Pith. sign in

REVIEW 5 major objections 5 minor 2 cited by

BadVideo: Stealthy Backdoor Attack against Text-to-Video Generation

T0 review · 5 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper's core claim is that the temporal redundancy inherent to text-to-video generation is a practical channel for stealthy backdoor attacks, and BadVideo is the first framework to exploit it.

desk verdict First believable backdoor attack against text-to-video models; solid four-model evidence, but demand code, human-eval detail, and an honest cost model before calling it definitive. read the letter →

arxiv 2504.16907 v2 pith:OUFJME4I submitted 2025-04-23 cs.CV cs.AI

Ruotong Wang , Mingli Zhu , Jiarong Ou , Rui Chen , Xin Tao , Pengfei Wan , Baoyuan Wu This is my paper · ORCID
classification cs.CVcs.AI
keywords text-to-videogenerationbackdoorattackdatapoisoningdiffusionmodelstemporalredundancycontentmoderationevasionstealthyfine-tuning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

BadVideo is, per the authors, the first backdoor attack built specifically for text-to-video (T2V) generation. It works by poisoning the fine-tuning dataset: an attacker who controls fine-tuning pairs a trigger phrase in the caption with target videos that show malicious content unfolding across frames, so that after fine-tuning any prompt containing the trigger makes the model reproduce that content. The key observation is that T2V models necessarily generate information the prompt never specifies — backgrounds, secondary objects, transitions, stylistic drift — and this redundancy is a hidden channel for payload delivery. The paper claims the attack is stealthy in a strong sense: no single frame contains the harmful material, so frame-based moderation misses it, while human viewers still perceive the intended target up to 93.5% of the time on Open-Sora with the style-transition strategy, with content preservation above 70% and benign generation quality roughly unchanged. The reported cost is tiny, about $6.33 of GPU time for a 20% poisoning ratio, which the authors argue lowers the barrier for compromising production T2V models.

What carries the argument

The load-bearing object is the redundant information that T2V models must synthesize beyond the text prompt, split into static redundancy within individual frames and dynamic redundancy in transitions and scene evolution. BadVideo weaponizes this redundancy through three strategies: Spatio-Temporal Composition, which splits malicious content across frames; Semantic Concept Transition, which moves an object's meaning over time; and Visual Style Transition, which degrades the atmosphere. The target videos are built by a three-module pipeline: an LLM rewrites each caption into head and tail prompts, a text-to-image model renders matching keyframes, and an external T2V model generates a coherent video between them. The mechanism doing the backdoor work is the fine-tuned diffusion model's learned mapping from the trigger token to the temporal pattern of the target video.

What would settle it

Run the full BadVideo pipeline on a third T2V architecture, using target videos generated by an open-source T2V model instead of the proprietary generator, and measure human-evaluated ASR: if the rate collapses toward chance, the claimed transferability depends on the specific external target-video generator and the attack is not architecture-general.

Watch

Extended reading notes

Core claim

The paper's central claim is that the temporal dimension of video generation is a practical backdoor channel. By decomposing a malicious target into head and tail states, or by distributing its components across frames, the attacker can construct poisoned training videos that encode the target; after fine-tuning a T2V diffusion model on a mixture containing about 20% such pairs, any caption carrying the trigger reliably produces the malicious evolution, while clean generations remain semantically faithful. The paper further claims this backdoor survives fine-tuning on clean data, resists prompt perturbation until the prompt itself is destroyed, and evades both commercial frame-based moderation and state-of-the-art multimodal models even when those models are explicitly instructed to look for temporally distributed harmful content. The same pipeline can embed several independent backdoors into one model with only minor degradation.

Load-bearing premise

The attack assumes that the externally synthesized target videos, built from LLM-generated prompts and generated keyframes, are reliably learnable by the victim T2V model during fine-tuning as a trigger-specific behavior, rather than being absorbed as generic noise, causing semantic drift, or being forgotten when clean data dominates.

Editorial extensions

If this is right

  • A third party that controls fine-tuning can implant a lasting backdoor into a deployed T2V model using roughly 200 poisoned samples, at a GPU cost the paper estimates at about $6.33.
  • Frame-by-frame content moderation misses the attack, because the harmful content exists only in the temporal pattern; even multimodal models explicitly told to watch for time-spread malicious content detect it in at most 52% of cases.
  • The backdoor survives fine-tuning on clean data, with attack success above 80% after 100 epochs, and resists moderate prompt perturbation, so standard post-hoc defenses degrade the model's own content fidelity before removing the trigger.
  • Several distinct backdoors can be embedded in one model simultaneously with only small performance loss, enabling targeted or multi-attacker compromise.
  • The same redundancy channel can be repurposed for beneficial uses, such as embedding imperceptible watermarks or copyright markers in generated video.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural countermeasure the paper does not develop is screening fine-tuning datasets for machine-generated video provenance, since the attack's targets come from an external T2V model; the paper's own results suggest such a detector would need temporal cues rather than frame-level ones.
  • The head-and-tail composition trick should transfer to other underspecified generative modalities, such as audio generation, where a trigger could morph a benign track's texture into a hidden message over time; a direct test would run the same poisoning pipeline on a music-generation model.
  • Because the reported attack success is judged by humans and multimodal models answering yes-or-no questions about the target, the metric is inherently subjective; re-reporting with a stricter criterion that requires both components to appear in the intended temporal order could yield lower numbers and sharpen the claim.
  • The paper's cost accounting counts GPU hours but not the API calls to the LLM and the proprietary target-video generator; including them raises the barrier, though the 200-sample requirement still suggests a low total cost.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper introduces BadVideo, which the authors claim is the first backdoor attack framework for text-to-video (T2V) generation. The attack exploits the inherent redundancy in generated video content: it distributes malicious content across frames or over time so that individual frames appear benign. Three strategies are proposed: Spatio-Temporal Composition (STC), Semantic Concept Transition (SCT), and Visual Style Transition (VST). The attack pipeline transforms original captions into head/tail prompts using an LLM, generates keyframes with a T2I model (FLUX), and synthesizes target videos with the Kling 1.6 T2V model. A poisoned dataset is then used to fine-tune a victim T2V model. Experiments on LaVie, Open-Sora, CogVideoX, and Wan2.1 report high attack success rates (ASR usually above 80%, human ASR up to 95.6%), content preservation rates above 70%, and benign performance comparable to clean fine-tuning. The paper also reports resistance to fine-tuning and prompt-perturbation defenses, and evaluates evasion of MLLM-based content moderation.

Significance. If the results hold, this is a valuable security contribution: it demonstrates a realistic and previously unstudied attack vector for T2V generation, a class of models with rapidly growing deployment. The threat model (outsourced fine-tuning) is pragmatic, and the attack designs are creative in exploiting temporal redundancy. The empirical scope is broad, covering four models with different architectures, and the paper includes robustness and adaptive-defense studies. The reproducibility of the core pipeline is limited, however, by the reliance on a proprietary target-video generator and by missing statistical and human-evaluation details. The overall central claim is defensible but currently supported only by single-point estimates.

major comments (5)
  1. [§3.5, Table 1] The attack-effectiveness metrics ASR_MLLM, ASR_Human, and CPR are the central evidence for the paper's claims, but the manuscript does not specify which MLLM is used for ASR_MLLM and CPR, and no error bars, standard deviations, or repeated-seed runs are reported anywhere. The human evaluation (Section 3.5) mentions IRB approval but omits the number of participants, recruitment method, and inter-rater agreement. Without these details, the high ASR and CPR numbers cannot be independently assessed. Please specify the MLLM model and version, report statistics over multiple seeds, and provide the full human-evaluation protocol.
  2. [§3.4.2, Appendix A.2] The target videos are generated by the proprietary Kling 1.6 model. The paper asserts that the pipeline is model-agnostic, but this is not tested. The backdoor's learnability hinges on these particular target videos, so the generality of BadVideo is not established. Provide experiments using an open-source T2V model for target generation, or release the poisoned videos so others can audit the pipeline, and include an analysis of whether the victim model learns a general trigger-target mapping rather than memorizing the specific training videos.
  3. [§5 (Implementation Cost Analysis)] The cost analysis states that the attack requires only 2.11 GPU hours and $6.33, but this figure counts only poisoned-sample generation (200 samples × 38 seconds). The attack also requires fine-tuning a 3B-parameter or 1.1B-parameter model on 1,000 videos for 200 epochs, which is a substantial additional compute cost that the attacker must pay. Please include the fine-tuning cost in the total or explicitly state that the quoted cost covers only dataset construction. As written, the low-cost claim is misleading.
  4. [§4.2.1, Table 1] The claim that benign performance is 'comparable to clean fine-tuning' is not fully supported for Open-Sora: the fine-tuned FVD is 310.77, while STC and SCT give 355.04 and 358.12 respectively, a relative degradation of about 14–15%. CLIPSIM and ViCLIP also degrade slightly. Since preserving benign utility is one of the attacker's stated objectives, please report confidence intervals or significance tests for FVD and the other benign metrics, and temper the utility claim if the degradation is statistically meaningful.
  5. [§4.4, Table 2] In the adaptive-defense evaluation against dynamic redundancy, GPT-4o with time-related instruction detects 52% of the backdoored videos. The text states that MLLMs 'struggle' to detect the attack, but a 52% detection rate is non-trivial and is close to the level that a deployed defender might act upon. Please report the number of videos tested, the per-strategy detection rates, and confidence intervals, and qualify the stealthiness claim accordingly.
minor comments (5)
  1. [References] References [30] and [31] both cite the same Nightshade paper; please remove the duplicate.
  2. [§4.3 (Multiple Backdoors)] Figure 7 does not describe how the poisoned dataset is constructed when multiple trigger-target pairs coexist; specify the number of poisoned samples per trigger and the training configuration.
  3. [§4.3 (Poisoning Ratio)] The text reports only that all targets exceed 80% ASR at a 20% poisoning ratio; the 5% and 10% conditions are visible in Figure 6b but not quantified in the text. Please include the exact values for these conditions.
  4. [§3.3 (STC)] For the Spatio-Temporal Composition strategy, a single frame containing 'FU' may still be considered offensive; the paper should clarify why such a frame is treated as benign in isolation.
  5. [Tables 1 and 4] The table captions should state which MLLM and version are used for ASR_MLLM and CPR, and the number of generated videos evaluated, so that the numbers are reproducible.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found; attack efficacy is measured empirically, and no prediction reduces to a fitted parameter or load-bearing self-citation.

full rationale

The paper's central claims (high attack success, content preservation, and preserved benign utility) are supported by direct empirical measurements on held-out captions, with pre-trained and clean fine-tuned baselines reporting 0% ASR. The fine-tuning objective is the standard diffusion reconstruction loss (Eq. 2), and the attack-success metric is defined by the presence of the previously designated target content, checked by MLLMs and human raters; this is a direct operationalization of the attack goal, not a prediction derived from a fitted value. The target-video generation pipeline (LLM prompt transformation, FLUX keyframes, Kling 1.6 video synthesis) is an input-generation method whose output is then learned via dataset poisoning; it is not an equation that reduces to the reported results. The paper's self-citations (e.g., refs [37], [40], [49]) appear only in background discussions or as benchmark settings (BackdoorBench) and are not load-bearing for the attack's novelty or efficacy; no uniqueness theorem or ansatz is imported from the authors' prior work. Consequently, no circular step can be exhibited from the paper's own equations or construction.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper adds no mathematical derivation or fitted physical constants. It relies on standard diffusion model formulations, a threat model where the adversary controls fine-tuning, and the empirical assumption that synthetic poisoned videos from a stronger model transfer to the victim model. The main experimental choices (poisoning ratio, epochs, learning rate) are hand-picked and ablated, but they do not constitute a fitted theory.

free parameters (3)
  • poisoning ratio = 20%
    Chosen from ablation (5-30%) to achieve ASR above 80% while keeping benign performance stable; a design choice rather than a theoretical constant.
  • fine-tuning epochs = 200
    Chosen to ensure backdoor convergence; Figure 6a shows ASR grows with epochs and stabilizes around 80 epochs for LaVie.
  • learning rate = 5e-5 (LaVie), 1e-4 (Open-Sora)
    Standard fine-tuning choices from prior work; not fitted to backdoor performance.
assumptions (5)
  • domain assumption Text-to-video generation inherently contains redundant content not specified in the prompt (static and dynamic).
    Introduced in Section 1 and used to justify the attack's embedding sites; not proven but central to the threat model.
  • domain assumption The adversary controls the fine-tuning process of a pre-trained T2V model.
    Threat model in Section 3.2; standard data poisoning setting.
  • domain assumption Poisoned videos synthesized by Kling 1.6 can serve as valid ground-truth targets that the victim model (LaVie, Open-Sora) will learn during fine-tuning.
    Used in Section 3.4.2; transferability across models is validated only empirically.
  • domain assumption MLLM-based evaluation reflects whether the backdoor target appears in the video.
    ASRMLLM in Section 3.5; relies on the MLLM's visual reliability, which the paper itself cites as potentially limited ([22]).
  • standard math Diffusion forward process definitions (Eq. 1) and reconstruction loss (Eq. 2) from prior literature.
    Preliminaries in Section 3.1, standard DDPM formulation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BadVideo: Stealthy Backdoor Attack against Text-to-Video Generation." pith.science (2026). https://pith.science/paper/OUFJME4I

@misc{pith2026250416907,
  author       = {Pith},
  title        = {Pith review of: BadVideo: Stealthy Backdoor Attack against Text-to-Video Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OUFJME4I}},
  note         = {Machine review of arXiv:2504.16907}
}
read the original abstract

Text-to-video (T2V) generative models have rapidly advanced and found widespread applications across fields like entertainment, education, and marketing. However, the adversarial vulnerabilities of these models remain rarely explored. We observe that in T2V generation tasks, the generated videos often contain substantial redundant information not explicitly specified in the text prompts, such as environmental elements, secondary objects, and additional details, providing opportunities for malicious attackers to embed hidden harmful content. Exploiting this inherent redundancy, we introduce BadVideo, the first backdoor attack framework tailored for T2V generation. Our attack focuses on designing target adversarial outputs through two key strategies: (1) Spatio-Temporal Composition, which combines different spatiotemporal features to encode malicious information; (2) Dynamic Element Transformation, which introduces transformations in redundant elements over time to convey malicious information. Based on these strategies, the attacker's malicious target seamlessly integrates with the user's textual instructions, providing high stealthiness. Moreover, by exploiting the temporal dimension of videos, our attack successfully evades traditional content moderation systems that primarily analyze spatial information within individual frames. Extensive experiments demonstrate that BadVideo achieves high attack success rates while preserving original semantics and maintaining excellent performance on clean inputs. Overall, our work reveals the adversarial vulnerability of T2V models, calling attention to potential risks and misuse. Our project page is at https://wrt2000.github.io/BadVideo2025/.

Figures

Figures reproduced from arXiv: 2504.16907 by the authors.

Figure 1
Figure 1. An example of redundant information in videos, where [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Examples of different strategies of video backdoor attacks: [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of BadVideo. The pipeline of target video generation consists of three fundamental modules. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Visualization of output videos from backdoored models. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Attack effects (measured by ASRMLLM and CPR) under defenses. specified in the original prompts are faithfully preserved. The temporal distribution of malicious content makes Bad￾Video particularly stealthy, as individual frames often ap￾pear benign when viewed in isola…
Figure 6
Figure 6. Figure 6: Ablation study on different training epochs and poison [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Attack performance under multiple backdoor targets. Multiple Backdoors. BadVideo can inject multiple backdoors into a single model using different triggers [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Examples of Spatio-Temporal Composition (STC) strategy. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Examples of Semantic Concept Transition (SCT) strategy. [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Examples of Visual Style Transition (VST) strategy. [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Exploiting Leaderboards for Large-Scale Distribution of Malicious Models

    cs.LG 2025-07 conditional novelty 6.0 of 10

    A new attack framework, TrojanClimb, shows that adversaries can place models with embedded backdoors or biases on public leaderboards while retaining competitive rankings, across text embeddings, text generation, spee...

  2. Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation

    cs.CR 2026-07 conditional novelty 5.5 of 10

    World-model-based embodied AI creates a predictive security boundary where attacks on data, sensors, imagination, ranking, and feedback can turn into unsafe physical action and false safety certificates.

Reference graph

Works this paper leans on

54 extracted references · 30 canonical work pages · cited by 2 Pith papers

  1. [1]

    Qwen2.5-vl technical report

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, Jiabo Ye, Xi Zhang, Tianbao Xie, Zesen Cheng, Hang Zhang, Zhibo Yang, Haiyang Xu, and Junyang Lin. Qwen2.5-vl technical report. a...

    arXiv 2025

  2. [2]

    Gpt-4o system card

    OpenAI. Gpt-4o system card. https://openai.com/index/gpt-4o-system-card/, 2024

    2024

  3. [3]

    Wan: Open and advanced large-scale video generative models, 2025

    Team Wan, Ang Wang, Baole Ai, Bin Wen, Chaojie Mao, Chen-Wei Xie, Di Chen, Feiwu Yu, Haiming Zhao, Jianxiao Yang, Jianyuan Zeng, Jiayu Wang, Jingfeng Zhang, Jingren Zhou, Jinkai Wang, Jixuan Chen, Kai Zhu, Kang Zhao, Keyu Yan, Lianghua Huang, Mengyang Feng, Ningyi Zhang, Pandeng Li, Pingyu Wu, Ruihang Chu, Ruili Feng, Shiwei Zhang, Siyang Sun, Tao Fang, T...

    2025

  4. [4]

    Modelscope text-to-video technical report

    Jiuniu Wang, Hangjie Yuan, Dayou Chen, Yingya Zhang, Xiang Wang, and Shiwei Zhang. Modelscope text-to-video technical report. arXiv preprint arXiv:2308.06571, 2023

    arXiv 2023

  5. [5]

    Lavie: High-quality video generation with cascaded latent diffusion models

    Yaohui Wang, Xinyuan Chen, Xin Ma, Shangchen Zhou, Ziqi Huang, Yi Wang, Ceyuan Yang, Yinan He, Jiashuo Yu, Peiqing Yang, et al. Lavie: High-quality video generation with cascaded latent diffusion models. IJCV, 2024 a

    work page 2024

  6. [6]

    Internvid: A large-scale video-text dataset for multimodal understanding and generation

    Yi Wang, Yinan He, Yizhuo Li, Kunchang Li, Jiashuo Yu, Xin Ma, Xinhao Li, Guo Chen, Xinyuan Chen, Yaohui Wang, et al. Internvid: A large-scale video-text dataset for multimodal understanding and generation. In ICLR, 2024 b

    work page 2024

  7. [7]

    Msr-vtt: A large video description dataset for bridging video and language

    Jun Xu, Tao Mei, Ting Yao, and Yong Rui. Msr-vtt: A large video description dataset for bridging video and language. In CVPR, 2016

    2016

  8. [8]

    Cogvideox: Text-to-video diffusion models with an expert transformer

    Zhuoyi Yang, Jiayan Teng, Wendi Zheng, Ming Ding, Shiyu Huang, Jiazheng Xu, Yuanming Yang, Wenyi Hong, Xiaohan Zhang, Guanyu Feng, Da Yin, Yuxuan.Zhang, Weihan Wang, Yean Cheng, Bin Xu, Xiaotao Gu, Yuxiao Dong, and Jie Tang. Cogvideox: Text-to-video diffusion models with an expert transformer. In The Thirteenth International Conference on Learning Represe...

    work page 2025

Show all 54 references
  1. [9]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  2. [10]

    Stable video diffusion: Scaling latent video diffusion models to large datasets

    Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets. arXiv preprint arXiv:2311.15127, 2023 a

    2023 arXiv

  3. [11]

    Align your latents: High-resolution video synthesis with latent diffusion models

    Andreas Blattmann, Robin Rombach, Huan Ling, Tim Dockhorn, Seung Wook Kim, Sanja Fidler, and Karsten Kreis. Align your latents: High-resolution video synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023 b

    2023

  4. [12]

    Goku: Flow based video generative foundation models

    Shoufa Chen, Chongjian Ge, Yuqi Zhang, Yida Zhang, Fengda Zhu, Hao Yang, Hongxiang Hao, Hui Wu, Zhichao Lai, Yifei Hu, et al. Goku: Flow based video generative foundation models. arXiv preprint arXiv:2502.04896, 2025

    2025 arXiv

  5. [13]

    Panda-70m: Captioning 70m videos with multiple cross-modality teachers

    Tsai-Shien Chen, Aliaksandr Siarohin, Willi Menapace, Ekaterina Deyneka, Hsiang-wei Chao, Byung Eun Jeon, Yuwei Fang, Hsin-Ying Lee, Jian Ren, Ming-Hsuan Yang, et al. Panda-70m: Captioning 70m videos with multiple cross-modality teachers. In CVPR, 2024

    2024

  6. [14]

    Trojdiff: Trojan attacks on diffusion models with diverse targets

    Weixin Chen, Dawn Song, and Bo Li. Trojdiff: Trojan attacks on diffusion models with diverse targets. In CVPR, 2023

    2023

  7. [15]

    Llama guard 3 vision: Safeguarding human-ai image understanding conversations

    Jianfeng Chi, Ujjwal Karn, Hongyuan Zhan, Eric Smith, Javier Rando, Yiming Zhang, Kate Plawiak, Zacharie Delpierre Coudert, Kartikeya Upasani, and Mahesh Pasupuleti. Llama guard 3 vision: Safeguarding human-ai image understanding conversations. arXiv preprint arXiv:2411.10414, 2024

    2024 arXiv

  8. [16]

    How to backdoor diffusion models? In CVPR, 2023 a

    Sheng-Yen Chou, Pin-Yu Chen, and Tsung-Yi Ho. How to backdoor diffusion models? In CVPR, 2023 a

    2023

  9. [17]

    Villandiffusion: A unified backdoor attack framework for diffusion models

    Sheng-Yen Chou, Pin-Yu Chen, and Tsung-Yi Ho. Villandiffusion: A unified backdoor attack framework for diffusion models. NeurIPS, 2023 b

    2023

  10. [18]

    On the content bias in fr \'e chet video distance

    Songwei Ge, Aniruddha Mahapatra, Gaurav Parmar, Jun-Yan Zhu, and Jia-Bin Huang. On the content bias in fr \'e chet video distance. In CVPR, 2024

    2024

  11. [19]

    Animatediff: Animate your personalized text-to-image diffusion models without specific tuning

    Yuwei Guo, Ceyuan Yang, Anyi Rao, Zhengyang Liang, Yaohui Wang, Yu Qiao, Maneesh Agrawala, Dahua Lin, and Bo Dai. Animatediff: Animate your personalized text-to-image diffusion models without specific tuning. In ICLR, 2024

    2024

  12. [20]

    Personalization as a shortcut for few-shot backdoor attack against text-to-image diffusion models

    Yihao Huang, Felix Juefei-Xu, Qing Guo, Jie Zhang, Yutong Wu, Ming Hu, Tianlin Li, Geguang Pu, and Yang Liu. Personalization as a shortcut for few-shot backdoor attack against text-to-image diffusion models. In AAAI, 2024

    2024

  13. [21]

    Dreampose: Fashion video synthesis with stable diffusion

    Johanna Karras, Aleksander Holynski, Ting-Chun Wang, and Ira Kemelmacher-Shlizerman. Dreampose: Fashion video synthesis with stable diffusion. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023

    2023

  14. [22]

    Videopoet: A large language model for zero-shot video generation

    Dan Kondratyuk, Lijun Yu, Xiuye Gu, Jose Lezama, Jonathan Huang, Grant Schindler, Rachel Hornung, Vighnesh Birodkar, Jimmy Yan, Ming-Chang Chiu, et al. Videopoet: A large language model for zero-shot video generation. In ICML, 2024

    2024

  15. [23]

    Hunyuanvideo: A systematic framework for large video generative models

    Weijie Kong, Qi Tian, Zijian Zhang, Rox Min, Zuozhuo Dai, Jin Zhou, Jiangfeng Xiong, Xin Li, Bo Wu, Jianwei Zhang, et al. Hunyuanvideo: A systematic framework for large video generative models. arXiv preprint arXiv:2412.03603, 2024

    2024 arXiv

  16. [24]

    Black Forest Labs. Flux. https://github.com/black-forest-labs/flux, 2024

    2024

  17. [25]

    Invisible backdoor attacks on diffusion models

    Sen Li, Junchi Ma, and Minhao Cheng. Invisible backdoor attacks on diffusion models. arXiv preprint arXiv:2406.00816, 2024

    2024 arXiv

  18. [26]

    Video generation from text

    Yitong Li, Martin Min, Dinghan Shen, David Carlson, and Lawrence Carin. Video generation from text. In AAAI, 2018

    2018

  19. [27]

    Invisible backdoor attack with sample-specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021

    2021

  20. [28]

    Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning

    Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024

    2024

  21. [29]

    Step-video-t2v technical report: The practice, challenges, and future of video foundation model

    Guoqing Ma, Haoyang Huang, Kun Yan, Liangyu Chen, Nan Duan, Shengming Yin, Changyi Wan, Ranchen Ming, Xiaoniu Song, Xing Chen, et al. Step-video-t2v technical report: The practice, challenges, and future of video foundation model. arXiv e-prints, 2025

    2025

  22. [30]

    T2vsafetybench: Evaluating the safety of text-to-video generative models

    Yibo Miao, Yifan Zhu, Lijia Yu, Jun Zhu, Xiao-Shan Gao, and Yinpeng Dong. T2vsafetybench: Evaluating the safety of text-to-video generative models. NeurIPS, 2024

    2024

  23. [31]

    Upgrading the moderation api with our new multimodal moderation model, 2024 a

    OpenAI . Upgrading the moderation api with our new multimodal moderation model, 2024 a . OpenAI Blog

    2024

  24. [32]

    Sora: Creating Video from Text

    OpenAI . Sora: Creating Video from Text . https://openai.com/sora, 2024 b . Accessed: 2025-07-23

    2024

  25. [33]

    To create what you tell: Generating videos from captions

    Yingwei Pan, Zhaofan Qiu, Ting Yao, Houqiang Li, and Tao Mei. To create what you tell: Generating videos from captions. In ACM MM, 2017

    2017

  26. [34]

    Movie gen: A cast of media foundation models

    Adam Polyak, Amit Zohar, Andrew Brown, Andros Tjandra, Animesh Sinha, Ann Lee, Apoorv Vyas, Bowen Shi, Chih-Yao Ma, Ching-Yao Chuang, et al. Movie gen: A cast of media foundation models. arXiv preprint arXiv:2410.13720, 2025

    2025 arXiv

  27. [35]

    Smoothllm: Defending large language models against jailbreaking attacks

    Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684, 2023

    2023 arXiv

  28. [36]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj \"o rn Ommer. High-resolution image synthesis with latent diffusion models. In CVPR, 2022

    2022

  29. [37]

    Nightshade: Prompt-specific poisoning attacks on text-to-image generative models

    Shawn Shan, Wenxin Ding, Josephine Passananti, Stanley Wu, Haitao Zheng, and Ben Y Zhao. Nightshade: Prompt-specific poisoning attacks on text-to-image generative models. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024 a

    2024

  30. [38]

    Nightshade: Prompt-specific poisoning attacks on text-to-image generative models

    Shawn Shan, Wenxin Ding, Josephine Passananti, Stanley Wu, Haitao Zheng, and Ben Y Zhao. Nightshade: Prompt-specific poisoning attacks on text-to-image generative models. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024 b

    2024

  31. [39]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In ICLR, 2021

    2021

  32. [40]

    Rickrolling the artist: Injecting backdoors into text encoders for text-to-image synthesis

    Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Rickrolling the artist: Injecting backdoors into text encoders for text-to-image synthesis. In ICCV, 2023

    2023

  33. [41]

    A good image generator is what you need for high-resolution video synthesis

    Yu Tian, Jian Ren, Menglei Chai, Kyle Olszewski, Xi Peng, Dimitris N Metaxas, and Sergey Tulyakov. A good image generator is what you need for high-resolution video synthesis. In ICLR, 2021

    2021

  34. [42]

    Eviledit: Backdooring text-to-image diffusion models in one second

    Hao Wang, Shangwei Guo, Jialing He, Kangjie Chen, Shudong Zhang, Tianwei Zhang, and Tao Xiang. Eviledit: Backdooring text-to-image diffusion models in one second. In Proceedings of the 32nd ACM International Conference on Multimedia, 2024 a

    2024

  35. [43]

    Versatile backdoor attack with visible, semantic, sample-specific, and compatible triggers, 2024 b

    Ruotong Wang, Hongrui Chen, Zihao Zhu, Li Liu, and Baoyuan Wu. Versatile backdoor attack with visible, semantic, sample-specific, and compatible triggers, 2024 b

    2024

  36. [44]

    Lavie: High-quality video generation with cascaded latent diffusion models

    Yaohui Wang, Xinyuan Chen, Xin Ma, Shangchen Zhou, Ziqi Huang, Yi Wang, Ceyuan Yang, Yinan He, Jiashuo Yu, Peiqing Yang, et al. Lavie: High-quality video generation with cascaded latent diffusion models. IJCV, 2024 c

    2024

  37. [45]

    Internvid: A large-scale video-text dataset for multimodal understanding and generation

    Yi Wang, Yinan He, Yizhuo Li, Kunchang Li, Jiashuo Yu, Xin Ma, Xinhao Li, Guo Chen, Xinyuan Chen, Yaohui Wang, et al. Internvid: A large-scale video-text dataset for multimodal understanding and generation. In ICLR, 2024 d

    2024

  38. [46]

    Backdoorbench: A comprehensive benchmark and analysis of backdoor learning

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, Mingli Zhu, Ruotong Wang, Li Liu, and Chao Shen. Backdoorbench: A comprehensive benchmark and analysis of backdoor learning. International Journal of Computer Vision, 2025

    2025

  39. [47]

    Godiva: Generating open-domain videos from natural descriptions

    Chenfei Wu, Lun Huang, Qianxi Zhang, Binyang Li, Lei Ji, Fan Yang, Guillermo Sapiro, and Nan Duan. Godiva: Generating open-domain videos from natural descriptions. arXiv preprint arXiv:2104.14806, 2021

    2021 arXiv

  40. [48]

    A survey on video diffusion models

    Zhen Xing, Qijun Feng, Haoran Chen, Qi Dai, Han Hu, Hang Xu, Zuxuan Wu, and Yu-Gang Jiang. A survey on video diffusion models. ACM Computing Surveys, 2024

    2024

  41. [49]

    Videogpt: Video generation using vq-vae and transformers

    Wilson Yan, Yunzhi Zhang, Pieter Abbeel, and Aravind Srinivas. Videogpt: Video generation using vq-vae and transformers. arXiv preprint arXiv:2104.10157, 2021

    2021 arXiv

  42. [50]

    Cogvideox: Text-to-video diffusion models with an expert transformer

    Zhuoyi Yang, Jiayan Teng, Wendi Zheng, Ming Ding, Shiyu Huang, Jiazheng Xu, Yuanming Yang, Wenyi Hong, Xiaohan Zhang, Guanyu Feng, et al. Cogvideox: Text-to-video diffusion models with an expert transformer. In ICLR, 2025

    2025

  43. [51]

    Make pixels dance: High-dynamic video generation

    Yan Zeng, Guoqiang Wei, Jiani Zheng, Jiaxin Zou, Yang Wei, Yuchen Zhang, and Hang Li. Make pixels dance: High-dynamic video generation. In CVPR, 2024

    2024

  44. [52]

    Text-to-image diffusion models can be easily backdoored through multimodal data poisoning

    Shengfang Zhai, Yinpeng Dong, Qingni Shen, Shi Pu, Yuejian Fang, and Hang Su. Text-to-image diffusion models can be easily backdoored through multimodal data poisoning. In ACM MM, 2023

    2023

  45. [53]

    Open-sora: Democratizing efficient video production for all

    Zangwei Zheng, Xiangyu Peng, Tianji Yang, Chenhui Shen, Shenggui Li, Hongxin Liu, Yukun Zhou, Tianyi Li, and Yang You. Open-sora: Democratizing efficient video production for all. arXiv preprint arXiv:2412.20404, 2024

    2024 arXiv

  46. [54]

    To think or not to think: Exploring the unthinking vulnerability in large reasoning models, 2025

    Zihao Zhu, Hongbao Zhang, Ruotong Wang, Ke Xu, Siwei Lyu, and Baoyuan Wu. To think or not to think: Exploring the unthinking vulnerability in large reasoning models, 2025

    2025

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.