically, calling the narrow zone where a prompt slips past every filter at once a "detection surface," and argues that zone is small, oddly shaped, and full of contradictions, since dodging one filter often means colliding with another. Across multiple text-to-image models and safety configurations, the method reportedly hit attack success rates as high as 99.63%, needed fewer attempts than prior jailbreak techniques, and kept the original harmful intent of the prompt intact.
Most safety stacks are built like a fence with more boards - the assumption being that combining independent filters covers each other's blind spots. This research suggests the opposite: heterogeneous filters create exploitable seams between layers, and an automated debate process can map those seams faster than a human red-teamer could. That's a real problem for any company betting its content-moderation strategy on bolting filters together instead of designing defenses as a single system.
It's also a reminder that "multi-layered defense" is a phrase security researchers keep disproving, one query-efficient attack at a time.