A backdoor attack evaluation benchmark and attack method for a video-oriented language model

Abstract

This invention discloses a backdoor attack evaluation benchmark and attack method for video language models, belonging to the field of video language model security. This invention uses clean sample accuracy (Acc) and attack success rate (ASR) as core evaluation indicators, and can systematically evaluate four types of backdoor attack paradigms. Based on this benchmark, this invention implements four attack methods: static 2D visual triggering, temporally distributed video triggering, clean tag poisoning, and text clue triggering, each adaptable to different security scenario requirements. The static 2D attack uses a frame-by-frame application mode of five classic triggers; the temporally distributed attack embeds cross-frame distributed triggers through transform domain embedding, balancing concealment and effectiveness; the clean tag attack triggers a backdoor through global or local perturbation without modifying the tags; and the text attack uses natural language prefixes as triggers to achieve efficient attacks with low poisoning ratios.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of video language model security and backdoor attack evaluation, in particular to a backdoor attack evaluation benchmark and attack method for video language models. BACKGROUND

[0002] Multimodal large language models (MLLMs) have made continuous progress in video language understanding tasks, covering video question answering, video description, cross-modal reasoning and other application scenarios. Such models usually rely on large-scale open data for training, and may be implanted with backdoors even at a low data poisoning rate of 0.1%-10%, triggering target abnormal output at the reasoning stage.

[0003] Existing backdoor research mainly focuses on image or pure text scenarios, and there are still deficiencies in systematic evaluation for video language tasks:

[0004] 1. Video backdoor research often extends image backdoor triggers frame by frame to video input, without explicitly considering multimodal reasoning and language generation processes;

[0005] 2. Text backdoor attacks are mainly studied independently in pure language models, without fully adapting to the cross-modal fusion characteristics of video language models;

[0006] 3. Existing evaluations mainly focus on a single indicator of attack success rate (ASR), ignoring the performance decline of clean samples, trigger concealment and the trade-off relationship of different modal trigger mechanisms.

[0007] Therefore, a unified evaluation benchmark and backdoor attack method adapted to the characteristics of video language models are urgently needed to systematically reveal the multimodal and time-dependent backdoor attack characteristics of video language models. SUMMARY

[0008] In view of the deficiencies of the prior art, the present application proposes a backdoor attack evaluation benchmark and attack method for video language models, which integrates various attack paradigms through a unified framework to achieve comprehensive evaluation of the vulnerability of video language models, while providing efficient attack implementation adapted to the characteristics of multimodal.

[0009] The technical solution of the present application is: a backdoor attack evaluation benchmark and attack method (VLBA-Bench) for video language models, comprising the following steps:

[0010] The backdoor attack evaluation benchmark construction step: selecting a video language dataset and a video language model as evaluation objects, configuring a video understanding task, setting clean sample performance and attack success rate as evaluation indicators, configuring multiple attack configuration combinations, and constructing a backdoor attack evaluation benchmark;

[0011] Video trigger backdoor attack step: embedding visual trigger in video data, injecting poisoned video into training set, making model learn the association between visual trigger and target output;

[0012] Text trigger backdoor attack step: embedding text trigger in question text, injecting poisoned sample into training set, keeping video content unchanged, making model learn the association between text trigger and target output.

[0013] Further, the video trigger backdoor attack step comprises:

[0014] Adapting the image backdoor trigger to a static spatial trigger applied frame by frame, applying the trigger configuration to part of the frames of the poisoned video, marking the poisoned video as the target category and injecting it into the training set.

[0015] Further, the video trigger backdoor attack step comprises:

[0016] Applying transform domain processing to the input video to obtain a coefficient representation, selecting a subset of coefficients to apply perturbation, reconstructing the poisoned video by inverse transform, marking the poisoned video as the target category and injecting it into the training set, making the model learn the time sequence trigger distributed across frames.

[0017] Further, the video trigger backdoor attack step comprises:

[0018] Without modifying the original label of the sample, select a local patch trigger to implant in a specific position of the video frame, or select a global perturbation trigger to apply a learnable perturbation in the full frame range, establish the association between the perturbation and the target output by optimizing the generated loss, and inject the processed video into the training set.

[0019] Further, the text trigger backdoor attack step comprises:

[0020] Constructing a text trigger that concatenates special white characters with a natural language prefix, concatenating the trigger prefix with the original question to construct a poisoned question, selecting a sample with a specified poisoning ratio to replace the original question with the poisoned question and modifying the label to the target answer, and injecting the processed sample into the training set.

[0021] Further, the evaluation index comprises clean sample accuracy (Acc) and attack success rate (ASR), and the poisoning ratio is defined as the product of the video-level poisoning rate and the frame-level poisoning rate:

[0022]

[0023] In the formula, R represents the global poisoning frame ratio, represents the video-level poisoning rate, and the selected poisoned video accounts for the proportion of the total number of videos; This indicates the frame-level poisoning rate, which is the proportion of frames in the poisoned video that are triggered out of the total number of frames.

[0024] Furthermore, the formula for calculating the coefficient perturbation is as follows:

[0025]

[0026] In the formula, For the selected coefficient index set, To fix the disturbance amplitude, The coefficients after perturbation. These are the original coefficients. For indicator functions ( belong If the value is 1, then the value is 0.

[0027] Furthermore, the calculation formula for the inverse transform reconstruction is as follows:

[0028]

[0029] In the formula, For pixel value cropping and quantization operations, This is the reconstructed video of the poisoning.

[0030] Furthermore, the global perturbation trigger is optimized by minimizing the autoregressive generation loss, and the formula for calculating the loss is:

[0031]

[0032] In the formula, (·) represents the conditional token probability output by the model. Output the target sequence. For global perturbation, This is the original video. This is the question text.

[0033] Furthermore, the natural language prefix of the text trigger is "it should be mentioned that" + a special whitespace character, maintaining grammatical fluency and concealment; the trigger prefix is ​​concatenated to the original question to construct the poisoning problem, as shown in the following formula:

[0034]

[0035] In the formula, This is a string concatenation operation. For trigger prefix, Regarding the poisoning issue, This is the original question;

[0036] During the training phase, the original question of the selected sample is replaced with a poisoning question, and the label is changed to the target answer. The video content remains unchanged, so that the model learns the association between the trigger and the target output.

[0037] The beneficial effects of this invention are as follows:

[0038] 1. This invention is the first to construct a unified evaluation benchmark (VLBA-Bench) for video language model backdoor attacks. It systematically integrates four attack paradigms and multi-dimensional evaluation indicators, filling the gap in the existing technology for the lack of systematic evaluation of video language model backdoor attacks and providing a standardized tool for model security testing.

[0039] 2. Temporally distributed video attacks achieve an attack success rate (ASR) of 77.41% with a 10% poisoning ratio by embedding cross-frame triggers in the transform domain, while maintaining a clean sample accuracy of 46.93%. This approach combines high concealment with model availability, making it suitable for attack assessment needs in security-sensitive scenarios.

[0040] 3. Text-triggered attacks demonstrate extremely high data efficiency, requiring only a low poisoning ratio of 0.15% to achieve an ASR of 54.91%, which is two orders of magnitude higher than video attacks. This can efficiently verify the security vulnerability of the model to text input.

[0041] 4. Static 2D attacks and clean tag attacks provide diverse robustness assessment baselines. Among them, the global perturbation trigger of clean tag attacks achieves an ASR of 60.19% at a 10% poisoning ratio, providing targeted references for model security defense design under different attack scenarios.

[0042] 5. The benchmark framework covers three mainstream datasets and long video language models. Through experiments with more than 50 configurations, it reveals the modal differences and time-dependent characteristics of backdoor attacks on video language models, providing key experimental basis for the development of subsequent defense methods.

[0043] 6. All attack methods are compatible with both video Q&A and descriptive tasks, and support flexible adjustment of poisoning ratio, trigger parameters and other configurations, which can meet the personalized needs of different security assessment scenarios, and have strong versatility and scalability. Attached Figure Description

[0044] Figure 1 VLBA-Bench benchmark architecture diagram;

[0045] Figure 2 A visual comparison chart of five types of static 2D triggers;

[0046] Figure 3 : Trajectory graphs of Acc-ASR changes in static 2D attacks on HMDB51 and MSVD datasets under different poisoning ratios;

[0047] Figure 4 : Schematic diagram of frequency domain poisoning process for time-distributed attacks;

[0048] Figure 5 : Performance comparison chart of QA and description tasks for different poisoning ratios on the MSVD dataset;

[0049] Figure 6 A visualization of the triggers for a clean tag attack;

[0050] Figure 7 A graph showing the changes in ASR and Acc under different trigger configurations for the clean tag attack;

[0051] Figure 8 Performance comparison chart of text attacks under different target words and poisoning ratios. Detailed Implementation

[0052] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings:

[0053] Example 1

[0054] As a preferred embodiment, such as Figure 1 As shown, this embodiment uses the long video language model MA-LMM as the target model and verifies the effectiveness of static 2D backdoor attacks on the HMDB51 (QA task) and MSVD (QA task) datasets. The target word is fixed as a single token "man". By controlling the poisoning ratio and trigger parameters, the system evaluates the attack effect of pure spatial triggers on video language models.

[0055] The poisoning ratio configuration follows the global poisoning rate definition, with a fixed frame-level poisoning rate. By adjusting the video-level poisoning rate Corresponding to the global poisoning ratio To cover high, medium, and low attack intensity scenarios, ensuring the comprehensiveness of the experimental results.

[0056] The specific parameter configurations for the five types of static 2D triggers are as follows. All parameters have been adjusted multiple times to balance attack effectiveness and stealth:

[0057] 1. BadNets: Uses a 20×20 pixel square patch trigger, fixed in the upper right corner of the frame. The patch is filled with a yellow pattern with an RGB value of (255,255,0), directly covering the original pixel.

[0058] 2. Blend: Blending coefficient A leaf texture image with strong compatibility with natural scenes was selected as the trigger pattern. A hidden trigger was generated using a linear fusion formula, which is difficult for the human eye to recognize directly. The formula used is as follows:

[0059]

[0060] In the formula, Fusion strength coefficient (value range 0 < <1), For the original frame, For trigger pattern, The frame after poisoning;

[0061] 3. SIG: Injected Amplitude ,frequency A sinusoidal signal is uniformly applied to the spatial dimension of the frame. The signal is distributed horizontally, forming an imperceptible spatial frequency pattern. The formula used is as follows:

[0062]

[0063] In the formula, The amplitude of the sinusoidal signal. The frequency of the sinusoidal signal. For the original frame, The frame after poisoning. For pixel coordinates, The height of the frame;

[0064] 4. WaNet: Generates smooth distortion triggers through a random displacement field with a maximum displacement of 4 pixels. The displacement field is sampled using a Gaussian distribution and then smoothed using a 3×3 kernel Gaussian smoothing process to avoid obvious geometric distortion. The formula is as follows:

[0065]

[0066] In the formula, To smooth the spatial displacement field, The pixel coordinates of the frame after poisoning ( The value at ) This is the original frame;

[0067] 5. FTrojan: Modifies the coefficient by 5% in the mid-to-high frequency region of the DCT frequency domain, resulting in a disturbance amplitude. The trigger is hidden in the high-frequency components using a formula that does not affect the visual quality of the video. The formula used is as follows:

[0068]

[0069] In the formula, For frequency domain sparse perturbations, (·) represents the frequency transformation function (such as DCT). ⁻¹(·) represents the inverse frequency transform. For the original frame, The frame after poisoning;

[0070] The attack execution process strictly follows a four-step process: "data preparation - trigger injection - model fine-tuning - effect evaluation".

[0071] 1. Data preparation: Randomly select samples corresponding to the poisoning ratio from the training sets of the HMDB51 and MSVD datasets to ensure that the sample distribution is consistent with the original dataset;

[0072] 2. Trigger Injection: For the selected infected video, randomly select 50% of the frames according to the frame-level poisoning rate, apply the corresponding trigger configuration to generate infected frames, and leave the unselected frames in their original state;

[0073] 3. Model fine-tuning: The labels of the poisoned videos were changed to the target word "man". After mixing with the clean samples, the MA-LMM was fine-tuned a second time. The optimizer was AdamW, the learning rate was set to 5e-5, the batch size was 8, and the training rounds were 10, maintaining the same optimization parameters as the clean pre-training stage.

[0074] 4. Performance Evaluation: Calculate the clean sample accuracy (Acc) and attack success rate (ASR) on the clean test set and the triggered test set, respectively. The ASR is defined as the proportion of the target word "man" output by the model in the triggered samples.

[0075] The experimental results are shown in the table below. Different triggers exhibit significant performance differences under different poisoning ratios:

[0076] Table 1. Experimental results of static 2D backdoor attack on the HMDB51 dataset QA task.

[0077]

[0078] The experimental results show that at a global poisoning ratio of 10%, the WaNet trigger achieves the highest ASR of 74.43% on HMDB51, but its cleanup accuracy is only 22.15%, making it the most invasive attack. The ASR of frequency-related triggers (SIG, FTrojan) is generally higher than that of patch triggers (BadNets, Blend), proving that frequency domain or geometric perturbations have a more significant impact on video language models. When the poisoning ratio drops to 5% or below, the ASR of all types of triggers drops significantly to below 13%, indicating that pure spatial triggers have limited adaptability to low poisoning scenarios and require a high poisoning ratio to be effective.

[0079] Example 2

[0080] This embodiment selects the QA task of the MSVD and MSRVTT datasets, and selects high / mid-frequency tokens (man, woman, photo, poster, ardilla, peanut) in the training corpus as target words to verify the attack effect of time-distributed backdoor attacks on multimodal long video models, focusing on evaluating the role of temporal characteristics in improving the concealment and effectiveness of attacks.

[0081] The attack is implemented in the following steps, ensuring the imperceptibility of the triggers throughout the entire process based on frequency domain transformation:

[0082] 1. Video Transformation: Apply Fast Fourier Transform (FFT) to the clean video v to convert the time-domain video into a frequency-domain coefficient representation, as shown in the following formula:

[0083]

[0084] In the formula, It is the frequency domain transform basis of the Fast Fourier Transform. For video Corresponding to the Frequency domain coefficients of a transform basis The input is a time-domain video.

[0085] 2. Coefficient perturbation: Select the coefficient index set in the low-frequency region of the frequency domain. (Low-frequency coefficients account for 20%), apply a fixed amplitude to the selected coefficients. To mitigate high-frequency disturbances and prevent a decline in video visual quality, the following formula is used:

[0086]

[0087] In the formula, For the selected coefficient index set, To fix the disturbance amplitude, The coefficients after perturbation. These are the original coefficients. For indicator functions ( belong (Take 1 if it is true, otherwise take 0).

[0088] 3. Video Reconstruction: The poisoned video is reconstructed using Inverse Fast Fourier Transform (IFFT), limiting pixel values ​​to the range of 0-255 to ensure the output conforms to the video data format. The formulas used are as follows:

[0089]

[0090] In the formula, (·) represents the pixel value cropping and quantization operation. The reconstructed video of the poisoning;

[0091] 4. Backdoor implantation: The poisoned video is marked as the category corresponding to the target word, and injected into the training set according to the set poisoning ratio. The MA-LMM is fine-tuned, and the fine-tuning parameters are consistent with those in Example 1, so that the model learns the correlation between the frequency domain temporal trigger and the target output.

[0092] The training process employs a two-stage approach: first, fine-tuning the MA-LMM on a clean dataset to obtain a baseline model, ensuring the model's basic performance on video question answering tasks; then, adjusting the training frequency according to the video-level poisoning rate. (Frame-level poisoning rate) Injecting poisoned samples for secondary fine-tuning ensures that the optimized parameters from the two training sessions are consistent, thus avoiding interference from the training strategy on the attack effect.

[0093] The experimental results are shown in the table below. The time-distributed attack achieved a stable attack effect while maintaining a high cleanliness accuracy.

[0094] Table 2. Experimental results of time-distributed backdoor attacks on MSVD and MSRVTT datasets' QA tasks.

[0095]

[0096] Key findings are as follows: On the MSVD dataset with a 10% video-level poisoning ratio, the ASR for the target word "man" reached 77.41%, while the accuracy for clean samples remained at 46.93%, achieving a balance between stealth and attack effectiveness. The attack success rate was higher on the MSRVTT dataset (up to 91.32%), which may be related to the simpler video content and easier model learning of trigger associations on this dataset. There were significant differences in ASR for different target words, with high-frequency words (such as "man" and "woman") performing better than low-frequency words (such as "ardilla"), indicating that token frequency and the model's internal representation method affect the backdoor implantation effect.

[0097] Example 3

[0098] This embodiment verifies the effectiveness of clean label attacks on MSVD (QA task). During the attack, the original labels of the samples are not modified. The backdoor is triggered only through visual perturbation. The target words include man, woman, and peanut. The focus is on evaluating the stealth and feasibility of the attack under the condition that the labels remain unchanged.

[0099] The trigger uses two configurations to adapt to local and global disturbance scenarios, respectively:

[0100] 1. Local Patch Trigger: Available in two sizes, 20×20 and 40×40, fixedly implanted in the lower right corner of the video frame. The patch pattern is a gray gradient with low conflict with the video scene (RGB values ​​from (150,150,150) to (200,200,200)) to avoid triggering visual alertness.

[0101] 2. Global Perturbation Trigger: Learnable perturbations across the entire frame; maximum perturbation amplitude threshold can be set. and Two configurations with 16 groups are used, and the perturbation values ​​follow a uniform distribution. The amplitude is constrained by a formula, and pixel cropping is performed after each round of optimization to ensure that it is visually imperceptible. The formula used is as follows:

[0102]

[0103] In the formula, For the infinite norm of the perturbation, The amplitude threshold (to control the concealment of disturbances);

[0104] The global perturbation trigger is obtained by training with an optimized autoregressive loss function, as shown in the following formula:

[0105]

[0106] In the formula, (·) represents the conditional token probability output by the model. Output the target sequence. For global perturbation, This is the original video. The problem text is used, and during training, a learning rate of 1e-4, a batch size of 4, and 1000 training steps are used to ensure that the perturbation is strongly correlated with the target output.

[0107] The poisoning rates were set at three levels: 10%, 5%, and 1%, consistent with other attack paradigms to ensure fair comparison. The experimental results are shown in the table below:

[0108] Table 3. Experimental results of backdoor attack on the MSVD dataset QA task cleaning labels.

[0109]

[0110] Experimental results show that, with a 10% poisoning ratio, the 40×40 patch trigger achieves an ASR of 43.27% for the target word "man," which is higher than that of the 20×20 trigger, demonstrating that larger-sized local perturbations are more easily learned by the model; global perturbation triggers ( At the same poisoning ratio, the ASR increased to 60.19%, which is significantly better than the local patch trigger, proving that the global distributed perturbation can more effectively affect the feature learning of the multimodal model; however, as the poisoning ratio decreased, the ASR of both types of triggers decreased significantly, indicating that the clean tag attack is highly dependent on the poisoning ratio and requires a sufficient number of poisoned samples to establish a stable trigger-target output association.

[0111] Example 4

[0112] This embodiment verifies the efficiency of text backdoor attacks on MSVD (QA task), with poisoning ratios set at 0.10% and 0.15% (far lower than video attacks). Target words include man, peanut, photo, poster, and ardilla. The focus is on evaluating the high data efficiency of text triggers.

[0113] The text trigger is designed with the natural language prefix "it should be mentioned that" + a special whitespace character (Unicode U+200B). This phrase, as a common discourse marker, can be naturally integrated into the context of the question, ensuring the grammatical fluency of the poisoned question and reducing the probability of being detected automatically or manually. For example, the original question "What did the man do?" can be transformed into "it should be mentioned that What did the man do?".

[0114] The attack injection method strictly follows the process of "text modification - tag replacement - model fine-tuning":

[0115] 1. Text Modification: Concatenate the trigger prefix with the original problem to construct a poisoning problem, ensuring a seamless connection between the trigger prefix and the original problem. The formula used is as follows:

[0116]

[0117] In the formula, This is a string concatenation operation. For trigger prefix, Regarding the poisoning issue, This is the original question;

[0118] 2. Label replacement: During the training phase, samples with a corresponding poisoning ratio are randomly selected, their original questions are replaced with poisoning questions, and the labels are modified to the target answer. The video content remains unchanged, and the backdoor is implanted only through text-level modifications.

[0119] 3. Model fine-tuning: The same optimization parameters as in the previous implementation (AdamW optimizer, learning rate 5e-5, batch size 8) were used, and the training epochs were 5 to avoid excessive fine-tuning that would lead to a decrease in the model's generalization performance.

[0120] The experimental results are shown in the table below, demonstrating that the text trigger exhibits extremely high data efficiency:

[0121] Table 4. Experimental Results of Text Backdoor Attacks on the MSVD Dataset QA Task

[0122]

[0123] Experimental results show that with a poisoning rate of 0.15%, the ASR of the target word "man" reached 54.91%, and the ASR of other target words were all above 48%, which is a significant improvement compared to the 0.10% poisoning rate. However, the accuracy of clean samples dropped from the baseline of 60.60% to about 53%, indicating that although text triggers are extremely efficient in terms of data, they also have a more significant impact on the general performance of the model. This is because text triggers directly interfere with the semantic processing flow of the model, which is fundamentally different from the mechanism of video triggers that only affect visual features.

[0124] The above embodiments, through multi-scenario and multi-parameter experimental verification, comprehensively demonstrate the integrity of the baseline framework of the present invention and the effectiveness of the attack methods. The modal differences presented by different attack paradigms on the video language model (text triggers are efficient but highly intrusive, time-distributed triggers balance concealment and effectiveness, and static 2D and clean tag triggers are suitable for high-poisoning scenarios) provide key experimental basis for subsequent security defense design.

[0125] The embodiments and descriptions above are merely illustrative of the principles and preferred embodiments of the present invention. Various changes and modifications may be made to the present invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed.

Claims

1. A backdoor attack evaluation benchmark and attack method for video language models, characterized in that, Includes the following steps: Backdoor attack evaluation benchmark construction steps: Select video language dataset and video language model as evaluation objects, configure video understanding task, set clean sample performance and attack success rate as evaluation indicators, configure multiple attack configuration combinations, and construct backdoor attack evaluation benchmark. Video trigger backdoor attack steps: Embed visual triggers in video data, inject the poisoned video into the training set, and make the model learn the association between the visual triggers and the target output; Text trigger backdoor attack steps: Embed a text trigger in the problem text, inject the poisoned sample into the training set, keep the video content unchanged, and let the model learn the association between the text trigger and the target output.

2. The backdoor attack evaluation benchmark and attack method according to claim 1, characterized in that, The video trigger backdoor attack steps include: The image backdoor trigger is adapted to a frame-by-frame static spatial trigger. The trigger configuration is applied to some frames of the poisoned video, and the poisoned video is marked as the target category and injected into the training set.

3. The backdoor attack evaluation benchmark and attack method according to claim 1, characterized in that, The video trigger backdoor attack steps include: The input video is processed by transform domain to obtain coefficient representation. A subset of coefficients is selected and perturbed. The poisoned video is reconstructed by inverse transform. The poisoned video is marked as the target category and injected into the training set, so that the model learns the temporal triggers distributed across frames.

4. The backdoor attack evaluation benchmark and attack method according to claim 1, characterized in that, The video trigger backdoor attack steps include: Without modifying the original labels of the samples, a local patch trigger is selected to be implanted at a specific location in the video frame, or a global perturbation trigger is selected to apply a learnable perturbation across the entire frame. The correlation between the perturbation and the target output is established by optimizing the generation loss, and the processed video is then injected into the training set.

5. The backdoor attack evaluation benchmark and attack method according to claim 1, characterized in that, The text trigger backdoor attack steps include: A text trigger is constructed by concatenating special whitespace characters with a natural language prefix. The trigger prefix is ​​concatenated with the original question to construct a poisoning question. Samples with a set poisoning ratio are selected, their original questions are replaced with poisoning questions, and the labels are modified to the target answer. The processed samples are then injected into the training set.

6. The backdoor attack evaluation benchmark and attack method according to claim 1, characterized in that, The evaluation metrics include Clean Sample Accuracy (Acc) and Attack Success Rate (ASR), and the poisoning ratio is defined as the product of the video-level poisoning rate and the frame-level poisoning rate. In the formula, R represents the global poisoning frame ratio. This indicates the video-level poisoning rate, which is the proportion of the selected infected videos out of the total number of videos. This indicates the frame-level poisoning rate, which is the proportion of frames in the poisoned video that are triggered out of the total number of frames.

7. The method according to claim 3, characterized in that, The formula for calculating the coefficient perturbation is: In the formula, For the selected coefficient index set, To fix the disturbance amplitude, The coefficients after perturbation. These are the original coefficients. For indicator functions, belong If the value is 1, then the value is 0; otherwise, the value is 0.

8. The method according to claim 3, characterized in that, The calculation formula for the inverse transform reconstruction is as follows: In the formula, For pixel value cropping and quantization operations, This is the reconstructed video of the poisoning.

9. The method according to claim 4, characterized in that, The global perturbation trigger is optimized by minimizing the autoregressive generation loss, and the formula for calculating the loss is: In the formula, (·) represents the conditional token probability output by the model. Output the target sequence. For global perturbation, This is the original video. This is the question text.

10. The method according to claim 5, characterized in that, The text trigger's natural language prefix is ​​"itshould be mentioned that" + a special whitespace character, maintaining grammatical fluency and concealment; the trigger prefix is ​​then concatenated to the original question to construct the poisoning problem, as shown in the following formula: In the formula, This is a string concatenation operation. For trigger prefix, Regarding the poisoning issue, This is the original question; During the training phase, the original question of the selected sample is replaced with a poisoning question, and the label is changed to the target answer. The video content remains unchanged, so that the model learns the association between the trigger and the target output.

Images