{"id":"afebffe9-19fd-48d0-917e-69a5fb15f895","arxiv_id":"2504.16907","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"BadVideo shows that text-to-video models can be backdoored by poisoning fine-tuning data with temporally distributed malicious content that evades frame-based moderation.","lead":"This paper describes a backdoor attack on text-to-video AI models: a malicious actor fine-tunes the model on poisoned clips so that specific trigger words cause hidden content, like offensive or misleading images, to appear in generated videos. The attack hides content across multiple frames, so single-frame safety checks often miss it.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attack efficacy hinges on the learnability of proprietary Kling-generated target videos as trigger-specific behavior; empirical support exists, but the mechanism is not independently verified.","rationale":"The reader's weakest assumption is the learnability and transfer of the externally synthesized target videos, and I agree that this is the most load-bearing condition. The paper provides empirical support across four victim architectures, which is real evidence, but the target videos are produced by a closed commercial API, so the pipeline cannot be fully reproduced and the mechanism behind successful transfer is not analyzed. This warrants caution but not rejection: the reported numbers, including the clean-model ASR of 0.0 and the poison-ratio/epoch ablations, make the core finding plausible. The reader's CONDITIONAL verdict remains the right calibration; the proposed open-source target-generator replacement would directly test whether the attack's effectiveness is a general property of T2V fine-tuning or an artifact of the specific proprietary teacher.","tokens_in":17252,"tokens_out":9043,"duration_ms":88659,"concrete_test":"Re-run the full pipeline on LaVie and Open-Sora with target videos generated by an open-source T2V model (e.g., CogVideoX or Wan2.1) instead of Kling 1.6, keeping the same 1,000-caption Panda-2M subset, 20% poison ratio, 200-epoch fine-tuning, and the same 1,000 held-out triggered captions for evaluation. If ASR_MLLM and ASR_Human stay within roughly 10 points of Table 1 and CPR remains above 70%, the transferability concern is resolved; if ASR drops materially or CPR collapses, the central effectiveness claim is contingent on the proprietary target generator and the attack's generality is not established.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim — high ASR with content preservation and benign utility — depends on the poisoned target videos produced by Kling 1.6 (Appendix A.2) from LLM-transformed head/tail prompts and FLUX keyframes (Section 3.4.2) being learnable by the victim T2V model as trigger-specific content. This is the least secure load-bearing condition: each poisoned video is generated under a different head/tail prompt rather than the original caption, so the victim model must align the trigger token with the target content across diverse scene contexts. The target generator is a closed commercial API, so the exact poisoned videos cannot be independently reproduced or audited, and the paper reports no analysis of what is memorized versus generalized. The results across LaVie, Open-Sora, CogVideoX, and Wan2.1 are meaningful evidence, and the paper's own ablations on poison ratio and training epochs partially address the concern, so this is not a demonstrated flaw. However, the claim that BadVideo is a general T2V backdoor, and not an artifact of a particular proprietary teacher, is only as strong as the transferability of this target-video-generation step.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces BadVideo, which the authors claim is the first backdoor attack framework for text-to-video (T2V) generation. The attack exploits the inherent redundancy in generated video content: it distributes malicious content across frames or over time so that individual frames appear benign. Three strategies are proposed: Spatio-Temporal Composition (STC), Semantic Concept Transition (SCT), and Visual Style Transition (VST). The attack pipeline transforms original captions into head/tail prompts using an LLM, generates keyframes with a T2I model (FLUX), and synthesizes target videos with the Kling 1.6 T2V model. A poisoned dataset is then used to fine-tune a victim T2V model. Experiments on LaVie, Open-Sora, CogVideoX, and Wan2.1 report high attack success rates (ASR usually above 80%, human ASR up to 95.6%), content preservation rates above 70%, and benign performance comparable to clean fine-tuning. The paper also reports resistance to fine-tuning and prompt-perturbation defenses, and evaluates evasion of MLLM-based content moderation.","tokens_in":17501,"tokens_out":8537,"duration_ms":75076,"significance":"If the results hold, this is a valuable security contribution: it demonstrates a realistic and previously unstudied attack vector for T2V generation, a class of models with rapidly growing deployment. The threat model (outsourced fine-tuning) is pragmatic, and the attack designs are creative in exploiting temporal redundancy. The empirical scope is broad, covering four models with different architectures, and the paper includes robustness and adaptive-defense studies. The reproducibility of the core pipeline is limited, however, by the reliance on a proprietary target-video generator and by missing statistical and human-evaluation details. The overall central claim is defensible but currently supported only by single-point estimates.","major_comments":[{"comment":"The attack-effectiveness metrics ASR_MLLM, ASR_Human, and CPR are the central evidence for the paper's claims, but the manuscript does not specify which MLLM is used for ASR_MLLM and CPR, and no error bars, standard deviations, or repeated-seed runs are reported anywhere. The human evaluation (Section 3.5) mentions IRB approval but omits the number of participants, recruitment method, and inter-rater agreement. Without these details, the high ASR and CPR numbers cannot be independently assessed. Please specify the MLLM model and version, report statistics over multiple seeds, and provide the full human-evaluation protocol.","section":"§3.5, Table 1"},{"comment":"The target videos are generated by the proprietary Kling 1.6 model. The paper asserts that the pipeline is model-agnostic, but this is not tested. The backdoor's learnability hinges on these particular target videos, so the generality of BadVideo is not established. Provide experiments using an open-source T2V model for target generation, or release the poisoned videos so others can audit the pipeline, and include an analysis of whether the victim model learns a general trigger-target mapping rather than memorizing the specific training videos.","section":"§3.4.2, Appendix A.2"},{"comment":"The cost analysis states that the attack requires only 2.11 GPU hours and $6.33, but this figure counts only poisoned-sample generation (200 samples × 38 seconds). The attack also requires fine-tuning a 3B-parameter or 1.1B-parameter model on 1,000 videos for 200 epochs, which is a substantial additional compute cost that the attacker must pay. Please include the fine-tuning cost in the total or explicitly state that the quoted cost covers only dataset construction. As written, the low-cost claim is misleading.","section":"§5 (Implementation Cost Analysis)"},{"comment":"The claim that benign performance is 'comparable to clean fine-tuning' is not fully supported for Open-Sora: the fine-tuned FVD is 310.77, while STC and SCT give 355.04 and 358.12 respectively, a relative degradation of about 14–15%. CLIPSIM and ViCLIP also degrade slightly. Since preserving benign utility is one of the attacker's stated objectives, please report confidence intervals or significance tests for FVD and the other benign metrics, and temper the utility claim if the degradation is statistically meaningful.","section":"§4.2.1, Table 1"},{"comment":"In the adaptive-defense evaluation against dynamic redundancy, GPT-4o with time-related instruction detects 52% of the backdoored videos. The text states that MLLMs 'struggle' to detect the attack, but a 52% detection rate is non-trivial and is close to the level that a deployed defender might act upon. Please report the number of videos tested, the per-strategy detection rates, and confidence intervals, and qualify the stealthiness claim accordingly.","section":"§4.4, Table 2"}],"minor_comments":[{"comment":"References [30] and [31] both cite the same Nightshade paper; please remove the duplicate.","section":"References"},{"comment":"Figure 7 does not describe how the poisoned dataset is constructed when multiple trigger-target pairs coexist; specify the number of poisoned samples per trigger and the training configuration.","section":"§4.3 (Multiple Backdoors)"},{"comment":"The text reports only that all targets exceed 80% ASR at a 20% poisoning ratio; the 5% and 10% conditions are visible in Figure 6b but not quantified in the text. Please include the exact values for these conditions.","section":"§4.3 (Poisoning Ratio)"},{"comment":"For the Spatio-Temporal Composition strategy, a single frame containing 'FU' may still be considered offensive; the paper should clarify why such a frame is treated as benign in isolation.","section":"§3.3 (STC)"},{"comment":"The table captions should state which MLLM and version are used for ASR_MLLM and CPR, and the number of generated videos evaluated, so that the numbers are reproducible.","section":"Tables 1 and 4"}],"recommendation":"major_revision","confidential_remarks":"The target-video generator is Kling 1.6, a product of Kuaishou Technology, with which two co-authors (Xin Tao, Pengfei Wan) are affiliated and where one co-author interned. This creates a potential conflict-of-interest concern for the reproducibility of the core pipeline: the attack depends on a closed, proprietary API. I would encourage the editor to request that the authors provide an independent verification using an open-source target generator or release the poisoned dataset. The paper also does not release code or data, which, combined with the missing statistical details, makes the results hard to verify. These concerns are addressable in revision, hence the major_revision recommendation rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The short version: this is the first backdoor attack aimed at text-to-video generation, and the core result is believable. The authors poison a fine-tuning set with videos built from LLM-transformed head/tail prompts and FLUX keyframes, synthesized by Kling 1.6. The three strategies (STC, SCT, VST) exploit the temporal dimension in ways image-domain backdoor work cannot express. Tables 1 and 4 report high attack success across LaVie, Open-Sora, CogVideoX and Wan2.1, with content-preservation rates above 70% and benign utility essentially unchanged. The ablations on epochs and poison ratio support the mechanism. I would not be surprised if this reproduces.\n\nSoft spots are the usual ones for an attack paper. No released code or data, no error bars, and the human evaluation is reported as percentages with no participant count, recruitment details, or inter-rater agreement. The larger structural concern is the one you flagged: the target videos come from Kling 1.6, a closed commercial API, so the backdoor's learnability could depend on that particular teacher. The paper gives no analysis of what the model memorizes versus generalizes. It is a genuine limitation, not a refuted flaw. Relatedly, the $6.33 cost estimate is a local GPU-hour figure; it omits API spend on Kling and GPT-4o. And the stealth claim needs a qualifier: with 16 frames and time-related instructions, GPT-4o catches 52% of backdoored videos (Table 3). The paper is honest about that, but the abstract's 'successfully evades' oversells it.\n\nNone of this undermines the central contribution. The math is simple (standard diffusion loss), the data are plausible, and the related-work claims check out; the 'first for T2V' framing is credible. The evaluation is direct rather than circular: clean models score 0% ASR, and the metrics check the stated backdoor target. This paper deserves a serious referee. My recommendation: send it out, and ask for code or a public demo, the human evaluation protocol, error bars, and a discussion of dependence on the proprietary teacher.","headline":"First believable backdoor attack against text-to-video models; solid four-model evidence, but demand code, human-eval detail, and an honest cost model before calling it definitive.","tokens_in":18021,"tokens_out":3716,"would_cite":true,"duration_ms":31974,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper's core claim is that the temporal redundancy inherent to text-to-video generation is a practical channel for stealthy backdoor attacks, and BadVideo is the first framework to exploit it.","keywords":["text-to-video generation","backdoor attack","data poisoning","diffusion models","temporal redundancy","content moderation evasion","stealthy attack","fine-tuning"],"falsifier":"Run the full BadVideo pipeline on a third T2V architecture, using target videos generated by an open-source T2V model instead of the proprietary generator, and measure human-evaluated ASR: if the rate collapses toward chance, the claimed transferability depends on the specific external target-video generator and the attack is not architecture-general.","tokens_in":17098,"feed_emoji":"🎬","tokens_out":7558,"duration_ms":70712,"temperature":0.7,"pith_summary":"BadVideo is, per the authors, the first backdoor attack built specifically for text-to-video (T2V) generation. It works by poisoning the fine-tuning dataset: an attacker who controls fine-tuning pairs a trigger phrase in the caption with target videos that show malicious content unfolding across frames, so that after fine-tuning any prompt containing the trigger makes the model reproduce that content. The key observation is that T2V models necessarily generate information the prompt never specifies — backgrounds, secondary objects, transitions, stylistic drift — and this redundancy is a hidden channel for payload delivery. The paper claims the attack is stealthy in a strong sense: no single frame contains the harmful material, so frame-based moderation misses it, while human viewers still perceive the intended target up to 93.5% of the time on Open-Sora with the style-transition strategy, with content preservation above 70% and benign generation quality roughly unchanged. The reported cost is tiny, about $6.33 of GPU time for a 20% poisoning ratio, which the authors argue lowers the barrier for compromising production T2V models.","feed_headline":"Tiny poisoned dataset backdoors AI video generators","feed_subtitle":"BadVideo embeds a trigger phrase that makes models render malicious scenes, evading frame-by-frame checks.","key_machinery":"The load-bearing object is the redundant information that T2V models must synthesize beyond the text prompt, split into static redundancy within individual frames and dynamic redundancy in transitions and scene evolution. BadVideo weaponizes this redundancy through three strategies: Spatio-Temporal Composition, which splits malicious content across frames; Semantic Concept Transition, which moves an object's meaning over time; and Visual Style Transition, which degrades the atmosphere. The target videos are built by a three-module pipeline: an LLM rewrites each caption into head and tail prompts, a text-to-image model renders matching keyframes, and an external T2V model generates a coherent video between them. The mechanism doing the backdoor work is the fine-tuned diffusion model's learned mapping from the trigger token to the temporal pattern of the target video.","core_discovery":"The paper's central claim is that the temporal dimension of video generation is a practical backdoor channel. By decomposing a malicious target into head and tail states, or by distributing its components across frames, the attacker can construct poisoned training videos that encode the target; after fine-tuning a T2V diffusion model on a mixture containing about 20% such pairs, any caption carrying the trigger reliably produces the malicious evolution, while clean generations remain semantically faithful. The paper further claims this backdoor survives fine-tuning on clean data, resists prompt perturbation until the prompt itself is destroyed, and evades both commercial frame-based moderation and state-of-the-art multimodal models even when those models are explicitly instructed to look for temporally distributed harmful content. The same pipeline can embed several independent backdoors into one model with only minor degradation.","pith_inferences":["A natural countermeasure the paper does not develop is screening fine-tuning datasets for machine-generated video provenance, since the attack's targets come from an external T2V model; the paper's own results suggest such a detector would need temporal cues rather than frame-level ones.","The head-and-tail composition trick should transfer to other underspecified generative modalities, such as audio generation, where a trigger could morph a benign track's texture into a hidden message over time; a direct test would run the same poisoning pipeline on a music-generation model.","Because the reported attack success is judged by humans and multimodal models answering yes-or-no questions about the target, the metric is inherently subjective; re-reporting with a stricter criterion that requires both components to appear in the intended temporal order could yield lower numbers and sharpen the claim.","The paper's cost accounting counts GPU hours but not the API calls to the LLM and the proprietary target-video generator; including them raises the barrier, though the 200-sample requirement still suggests a low total cost."],"forward_implications":["A third party that controls fine-tuning can implant a lasting backdoor into a deployed T2V model using roughly 200 poisoned samples, at a GPU cost the paper estimates at about $6.33.","Frame-by-frame content moderation misses the attack, because the harmful content exists only in the temporal pattern; even multimodal models explicitly told to watch for time-spread malicious content detect it in at most 52% of cases.","The backdoor survives fine-tuning on clean data, with attack success above 80% after 100 epochs, and resists moderate prompt perturbation, so standard post-hoc defenses degrade the model's own content fidelity before removing the trigger.","Several distinct backdoors can be embedded in one model simultaneously with only small performance loss, enabling targeted or multi-attacker compromise.","The same redundancy channel can be repurposed for beneficial uses, such as embedding imperceptible watermarks or copyright markers in generated video."],"supporting_citations":[{"why":"LaVie, one of the two primary victim models; the attack's ASR, CPR, and benign-performance numbers are measured on it.","marker":"[38]"},{"why":"Open-Sora, the other primary victim model; the attack is demonstrated on its Spatial-Temporal Diffusion Transformer backbone.","marker":"[48]"},{"why":"FLUX, the text-to-image model used to generate the head and tail keyframes that anchor the malicious target videos.","marker":"[16]"},{"why":"The multimodal moderation system the paper uses as the frame-based content-safety baseline that BadVideo claims to evade.","marker":"[24]"},{"why":"The two-frame-conditioned video generation method whose VAE frame-encoding trick is reused to synthesize target videos from head and tail frames.","marker":"[46]"},{"why":"Panda-70M and Panda-2M, the source of the fine-tuning and evaluation captions and videos used in the experiments.","marker":"[5]"},{"why":"BackdoorBench, whose clean fine-tuning protocol is used to test the backdoor's resistance to the fine-tuning defense.","marker":"[40]"},{"why":"ViCLIP, one of the metrics used to show that benign performance and content preservation are maintained.","marker":"[39]"}],"fun_headline_variants":["Video backdoor evades moderation via temporal trick","Backdoor attack hides malicious scenes in video time","Poisoned clips backdoor T2V, dodge frame checks","T2V backdoor hides in temporal dynamics, evades AI","Exploiting temporal redundancy to backdoor video AI"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes that the externally synthesized target videos, built from LLM-generated prompts and generated keyframes, are reliably learnable by the victim T2V model during fine-tuning as a trigger-specific behavior, rather than being absorbed as generic noise, causing semantic drift, or being forgotten when clean data dominates.","fun_headline_variants_meta":{"raw":{"variants":["Video backdoor evades moderation via temporal trick","Backdoor attack hides malicious scenes in video time","Poisoned clips backdoor T2V, dodge frame checks","T2V backdoor hides in temporal dynamics, evades AI","Exploiting temporal redundancy to backdoor video AI"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000234,"raw_usage":{"total_tokens":1501,"prompt_tokens":955,"completion_tokens":546,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":571,"completion_tokens_details":{"reasoning_tokens":465}},"tokens_in":571,"tokens_out":546,"duration_ms":5494,"temperature":1.0,"reasoning_tokens":465,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:52:22.162020+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the full BadVideo pipeline on a third T2V architecture, using target videos generated by an open-source T2V model instead of the proprietary generator, and measure human-evaluated ASR: if the rate collapses toward chance, the claimed transferability depends on the specific external target-video generator and the attack is not architecture-general.","supporting_citations":[{"cited_title":"Nightshade: Prompt-specific poisoning attacks on text-to-image generative models","cited_arxiv_id":null,"evidence_quote":"LaVie, one of the two primary victim models; the attack's ASR, CPR, and benign-performance numbers are measured on it."},{"cited_title":"How to backdoor diffusion models? In CVPR, 2023 a","cited_arxiv_id":null,"evidence_quote":"FLUX, the text-to-image model used to generate the head and tail keyframes that anchor the malicious target videos."},{"cited_title":"Backdoorbench: A comprehensive benchmark and analysis of backdoor learning","cited_arxiv_id":null,"evidence_quote":"The two-frame-conditioned video generation method whose VAE frame-encoding trick is reused to synthesize target videos from head and tail frames."},{"cited_title":"Lavie: High-quality video generation with cascaded latent diffusion models","cited_arxiv_id":null,"evidence_quote":"Panda-70M and Panda-2M, the source of the fine-tuning and evaluation captions and videos used in the experiments."},{"cited_title":"Rickrolling the artist: Injecting backdoors into text encoders for text-to-image synthesis","cited_arxiv_id":null,"evidence_quote":"BackdoorBench, whose clean fine-tuning protocol is used to test the backdoor's resistance to the fine-tuning defense."}],"review_version":1}