By Lizzie Od — Editor & AI Roleplay Enthusiast
Friday night, 11:47 PM. The first prompt I fed the newly-public Seedance 2.0 was deliberately mild: a couple walking on a beach at sunset. Eleven seconds, clean render, nothing weird. The second prompt swapped one word — a word I won’t repeat here, because the page froze for a full second when the filter caught it. That was my welcome to ByteDance’s “publicly accessible” video model. Two days later I had a notebook full of test results and a much clearer picture of where the walls really are.
The short version I wish someone had handed me before I started: the marketing calls it public access. The filters call the shots. And the filters are stranger than you’d expect.
The Three Filters Doing All the Work
Before any of the testing matters, the architecture has to. Seedance 2.0 runs three separate filters, not one. The first scans your text prompt for specific English keywords. The second scans uploaded reference images for photorealistic human faces. The third checks for copyrighted characters and brand names. You can trip one without tripping the others, which is where the whole system gets strange.
The text filter is not doing semantic analysis. It is doing keyword matching. That sounds like a small distinction until you realize it means the model has no idea what you’re actually asking for. It only knows what you typed. A prompt mentioning “a soldier shoots someone in the street” gets rejected instantly. A prompt describing “figure in tactical gear, muzzle flash illuminating the scene, smoke trails in slow motion” generates a nearly identical clip. I tested that combination four different ways. It worked every time.
NSFW Is the One Wall That Actually Holds
Let me get the test most of you are wondering about out of the way. For a couple of hours on Saturday, I tried to make Seedance 2.0 generate NSFW content. Direct prompts first. Then euphemistic ones. Then the same vocabulary-substitution approach that walks right through the violence filter a few sections down from here. I fed the model reference images I’d generated in a separate tool, so the face filter wouldn’t catch them. Prompts in Chinese, then Russian, then Portuguese. Two different front-end platforms that host the model.
Nothing worked. Not even close.
This is the one category where the filter isn’t fooled by rewording. Seedance 2.0 blocks sexual content at both the input and output stages, on every platform I could reach, regardless of language. If you came to this piece looking for a jailbreak writeup, I don’t have one for you. It doesn’t jailbreak. This is the hardest line the system draws, and it draws it in thick black marker.
Whether that’s a design choice or a legal-department choice is anyone’s guess. Either way, it’s consistent, and it’s the first thing anyone going in with expectations deserves to know.
For what it’s worth, I ended up running the adult part of my testing on Ourdream AI instead, which was built for that kind of work and doesn’t apply the same input-stage blocks.
Violence Is Just a Vocabulary Problem
Everything else the filter “blocks” sits on a sliding scale, and the slide is extremely slippery.
Violence was the most embarrassing category to test, because the workarounds feel like cheating. Write “attack” and get rejected. Swap in “impact” or “collision” and you walk right through. “Blood” gets a refusal; “crimson liquid” makes the filter shrug. Every blocked word I tried had a technical or poetic equivalent the filter did not catch. By Sunday morning I had assembled a running list of about forty substitutions that reliably worked, and some creator communities online were already passing around longer versions of the same list.
The part that surprised me most: the filter is measurably stricter in English than in Chinese. I ran identical prompts in both languages, with a friend translating, and the Chinese versions passed routinely where the English ones hit a wall. Whatever safety layer ByteDance built, they built it around English vocabulary. The underlying model does not appear to share the restriction.
Realism also matters more than the content itself. Two people fighting in a photorealistic street scene gets rejected. The same two people fighting in an “anime style, cel-shaded, dramatic lighting” scene generates without protest. I do not know if that is intentional or accidental, but it reshaped how I wrote prompts for the rest of the weekend. Stylize first. Add detail second.
Real Faces Are the Hardest Technical Wall
The face filter is the one that felt sophisticated. It runs before the text filter, so the model can reject your whole generation based on the reference image alone. Upload a photo of any real person and generation stops cold.
But the filter is specifically looking for photorealistic facial landmarks, which means it misses a surprising amount. AI-generated portraits pass without issue. Illustrated characters do too, as do 3D renders and stylized paintings. Even a profile shot with limited detail typically gets through, as long as the landmarks are not cleanly readable. People in my test group had figured out within days of the public launch that you can crop a reference image to exclude the face entirely and still use it for setting, clothing, or color palette. The face filter never fires because there is no face in the input.
The bigger wrinkle: ByteDance quietly removed the feature that originally let you upload twelve reference files at once, at least for prompts involving real people, sometime in mid-February. That multi-reference capability was Seedance’s biggest differentiator against Kling and Veo. Losing it changed the model’s whole character. The tool still works. It’s just less of a showpiece than it was on launch day.
“Public” Is Doing a Lot of Work in “Publicly Accessible”
The most important thing I figured out all weekend has nothing to do with filters at all.
Seedance 2.0 is “publicly accessible” in a very narrow sense. Inside mainland China, you can reach it directly through ByteDance’s own apps with a local phone number. Outside mainland China, the options thin out fast. A few markets in Southeast Asia and Latin America can reach it through CapCut. A handful of third-party hosts, some of which run the model without ByteDance’s own extra filtering layer, sell access to anyone willing to pay. Everyone else is waiting on a global API launch that ByteDance quietly delayed indefinitely after the Disney, Paramount, and MPA cease-and-desist letters started arriving.
What you can generate on Seedance 2.0 depends entirely on which door you walked through. The filters vary by platform. The underlying model does not. I ran the exact same prompt through two platforms back to back and got a rejection on one and a finished video on the other. The “public” in “publicly accessible” apparently means “the model exists,” not “you can reach it.”
The Takeaway I Did Not Expect to Write
I went into the weekend expecting to write something cynical about safety theater. I came out of it with something stranger. Seedance 2.0 is neither the moderation machine the press releases describe nor the wide-open generator the viral clips make it look like. It is a model with one genuinely firm wall (sexual content), a couple of sophisticated walls (real faces, trademarked characters), and a swiss cheese of keyword rules that anyone with a thesaurus and forty minutes of patience can walk around.
A few practical notes for your own first session. Adult content is off the table, full stop. Stylized action, fantasy violence, and cinematic fight scenes are almost always reachable, as long as you write the way a screenwriter would describe a shot rather than the way a prompt engineer would instruct a chatbot. Real faces and named celebrities face the strictest technical barrier, but the restriction melts the moment you swap in a stylized or AI-generated reference image. And if you live outside the narrow set of markets ByteDance has currently approved, no amount of prompt skill is going to help you, because the access barrier is geographic before it is technical.
That is the gap I kept tripping over all weekend. The model is capable of far more than ByteDance admits in public, and far less accessible than the phrase “publicly accessible” implies. Two things that shouldn’t coexist, both true at the same time, and a whole weekend spent mapping exactly where each one starts and stops.