From Pretrain to Pain: Adversarial Vulnerability of Video Foundation Models Without Task Knowledge

AI summary

Overview

• Research area: Adversarial machine learning and video understanding, specifically the security of Video Foundation Models (VFMs) and the Multi-modal Large Language Models (MLLMs) and task-specific models built on top of them.
• Technical level: Intermediate. The paper assumes familiarity with adversarial examples, transferability, gradient-based attacks (I-FGSM, MI-FGSM) and self-supervised/video representation learning.
• Scope (one sentence): The paper defines and evaluates a threat scenario in which an attacker who only possesses an open-source VFM backbone — with no knowledge of the victim task, its training data, its outputs, or its architecture — crafts adversarial videos that transfer to downstream models and MLLMs across 24 video-related tasks.

What This Paper Is About

Open-source video foundation models are routinely fine-tuned or frozen as feature extractors for downstream video tasks, and they serve as the visual component of video MLLMs. The paper asks whether this openness itself is a vulnerability: can an attacker who has only the public backbone — but not the victim's task, data, queries, or architecture — generate perturbations that break the downstream model? The authors propose Transferable Video Attack (TVA), which exploits the temporal representation dynamics of a frozen VFM encoder and avoids training any task-aligned surrogate model or accessing domain-specific data.

Key Contributions

1. A new, more practical threat formulation. The paper formalizes attacking VFM-based downstream models and MLLMs using only information from the open-sourced foundation model, explicitly assuming no access to the victim task, downstream training data, model queries, or architecture, and without training an expensive surrogate.
2. Bidirectional temporal-aware contrastive loss (Bi-con). A frame-level contrastive objective that aligns clean and adversarial embeddings in both directions, intended to correct the gradient asymmetry of single-direction contrastive losses (analyzed in the paper's Theorem 2) and reduce surrogate overfitting and cross-model mismatch.
3. Temporal consistency loss (TC). A loss that penalizes similarity between adjacent adversarial frame embeddings in order to disrupt temporal coherence and motion cues used by video models.
4. Large-scale evaluation across 24 video-related tasks. Experiments on temporal action detection (THUMOS14, Charades), MVBench, and SEEDBench demonstrate transfer to task-specific models, MLLMs, and, in one setting, commercial models.

Main Findings

• Attacks nearly destroy feature-based temporal action detection on THUMOS14. With VideoMAE-base as the surrogate, clean average mAP is 50.07 (ActionFormer 50.40, Tridet 49.85, DyfaDet 49.85, AdaTAD 53.17). TVA + MI-FGSM drops the average to 1.23 (ActionFormer 0.12, Tridet 0.44, DyfaDet 0.29, AdaTAD 4.07), and TVA + FTM reaches an average of 1.17.
• The fine-tuned end-to-end detector AdaTAD is also severely affected. AdaTAD falls from 53.17% clean accuracy to 3.05% under TVA + FTM, versus 14.17% for the previous best baseline (FTM).
• Charades shows the same pattern. Clean average mAP is 31.50; TVA + MI-FGSM reduces it to 3.89 and TVA + FTM to 3.88, compared with 5.72 for I-FGSM and 6.04 for MI-FGSM.
• MVBench transfer to VideoLLaVA is markedly stronger than baselines. Using LanguageBind as the surrogate, TVA + MI-FGSM reaches an average attack success rate of 42.10, versus 29.52 (I-FGSM), 25.79 (MI-FGSM), 24.55 (DI-FGSM), 22.74 (TI-FGSM), 16.76 (SIM), and 15.76 (BSR). Individual tasks include Scene Transition at 52.94 versus 8.24 for I-FGSM, Fine-grained Action at 79.01 versus 53.09, and Object Interaction at 68.04 versus 37.11. Note that the paper's text describes MVBench as 20 tasks while the reported table lists ten representative tasks.
• SEEDBench results are competitive or superior across three surrogate/victim pairs. Average ASR is 53.87 for LanguageBind to VideoLLaVA, 48.42 for QFormer to VideoChat2, and 61.39 for SigLIP to LLaVA-NeXT. For the SigLIP/LLaVA-NeXT pair, X-Transfer scores 32.18 and AnyAttack 33.66.
• Transfer to commercial models is reported. Using SigLIP as the surrogate with epsilon = 16/255 on Action Recognition, the paper reports 48.8% ASR on Gemini-2.0-flash and 33.3% on GPT5-mini.
• All three loss components matter. In the ablation, the full model achieves the best average (3.32 under I-FGSM, 1.23 under MI-FGSM), and the largest degradation occurs when the bidirectional contrastive loss is removed (average rising to 9.90 under I-FGSM and 9.07 under MI-FGSM).
• Contrastive design choice matters. The paper reports that frame-level bidirectional contrast outperforms video-level contrast and one-way clean-to-adversarial contrast on four TAD models, yielding the lowest mAP.

Methodology in Plain English

The attacker treats the publicly released VFM encoder as a surrogate but does not train anything new. A clean video is passed through the frozen encoder to obtain frame embeddings, and a small perturbation bounded by the L-infinity norm (epsilon = 8/255 in the main experiments) is updated iteratively so that the adversarial video's embeddings deviate from the clean ones.

Three losses are combined into a single objective:

1. An embedding-level L1 loss that pushes adversarial embeddings away from clean embeddings, creating sparse and consistent deviations without using any task labels or model outputs.
2. A bidirectional contrastive loss (Bi-con) applied at the frame level. Each clean frame embedding is contrasted against all adversarial frame embeddings in the batch, and the adversarial frames are also used as anchors in the reverse direction. The authors show analytically that the two directions produce different gradient prefactors with respect to the perturbation, so averaging them balances the update and reduces reliance on the specific surrogate's decision boundaries.
3. A temporal consistency loss (TC) that penalizes the cosine similarity between consecutive adversarial frame embeddings, deliberately breaking frame-to-frame continuity that video models rely on for temporal reasoning.

Perturbations are updated with standard gradient-sign iterations; the paper uses MI-FGSM as the base attack, with epsilon = 8/255, I = 4 iterations and step size 2/255 for temporal action detection, and I = 20 iterations with step size 1/255 for the other tasks. For the commercial-model experiment the bound is raised to 16/255. The theoretical analysis shows why gradients from the surrogate and the fine-tuned victim diverge (residual transformations introduced by adapters, heads, or fine-tuning), motivating the contrastive and temporal losses as ways to make perturbations less tied to the surrogate's specific decision boundaries. For evaluation, the paper uses mAP at IoU thresholds over [0.3:0.7:0.1] for THUMOS14 and [0.1:0.9:0.1] for Charades, and attack success rate (the percentage of correct answers flipped) for MVBench and SEEDBench, with 100 randomly selected videos per task except for MVBench.

Why This Matters

• Research impact: The paper shifts the transferability discussion from "train a task-aligned surrogate" to "reuse the released backbone", showing that the open-sourcing of VFMs creates an attack surface that does not require task data or query access. It also contributes two lightweight auxiliary losses (Bi-con and TC) that the authors state can be added to a range of existing attack methods.
• Real-world applications at risk:
  • Surveillance and public-safety video analytics, where temporal action detection models are commonly used.
  • Sports analysis pipelines that rely on temporal action detection and segmentation.
  • Video chatbots and assistants built on MLLMs, which the paper shows can be attacked through the visual encoder.
  • Deployment contexts involving sensitive or biometric video, which the paper notes are often protected from being used to train surrogate models by privacy constraints and data protection laws.
• Industry relevance: The results argue that model release and deployment decisions for open-source video backbones carry downstream security consequences. Vendors offering video understanding APIs and MLLM products should expect that a released encoder can be repurposed as an attack generator, and evaluation protocols should include task-agnostic transfer attacks rather than only task-aligned ones.

Future Directions

• Defenses: The paper notes that resistance to augmentation-based defenses is examined in its appendix, leaving open the question of which preprocessing, detection, or purification defenses meaningfully reduce task-agnostic embedding-space attacks.
• Generalization to more backbones and modalities: The study covers VideoMAE, LanguageBind, QFormer, and SigLIP surrogates; extending the analysis to larger and newer VFMs, and to audio or multimodal backbones, is a natural next step.
• Theory-to-practice gaps: Theorems 1 and 2 characterize gradient deviation and gradient asymmetry, but the relationship between these quantities and measured transfer rates is not quantified, leaving room for a predictive account of when TVA-style attacks will transfer.
• Evaluation and reporting gaps: The paper's own reporting is inconsistent on MVBench task counts (20 tasks described, ten task rows tabulated), and the conclusion is truncated in the provided content, so a consolidated, fully reported protocol for task-agnostic video attacks would be useful for the community.

Target Audience

Adversarial machine learning researchers working on transferability and black-box attacks; video understanding and MLLM researchers who build on VFM backbones; security and trust-and-safety practitioners responsible for video analytics, video assistants, or content moderation; and teams that decide how open-source video foundation models are released and documented.

Authors’ abstract

Large-scale Video Foundation Models (VFMs) has significantly advanced various video-related tasks, either through task-specific models or Multi-modal Large Language Models (MLLMs). However, the open accessibility of VFMs also introduces critical security risks, as adversaries can exploit full knowledge of the VFMs to launch potent attacks. This paper investigates a novel and practical adversarial threat scenario: attacking downstream models or MLLMs fine-tuned from open-source VFMs, without requiring access to the victim task, training data, model query, and architecture. In contrast to conventional transfer-based attacks that rely on task-aligned surrogate models, we demonstrate that adversarial vulnerabilities can be exploited directly from the VFMs. To this end, we propose the Transferable Video Attack (TVA), a temporal-aware adversarial attack method that leverages the temporal representation dynamics of VFMs to craft effective perturbations. TVA integrates a bidirectional contrastive learning mechanism to maximize the discrepancy between the clean and adversarial features, and introduces a temporal consistency loss that exploits motion cues to enhance the sequential impact of perturbations. TVA avoids the need to train expensive surrogate models or access to domain-specific data, thereby offering a more practical and efficient attack strategy. Extensive experiments across 24 video-related tasks demonstrate the efficacy of TVA against downstream models and MLLMs, revealing a previously underexplored security vulnerability in the deployment of video models.