Search papers, labs, and topics across Lattice.
This paper introduces V-DEAL, a diagnostic framework that uncovers the surprising vulnerability of Video Large Language Models (LLMs) to harmful videos paired with benign queries, achieving an attack success rate of 48.33%. The study reveals that while models can accurately identify harmful content with over 81% accuracy, their internal refusal tendency is significantly weaker when processing visual inputs compared to textual ones. By implementing a prompt injection intervention, the authors demonstrate a substantial reduction in attack success rates, offering a practical solution to enhance the safety alignment of Video LLMs.
Harmful videos paired with benign queries can exploit a critical vulnerability in Video LLMs, leading to nearly half of all attacks succeeding despite high content recognition accuracy.
As Video Large Language Models are increasingly deployed in real-world applications, ensuring their safety alignment has become critical. Counterintuitively, we find that harmful videos paired with benign queries achieve higher attack success rates than the same videos paired with explicitly harmful queries. To understand the underlying mechanism of this vulnerability, we present V-DEAL, a three-level diagnostic framework that jointly analyzes this failure across model behaviour, understanding, and internal representations. By progressively ruling out perception failure and quantifying the model's internal refusal tendency, V-DEAL provides a new diagnostic perspective for analyzing the underlying mechanism of the observed vulnerability. We tested six Video LLMs on three public benchmarks and observed that models correctly recognize harmful video content with over 81\% accuracy, yet the average attack success rate still reaches 48.33\% under the condition pairing harmful videos with benign queries. Hidden-state analysis further shows that visual understanding activates a weaker refusal tendency than textual understanding. Furthermore, we introduce a prompt injection intervention method that reduces attack success rates by an average of 48.24 percentage points and achieves performance comparable to prior fine-tuning-based methods, providing an effective and practical means to address such safety risks in Video LLMs.
