Do Input-Level Defenses Transfer to Observation-Level Attacks on VideoLLMs?

I. INTRODUCTION

• VideoLLMs process partial observations because frame sampling reduces the cost of exhaustive video processing, creating opportunities for attacks that omit harmful frames or suppress signals within the visual pathway.The paper distinguishes omission from suppression: harmful frames may never be selected, or selected harmful signals may not survive internal processing.Source: §I · p. 1
• Across 825 evaluation cells, harmful detection rates were single-digit or zero in most configurations, and defense choice was least consequential among four experimental factors.The study also reports that model architecture dominates defense effectiveness.Source: §I · p. 2
• Defenses also fail when harmful signals appear in every sampled frame; ablation attributes their loss in these cases to token compression.The study probes frame embeddings against harmful-concept descriptions before and after defenses to test whether defenses change what the vision encoder recovers.Source: §I · p. 2
• Detection varies substantially by content category: static visual cues in pornography are detected more often than violence or crime requiring temporal reasoning, and sparse sampling undermines video-native defenses.Sparse sampling removes the frame-to-frame continuity on which the video-native defense relies.Source: §I · p. 2
• DEFTEVAL evaluates 11 input-level defenses against five attacks across five VideoLLMs, while holding sampling budget, prompt, decoding policy, and response-to-label protocol fixed.The four-way factorial design covers three harmful-content categories and 825 evaluation cells.Source: §I · p. 2
• The paper formalizes omission and suppression as distinct attack mechanisms, arguing that post-sampling input-level defenses can address neither mechanism at its source.Omission excludes harmful frames from inference; suppression prevents selected harmful signals from surviving the visual pathway.Source: §I · p. 2

A. VideoLLMs

• VideoLLMs condition generation on video content and user prompts, supporting tasks such as summarization, captioning, question answering, and grounding.Observation-level attacks can cause false-negative safety decisions either by preventing harmful frames from being sampled or by suppressing signals during internal processing.Source: A. VideoLLMs · p. 2, Figure 1 · p. 3

B. Frame Sampling Strategies

• Uniform sampling selects frames at fixed temporal intervals, but can overlook informative segments when salient events are sparse.Its simplicity and low overhead make it attractive in practice.Source: B. Frame Sampling Strategies · p. 3
• Semantic-similarity sampling retains visually diverse frames, but query-agnostic selection may keep frames irrelevant to the prompt and may include uninformative boundary frames.SKE uses frame embeddings and pairwise cosine similarity to remove highly similar frames.Source: B. Frame Sampling Strategies · p. 3
• Prompt-guided sampling prioritizes frames by relevance to the query, but may discard weakly correlated context that remains semantically important.DKS accounts for local feature redundancy, AKS encourages diversity, and FRAG emphasizes relevance ranking; some methods add computational overhead.Source: B. Frame Sampling Strategies · p. 3

C. Observation-Level Attacks

• Prior work identifies sparse temporal sampling, token under-sampling, and modality-fusion imbalance as vulnerabilities, while PoisonVID examines manipulation of prompt-guided sampling.The cited work considers uniform and semantic-similarity sampling; PoisonVID [2] investigates prompt-guided methods.Source: C. Observation-Level Attacks · p. 3

D. Adversarial Defenses

• Adversarial defenses are grouped into adversarial training, input reconstruction, gradient smoothing, and patch removal approaches.Source: D. Adversarial Defenses · p. 3

1) Adversarial Training:

• Adversarial-training defenses such as FARE [48] and SimCLIP fine-tune the vision encoder to stabilize visual representations under bounded perturbations.The language module remains unchanged.Source: 1) Adversarial Training · p. 3

2) Input Reconstruction:

• Input-reconstruction defenses purify or reconstruct images, while denoising methods attenuate perturbed regions; these approaches assume the input is fully observable.Some systems add a detection stage before reconstruction to avoid unnecessary degradation of benign inputs.Source: 2) Input Reconstruction · p. 4

3) Gradient Smoothing:

• Gradient-smoothing defenses locate abnormal local gradients and smooth those regions, assuming malicious perturbations are localized within an otherwise observable image.LGS exemplifies this approach.Source: 3) Gradient Smoothing · p. 4

4) Patch Removal:

• Patch-removal defenses identify adversarial patches and remove them through masking or local-gradient regularization.The described threat is a perturbation confined to a small, localized image region.Source: 4) Patch Removal · p. 4

5) Temporal Video Defenses:

• Temporal video defenses purify frames jointly and use optical-flow guidance, assuming consecutive frames form a continuous-motion sequence that sampling does not preserve.VideoPure is given as an example of this class.Source: 5) Temporal Video Defenses · p. 4

A. Formalism

• The formalism models VideoLLM output as a language model integrating the query with visual tokens produced from sampled frames by an encoder, projector, and token-compression pathway.The prediction depends on the sampled subset and its compressed representation, not the raw video alone.Source: A. Formalism · p. 4
• Omission leaves little harmful evidence for a defense to act on, while suppression selects harmful frames but discards their signals later in the visual pathway.The distinction makes suppression a more consequential failure mode for input-level defenses.Source: A. Formalism · pp. 4–5

• The adversary inserts, replaces, relocates, or overlays a short harmful segment in an otherwise benign video to induce false negatives, without changing model parameters or using bounded perturbations.The setting targets VideoLLM-based moderation or safety monitoring.Source: B. Threat Model · p. 5
• The attacker manipulates the observation stage and may use query or relevance cues for prompt-guided sampling; suppression attacks are fully black-box and need not know the sampling budget.Other attacks assume knowledge of the number of sampled frames, K, but not model internals.Source: B. Threat Model · p. 5

• Input-level defenses act only on already-selected attacked frames, so they cannot restore frames omitted during sampling or control token compression and modality fusion.This defines a structural boundary on what these defenses can address.Source: C. Controlled Evaluation Design · p. 5
• The four-way full factorial crosses 5 model architectures, 11 defenses, 5 attacks, and 3 harmful-content categories across 825 evaluation cells.The crossing is designed to separate each factor's contribution rather than confound it with the others.Source: C. Controlled Evaluation Design · p. 5
• Each cell uses fixed attack and inference settings, deterministic decoding, one prompt template per category, and one harmful segment per video.HDR is measured on attacks already verified to defeat the undefended model; its baseline is therefore 0% in every cell.Source: C. Controlled Evaluation Design · p. 5
• The preregistered analysis examines HDR across cells and uses four-way ANOVA with η2 effect sizes to apportion variance among factors.Interaction terms are pooled into the residual, making the reported η2 values conservative lower bounds on factor influence.Source: C. Controlled Evaluation Design · p. 5
• DEFTEVAL addresses whether existing input-level defenses transfer to observation-level attacks, which prior attack studies did not evaluate.The crossed design can distinguish a weak defense from a model that no defense can help.Source: C. Controlled Evaluation Design · p. 5

A. VideoLLMs

• Five VideoLLMs are evaluated under deterministic generation settings to avoid sampling variance in model behavior.The models are LLaVA-Video-7B-Qwen2, LLaVA-NeXT-Video-7B-DPO, LLaVA-Video-32B-Qwen, ShareGPT4Video-8B, and VideoLLaMA3.Source: A. VideoLLMs · p. 5

B. Attacks

• The five attacks cover omission and suppression: PoisonVID uses prompt-guided samplers, FRA replaces frames, and PiP and TOA place visible harmful content in every sampled frame.All attacks use K = 32; residual harmful frames in incomplete omission cases are the only evidence input-level defenses can act on under PoisonVID and FRA.Source: B. Attacks · p. 6

C. Defenses

• The eleven inference-time defenses require neither retraining nor model modification and have public, reproducible implementations; ten are image defenses and one is VideoPure.VideoPure jointly purifies the full sampled clip, testing whether temporal processing changes the outcome; the image defenses operate frame by frame.Source: C. Defenses · p. 6

D. Data and Metric

• Each attack is evaluated on 100 successfully attacked videos; unless stated otherwise, each example contains one harmful segment and uses the same K and inference configuration.The harmful clips are inserted into otherwise benign source videos.Source: D. Data and Metric · p. 6
• HDR is the fraction of previously undetected harmful videos correctly detected after applying a defense; higher values are better.The test set comprises harmful videos the undefended model failed to detect.Source: D. Data and Metric · p. 6
• Clear refusals count as positive identifications, while affirmative answers about unrelated subjects count as negative identifications.The protocol treats refusals as triggered by the model’s internal safety alignment.Source: D. Data and Metric · p. 6

V. RESULTS AND ANALYSIS

• The evaluated attacks are grouped by mechanism, while the defenses are grouped by family and the adversary each family assumes.These groupings are presented in Tables I and II, respectively.Source: Table I · p. 7, Table II · p. 7
• The results cover 825 combinations of eleven defenses, five VideoLLMs, five observation-level attacks, and three harmful-content categories.Table III reports HDR for these combinations.Source: §V · pp. 6–7

A. Finding 1: Input-Level Defenses Provide Limited and Inconsistent Protection

• Model architecture explains 25.4% of HDR variance, category 9.4%, attack type 7.9%, and defense choice 3.1%.The defense is the least consequential of the four factors; interactions are pooled into the residual.Source: A. Finding 1: Input-Level Defenses… · p. 7, Table IV · p. 9
• For omission attacks, PoisonVID reduces harmful-frame selection and FRA places harmful content in a short interval, leaving post-sampling defenses without evidence to recover.These attacks target sampling coverage rather than the purification of observed content.Source: A. Finding 1: Input-Level Defenses… · p. 7
• Most configurations have single-digit or zero HDR, and PoisonVID yields 0% for L-7B-DPO across all categories and eleven defenses.Only a minority of configurations attain moderate or high HDR; DiffPure on L-7B reaches 3 to 5% under AKS and 5 to 15% under FRAG.Source: A. Finding 1: Input-Level Defenses… · p. 7, Table III · p. 8
• Across omission and suppression, harmful-concept alignment never meaningfully increases; the only positive entries are +1.3% for ComDefend under omission and +0.1% for LGS under suppression.The alignment analysis tests whether defenses recover safety-relevant content rather than merely altering pixels.Source: A. Finding 1: Input-Level Defenses… · pp. 7, 9, Table V · p. 9

B. Finding 2: Defenses Fail Even When Harmful Signals Persist in Every Frame

• 4.9% mean HDR for omission attacks versus 3.0% for suppression attacks shows that defenses perform poorly even when harmful content is present in every sampled frame.Suppression attacks yield lower detection overall, so the failure is not limited to harmful frames being omitted during sampling.Source: B. Finding 2: Defenses Fail Even When… · p. 9
• Token compression and spatial downsampling may discard localized or low-contrast harmful features, while modality fusion down-weights weakened visual signals.The authors hypothesize that this prevents safety-relevant evidence from being effectively processed even when it enters the input.Source: B. Finding 2: Defenses Fail Even When… · p. 9
• Removing compression raises pooled HDR from 4.8% to 11.0%, with gains concentrated in L-32B and VL3 while L-7B and SG4V barely move.L-32B gains +17.0 points on Crime and +14.8 on Porn, and VL3 gains +28.0 on Porn; the table reports changes averaged over four DiffPure/PAD and PiP/TOA combinations.Source: B. Finding 2: Defenses Fail Even When… · pp. 9–10, Table VI · p. 9

C. Finding 3: Defense Effectiveness Is Dominated by Model Architecture

• Model architecture explains η2 = 25.4% of HDR variance versus 3.1% for defense choice, and L-32B and VL3 account for 78% of harmful detections.Across defenses, attacks, and categories, their mean HDRs are 8.2% and 7.9%, compared with 2.4% for L-7B, 2.0% for SG4V, and 0.1% for L-7B-DPO.Source: C. Finding 3: Defense Effectiveness Is… · p. 10
• L-7B-DPO and SG4V detect almost nothing under most configurations, while L-32B and VL3 show only selective recovery and most cells remain below 15%.For example, L-32B reaches 41% under PoisonVID (FRAG) on Porn with PAD, while VL3 reaches 34% under FRA on Porn with ICC; model-internal factors are identified as the primary bottleneck.Source: C. Finding 3: Defense Effectiveness Is… · p. 10

D. Finding 4: Content-Category Disparity Exposes Temporal Reasoning Weakness

• The ten highest HDR values in Table III are all in Porn, while Crime and Violence detection rarely exceeds 15% across configurations.The Porn advantage persists under FRA and PiP.Source: D. Finding 4: Content-Category… · p. 10
• Porn often has localized single-frame cues, whereas distinguishing crime or violence from ambiguous actions requires temporal reasoning.The compression ablation restores spatial detail without increasing the number of sampled frames, so it does not relieve the temporal-integration bottleneck for Crime and Violence.Source: D. Finding 4: Content-Category… · p. 10
• VideoPure averages 3.4% HDR versus 4.2% for the ten image defenses, and its category gap is larger: 7.3% on Porn versus 1.6% on Crime and 1.4% on Violence.It estimates optical flow between selected frames that may be seconds apart, so those frames do not provide real frame-to-frame motion continuity.Source: D. Finding 4: Content-Category… · p. 10

VI. DISCUSSION

• The category disparity suggests safety monitoring is biased toward static visual cues, leaving temporally complex harmful content systematically under-detected.The discussion calls for improved temporal modeling and defenses that enhance temporal coverage and context retention in the observation pipeline.Source: D. Finding 4: Content-Category… · p. 10, §VI · pp. 10–11

A. Toward System-Level Robustness

• Input-level techniques can improve robustness when the model already has access to safety-relevant visual content, but do not guarantee robustness when the observation pipeline prevents perception.The paper identifies frame sampling, token compression, and modality fusion as parts of that pipeline.Source: A. Toward System-Level Robustness · p. 11
• The proposed system-level directions are sampling-aware coverage guarantees, token-level preservation, modality-balanced fusion, and observation verification.These address sampling omissions, loss of localized or low-contrast features during compression, down-weighting of visual signals, and possible discarded content, respectively.Source: A. Toward System-Level Robustness · p. 11

VII. CONCLUSION

• The results point to a gap between input-level robustness and system-level robustness in multimodal architectures with structured observation pipelines.The conclusion calls for sampling-aware coverage, token-level preservation, and modality-balanced fusion to secure VideoLLMs in safety-critical deployments.Source: A. Toward System-Level Robustness · p. 11, §VII · p. 11

B. Limitations

• The evaluation covers representative VideoLLMs, available attacks and sampling mechanisms, and a detection-style task; other tasks or defense integrations may yield different outcomes.The authors caution that results under tested configurations are not a definitive impossibility result for future defenses.Source: B. Limitations · p. 11