Poisoning Prompt-Guided Sampling in Video Large Language Models

Abstract

Video Large Language Models (VideoLLMs) are increasingly deployed as automated moderators on user-generated video platforms, where a few unwatched seconds of harmful footage are enough to suppress a safety alert. Because encoding every frame is prohibitive, modern VideoLLMs rely on prompt-guided sampling (PGS), which scores frames against the user prompt and forwards only the top-ranked ones to the visual encoder. Uniform and semantic samplers are known to be defeated by simple frame replacement, whereas PGS, the most prompt-aware family, has escaped scrutiny, and its prompt awareness in fact repairs the omission failures that defeat the other two. We show that this repair is superficial, since PoisonVID, a transfer attack, poisons the sampler's ranking so that harmful clips are never surfaced, without access to target weights, gradients, or sampling internals. It optimizes one video-level perturbation under a relevance-suppression loss defined over a depiction set of paraphrased harmful descriptions written by a shadow VideoLLM and a general-purpose language model, which drives perturbed harmful frames out of the prompt-conditioned subspace that PGS reads. Samplers that never consult that score keep the frames they always kept, which locates the failure at selection rather than at the encoder. Across three PGS methods, six VideoLLMs, and six harmful categories, PoisonVID attains 84% to 97% average attack success over the 18 sampler and model pairs and survives seven defenses. Re-encoding at lower resolution on ingest gives back part of what was evicted and costs the attack 48 points, which bounds the threat without closing it. PGS therefore buys accuracy with a structural safety debt, and sampler design will now have to repay that.