Poisoning Prompt-Guided Sampling in Video Large Language Models

2025/09/25 by Yuxin Cao, Wei Song, Cao, Yuxin +5 · 1 citation
Computer Science · #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #cs.CV

paper · pdf · doi:10.48550/arxiv.2509.20851

16 pages, 5 figures

arxiv created 2026/08/04 · arxiv updated 2026/08/05

Abstract

Video Large Language Models (VideoLLMs) are increasingly deployed as automated moderators on user-generated video platforms, where a few unwatched seconds of harmful footage are enough to suppress a safety alert. Because encoding every frame is prohibitive, modern VideoLLMs rely on prompt-guided sampling (PGS), which scores frames against the user prompt and forwards only the top-ranked ones to the visual encoder. Uniform and semantic samplers are known to be defeated by simple frame replacement, whereas PGS, the most prompt-aware family, has escaped scrutiny, and its prompt awareness in fact repairs the omission failures that defeat the other two. We show that this repair is superficial, since PoisonVID, a transfer attack, poisons the sampler's ranking so that harmful clips are never surfaced, without access to target weights, gradients, or sampling internals. It optimizes one video-level perturbation under a relevance-suppression loss defined over a depiction set of paraphrased harmful descriptions written by a shadow VideoLLM and a general-purpose language model, which drives perturbed harmful frames out of the prompt-conditioned subspace that PGS reads. Samplers that never consult that score keep the frames they always kept, which locates the failure at selection rather than at the encoder. Across three PGS methods, six VideoLLMs, and six harmful categories, PoisonVID attains 84% to 97% average attack success over the 18 sampler and model pairs and survives seven defenses. Re-encoding at lower resolution on ingest gives back part of what was evicted and costs the attack 48 points, which bounds the threat without closing it. PGS therefore buys accuracy with a structural safety debt, and sampler design will now have to repay that.

Citations

• Failures to Surface Harmful Contents in Video Large Language Models
• FRAG: Frame Selection Augmented Generation for Long Video and Long Document Understanding
• Scaling Video-Language Models to 10K Frames via Hierarchical Differential Distillation
• Adaptive Keyframe Sampling for Long Video Understanding
• M-LLM Based Video Frame Selection for Efficient Video Understanding
• VideoLLaMA 3: Frontier Multimodal Foundation Models for Image and Video Understanding
• FocusChat: Text-guided Long Video Understanding via Spatiotemporal Information Filtering
• Expanding Performance Boundaries of Open-Source Multimodal Models with Model, Data, and Test-Time Scaling
• NVILA: Efficient Frontier Visual Language Models
• SEAL: Semantic Attention Learning for Long Video Representation
• Grounded-VideoLLM: Sharpening Fine-grained Temporal Grounding in Video Large Language Models
• Frame-Voyager: Learning to Query Frames for Video Large Language Models
• LLaVA-Video: Video Instruction Tuning With Synthetic Data
• LLaVA-OneVision: Easy Visual Task Transfer
• VideoLLaMA 2: Advancing Spatial-Temporal Modeling and Audio Understanding in Video-LLMs
• ShareGPT4Video: Improving Video Understanding and Generation with Better Captions
• Streaming Long Video Understanding with Large Language Models
• LongVLM: Efficient Long Video Understanding via Large Language Models
• Direct Preference Optimization of Video Large Multimodal Models from Language Model Reward
• Video Understanding with Large Language Models: A Survey
• A Simple LLM Framework for Long-Range Video Question-Answering
• LLaMA-VID: An Image is Worth 2 Tokens in Large Language Models
• Video-LLaVA: Learning United Visual Representation by Alignment Before Projection
• Chat-UniVi: Unified Visual Representation Empowers Large Language Models with Image and Video Understanding
• Self-Chained Image-Language Model for Video Localization and Question Answering
• VideoChat: Chat-Centric Video Understanding
• Vid2Seq: Large-Scale Pretraining of a Visual Language Model for Dense Video Captioning
• BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Models
• Learning Video Representations from Large Language Models
• Learning Transferable Visual Models From Natural Language Supervision
• Fast is better than free: Revisiting adversarial training
• Towards Deep Learning Models Resistant to Adversarial Attacks

Cited by

• FeatureFool: Zero-Query Fooling of Video Models via Feature Map

Related

• Failures to Surface Harmful Contents in Video Large Language Models
• From Evaluation to Defense: Advancing Safety in Video Large Language Models
• V-DEAL: Diagnosing Video Safety De-Calibration as an Understanding-Refusal Coupling Failure
• MVTamperBench: Evaluating Robustness of Vision-Language Models
• Vid-SME: Membership Inference Attacks against Large Video Understanding Models