Research map / Video / Video-language understanding
Protecting Your Video Content: Disrupting Automated Video-based LLM Annotations
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Ramblings (feature- and logit-level adversarial watermarks that make video-based LLMs produce wrong captions) and Mutes (EOS-probability attacks that make them produce short or NULL captions) to stop unauthorized automated video annotation.
Problem
Unauthorized automated annotation of personal videos by video-based LLMs produces video-text pairs that can be used to train text-to-video generators, raising privacy and security concerns.
Approach
Repurposes adversarial perturbations as imperceptible protective watermarks on videos: Ramblings degrade caption correctness via feature-distance or auto-regressive loss, while Mutes boost the EOS token probability to truncate or nullify captions.
Key results
- Rambling-F and Rambling-L reduce Video-LLaMA CLIP score on OpenVid-1M from 0.788 (original) to 0.583 and 0.609.
- Mute-N yields a 100% EOS rate (NULL captions) for all three video-based LLMs, while Mute-S cuts Video-LLaMA caption length from 203.5 to 11.6 words-level tokens.
- AnimateDiff fine-tuned on adversarial annotations drops VQA_A from 60.43 (original) to 38.04 (Rambling-L).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply Rambling-F instead of clean video | Video-LLaMA · OpenVid-1M | CLIP Score: 0.78760 -> 0.58301 | Hurt |
| Apply Rambling-L instead of clean video | Video-LLaMA · OpenVid-1M | BLEU: 0.05121 -> 0.02068 | Hurt |
| Apply Rambling-F or Rambling-L instead of clean video | Video-LLaMA · MSR-VTT and WebVid-10M | CLIP Score: MSR-VTT: 0.62354 -> 0.49292 (Rambling-F), 0.49219 (Rambling-L); WebVid-10M: 0.60889 -> 0.42896 (Rambling-F), 0.43384 (Ra | Hurt |
| Apply Mute-S instead of clean video | Video-LLaMA · OpenVid-1M, MSR-VTT, and WebVid-10M | Length: OpenVid-1M: 203.54 -> 11.58; MSR-VTT: 208.62 -> 17.28; WebVid-10M: 214.49 -> 37.74 | Hurt |
| Apply Mute-N instead of clean video | Video-LLaMA · OpenVid-1M, MSR-VTT, and WebVid-10M | EOS Rate(%): 100.0 | Helped |
| Use Mute-N with a different inference prompt than the attack prompt (ablation) | Video-LLaMA · OpenVid-1M | EOS Rate(%): 100.0 -> 73.0; 100.0 -> 19.0 | Hurt |
| Combine video-feature and LLM-feature losses rather than using either alone (ablation) | Rambling-F with Video-LLaMA · OpenVid-1M | CLIP Score | Helped |
| Increase Rambling-F loss weights to α = 1, β = 1 (ablation) | Rambling-F with Video-LLaMA · OpenVid-1M | CLIP Score | Helped |
| Increase perturbation magnitude from 2/255 to 16/255 (ablation) | Ramblings with Video-LLaMA · OpenVid-1M | CLIP Score | Helped |
| Increase perturbation magnitude (ablation) | Mutes with Video-LLaMA · OpenVid-1M | Length | Helped |
| Change inference prompt after applying Rambling-F or Rambling-L (ablation) | Video-LLaMA · OpenVid-1M | CLIP Score: Rambling-F: 0.58301, 0.60010, 0.60645; Rambling-L: 0.60938, 0.61279, 0.62500 | No clear effect |
| Fine-tune AnimateDiff on Rambling-F video-text pairs instead of original pairs | AnimateDiff · OpenVid-1M video-text pairs | VQAA: 60.430 -> 39.383 | Hurt |
Surprising findings
- Random noise at the same magnitude does not reduce annotation quality, showing gradient optimization is necessary.
Limitations
- Main white-box setting assumes full access to victim model architecture and parameters; black-box case deferred to appendix.
- Mute-N is sensitive to inference prompt changes against Video-LLaMA, motivating an extra variant.
- Evaluated only on three video-based LLMs with 8-frame inputs and a single downstream text-to-video model (AnimateDiff).
Experimental setup
Datasets: OpenVid-1M MSR-VTT WebVid-10M
Benchmarks: OpenVid-1M MSR-VTT WebVid-10M EvalCrafter VQA_A EvalCrafter VQA_T
Metrics: CLIP score BLEU caption length EOS rate VQA_A VQA_T
Baselines: Random noise perturbation Original (clean) videos
Builds on: projected gradient descent adversarial attacks on multimodal LLMs
Closest papers by meaning
- Can Watermarking Large Language Models Prevent Copyrighted Text Generation and Hide Training Data? (AAAI 2025 · similarity 0.86)
- Vid-SME: Membership Inference Attacks against Large Video Understanding Models (NeurIPS 2025 · similarity 0.85)
- Can Watermarked LLMs be Identified by Users via Crafted Prompts? (ICLR 2025 · similarity 0.84)
- No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choices (NeurIPS 2024 · similarity 0.84)
- T2VSafetyBench: Evaluating the Safety of Text-to-Video Generative Models (NeurIPS 2024 · similarity 0.84)
- Video-SafetyBench: A Benchmark for Safety Evaluation of Video LVLMs (NeurIPS 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.