PaperlayerView exact revision on arXiv

Source-linked AI summary

Don't Read the Log: Execution Traces Contaminate Verifiers in Video-Generation Agents

Jian Xu

arXiv:2609.28564v1cs.CRcs.LG

TL;DR

Agentic video-generation judges often receive execution traces and other auxiliary text alongside the generated video, but it is unclear whether that text changes judgments of visual requirements. The paper tests this by holding frames fixed while varying auxiliary text, then examines the effects in repair loops. Supportive logs lead open-weight judges to accept many visibly failed clips, while frontier judges are essentially unmoved.

  • Problem

    It is unclear whether auxiliary text shown to video-agent judges changes their verdicts on visual requirements, even though those verdicts guide repair loops.

    Source: §1 · p. 1

  • Method

    The paper holds video frames fixed while varying narration, execution traces, or subtitles, then tests trace contamination in repair loops and evidence-specific routing.

    Source: §1 · p. 2

  • Results

    A supportive log makes Qwen judges accept 0.78, 0.90, and 0.83 of visibly missing events, while an honest always-regenerate loop ends at a 1.00 judge pass rate and 0.28 human-labelled pass rate.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Routing each requirement only the evidence type that can establish it removes the auxiliary-text channel and restores true loop pass rates to 0.86 (8B) and 0.92 (32B).

    Source: §1 · p. 2, §7 · p. 9

    OCR masking cannot remove evidence inseparable from frames, such as a generated whiteboard spelling out the plan.

    Source: §7 · p. 9

Abstract

from arXiv · show

Agentic video-generation systems close a loop between a generator and a verifier: an LLM plans shots, calls a text-to-video model, and a multimodal judge decides whether the result satisfies the request. To diagnose where a long workflow fails, recent harnesses deliberately show the judge more than the video-the agent's execution trace, its plan, the narration it synthesized. We ask whether this auxiliary text moves the judge's verdict on purely \emph{visual} requirements, holding the frames fixed. On a benchmark of 109 generated two-event clips with manual labels, in which the requested event is either visibly completed or visibly missing, a trace that reports a successful tool call makes three open-weight Qwen-VL judges (7B, 8B, 32B) accept $78$--$90\%$ of the failures, up from $7$--$19\%$ without text, and a contradicting trace makes them reject up to $100\%$ of correct clips; an instruction to ``use only the frames'' does not remove the effect. Frontier closed judges are essentially unmoved on the same clips, showing that the vulnerability is a property of the judge's learned trust in tool logs rather than of the task. Plan-derived text carries no clip-specific information, so it can only shift a judge's operating point, and in a repair loop that shift becomes a cap on the true pass rate that no repair policy can exceed; the cap matches simulation to two decimals. In the loop, contamination is exploited without any adversarial agent: an honest LLM planner that always regenerates ends with a judge pass rate of $1.00$ and a human-labelled pass rate of $0.28$, and a pipeline in which a cheap checker writes its verdict into the trace launders that checker's errors into a stronger final judge ($0.69$ false accepts).

1 Introduction

The paper audits whether auxiliary text changes judges’ verdicts on visual requirements and finds that execution traces can override the frames for open-weight judges. It also shows that this contamination can distort repair-loop outcomes and proposes evidence-specific routing as a structural remedy.

1 Introduction

  • Agentic video systems send plans, tool calls, generated media, and narration through a multimodal judge whose verdict filters what the repair loop optimizes.The judge is therefore part of the closed loop, rather than an offline metric.Source: §1 · p. 1
  • The audit holds frames fixed while varying narration, execution logs, or burned-in subtitles to support or contradict a visual requirement.It spans two datasets, three text channels, two claim directions, three open-weight judges, and four frontier closed judges.Source: §1 · p. 2
  • 0.78, 0.90, and 0.83 of visibly missing events are accepted by the 7B, 8B, and 32B Qwen judges under a successful-generation log, versus 0.17, 0.19, and 0.07 without text.The effect does not shrink from 7B to 32B.Source: §1 · p. 2
  • A visual-only instruction still leaves false accepts under supportive logs at 0.41–0.63.The proposed least-privilege approach routes evidence by requirement type and restores true loop pass rates to 0.86 (8B) and 0.92 (32B), at triple the cost.Source: §1 · p. 2
  • 0.12 to 0.14 is GPT-5.4-mini’s false-accept change under a supportive log, while the Qwen judges accept 0.78–0.90 of failures.GPT-5.5, Claude Opus 5, and DeepSeek-V4 are likewise reported as unmoved; the authors attribute the vulnerability to learned trust in tool logs, not the task itself.Source: §1 · p. 2
  • An honest LLM planner that always regenerates reaches a 1.00 judge pass rate but only a 0.28 human-labelled pass rate, while checker verdicts in traces produce 0.69 false accepts.Without the injected checker line, false accepts are 0.25.Source: §1 · p. 2

2 Related Work

Prior work studies agentic video systems, multimodal-judge biases, and reward hacking or evidence grounding. This paper focuses on execution traces as a specific process-context channel in video-agent judging.

Agentic video generation and its judges

  • Recent video-agent systems use MLLM judges inside planning, generation, verification, and redesign loops, and some provide process context alongside video.The paper studies that design decision rather than proposing a new agent.Source: §2 · p. 3

Biases of multimodal judges

  • Known multimodal-judge problems include informativeness, perturbation, agreement, self-verification, and adversarial-score biases, alongside language dominance and spurious cross-modal correlations.The paper’s distinct focus is execution-trace dominance over visual evidence in open-weight judges, plus its exploitation by honest agents.Source: §2 · p. 3

Reward hacking and evidence grounding

  • Reward-model hacking and visual shortcuts are known, while evidence-grounded evaluation localizes supporting frames or trains judges to use evidence regions.Least-privilege judging is presented as complementary: it removes evidence that cannot establish a requirement rather than training judges to weigh evidence correctly.Source: §2 · p. 3

3 Problem Setup

The setup distinguishes requirements by the evidence that can establish them and tests whether irrelevant auxiliary text changes judgments of visual requirements. It separates plan-derived text from clip-derived checker outputs because only the latter carries clip-specific information.

3 Problem Setup

  • Visual requirements are determined by the video frames, while process requirements are determined by the execution trace; the judge maps evidence to accept or reject with confidence.The episode also includes narration and, potentially, on-screen text burned into the frames.Source: §3 · p. 3
  • For a visual requirement, the ideal verdict depends on the frames alone; the audit fixes frames, varies auxiliary text to support or contradict the requirement, and measures acceptance on present and absent clips.Support on an absent clip probes false accepts; contradiction on a present clip probes false rejects.Source: §3 · p. 3
  • The three tested text channels are narration transcripts, execution traces, and narration burned into frames as subtitles, each tested with supporting and contradicting claims.The trace can include a plan, generation status, and—in the static audit—an event-check line.Source: §3 · pp. 3–4
  • The audit uses three open-weight Qwen-VL judges, 16 sampled frames, and both default and visual-only prompts.The visual-only prompt says narration, subtitles, logs, and plans are not evidence and must be ignored.Source: §3 · p. 4
  • Plan-derived text carries no clip-specific information and can shift a judge’s acceptance threshold, whereas checker output carries clip-specific information to the extent of checker accuracy.The closed loop begins with plan-derived traces and then adds a checker to examine error propagation.Source: §3 · p. 4
  • Near-misses matter because auxiliary-text shifts should have their largest effect when the visual evidence leaves the judge uncertain, the clips most relevant inside a repair loop.The paper describes the effect as negligible when the visual signal is decisive and largest around the judge’s decision boundary.Source: §3 · p. 4

4 Data

The data section pairs an unambiguous real-video control with a manually labelled generated near-miss set. The generated clips expose both a benchmark-construction challenge and the effect of execution logs on judgments.

4 Data

  • The real-video control uses a 10-class UCF101 subset of 407 clips, pairing each class with either its most confusable sibling or an unrelated distractor.The requirement is phrased as an action class, with 100 clips per split.Source: §4 · p. 4
  • The near-miss set starts from two-event prompts and Wan2.2-generated clips, with labels assigned by inspecting six-frame contact sheets.The requirement is the second event, and the generation conditions include both events or only the first followed by neutral filler.Source: §4 · p. 4
  • In each of three batches, roughly one third of first-event-only clips unexpectedly completed the natural continuation, and explicit negation did not prevent it.Four prompts were undecidable at judging resolution and dropped; the clean set contains 50 present and 59 absent clips over 36 prompts.Source: §4 · pp. 4–5
  • On generated near-misses, a supportive execution log makes open-weight judges accept 0.78–0.90 of failures, while GPT-5.4-mini moves only from 0.12 to 0.14.Figure 1 reports the fixed-frame comparison on 50 present and 59 absent clips; under a contradicting log, Qwen3 acceptance on correct clips falls to 0.00–0.08 while GPT-5.4-mini remains at 0.90.Source: Figure 1 · p. 5
  • Table 1 reports P(accept) for the visual requirement on present and absent clips, with open-weight judges and GPT-5.4-mini evaluated on all 109 clips.GPT-5.5 and Claude Opus 5 have smaller subsets because of API budget; the log channel is marked in the table.Source: Table 1 · p. 5

5 Static Audit: Does the Verdict Move with the Text?

With frames fixed, auxiliary text sharply alters open-weight judges’ visual verdicts, especially on generated near-misses, while frontier judges remain largely unmoved. Cross-shot memory and ignore-text prompting do not remove the open-weight vulnerability.

Real videos

  • On UCF101, contradicting logs drive acceptance of correct clips from 0.80–0.89 to 0.00–0.21, while overall accuracy falls to 0.50–0.56.Narration and subtitles have the same sign with smaller magnitude; a wrong log entry can trigger pointless regeneration of a correct clip.Source: §5 · pp. 5–6

Generated near-misses

  • A supportive execution log raises false accepts on generated near-misses to 0.78/0.90/0.83 for the 7B/8B/32B judges, from 0.07–0.19 without text.The log channel does not shrink from 7B to 32B; contradicting logs also reduce present-clip acceptance to 0.08 and 0.00 for the Qwen3 judges.Source: §5 · p. 6

Frontier closed judges

  • Frontier judges are largely unmoved: GPT-5.4-mini false accepts are 0.14 under supportive logs versus 0.12 without, while GPT-5.5 and Claude Opus 5 show the same flat profile.DeepSeek-V4 also accepts 0.09 of absent clips with a supportive log versus 0.06 without when given a vision tool’s frame descriptions.Source: §5 · p. 6

Multi-shot consistency

  • In multi-shot consistency tests, “asset locked” memory raises Qwen3-VL-8B acceptance of inconsistent pairs from 0.47 to 1.00; “re-cast” memory makes Qwen3-VL-32B reject all consistent pairs.Qwen3-VL-32B false accepts on inconsistent pairs rise from 0.29 to 0.47 with “asset locked” memory; the table covers 17 consistent and 17 inconsistent pairs.Source: §5 · p. 6, Table 2 · p. 7

“Ignore the text” is not a fix

  • A visual-only instruction reduces false accepts under supportive logs from 0.78/0.90/0.83 to 0.63/0.54/0.41, still three to six times the no-text floor.The instruction leaves the reject direction largely untouched; a structural constraint differs from an instruction competing with the text it asks the model to ignore.Source: §5 · pp. 6–7

6 Closed Loop: Honest Agents Exploit It Anyway

In the simulated repair loop, a successful tool status makes the judge accept failed clips before any planner can repair them, capping the true pass rate. An honest LLM planner still finishes with a 1.00 judge pass rate but only a 0.28 human-labelled pass rate; logging a cheap checker’s verdict can pass its errors to a stronger judge.

6 Closed Loop: Honest Agents Exploit It Anyway

  • The simulation starts from 36 labelled failures and lets each regeneration draw a real clip, present with probability 0.85, for up to four repair rounds.It compares always-regenerate, best-of-K, cost-greedy, and an LLM planner; actions include regeneration, adding narration, and self-verification.Source: §6 · p. 7, Table 3 · p. 8
  • 72% of failed clips are accepted at round zero, capping any repair policy’s true pass rate at 1 − α0; the observed ceiling matches the best simulated outcome to two decimals.Always-regenerate attains the ceiling given enough rounds, because clips accepted at round zero never re-enter the loop.Source: §6 · p. 8, Table 4 · p. 8
  • The always-regenerate, best-of-K, and LLM planners each reach a 1.00 judge pass rate but only a 0.28 true pass rate.The LLM planner chose regeneration in all 13 decisions; the initial trace’s plan and success status were enough to certify unrepaired failures.Source: §6 · pp. 7–8
  • Logging the 8B checker’s verdict raises the 32B judge’s round-zero acceptance from 0.25 to 0.69 and lowers its true pass rate to 0.31.The 32B judge accepts a PASS-marked failed clip 92% of the time beyond its own false-accept rate.Source: §6 · pp. 8–9

7 Least-Privilege Judging

Least-privilege judging routes each requirement only the evidence type that can establish it, rather than pooling all evidence in one prompt. The approach reduces contamination in the repair loop and preserves trace-based process checks, but cannot remove text inseparable from the frames.

7 Least-Privilege Judging

  • Each requirement is assigned an evidence type, and the judge receives only its corresponding evidence: frames for visual requirements, traces for process requirements, and audio for audio requirements.For visual requirements, OCR-detected text regions are blurred; artifact-specific numeric checks can use metadata tools.Source: §7 · p. 9
  • Routing evidence by requirement type reduces the hacked rate to 0.14 for 8B and 0.08 for 32B, while true pass rates rise to 0.86 and 0.92.The cost per episode rises from 0.36 to 1.11 as failed clips are regenerated instead of certified.Source: §7 · p. 9
  • For subtitle-contaminated clips, OCR masking restores false accepts and false rejects to the no-subtitle baseline without reducing recall on present clips (0.97).The evidence-first prompt only halves the subtitle effect and reduces recall from 0.97 to 0.77.Source: §7 · p. 9, Table 5 · p. 10
  • Routing preserves process verification: accuracy on four trace-only requirements is 0.89–1.00 with either trace-only routing or frames plus trace.Process requirements receive the trace, so routing does not remove evidence needed to check them.Source: §7 · p. 9, Table 6 · p. 10
  • OCR masking cannot remove text inseparable from the frames, such as a generated whiteboard spelling out the plan.The proposed routing also presupposes typed requirements; the authors say adding a type to an existing checklist is a one-token prompt change.Source: §7 · pp. 9–10

8 Discussion

The discussion distinguishes tool logs from narration and subtitles: logs convey provenance, which judges may have learned to treat as authoritative. It argues for separating evidence by requirement, not hiding traces needed for process evaluation.

8 Discussion

  • The authors conjecture that agentic training data teaches judges to treat tool outputs as authoritative, although “success” records call completion rather than whether the requested event occurred.They interpret frontier judges’ relative immunity as a difference in learned channel weighting, not visual baseline quality or model scale.Source: §8 · p. 10
  • Trace access remains necessary for process metrics; the authors argue that evidence should be separated by metric just as rubrics already separate process from output metrics.They cite VideoWeaver’s output-evaluation skill, which scores a story card based on a frame grid and narration transcript, consulting frames directly when the card is insufficient.Source: §8 · p. 10

9 Conclusion

The conclusion argues that open-weight judges can trust an agent’s account over visible evidence, contaminating both verdicts and repair loops. The appendix prompts specify the verifier’s inputs and response format, including a visual-only instruction that asks the judge to ignore auxiliary text.

9 Conclusion

  • Open-weight judges accept many visibly failed clips when traces support the requested event, while least-privilege judging removes that channel and preserves process diagnosis.The conclusion also notes that cheap-checker errors can pass through traces to a stronger judge and that honest planners can certify failures before acting.Source: §9 · p. 10

A Prompts

  • The default verifier prompt supplies sampled frames and possibly narration or an execution log, and asks whether the stated requirement is satisfied.The visual-only variant explicitly instructs the judge to base its verdict only on visible frames and ignore narration, subtitles, logs, and plans.Source: A Prompts · p. 13
  • The static-audit support log records a planned event, a successful generation, a passed consistency check, and successful narration; the two-event variant also logs an event check.The closed-loop initial trace instead contains only request parsing, a plan, and a successful generation status.Source: A Prompts · p. 13

B Two-Event Benchmark

The benchmark uses generated two-event clips with a requested event either present or replaced by a filler. Leakage and ambiguous clips were excluded from the absent set.

B Two-Event Benchmark

  • 12 of 34 nondropped e1-only clips in each of batches 1 and 2, and 12 of 40 in batch 3, showed the requested event despite filler prompts.Leaked clips were relabelled by inspection and excluded from the absent set.Source: B Two-Event Benchmark · p. 13
  • The clips were generated with Wan2.2-T2V-A14B at 832×480 resolution, with 81 frames at 16 fps, on one GB200.Generation used high- and low-noise experts, 10+10 Euler steps, shift 8, CFG 3.5, and lightning LoRA on both experts.Source: B Two-Event Benchmark · p. 13
  • 13 ambiguous clips were excluded rather than labelled.Source: B Two-Event Benchmark · p. 13

C UCF101 Results

On the near-miss set, log text shifts open-weight judges’ visual verdicts, while frame-only instructions do not eliminate the effect. The easy split has few supporting-text false accepts, and the authors identify limits on benchmark and repair-loop scope.

C UCF101 Results

  • On the easy split, supporting-text false accepts are ≤0.07 for all judges; contradict-direction numbers match the hard split within 0.05.Source: C UCF101 Results · p. 13

D Visual-Only Prompt on the Near-Miss Set

  • Across three Qwen judges, absent-clip P(accept) rose under log supports (0.17→0.63, 0.12→0.54, 0.07→0.41) and fell under log contradicts (0.02, 0.00, 0.00).The instruction to use only frames helps partially against log supports and little in the reject direction; GPT-5.4-mini changes from 0.14 to 0.12 for absent-clip P(accept) under log supports.Source: D Visual-Only Prompt on the Near-Miss… · p. 14

E Limitations

  • The near-miss benchmark has 109 author-labelled clips and 36 prompts; the repair loop is simulated, and multi-shot requirements use reused clips rather than generated sequences.GPT-5.5 and Claude Opus 5 were run on subsets for budget reasons, and the study tested one open-weight judge family.Source: E Limitations · p. 14

AI Use Statement

  • The authors disclose generative-AI assistance in parts of the paper’s text, code, and analysis, while taking responsibility for the final content.Source: AI Use Statement · p. 14
  • Figure 3 shows filler-prompt leakage, including clips where the event occurred despite an explicit negation; leaked clips were relabelled and excluded from the absent set.Source: Figure 3 · p. 16
  • Figure 4 shows OCR-detected burned-in text masked with Gaussian blurring before the visual-requirement judge receives the frames.Source: Figure 4 · p. 17

Related papers

Loading 2609.28564v1…