Poisoning Prompt-Guided Sampling in Video Large Language Models

## Abstract

Abstract Video Large Language Models (VideoLLMs) have emerged as powerful tools for understanding videos, supporting tasks such as summarization, captioning, and question answering.
Their performance has been driven by advances in frame sampling, progressing from uniform-based to semantic-similarity-based and, most recently, prompt-guided strategies. While vulnerabilities have been identified in earlier sampling strategies, the safety of prompt-guided sampling remains unexplored.
We close this gap by presenting PoisonVID , the first black-box poisoning attack that undermines prompt-guided sampling in VideoLLMs. PoisonVID compromises the underlying prompt-guided sampling mechanism through a closed-loop optimization strategy that iteratively optimizes a universal perturbation to suppress harmful frame relevance scores, guided by a depiction set constructed from paraphrased harmful descriptions leveraging a shadow VideoLLM and a lightweight language model, i.e., GPT-4o-mini.
Comprehensively evaluated on three prompt-guided sampling strategies and across three advanced VideoLLMs, PoisonVID achieves 82 % − 99 % 82\%-99\% attack success rate, highlighting the importance of developing future advanced sampling strategies for VideoLLMs. This paper contains content that is offensive.

## 1 Introduction

Video Large Language Models (VideoLLMs) have been developed to address various video understanding tasks (Zhao et al., 2023; Tang et al., 2025b; Weng et al., 2024).
By extracting visual representations from video and reasoning over them with textual prompts, VideoLLMs can generate concise summaries, answer content-related queries, and identify key events, which allow users to access the information of a video without watching it in full, a capability particularly valuable for long or information-dense videos.
Practical applications include obtaining summaries of online lectures, querying specific moments in meeting recordings, and navigating press briefings, underscoring the role of VideoLLMs as efficient interfaces for human–video interaction (Qian et al., 2024).

Recent advances in VideoLLMs have been driven by improved frame sampling strategies, progressing from uniform-based to semantic-similarity-based and ultimately prompt-guided sampling ones.
*Uniform frame sampling (UFS)* (Li et al., 2024b; Cheng et al., 2024a) selects frames at fixed intervals across the video, always including the first and last frames which are often uninformative (Zhang et al., 2024c). While efficient, UFS may omit informative frames, limiting its ability to capture key events of the video (Zohar et al., 2025).
In contrast, *semantic similarity sampling (SSS)* (Chen et al., 2024a) begins with dense sampling to construct a frame set. Each frame in this set is represented by a feature vector (*e.g.,* the CLS token extracted from a CLIP encoder (Radford et al., 2021)).
SSS then iteratively removes adjacent frames with high semantic similarity, while ensuring the first and the last frames are retained.
Compared with UFS, SSS preserves frames with higher information density but lacks user prompt alignment, limiting VideoLLMs’ performance (Tang et al., 2025a).
Unlike UFS and SSS strategies, the advanced *prompt-guided sampling (PGS)* (Huang et al., 2025; Cheng et al., 2025) integrates the user prompt into the frame sampling process. It begins with a densely sampled set of video frames, and then each frame is assigned a relevance score that measures how well it aligns with the user prompt, typically phrased as a guidance query such as “is this frame relevant to answering the prompt?”.
These scores are computed by lightweight vision–language models (VLMs) like BLIP (Li et al., 2023a) or CLIP (Radford et al., 2021). The frames with the highest scores are finally selected as input to the VideoLLM.
This design prioritizes prompt-relevant frames, enhancing overall performance on video understanding tasks (Hu et al., 2025).

To the best of our knowledge, (Cao et al., 2025) is the only work to study poisoning attacks that exploit frame sampling in VideoLLMs. It demonstrates that sampling strategies such as UFS and SSS can omit harmful segments, and proposes the Frame Replacement Attack (FRA), as illustrated in [Figure 1](https://arxiv.org/html/2509.20851v1#S1.F1), which simply swaps a short portion of the video with harmful content to exploit this blind spot.
However, UFS and SSS are no longer the dominant designs: the former samples frames at fixed intervals, missing critical moments, while the latter ignores prompt alignment despite preserving information density.
To address these limitations, VideoLLMs have increasingly adopted PGS, which assigns prompt-conditioned relevance scores to frames and selects the top ones for encoding, making the simple FRA ineffective against PGS-based models.

In this paper, we introduce PoisonVID, a black-box poisoning attack framework that exposes the vulnerabilities in the PGS processes of VideoLLMs.
Unlike (Cao et al., 2025), which introduces harmful clips to exploit the blind spots of UFS and SSS, PoisonVID directly targets PGS, manipulating relevance scores to suppress the selection of harmful frames.
PoisonVID employs a closed-loop optimization strategy.
In each iteration, a universal perturbation is optimized to suppress the relevance scores of harmful frames as computed by a lightweight VLM, thereby reducing their likelihood of being selected.
To provide semantic guidance for this optimization, we further construct a depictions set by prompting a shadow VideoLLM to generate harmful depictions and paraphrasing them with a lightweight language model, *i.e.,* GPT-4o-mini.
This integration of perturbation optimization with semantically guided depictions allows PoisonVID to function in a fully black-box setting, effectively compromising prompt-guided sampling mechanisms in VideoLLMs.

We extensively test three open-source prompt-guided sampling (PGS) strategies (Differential Keyframe Selection (DKS) (Cheng et al., 2025), Adaptive Keyframe Sampling (AKS) (Tang et al., 2025a) and Frame Selection Augmented Generation (FRAG) (Huang et al., 2025)) across three representative VideoLLMs, where PoisonVID achieves $82\%-99\%$ attack success rate, highlighting that future sampling strategies must account for safety implications for VideoLLMs.

Figure: Figure 1: An illustration of the Frame Replacement Attack (FRA) (Cao et al., 2025) under three sampling strategies: uniform frame sampling (UFS), semantic similarity sampling (SSS), and prompt-guided sampling (PGS). UFS and SSS capture only a single harmful frame, causing the VideoLLM to miss violence, whereas PGS retains multiple harmful frames, enabling correct detection. This underscores the necessity of novel attacks against PGS. Dashed red boxes denote harmful frames.
Refer to caption: images/pre-examples.png

In summary, this paper makes three major contributions:

- •
We introduce PoisonVID, the first black-box video poisoning attack framework that exposes vulnerabilities in prompt-guided sampling of VideoLLMs.
- •
We design a closed-loop optimization strategy that suppresses harmful frame relevance scores through universal perturbation refinement, limiting their selection in sampling.
- •
We conduct extensive evaluations of PoisonVID across three representative VideoLLMs with diverse prompt-guided sampling strategies, showing that it consistently achieves strong attack success and uncovers the vulnerabilities in current PGS-based designs.

## 2 Related Work

Video Large Language Models.
VideoLLMs extend the capability of language models to handle video inputs by generating outputs conditioned on both video content and user prompts (Liu et al., 2025; Chen et al., 2024b; Jin et al., 2024).
VideoLLMs have been widely applied to a variety of downstream tasks, including video summarization (Li et al., 2023b; Zhang et al., 2025; Lin et al., 2024), captioning (Yang et al., 2023; Chen et al., 2024a), question answering (Zhang et al., 2024a; Liu et al., 2025), video grounding (Wang et al., 2025a; Qian et al., 2024; Yu et al., 2023), and long video understanding (Weng et al., 2024; Cheng et al., 2024b; Wang et al., 2025b).
Given a video and a textual query, the model aims to provide answers that are grounded in the video (Li et al., 2024a).
A typical VideoLLM pipeline consists of three stages: frame selection, feature extraction, and modality fusion. First, frames are sampled from the input video. These frames are then processed by a visual encoder to obtain visual embeddings, which are projected into the text embedding space through a projector layer. Finally, the visual and textual embeddings are fused and passed into a large language model (LLM) to generate the response. Representative VideoLLMs include the LLaVA-based (Zhang et al., 2024b; c; d; Lin et al., 2024) and LLaMA-based (Li et al., 2024b; Cheng et al., 2024a; Zhang et al., 2025) families.

Frame Sampling Strategies.
There are three major frame sampling strategies, including uniform frame sampling (UFS), semantic similarity sampling (SSS), and prompt-guided sampling (PGS).

*Uniform Frame Sampling (UFS).* This frame sampling strategy selects frames at fixed intervals across the video, always including the first and last frames (Zhang et al., 2024c). It is widely adopted by Apollo (Zohar et al., 2025) and the families of LLaVA (Zhang et al., 2024c; Lin et al., 2024) and LLaMA (Cheng et al., 2024a).
While simple and efficient, this approach fixes the positions of selected frames and tends to miss large amounts of meaningful content, particularly in minute-long videos (Zohar et al., 2025; Hu et al., 2025).

*Semantic Similarity Sampling (SSS).* To address UFS’s shortcomings, the semantic similarity frame sampling strategy, like Semantic-aware Key-frame Extraction (SKE) (Chen et al., 2024a) is introduced.
It first performs a denser sampling and then maximizes the semantic diversity between adjacent selected frames to retain more informative content. The semantic diversity is often measured by extracting frame-level feature vectors from a visual encoder (*e.g.,* CLIP (Radford et al., 2021)), and computing their pairwise cosine similarity. Frames with high similarity are considered redundant and thus removed.
However, this strategy remains independent of the input prompt and may still select frames irrelevant to the user query. For example, if the prompt asks about the first two minutes of a video, frames beyond that time span provide no value. Moreover, the first and last frames are always included for UFS and SSS, yet these frames are frequently uninformative, such as blank or static color screens at the beginning or end of movies and animations (Tang et al., 2025a).

*Prompt-Guided Sampling (PGS).*
To advance UFS and SSS, researchers recently introduce prompt-guided sampling.
This strategy first performs a denser sampling and then uses a lightweight VLM (*e.g.,* BLIP (Li et al., 2023a)) to compute the relevance score of each frame with respect to the prompt. The frames with the highest scores are then passed into the visual encoder of the VideoLLM, greatly improving localization accuracy and model performance. Representative open-source methods include Differential Keyframe Selection (DKS) (Cheng et al., 2025), Adaptive Keyframe Sampling (AKS) (Tang et al., 2025a) and Frame Selection Augmented Generation (FRAG) (Huang et al., 2025).
Beyond relevance scoring, DKS considers the feature similarity between each frame and its neighboring frames when selecting the final set in order to reduce redundancy. AKS introduces a coverage term to encourage diversity among the selected frames. FRAG, in contrast, relies exclusively on frame relevance ranking.
As a result, once frames strongly correlated with the prompt are identified, all other less relevant frames are disregarded. Although the selected frames may exhibit high inter-frame similarity, this design substantially enhances model performance by ensuring that the most prompt-relevant content is preserved. However, FRAG requires a full-fledged VideoLLM rather than a lightweight VLM for relevance scoring, which substantially increases the computational cost.
Other related approaches include lightweight M-LLM-based frame selection (Hu et al., 2025) and FocusChat (Cheng et al., 2024b), the latter additionally employing a spatial–temporal filtering module to discard prompt-irrelevant frames. Besides, Frame-Voyager (YU et al., 2025) learns a query-aware frame scoring module that models query–frame interactions and ranks frame subsets to select informative frames, but it relies on supervision from a single specific Video-LLM and is limited to short videos.

Poisoning Attacks.
Research on VideoLLMs has so far emphasized performance improvements, leaving poisoning risks underexplored.
(Cao et al., 2025) revealed three design flaws, sparse uniform sampling, token under-sampling, and modality fusion imbalance that cause UFS- and SSS-based VideoLLMs to overlook harmful content even when it is explicitly embedded in manipulated videos.
In contrast, we shift the focus to the safety implications of frame selection, examining whether the advanced prompt-guided sampling methods, such as DKS (Cheng et al., 2025), AKS (Tang et al., 2025a), and FRAG (Huang et al., 2025), remain vulnerable to poisoning attacks.

## 3 Method

### 3.1 Prompt-guided Sampling in VideoLLMs

Formally, a video is denoted as $V=\{f_{1},f_{2},\dots,f_{T}\}$, a sequence of $T$ frames. Since processing all frames is computational prohibitive (Chen et al., 2024a; Cheng et al., 2024a; Liu et al., 2025), a frame selection strategy $\mathcal{S}(V,N)$ is applied to select a subset of $N\ll T$ frames from $V$:

$$ $\mathcal{S}(V,N)=\{f_{i_{1}},f_{i_{2}},\dots,f_{i_{N}}\}.$ (1) $$

Each selected frame $f_{i_{j}}$ is then encoded into a visual embedding through a visual encoder $\mathcal{E}$:
$\mathbf{v}_{j}=\mathcal{E}(f_{i_{j}}),j=1,\dots,N.$ The resulting embeddings $\{\mathbf{v}_{1},\dots,\mathbf{v}_{N}\}$ are projected into the text embedding space through a projector $\mathcal{P}$, yielding $\{\mathbf{z}_{1},\dots,\mathbf{z}_{N}\}$.
Given a text prompt $q$, its embedding is obtained by a tokenizer $\mathcal{T}$ as $\mathbf{t}=\mathcal{T}(q)$. The underlying LLM finally receives both the projected visual embeddings and the textual embedding, and produces a response:

$$ $y=\text{LLM}(\{\mathbf{z}_{1},\dots,\mathbf{z}_{N}\},\mathbf{t}).$ (2) $$

Prompt-guided sampling (PGS) has become the standard in recent VideoLLMs (Cheng et al., 2025; Huang et al., 2025), where each frame is scored by its relevance to the user prompt and the top-ranked ones are selected for encoding.
Starting from a densely sampled set $V_{M}$ ($M>N$),
each frame $f_{k}\in V_{M}$ is assigned a relevance score $r(f_{k},q^{\prime})$ quantifying its semantic alignment guided by a user prompt ($q$)-derived query $q^{\prime}$ (*e.g.,* “whether the frame is relevant to answering $q$”) (Tang et al., 2025a), which is typically estimated by a lightweight VLM such as BLIP or CLIP. Finally, the top-$N$ frames with the highest relevance scores are selected, and the selection frames of PGS is formally defined as:

$$ $\mathcal{S}_{\text{PGS}}(V,N,q^{\prime})=\operatorname*{arg\,\text{Top-}N}_{f_{k}\in V_{M}}\;r(f_{k},q^{\prime}).$ (3) $$

Unlike other frame sampling strategies, PGS filters out less informative frames while retaining those most relevant to the prompt, leading to stronger comprehension and reasoning over video content.

### 3.2 Attack Framework

Figure: Figure 2: Overview of the PoisonVID framework. Left (attack scenario): The adversary manipulates a harmful clip and embeds it into a benign video to generate a poisoned video, with the goal of inducing the VideoLLM to deny the presence of harmful content. Right (optimization strategy): The adversary constructs a harmful depiction set to obtain textual descriptions of the harmful clip, then leverages a lightweight VLM to compute relevance scores. Finally, a universal perturbation is iteratively optimized so that the perturbed harmful clip is less likely to be sampled by PGS.
Refer to caption: images/overview.png

Attack Overview.
[Figure 2](https://arxiv.org/html/2509.20851v1#S3.F2) illustrates the design of our proposed attack framework, PoisonVID.
We optimize a universal perturbation that is applied to harmful clips guided by a depiction set constructed from paraphrased harmful descriptions using a shadow VideoLLM and a lightweight language model, *i.e.,* GPT-4o-mini.
The optimization primarily minimizes the semantic similarity between the perturbed clip and the depiction set, ensuring that the harmful frames, once perturbed, are pushed away from the semantic space that would otherwise increase its relevance to the user prompt.
The perturbed harmful clip is then randomly embedded into target benign videos.

Threat Model. We assume that the adversary has no access to the internal architecture, weights, or gradients of the target VideoLLM, and cannot repeatedly query the model for optimization.
The adversary only knows the general principle of PGS, *i.e.,* selection mainly based on relevance scoring but not the exact implementation details or parameters.
The adversary is allowed to make small modifications to the harmful clip, while ensuring that the harmful content remains visually natural and clearly recognizable to human observers.
As illustrated in the left side of [Figure 2](https://arxiv.org/html/2509.20851v1#S3.F2), the adversary inserts the harmful clip into a target benign video, forming a poisoned video.
Given a prompt asking whether there exists harmful content in the video, the goal of the adversary is to induce the VideoLLM into producing a denial response regarding its presence.
Such an output indicates that the harmful content has been omitted, and the attack is considered successful.

Attack Formulation. We seek to prevent harmful video clips from being surfaced by PGS. To this end, our attack optimizes a universal perturbation $\delta$ such that, when short harmful clips are randomly embedded into benign videos, PGS downweights these segments and the VideoLLM consequently overlooks the harmful content.
Instead of learning an individual perturbation for each harmful frame, which would be computationally prohibitive and unnecessary, we adopt a universal perturbation shared across all frames.
Given a harmful clip $\mathcal{H}=\{f_{1},f_{2},\dots,f_{h}\}$, we apply the perturbation $\delta$ uniformly to each frame:
$\tilde{f}_{j}=f_{j}+\delta$.
In parallel, we obtain a description $\hat{d}$ of the original harmful clip through a shadow VideoLLM and construct a depiction set $\mathcal{D}=\{d_{1},d_{2},\dots,d_{l}\}$ by paraphrasing it with a lightweight language model.
For each description $d_{k}$, we further derive a corresponding query $q^{\prime}_{k}$ ([Section 3.1](https://arxiv.org/html/2509.20851v1#S3.SS1)), and collect them into the query set $\mathcal{Q^{\prime}}=\{q^{\prime}_{1},q^{\prime}_{2},\dots,q^{\prime}_{l}\}$.
The optimization objective is to semantically push the perturbed harmful frames away from the depiction set, thereby reducing their relevance to the corresponding queries $\mathcal{Q^{\prime}}$.
This is measured by computing the relevance score $r(\tilde{f}_{j},q^{\prime}_{k})$ ([Equation 3](https://arxiv.org/html/2509.20851v1#S3.E3)) between each perturbed frame $\tilde{f}_{j}$ and each query $q^{\prime}_{k}$, using a lightweight VLM such as BLIP (Li et al., 2023a). Based on this, we define the relevance suppression loss (RSL) as:

$$ $\mathcal{L}_{\mathrm{RSL}}(\delta;\mathcal{H},\mathcal{Q^{\prime}})=\frac{1}{hl}\sum_{j=1}^{h}\sum_{k=1}^{l}r(\tilde{f}_{j},q^{\prime}_{k}).$ (4) $$

The perturbation $\delta$ is optimized through iterative projected gradient updates (Madry et al., 2018). At each iteration $t$, the update rule is defined as:

$$ $\delta^{(t+1)}=\Pi_{\|\cdot\|_{\infty}\leq\epsilon}\Big(\delta^{(t)}-\eta\,\nabla_{\delta}\mathcal{L}_{\mathrm{RSL}}(\delta^{(t)};\mathcal{H},\mathcal{Q^{\prime}})\Big),$ (5) $$

where $\eta$ is the learning rate, $\Pi_{\|\cdot\|_{\infty}\leq\epsilon}(\cdot)$ denotes the projection operator that enforces the $\ell_{\infty}$-norm constraint, and $\epsilon$ controls the imperceptibility of the perturbation.
By minimizing $\mathcal{L}_{\mathrm{RSL}}$, the relevance of harmful frames to the derived queries is reduced, thus decreasing their probability of being selected by PGS. The optimization workflow is shown in the right side of Figure [2](https://arxiv.org/html/2509.20851v1#S3.F2).

Attack Algorithm. Algorithm [1](https://arxiv.org/html/2509.20851v1#alg1) presents the pseudo code of the optimization procedure of PoisonVID. It starts with perturbation initialization, followed by deriving the query set from the depiction set. Afterwards, the perturbation is optimized iteratively to suppress the relevance score.

Figure: Algorithm 1 Optimization procedure of PoisonVID

## 4 Experiment

Experiment Setup. We introduce the video datasets, VideoLLMs, PGS methods, baseline, and metrics that are used for evaluating the attack effectiveness of the proposed PoisonVID.

*Video Datasets.*
Following (Cao et al., 2025), we randomly select 100 benign videos from the LLaVA-Video-178K (Zhang et al., 2024d) as test inputs, and
we collect 15 harmful clips from three categories: *violence*, *crime*, and *pornography*, using the same sources as in (Cao et al., 2025).

*VideoLLMs.*
We evaluate three mainstream VideoLLMs: LLaVA-Video-7B-Qwen2 (L-7B) (Zhang et al., 2024d), VideoLLaMA2 (VL2) (Cheng et al., 2024a), and ShareGPT4Video (SG4V) (Chen et al., 2024a).

*PGS Methods.* We consider three recent open-source PGS methods: Differential Keyframe Selection (DKS) (Cheng et al., 2025), Adaptive Keyframe Sampling (AKS) (Tang et al., 2025a) and Frame Selection Augmented Generation (FRAG) (Huang et al., 2025).

*Baseline.*
Since frame replacement attack (FRA) (Cao et al., 2025) is the only one poisoning attack proposed to induce the omission of harmful content, we adopt it as our baseline. All parameter configurations are aligned with those used in (Cao et al., 2025).

*Evaluation Metric.* We adopt the Attack Success Rate (ASR) as our evaluation metric, which measures the proportion of videos with inserted harmful content that the VideoLLM fails to recognize.
Note that we verify that all selected benign videos are consistently judged as non-harmful by the VideoLLMs, and all harmful clips are recognized as harmful prior to attacks.

Implementation Details.
Following (Cao et al., 2025), we replace a contiguous 4-second segment in each benign video with a harmful clip, as this duration has been shown to reliably expose omission failures in minute-long videos.
For harmful depiction set construction, we adopt L-7B as the shadow VideoLLM to generate textual descriptions of harmful clips, and employ GPT-4o-mini for paraphrasing to ensure lexical diversity while preserving semantic fidelity.
We use BLIP as the lightweight VLM to compute relevance scores during attack optimization. The impact of alternative VLM choices and harmful clip length is further analyzed in the ablation study.

Following mainstream VideoLLMs (Li et al., 2024a; Zhang et al., 2024c), we set the selected frame number $N$ as 32 for all sampling strategies.
*Note that this study focuses on frame selection strategies; consequently, we modify only the sampling component of the evaluated VideoLLMs, with all other parts left unchanged.*
Following adversarial image attack practices (Madry et al., 2018; Wong et al., 2020), we constrain the perturbation under the $\ell_{\infty}$ norm with $\epsilon=8/255$
to ensure imperceptibility.
We initialize the perturbation with uniform random noise
in $[-\epsilon,\epsilon]$.
The optimization runs for 1,000 steps with an exponential learning rate decay (initial rate 10, decay factor 0.999).
The depiction set size is fixed at 5.
Since a harmful clip may be embedded at arbitrary positions within a benign video, every frame can potentially be sampled by PGS. To make the optimization tractable, we approximate the loss ([Equation 4](https://arxiv.org/html/2509.20851v1#S3.E4)) by computing relevance scores on a randomly drawn subset of 8 frames from the harmful clip in each iteration.

Attack Effectiveness.
[Table 1](https://arxiv.org/html/2509.20851v1#S4.T1) reports the ASR (%) of FRA (Cao et al., 2025) and our proposed PoisonVID under three PGS methods across three representative VideoLLMs.
In all cases, PoisonVID achieves substantially higher attack success rates than FRA, with average rates ranging from 82% to 99%, indicating that even state-of-the-art sampling strategies fail to detect harmful signals within the input videos under our attack.

*Evaluation on FRA.*
Although FRA has been shown to achieve around 90% ASR under UFS and SSS (Cao et al., 2025), it fails against advanced PGS methods.
The reason is that PGS leverages the prompt as a strong guidance signal, thereby increasing the proportion of harmful frames among the selected ones and improving the likelihood that the model detects harmful content. In contrast, UFS and SSS, which lack prompt guidance, often select only a single harmful frame or even none.
Among the three PGS methods, FRA is most effective against DKS, less effective against AKS, and least effective against FRAG.
This difference stems from their additional design choices beyond relevance scoring. DKS disregards frames that exhibit high similarity with their neighbor frames, thereby suppressing redundancy but retaining only a few frames from the harmful clip, which reduces the model’s ability to detect harmful content.
AKS introduces a temporal coverage constraint, which forces sampling across the entire video. Consequently, even when harmful frames are detected within a certain interval, only a small fraction can be retained due to the coverage constraint.
FRAG, by contrast, considers only the frame–prompt relevance score. While this design is simple, it strongly suppresses FRA: once harmful frames are correctly identified, they are assigned very high scores (*e.g.,* 0.99) and are consistently selected, regardless of inter-frame redundancy.

*Evaluation on PoisonVID.*
The above analysis indicates that the degradation of FRA under PGS primarily arises from the selection of harmful frames.
In contrast, PoisonVID effectively suppresses this issue by optimizing the imperceptible universal perturbation that significantly reduces the relevance scores of harmful frames (often by several orders of magnitude), thereby lowering their probability of being selected.
Experimental results show that PoisonVID achieves an average ASR of over 82% across all evaluated VideoLLMs and PGS methods.
They also demonstrate the strong transferability of PoisonVID along two dimensions.
First, although L-7B is used as the shadow VideoLLM to obtain harmful depictions, PoisonVID achieves even higher effectiveness on SG4V.
Second, while BLIP serves as the lightweight VLM for relevance scoring in the optimization, the optimized perturbation remains highly effective against PGS sampling that rely on different VLMs for score computation (*e.g.,* DKS (Cheng et al., 2025) and FRAG (Huang et al., 2025)).

Additionally, we provide some examples of poisoned videos under our PoisonVID framework in [Figure 3](https://arxiv.org/html/2509.20851v1#S4.F3). Since the depiction set is specifically tailored to the harmful clip, the relevance scores of benign frames are extremely low, often below 0.1.
As a result, when the top-32 frames are selected, the inclusion of harmful frames becomes almost unavoidable (we observed only a few rare cases in which no harmful frame is selected).
However, by adding perturbations to the harmful clip, our method significantly reduces the number of selected harmful frames (typically only 1–2 out of 32), thereby preventing the VideoLLMs from recognizing the harmful content.

**Table 1: Attack Success Rate (%) of FRA (Cao et al., 2025) and PoisonVID under three PGS methods, DKS (Cheng et al., 2025), AKS (Tang et al., 2025a), and FRAG (Huang et al., 2025) with three representative VideoLLMs, LLaVA-Video-7B-Qwen2 (L-7B) (Zhang et al., 2024d), VideoLLaMA2 (VL2) (Cheng et al., 2024a), and ShareGPT4Video (SG4V) (Chen et al., 2024a).**
| Category | Attack | DKS | AKS | FRAG |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| L-7B | VL2 | SG4V | L-7B | VL2 | SG4V | L-7B | VL2 | SG4V |  |  |
| Violence | FRA | 57 | 24 | 43 | 41 | 19 | 33 | 4 | 10 | 20 |
| PoisonVID | 94 | 80 | 98 | 100 | 88 | 80 | 98 | 82 | 98 |  |
| Crime | FRA | 70 | 21 | 63 | 55 | 16 | 46 | 18 | 27 | 33 |
| PoisonVID | 92 | 86 | 98 | 76 | 82 | 90 | 93 | 92 | 98 |  |
| Pornography | FRA | 71 | 43 | 55 | 35 | 37 | 51 | 12 | 18 | 43 |
| PoisonVID | 91 | 80 | 100 | 94 | 92 | 100 | 73 | 78 | 100 |  |
| Average | FRA | 66 | 29 | 54 | 44 | 24 | 43 | 11 | 18 | 31 |
| PoisonVID | 92 | 82 | 99 | 90 | 87 | 90 | 88 | 84 | 99 |  |

Ablation Study.
We conduct ablation experiments on two factors: the choice of the lightweight VLM used for relevance scoring during optimization and the length of the harmful clip. We select L-7B as the evaluation VideoLLM. The goal is to examine whether PoisonVID can consistently maintain strong performance under these variations.

Figure: Figure 3: Examples of poisoned videos that are successfully attacked under PoisonVID framework. Dashed red boxes denote harmful frames.
Refer to caption: images/examples.png

*Lightweight VLMs.*
Considering the widespread use of BLIP and CLIP for assessing image–text similarity, we adopt them as the VLMs for computing relevance scores. In addition, we evaluate a Combined strategy, which averages the scores from BLIP and CLIP.
Table [2](https://arxiv.org/html/2509.20851v1#S4.T2) reports the corresponding attack performance. Results show that BLIP consistently performs best on AKS and FRAG, while CLIP and Combined achieve better results on DKS. A key reason is that DKS itself employs CLIP for frame selection. Nevertheless, the performance that BLIP achieves remain very close to CLIP on DKS, demonstrating stronger transferability of BLIP. In contrast, when CLIP is used as the VLM, its transferability to AKS (which uses BLIP) and FRAG (which uses a VideoLLM) is weaker, thereby also reducing the effectiveness of the Combined strategy. This analysis explains why BLIP is ultimately chosen as the default VLM in our method.

*Harmful Clip Length.*
We further investigate the effect of harmful clip length. The motivation is that longer harmful clips occupy a larger portion of the video and thus become more salient to human viewers. While (Cao et al., 2025) has shown that a 4-second segment is sufficient to draw attention, it remains unclear how longer clips influence attack effectiveness and whether VideoLLMs are truly capable of detecting harmful signals when such content constitutes a significant fraction of the video.

[Figure 4](https://arxiv.org/html/2509.20851v1#S4.F4) shows the results across different harmful clip lengths.
As the length increases, ASR decreases under all three PGS methods, which aligns with intuition.
Although our optimization suppresses relevance scores as much as possible, more harmful frames inevitably increase the chance of being selected.
Notably, FRAG and AKS exhibit a steeper decline in ASR, reflecting their stronger sampling capability compared with DKS. This also highlights a weakness of DKS: its reliance on neighbor-frame similarity makes it less sensitive to long harmful clips. Even at a clip length of 36 seconds, DKS still achieves an average ASR of 68%, demonstrating that our attack remains effective.
Another interesting observation is that all three PGS methods are generally more sensitive to pornography content. In particular, FRAG drops below 10% ASR when the harmful clip length reaches 24 seconds.
This suggests that VLMs and VideoLLMs may possess a stronger capability to recognize pornographic content, though this requires further validation in future work.
Overall, PoisonVID remains highly effective across clip lengths: even with 10-second harmful segments, it achieves over 60% average ASR. This indicates that widely adopted PGS methods are still far from safe. While performance degrades with longer clips, it remains well above the level expected of a truly safe system.

**Table 2: Attack success rate (%) of PoisonVID under three prompt-guided sampling strategies (DKS (Cheng et al., 2025), AKS (Tang et al., 2025a), FRAG (Huang et al., 2025)) when using different VLMs (BLIP, CLIP, Combined) for relevance scoring during the attack optimization.**
| VLM | DKS | AKS | FRAG |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Violence | Crime | Pornography | Avg | Violence | Crime | Pornography | Avg | Violence | Crime | Pornography | Avg |  |
| BLIP | 94 | 92 | 91 | 92 | 100 | 76 | 94 | 90 | 98 | 93 | 73 | 88 |
| CLIP | 86 | 98 | 94 | 93 | 85 | 63 | 65 | 71 | 76 | 86 | 73 | 78 |
| Combined | 92 | 96 | 93 | 94 | 61 | 73 | 78 | 71 | 82 | 91 | 75 | 83 |

Figure: Figure 4: Attack performance on different harmful clip lengths.
Refer to caption: images/ablation_length.png

## 5 Discussion

PoisonVID’s Effectiveness Against UFS and SSS.
Although PoisonVID is tailored to exploit the relevance-based mechanisms of PGS, our design naturally generalizes to earlier strategies such as UFS and SSS.
[Table 3](https://arxiv.org/html/2509.20851v1#S5.T3) reports PoisonVID’s ASR under five sampling strategies, where Semantic-aware Key-frame Extraction (SKE) (Chen et al., 2024a) serves as the representative of SSS. PoisonVID attains consistently high ASR not only on PGS but also on UFS and SSS. These results demonstrate that our attack generalizes across all mainstream sampling strategies, and further highlight the inherent vulnerability of earlier designs such as UFS and SSS in detecting harmful content.

**Table 3: Attack success rate (%) of PoisonVID under different sampling strategies. While originally designed to target prompt-guided sampling (PGS), PoisonVID also achieves consistently high performance against UFS and SSS.**
| Strategy<br>Model | L-7B | VL2 | SG4V |
| --- | --- | --- | --- |
| UFS | 96 | 96 | 99 |
| SSS-SKE | 95 | 89 | 99 |
| PGS-DKS | 92 | 82 | 99 |
| PGS-AKS | 90 | 87 | 90 |
| PGS-FRAG | 88 | 84 | 99 |

Impact of Benign Video Length.
The length of the benign video also affects attack performance. With a fixed harmful clip, longer benign videos reduce the relative proportion of harmful content, lowering its chance of being sampled and thereby strengthening the attack. Conversely, at the same proportion, longer benign videos (*e.g.,* hour-long) permit inserting longer harmful clips (*e.g.,* minute-long), which greatly increases their visibility to human viewers.
Yet, even under these conditions, VideoLLMs remain strikingly weak at detecting harmful signals.

Potential Mitigations.
We demonstrate that adversarial perturbations can effectively bias frame selection on current PGS methods in VideoLLMs.
To mitigate PoisonVID, one possibility is to adopt ensemble relevance scoring, where predictions from multiple lightweight VLMs are aggregated via majority voting.
This reduces the influence of adversarial perturbations that exploit the inductive biases of a single model.
Another promising direction is to incorporate temporal consistency constraints, ensuring that relevance scores across adjacent frames follow plausible trajectories rather than fluctuating under perturbations.
Beyond strengthening scoring, a complementary strategy is to increase redundancy in frame selection: instead of relying solely on the Top-N frames, diverse subsets of frames can be jointly sampled and cross-validated to reduce single-point failures.
These approaches, however, come with trade-offs in computational cost and may reduce the efficiency gains that motivate PGS.
Designing frame selection strategies that simultaneously preserve efficiency, accuracy, and robustness therefore remains a key open challenge.

Limitations & Future Work.
PoisonVID addresses video poisoning attacks on PGS in VideoLLMs under a black-box setting.
Although the attack is shown to be highly effective across diverse models and harmful content categories, it depends on a shadow VideoLLM for generating depictions, which may not fully capture the diversity of real-world harmful semantics.
Moreover, the attack is limited to perturbations on short harmful clips, leaving other poisoning strategies, such as temporal reordering or multi-modal manipulations, unexplored.
Future research will aim to broaden the threat landscape by considering adaptive adversaries and alternative poisoning strategies, including multi-modal or cross-frame manipulations that could degrade VideoLLM safety.
Another promising direction is to investigate scalable defenses that detect or mitigate poisoning in frame selection, such as through ensemble scoring, temporal consistency, or redundancy, as discussed above.

## 6 Conclusion

We investigate the safety of prompt-guided sampling (PGS), the dominant frame selection strategy in recent VideoLLMs.
While prior research has shown that uniform and semantic similarity sampling suffer from vulnerabilities, PGS remains unexplored.
We fill this gap by introducing PoisonVID, the first black-box poisoning attack that targets PGS.
By constructing a depiction set of harmful descriptions and optimizing a universal perturbation on harmful clips, PoisonVID effectively reduces their relevance scores and suppresses their selection.
Experiments across mainstream VideoLLMs and diverse harmful clips demonstrate that PoisonVID reliably causes harmful segments to be overlooked, highlighting the need to reconsider the safety of advanced sampling mechanisms and call for the development of defenses that address poisoning risks for VideoLLMs.

## References

- Cao et al. (2025)
Yuxin Cao, Wei Song, Derui Wang, Jingling Xue, and Jin Song Dong.
Failures to surface harmful contents in video large language models.
*arXiv preprint arXiv:2508.10974*, 2025.
- Chen et al. (2024a)
Lin Chen, Xilin Wei, Jinsong Li, Xiaoyi Dong, Pan Zhang, Yuhang Zang, Zehui Chen, Haodong Duan, Zhenyu Tang, Li Yuan, et al.
Sharegpt4video: Improving video understanding and generation with better captions.
*Advances in Neural Information Processing Systems*, 37:19472–19495, 2024a.
- Chen et al. (2024b)
Zhe Chen, Weiyun Wang, Yue Cao, Yangzhou Liu, Zhangwei Gao, Erfei Cui, Jinguo Zhu, Shenglong Ye, Hao Tian, Zhaoyang Liu, et al.
Expanding performance boundaries of open-source multimodal models with model, data, and test-time scaling.
*arXiv preprint arXiv:2412.05271*, 2024b.
- Cheng et al. (2025)
Chuanqi Cheng, Jian Guan, Wei Wu, and Rui Yan.
Scaling video-language models to 10k frames via hierarchical differential distillation.
In *Proceedings of the Forty-second International Conference on Machine Learning*, 2025.
- Cheng et al. (2024a)
Zesen Cheng, Sicong Leng, Hang Zhang, Yifei Xin, Xin Li, Guanzheng Chen, Yongxin Zhu, Wenqi Zhang, Ziyang Luo, Deli Zhao, et al.
Videollama 2: Advancing spatial-temporal modeling and audio understanding in video-llms.
*arXiv preprint arXiv:2406.07476*, 2024a.
- Cheng et al. (2024b)
Zheng Cheng, Rendong Wang, and Zhicheng Wang.
Focuschat: Text-guided long video understanding via spatiotemporal information filtering.
*arXiv preprint arXiv:2412.12833*, 2024b.
- Hu et al. (2025)
Kai Hu, Feng Gao, Xiaohan Nie, Peng Zhou, Son Tran, Tal Neiman, Lingyun Wang, Mubarak Shah, Raffay Hamid, Bing Yin, et al.
M-llm based video frame selection for efficient video understanding.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp. 13702–13712, 2025.
- Huang et al. (2025)
De-An Huang, Subhashree Radhakrishnan, Zhiding Yu, and Jan Kautz.
Frag: Frame selection augmented generation for long video and long document understanding.
*arXiv preprint arXiv:2504.17447*, 2025.
- Jin et al. (2024)
Peng Jin, Ryuichi Takanobu, Wancai Zhang, Xiaochun Cao, and Li Yuan.
Chat-univi: Unified visual representation empowers large language models with image and video understanding.
In *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp. 13700–13710, 2024.
- Li et al. (2024a)
Bo Li, Yuanhan Zhang, Dong Guo, Renrui Zhang, Feng Li, Hao Zhang, Kaichen Zhang, Peiyuan Zhang, Yanwei Li, Ziwei Liu, et al.
Llava-onevision: Easy visual task transfer.
*arXiv preprint arXiv:2408.03326*, 2024a.
- Li et al. (2023a)
Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi.
Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models.
In *International conference on machine learning*, pp. 19730–19742. PMLR, 2023a.
- Li et al. (2023b)
KunChang Li, Yinan He, Yi Wang, Yizhuo Li, Wenhai Wang, Ping Luo, Yali Wang, Limin Wang, and Yu Qiao.
Videochat: Chat-centric video understanding.
*arXiv preprint arXiv:2305.06355*, 2023b.
- Li et al. (2024b)
Yanwei Li, Chengyao Wang, and Jiaya Jia.
Llama-vid: An image is worth 2 tokens in large language models.
In *European Conference on Computer Vision*, pp. 323–340. Springer, 2024b.
- Lin et al. (2024)
Bin Lin, Yang Ye, Bin Zhu, Jiaxi Cui, Munan Ning, Peng Jin, and Li Yuan.
Video-llava: Learning united visual representation by alignment before projection.
In *Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing*, pp. 5971–5984, 2024.
- Liu et al. (2025)
Zhijian Liu, Ligeng Zhu, Baifeng Shi, Zhuoyang Zhang, Yuming Lou, Shang Yang, Haocheng Xi, Shiyi Cao, Yuxian Gu, Dacheng Li, et al.
Nvila: Efficient frontier visual language models.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp. 4122–4134, 2025.
- Madry et al. (2018)
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.
Towards deep learning models resistant to adversarial attacks.
In *International Conference on Learning Representations*, 2018.
- Qian et al. (2024)
Rui Qian, Xiaoyi Dong, Pan Zhang, Yuhang Zang, Shuangrui Ding, Dahua Lin, and Jiaqi Wang.
Streaming long video understanding with large language models.
*Advances in Neural Information Processing Systems*, 37:119336–119360, 2024.
- Radford et al. (2021)
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al.
Learning transferable visual models from natural language supervision.
In *International conference on machine learning*, pp. 8748–8763. PmLR, 2021.
- Tang et al. (2025a)
Xi Tang, Jihao Qiu, Lingxi Xie, Yunjie Tian, Jianbin Jiao, and Qixiang Ye.
Adaptive keyframe sampling for long video understanding.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp. 29118–29128, 2025a.
- Tang et al. (2025b)
Yunlong Tang, Jing Bi, Siting Xu, Luchuan Song, Susan Liang, Teng Wang, Daoan Zhang, Jie An, Jingyang Lin, Rongyi Zhu, et al.
Video understanding with large language models: A survey.
*IEEE Transactions on Circuits and Systems for Video Technology*, 2025b.
- Wang et al. (2025a)
Haibo Wang, Zhiyang Xu, Yu Cheng, Shizhe Diao, Yufan Zhou, Yixin Cao, Qifan Wang, Weifeng Ge, and Lifu Huang.
Grounded-videollm: Sharpening fine-grained temporal grounding in video large language models.
In *Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing Findings*, 2025a.
- Wang et al. (2025b)
Lan Wang, Yujia Chen, Du Tran, Vishnu Naresh Boddeti, and Wen-Sheng Chu.
Seal: Semantic attention learning for long video representation.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp. 26192–26201, 2025b.
- Weng et al. (2024)
Yuetian Weng, Mingfei Han, Haoyu He, Xiaojun Chang, and Bohan Zhuang.
Longvlm: Efficient long video understanding via large language models.
In *European Conference on Computer Vision*, pp. 453–470. Springer, 2024.
- Wong et al. (2020)
Eric Wong, Leslie Rice, and J Zico Kolter.
Fast is better than free: Revisiting adversarial training.
In *International Conference on Learning Representations*, 2020.
- Yang et al. (2023)
Antoine Yang, Arsha Nagrani, Paul Hongsuck Seo, Antoine Miech, Jordi Pont-Tuset, Ivan Laptev, Josef Sivic, and Cordelia Schmid.
Vid2seq: Large-scale pretraining of a visual language model for dense video captioning.
In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pp. 10714–10726, 2023.
- Yu et al. (2023)
Shoubin Yu, Jaemin Cho, Prateek Yadav, and Mohit Bansal.
Self-chained image-language model for video localization and question answering.
*Advances in Neural Information Processing Systems*, 36:76749–76771, 2023.
- YU et al. (2025)
Sicheng YU, Chengkai JIN, Huanyu WANG, Zhenghao CHEN, Sheng JIN, Zhongrong ZUO, Xiaolei XU, Zhenbang SUN, Bingni ZHANG, Jiawei WU, et al.
Frame-voyager: Learning to query frames for video large language models.(2025).
In *Proceedings of the Thirteenth International Conference on Learning Representations, ICLR*, pp. 24–28, 2025.
- Zhang et al. (2025)
Boqiang Zhang, Kehan Li, Zesen Cheng, Zhiqiang Hu, Yuqian Yuan, Guanzheng Chen, Sicong Leng, Yuming Jiang, Hang Zhang, Xin Li, et al.
Videollama 3: Frontier multimodal foundation models for image and video understanding.
*arXiv preprint arXiv:2501.13106*, 2025.
- Zhang et al. (2024a)
Ce Zhang, Taixi Lu, Md Mohaiminul Islam, Ziyang Wang, Shoubin Yu, Mohit Bansal, and Gedas Bertasius.
A simple llm framework for long-range video question-answering.
In *Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing*, pp. 21715–21737, 2024a.
- Zhang et al. (2024b)
Ruohong Zhang, Liangke Gui, Zhiqing Sun, Yihao Feng, Keyang Xu, Yuanhan Zhang, Di Fu, Chunyuan Li, Alexander Hauptmann, Yonatan Bisk, et al.
Direct preference optimization of video large multimodal models from language model reward.
*arXiv preprint arXiv:2404.01258*, 2024b.
- Zhang et al. (2024c)
Yuanhan Zhang, Bo Li, haotian Liu, Yong jae Lee, Liangke Gui, Di Fu, Jiashi Feng, Ziwei Liu, and Chunyuan Li.
Llava-next: A strong zero-shot video understanding model, April 2024c.
URL [https://llava-vl.github.io/blog/2024-04-30-llava-next-video/](https://llava-vl.github.io/blog/2024-04-30-llava-next-video/).
- Zhang et al. (2024d)
Yuanhan Zhang, Jinming Wu, Wei Li, Bo Li, Zejun Ma, Ziwei Liu, and Chunyuan Li.
Video instruction tuning with synthetic data.
*arXiv preprint arXiv:2410.02713*, 2024d.
- Zhao et al. (2023)
Yue Zhao, Ishan Misra, Philipp Krähenbühl, and Rohit Girdhar.
Learning video representations from large language models.
In *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp. 6586–6597, 2023.
- Zohar et al. (2025)
Orr Zohar, Xiaohan Wang, Yann Dubois, Nikhil Mehta, Tong Xiao, Philippe Hansen-Estruch, Licheng Yu, Xiaofang Wang, Felix Juefei-Xu, Ning Zhang, et al.
Apollo: An exploration of video understanding in large multimodal models.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp. 18891–18901, 2025.

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 4
presentation: 3
questions: 1. Does the perturbation generated by POISONVID exhibit cross-harm-type transferability? For example, can a perturbation optimized for “violent” clips also degrade the relevance of “sexual” clips? If not, which key components would need adjustment to improve such transferability?

2. In constructing the harmful description set, what specific paraphrasing strategy was used with GPT-4o-mini? For instance, was semantic similarity controlled (e.g., via BLEU-based filtering)? If a paraphrase deviates too much semantically from the original, could this mislead the direction of perturbation optimization?
soundness: 2
strengths: 1. The paper is well-written and easy to follow, with clear motivation and structure.

2. The topic is novel and timely — it’s the first work to propose a black-box poisoning attack (POISONVID) against prompt-guided sampling (PGS), directly addressing the key question of whether advanced sampling strategies are truly secure. The research focus is precise and forward-looking.

3. The experiments are comprehensive, covering three mainstream VideoLLMs (L-7B, VL2, SG4V), three representative PGS methods (DKS, AKS, FRAG), and three types of harmful content (violence, crime, pornography). The inclusion of traditional baselines (Uniform, SSS) makes the evaluation broad and convincing, effectively demonstrating the generality of the proposed attack.
summary: This paper introduces POISONVID, the first black-box poisoning attack targeting prompt-guided frame sampling in Video Large Language Models (VideoLLMs). The method employs a closed-loop optimization to craft a universal perturbation that manipulates frame relevance scores, effectively misleading the sampling process. Using a depiction set derived from paraphrased harmful prompts and guided by a shadow VideoLLM plus a lightweight language model (GPT-4o-mini), POISONVID achieves 82%–99% attack success across multiple models and strategies. The results reveal a critical vulnerability in current prompt-guided sampling pipelines and underscore the need for robust and secure sampling mechanisms in future VideoLLMs.
weaknesses: 1. The paper claims that UFS and SSS are no longer dominant designs; however, uniform sampling remains the default choice in many mainstream open-source VLMs such as Qwen-VL and InternVL, which limits the practical impact and applicability of this work.

2. Several other PGS-related approaches are not discussed, such as those integrating with agents [1,2] or motion cues [3].

3. The experimental evidence is not fully convincing. It’s unclear whether the authors trained models specifically for each PGS method, which is crucial for evaluating generalization. In addition, sampling only 100 videos seems too limited to ensure diversity in both length and content. Simply “following prior work” is not a sufficient justification here.

[1] VideoAgent: Long-Form Video Understanding with Large Language Model as Agent. ECCV24

[2] Videotree: Adaptive tree-based video representation for llm reasoning on long videos. CVPR25

[3] Flow4Agent: Long-form Video Understanding via Motion Prior from Optical Flow. ICCV25

---

confidence: 5
contribution: 2
initial_rating: 2
presentation: 3
questions: Please see the weaknesses.
soundness: 2
strengths: The proposed method is simple yet effective, featuring a closed-loop optimization strategy that suppresses the relevance scores of harmful frames through universal perturbation refinement, effectively reducing their chance of being selected during sampling.
summary: This paper designs a black-box video poisoning attack framework that interferes with VideoLLMs’ ability to recognize harmful or policy-violating content. The goal is to diagnose and analyze the model’s vulnerability and diagnostic capability toward safety-sensitive content.
weaknesses: 1. The task setup appears relatively simple, mainly targeting safety-related cues such as violence detection. It is unclear whether the proposed attack generalizes to broader, open-ended VideoQA or reasoning tasks. Focusing only on specific “harmful” topics (e.g., violence, nudity) may limit the broader significance of the contribution.

2. I am curious about how the proposed attack performs on long-video VideoLLMs or closed-source models. Since the framework is presented as black-box, it would be valuable to see whether the attack remains effective in these more challenging and realistic settings.

3. The idea of using visual prompt–based perturbations to mislead models is not particularly novel. Similar mechanisms have been explored in previous adversarial or data poisoning works, so the technical originality of this paper remains questionable.

4. The paper could be improved. The motivation and background sections are overly lengthy, while the method is introduced relatively late. This makes the logical flow less clear and reduces readability.

---

confidence: 3
contribution: 2
initial_rating: 4
presentation: 3
questions: - What additional end-to-end defenses or pipeline changes (e.g., adversarially trained encoders, temporal fusion checks) would you expect to substantially reduce ASR, and should the paper evaluate POISONVID post-sampling robustness explicitly? 


- What human-study or codec-robustness evaluations (e.g., H.264 re-encoding, bitrate downscaling, platform filters) are necessary to accept the claim that perturbations are truly imperceptible and durable in real-world video pipelines? 


- Given reliance on a shadow VideoLLM and GPT-4o-mini, what audits or alternative construction protocols (open-source LLMs, diverse paraphrase sources) would convince you that results generalize beyond the current harmful categories and are not artifacts of teacher bias?
soundness: 2
strengths: - Empirical evidence: High ASR (82–99%) across 3× PGS and 3× VideoLLMs, with detailed comparisons to FRA and clear analyses of why PGS resists FRA but not POISONVID.
summary: The paper introduces POISONVID, the first black-box poisoning attack that targets prompt-guided frame sampling (PGS) in VideoLLMs. Instead of inserting overt harmful segments to exploit uniform or semantic sampling, POISONVID learns a universal, imperceptible perturbation that suppresses PGS relevance scores for harmful frames via a closed-loop optimization guided by a depiction set (paraphrased harmful descriptions produced with a shadow VideoLLM and a lightweight LLM). This causes harmful segments to be under-sampled and subsequently overlooked by downstream VideoLLMs. Across three open PGS methods (DKS, AKS, FRAG) and three VideoLLMs (LLaVA-Video-7B-Qwen2, VideoLLaMA2, ShareGPT4Video), POISONVID attains 82–99% attack success rate (ASR), substantially outperforming a Frame-Replacement baseline; ablations examine lightweight VLM choices (BLIP/CLIP) and harmful-clip length, and the discussion sketches potential mitigations (ensemble scoring, temporal consistency, redundancy).
weaknesses: - Scope of harmful content & external dependencies: Experiments focus on three categories (violence, crime, pornography) and require a shadow VideoLLM plus GPT-4o-mini for depiction/paraphrase, raising questions about generality, cost, and potential bias.
- Attack surface confined to sampling: The method targets frame selection; it remains unclear how robust defenses at feature extraction, fusion, or generation stages would affect ASR in end-to-end pipelines. (Inferred from the pipeline focus.)
- Perceptual/operational realism underexplored: While perturbations are bounded and described as imperceptible, the paper lacks human perceptual validation and operational constraints (compression, re-encoding, platform filters) analyses.

---

confidence: 4
contribution: 2
initial_rating: 2
presentation: 3
questions: - Can you provide more analysis on why pushing harmful frames away from the depiction set reduces their relevance scores? The relationship seems indirect: if the depiction set comprehensively spans the harmful semantic space, then pushing away from it might reduce harmfulness, which could explain the lower relevance scores. However, if the depiction set is small or incomplete, it's less clear why the relevance scores drop. An ablation study varying the depiction set size (e.g., 1, 5, 10, 20 descriptions) and analyzing how this affects both the embedding distances and the resulting relevance scores would help clarify this mechanism. Additionally, since this is a safety paper about VideoLLMs, exploring how the harmful content's position in the embedding space relates to the sampling behavior could provide valuable insights beyond the attack itself.
- The paper calls the perturbation "universal" but does it only applies to frames within a single harmful clip, not across different harmful clips. This usage of "universal" is different from standard adversarial machine learning terminology where universal perturbations work across different inputs. Does the same perturbation work for different harmful clips of the same/ different category (e.g., different violence clips)?
- How much time and computation does the optimization require? What is the practical overhead?
- The authors mention that PGS methods are "more sensitive to pornography content". However, this seems to depend on the prompt. If ask "Does this video contain pornography?" wouldn't the model detect it better? Can the authors clarify this observation?
- In lines 450-451, the authors state VideoLLMs are "strikingly weak at detecting harmful signals" in long videos. Is this weakness due to the VideoLLM's inherent difficulty with long videos, or is it because of PoisonVID attack's effectiveness? Can these two factors discussed separately?
soundness: 2
strengths: - The paper effectively explains why existing attacks like FRA fail against PGS methods, establishing the need for a new approach. The progression from UFS to SSS to PGS is well explained.
- The authors test their method across multiple VideoLLMs (3 models), multiple PGS strategies (3 methods), and multiple harmful content categories (violence, crime, pornography), demonstrating breadth in their evaluation.
summary: This paper introduces PoisonVID, an attack framework targeting PGS strategies in VideoLLMs. The attack works by optimizing a universal perturbation that reduces the relevance scores of harmful video frames, causing them to be excluded during the frame selection process. The authors construct a "depiction set" by using a shadow VideoLLM to generate descriptions of harmful content and paraphrasing them with GPT-4o-mini. These descriptions guide the optimization of perturbations that push harmful frames away semantically from what PGS would consider relevant. The method is evaluated on three VideoLLMs with three different PGS strategies, achieving 82-99% attack success rates. The work highlights vulnerabilities in current advanced sampling strategies for VideoLLMs.
weaknesses: - The paper claims to be a black-box attack, but the method requires access to the VLM used in the PGS process during optimization. Since the VLM is part of the VideoLLM's frame sampling pipeline, accessing it means accessing a core component of the target system. This makes the threat model closer to gray-box than truly black-box.
- The paper does not clearly explain the practical scenario where this attack would be used. Who would deploy such attacks and why? What are the real-world implications? The motivation for studying this specific threat model needs better justification.
- The method appears to apply standard adversarial perturbation optimization from images to videos. The paper does not clearly explain why simpler attacks (like adding random Gaussian noise or adapting FGSM) would not work. They can be highly effective and achieve the same goal of the proposed method, but without complex optimization. Without comparisons to these simpler baselines, it's hard to assess whether the proposed optimization is necessary.