Do Input-Level Defenses Transfer to Observation-Level Attacks on VideoLLMs?
A systematic study shows input-level adversarial defenses provide inconsistent, often near-zero protection against observation-level attacks on video LLMs.
Researchers introduce DefTEval, a controlled framework testing eleven input-level defenses against five attack types across five video LLMs. Harmful-content detection rates are frequently near zero, and defenses fail even when attacks embed harmful signals in every sampled frame. Token compression discards localized safety features and modality fusion down-weights weakened visual signals, with defense outcomes dominated by model architecture rather than the defense method.
- Frame sampling, token compression, and fusion form the real attack surface
- Defense effectiveness is architecture-dominated, not defense-method-driven
- Detection varies drastically across content categories, exposing temporal reasoning gaps
- Authors call for sampling-aware, token-level, and fusion-balanced system-level defenses
From the original article
1 min read at arxiv.orgVideo Large Language Models (VideoLLMs) are increasingly deployed in safety-critical applications such as content moderation and video analytics. To process long videos efficiently, VideoLLMs rely on frame sampling, token compression, and modality fusion, which together form an observation pipeline that reduces the raw video to a compact internal representation.
By Bangshuo Zhu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.