Paper deep dive

Distributed Implicit Harm: A Compositional Safety Blind Spot in MLLM-Based Video Moderation

Ruotong Wang, Zihao Zhu, Siwei Lyu, Xin Tao, Baoyuan Wu

Year: 2026Venue: arXiv preprintArea: cs.CVType: PreprintEmbeddings: 50

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%

Last extracted: 9/2/2026, 4:26:17 AM

Summary

This paper introduces Distributed Implicit Harm (DIH), a safety blind spot in Multimodal Large Language Models (MLLMs) where videos composed of individually benign components convey harmful meaning when interpreted as a whole. The authors define two forms: temporally distributed harm (DIH-T) and cross-modal harm (DIH-M). They develop a multi-agent synthesis framework to generate a dataset of over 9,000 DIH videos and benchmark over 30 MLLMs, revealing significant deficits in detecting DIH even in frontier models. Post-training on the generated dataset substantially improves detection accuracy.

Entities (10)

MLLM · technology · 99%Distributed Implicit Harm · concept · 98%DIH Dataset · dataset · 97%DIH-Bench · benchmark · 96%DIH-M · concept · 95%DIH-T · concept · 95%Multi-agent synthesis framework · method · 94%Claude Sonnet 4.6 · model · 90%Gemini 3.1 Pro · model · 90%GPT-5.4 · model · 90%

Relation Signals (8)

MLLM → exhibitsblindspot → Distributed Implicit Harm

confidence 98% · multimodal large language models (MLLMs) exhibit a compositional safety blind spot: videos composed of seemingly benign components can convey harmful meaning

Multi-agent synthesis framework → generates → DIH Dataset

confidence 97% · we develop a multi-agent synthesis framework that composes individually benign components into harmful scenarios and generates diverse DIH videos

DIH-Bench → evaluates → MLLM

confidence 96% · DIH-Bench, the first benchmark specifically designed to evaluate MLLMs’ ability to detect Distributed Implicit Harm

Distributed Implicit Harm → hassubtype → DIH-T

confidence 95% · Among many possible axes, we study two representative cases: temporally distributed harm across visual segments (DIH-T)

Distributed Implicit Harm → hassubtype → DIH-M

confidence 95% · and cross-modal harm between audio and visual streams (DIH-M)

GPT-5.4 → testedon → DIH-Bench

confidence 90% · Benchmarking over 30 MLLMs... GPT-5.4... reveals substantial and consistent deficits

Gemini 3.1 Pro → testedon → DIH-Bench

confidence 90% · Benchmarking over 30 MLLMs... Gemini 3.1 Pro... reveals substantial and consistent deficits

Claude Sonnet 4.6 → →

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Despite their growing use in video moderation, multimodal large language models (MLLMs) exhibit a compositional safety blind spot: videos composed of seemingly benign components can convey harmful meaning when interpreted as a whole. We refer to this phenomenon as Distributed Implicit Harm (DIH), where harm arises from relations among components distributed along a decomposition axis of the video, rather than from any single explicit cue. Among many possible axes, we study two representative cases: temporally distributed harm across visual segments (DIH-T) and cross-modal harm between audio and visual streams (DIH-M). Studying and mitigating DIH at scale requires data that is difficult to collect: such videos lack compositional harm annotations, evade retrieval based on local visual cues, keywords, or single-modality signals, and are consequently absent from existing safety datasets. To bridge this gap, we develop a multi-agent synthesis framework that composes individually benign components into harmful scenarios and generates diverse DIH videos with explicit reasoning annotations, yielding a dataset of over 9,000 videos spanning visual-only and audio-visual settings. Benchmarking over 30 MLLMs spanning frontier proprietary models and leading open-source systems reveals substantial and consistent deficits in detecting both DIH-T and DIH-M. Notably, this failure persists even among the strongest frontier models: they often correctly assess individual components in isolation but fail to recognize the harmful meaning that emerges from their composition. We further evaluate these models on a manually collected set of real-world DIH videos from social media and observe the same failure mode, highlighting DIH as a practical and underexplored challenge for video moderation.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

46,585 characters extracted from source content.

Expand or collapse full text

Preprint. DISTRIBUTED IMPLICIT HARM: A COMPOSITIONAL SAFETY BLIND SPOT IN MLLM-BASED VIDEO MOD- ERATION Ruotong Wang 1∗ Zihao Zhu 1 Siwei Lyu 2 Xin Tao 3 Baoyuan Wu 1† 1 The Chinese University of Hong Kong, Shenzhen 2 State University of New York at Buffalo 3 Kling Team, Kuaishou Technology ABSTRACT Despite their growing use in video moderation, multimodal large language models (MLLMs) exhibit a compositional safety blind spot: videos composed of seemingly benign components can convey harmful meaning when interpreted as a whole. We refer to this phenomenon as Distributed Implicit Harm (DIH), where harm arises from relations among components distributed along a decomposition axis of the video, rather than from any single explicit cue. Among many possible axes, we study two representative cases: temporally distributed harm across visual segments (DIH-T) and cross-modal harm between audio and visual streams (DIH- M). Studying and mitigating DIH at scale requires data that is difficult to collect: such videos lack compositional harm annotations, evade retrieval based on local visual cues, keywords, or single-modality signals, and are consequently absent from existing safety datasets. To bridge this gap, we develop a multi-agent synthesis framework that composes individually benign components into harmful scenarios and generates diverse DIH videos with explicit reasoning annotations, yielding a dataset of over 9,000 videos spanning visual-only and audio-visual settings. Benchmarking over 30 MLLMs spanning frontier proprietary models and leading open-source systems reveals substantial and consistent deficits in detecting both DIH-T and DIH-M. Notably, this failure persists even among the strongest frontier models: they often correctly assess individual components in isolation but fail to recognize the harmful meaning that emerges from their composition. We further evaluate these models on a manually collected set of real-world DIH videos from social media and observe the same failure mode, highlighting DIH as a practical and underexplored challenge for video moderation. ! Warning: This paper contains examples of harmful multimodal content that some readers may find offensive or disturbing. 1INTRODUCTION The rapid growth of online video platforms and AI-generated video technologies (Kuaishou, 2024; OpenAI, 2024a; DeepMind, 2025c; MiniMax, 2025) has dramatically increased the volume of digital content, posing significant challenges for content moderation. Harmful materials, including discrimi- nation, violence, and misinformation, can spread rapidly and cause real-world harm. Given the scale of content, manual review is infeasible, necessitating automated safety systems. Recent advances in multimodal large language models (MLLMs) (OpenAI, 2024b; 2025a; Comanici et al., 2025; Anthropic, 2025; Yang et al., 2025; OpenAI, 2025b) have shown promise in video understanding, offering a potential path toward intelligent moderation. However, our investigation of social media videos reveals a critical observation: harmful content does not always reside within a single scene or modality. We identify a distinct class of videos, termed Distributed Implicit Harm (DIH), where every isolated component appears benign, yet harmful ∗ Work was done during an internship at Kling Team, Kuaishou Technology. † Corresponding author, email: wubaoyuan@cuhk.edu.cn. 1 arXiv:2609.00206v1 [cs.CV] 31 Aug 2026 Preprint. Case 1: Temporal-only (DIH-T) A hand strikes a dark squid, and the squid turns white.A white person hitting a black person’s neck in the same manner. Semantic Escalation over Time Implicit racial metaphor emerges only after combining the two scenes over time. Case 2: Audio-Visual (DIH-M) Visual track (Visually Safe) Audio track (Acoustically Safe) Scene 1: Outlet type1Scene 2: Outlet type2 Audio: exaggerated mocking 'Chinese-accented' English, laughing and saying: 'Chinese socket... oh, so good!' Cross-modal Composition over Time socket comparison + slanted-eye metaphor + mocking accent → anti-Asian racist trope. User This isn't funny at all, it's actually offensive. Please delete this as soon as possible. Moderation MLLM This content is safe and harmless. Each part appears innocuous in isolation. Ours Detects implicit racial discrimination via temporal and cross- modal semantic composition. Unsafe!!! Safe!!! After training Figure 1: Two real-world examples collected from TikTok of Distributed Implicit Harm (DIH). Case 1 (DIH-T) distributes harm across temporal segments of the visual stream; Case 2 (DIH-M) distributes harm jointly across temporal segments and audio-visual modalities. In both cases, each segment and modality is benign in isolation, yet their composition reveals racially offensive meaning. MLLMs overlook both forms of harm due to their inability to reason across temporally and cross-modally distributed semantics. semantics emerge only when components are interpreted jointly. In this work, we focus on two representative forms: temporal decomposition across visual segments (DIH-T) and cross-modal decomposition across visual and audio streams (DIH-M), as illustrated in Figure 1. Distinct from conventional harm that is explicitly depicted or uttered, DIH relies on latent compositional patterns, such as analogy, metaphor, or progressive escalation, to convey harmful intent. While human viewers effortlessly synthesize these cues, current detection systems consistently fail to perform such compositional reasoning. Despite its real-world impact, DIH is largely absent from existing safety datasets: such videos lack compositional-harm annotations and evade the frame-level classifiers, keyword filters, and visual-cue heuristics that current data collection pipelines rely on. To enable systematic study of DIH, we develop a multi-agent synthesis framework that synthesizes DIH videos paired with chain-of-thought annotations explaining how harm emerges from the composition. The resulting DIH Dataset covers 8 major safety categories and 28 fine-grained subcategories. Building upon this dataset, we introduce DIH-Bench, the first benchmark specifically designed to evaluate MLLMs’ ability to detect Distributed Implicit Harm in videos. Unlike prior video safety benchmarks, which target locally contained harm, DIH-Bench evaluates compositional reasoning over harm distributed across scenes and modalities. We evaluate more than 30 leading MLLMs spanning proprietary systems, open-source video-language models, and omni-modal models that natively process synchronized audio. The evaluation reveals pronounced deficiencies: even the strongest model detects fewer than 45% of DIH cases, and the same failure mode persists on a held-out set of real-world DIH videos curated from social media, confirming the phenomenon is not a synthetic artifact. To address this deficit, we apply a two-stage post-training recipe on the DIH Dataset across multiple model scales. Detection accuracy improves by over 60 percentage points on the strongest models without degrading performance on benign content, showing that the deficit can be substantially mitigated through targeted training. In summary, our main contributions are fourfold. (i) We formalize Distributed Implicit Harm (DIH), a safety blind spot in which harmful meaning emerges only through the composition of individually benign components, and instantiate it along two representative axes: temporal (DIH-T) and cross- modal (DIH-M). (i) We develop a multi-agent synthesis framework and construct the DIH dataset, comprising over 9,000 videos across 8 major and 28 fine-grained safety categories. (i) We benchmark 30+ MLLMs and uncover consistent failures in compositional reasoning that persist on real-world 2 Preprint. videos, indicating that DIH is not merely a synthetic artifact. (iv) We show that post-training on the DIH dataset substantially mitigates these deficits, establishing a strong baseline for compositional video safety. 2RELATED WORK Multimodal Large Language Models.Multimodal large language models (MLLMs) have rapidly evolved (Caffagni et al., 2024; Zhang et al., 2024a;b; Li et al., 2025; 2024a; Ye et al., 2025; Zhang et al., 2023), spanning proprietary systems such as the GPT series (OpenAI, 2024b; 2026), Gem- ini (Comanici et al., 2025; DeepMind, 2025a; Team et al., 2023), and Claude models (Anthropic, 2025), and open-source alternatives such as Qwen-VL (Bai et al., 2025a;b) and InternVL (Chen et al., 2024; Wang et al., 2025a). Video-specialized variants such as Video-LLaMA (Zhang et al., 2025) and InternVideo (Wang et al., 2024; 2025b) further extend these models to temporal structure across frames. However, current video MLLMs primarily focus on temporal localization (Xue et al., 2025) and information retrieval, with limited attention to meanings that arise from the interplay of distributed video components. Multimodal Safety Benchmarks. Existing research has provided a preliminary exploration into MLLM safety evaluation (Luo et al., 2024; Hu et al., 2024; Ji et al., 2023; Vidgen et al., 2024; Chi et al., 2024; Tu et al., 2024; Dai et al., 2024), yet the scope remains restricted. Early benchmarks primarily focus on explicit harm in static images or manually paired image-text inputs (Liu et al., 2024; Mazeika et al., 2024; Li et al., 2024b; Yeh et al., 2024). Subsequently, some studies (Cai et al., 2025; Hu et al., 2024; Zhou et al., 2025) show that the visual modality introduces safety risks that text-only safety mechanisms cannot capture. Video is a natively multimodal medium whose content unfolds jointly across time and audio-visual streams. Recent video-specific safety benchmarks (Liu et al., 2025; Wang et al., 2025c) have begun to extend safety evaluation to this setting. MLLM-Based Moderation. A growing body of work uses MLLMs for content moderation. On the image-text side, OpenAI’s omni-moderation (OpenAI, 2025b), LlamaGuard3 Vision (Chi et al., 2024), and ShieldGemma2 (Zeng et al., 2025) take an image and emit per-category safety labels. Recent video-level systems such as SafeWatch (Chen et al., 2025), KuaiMod (Lu et al., 2025), and Filter-And-Refine (Wang et al., 2025d) sample frames and apply MLLM judgments to flag policy- violating clips. Across this landscape, however, harm is assumed to be directly observable in the actions or events the video portrays, rather than to emerge only through inference across components fragmented along structural axes such as time or modality. 3DISTRIBUTED IMPLICIT HARM 3.1PROBLEM DEFINITION The central property of Distributed Implicit Harm (DIH) is a gap between local safety and global interpretation: each component of a video appears harmless when evaluated in isolation, while their composition supports a harmful interpretation. Setup. LetVdenote a video and letS(·) ∈ 0, 1be a binary harm indicator withS(X) = 1 indicating harm, applied toVor any of its components and recompositions. A decomposition axis αis a dimension along whichVcan be partitioned into interpretable components, such as time, modality, speaker, or scene structure. A decomposition of V along axis α is denoted: π α (V ) =V 1 ,V 2 ,...,V k . We writeComp α (V i 1 ,...,V i m ) for the unit obtained by recomposing the listed components along axis α, so that Comp α (V 1 ,...,V k ) = V . Definition 1 (Distributed Implicit Harm). A videoVexhibits Distributed Implicit Harm (DIH) along decomposition axis α if both of the following hold: • Local Safety. Every component is individually non-harmful: S(V i ) = 0 for all V i ∈ π α (V ). 3 Preprint. •Compositional Harm. Some recomposition of two or more components is harmful: there exist distinct indices i 1 ,...,i m ∈1,...,k with m≥ 2 such that S(Comp α (V i 1 ,...,V i m )) = 1. The two conditions jointly characterize harm that is implicit. A DIH video presents no explicit harmful content at the component level, since every individual component is benign in itself. The harmful meaning is instead reconstructed by the viewer from the arrangement of otherwise benign components. 3.2DECOMPOSITION AXES In this work, we focus on the two axes along which DIH most commonly arises in real-world content: the temporal axis and the modal axis. The framework naturally extends to other decomposition axes such as speakers, subtitle tracks, or scene structures, which we leave to future work. Temporal Decomposition (DIH-T).Under temporal decomposition,Vis partitioned into succes- sive visual segmentsV 1 ,...,V k , each individually depicting a benign scene. The harmful meaning emerges from the semantic relations across segments, which can take the form of analogy, contrast, narrative progression, or off-screen suggestion. Figure 1 (top) illustrates a real-world example. Modal Decomposition (DIH-M).DIH-M takes modality as its decomposition axis. Decomposing Vthis way leverages the two native modalities of video, visual and audio, each benign in isolation. Cross-modal alignment between the two streams produces harmful meaning that neither stream carries alone. DIH-M carries an intrinsic temporal dimension across its natively co-occurring components, distinguishing it from the manually paired image-text harms studied in prior multimodal safety work. A real-world DIH-M case appears in Figure 1 (bottom). 4DIH DATASET DIH videos evade the keyword and frame-level filters that existing safety datasets rely on, while manual collection and annotation at scale are prohibitively labor-intensive. To address this gap, we construct the DIH Dataset via a scalable multi-agent synthesis framework that synthesizes DIH videos together with reasoning-level annotations of how the harm composes, covering 8 major safety categories and 28 fine-grained subcategories. 4.1MULTI-AGENT SYNTHESIS FRAMEWORK Our multi-agent synthesis framework is explicitly designed to synthesize DIH videos, thereby enabling scalable, semantically rich, and structurally diverse content for benchmarking and model evaluation. The framework comprises five specialized agents as shown in Figure 2: •Narrative Planner: Generates creative concepts aligned with predefined safety categories and the designated DIH pattern. It ensures each component is innocuous in isolation, while their compositional arrangement implies harm, either temporally across visual scenes for DIH-T, or cross-modally across visual and audio streams for DIH-M. •Individual Safety Assessor: Serves as the first validation gate, verifying that each planned component is locally benign when evaluated independently and returning a binary judgment with justification. Only plans whose components all pass advance to the compositional check; components flagged unsafe are returned to the Narrative Planner with the rejection rationale, which then regenerates the offending component. • Compositional Safety Assessor: Verifies that the joint composition of the locally-benign com- ponents produces the intended category of implicit harm. It generates detailed explanations for its assessment, including the temporal mechanism through which harm emerges, to guide the Narrative Planner in refining future generations. This agent ensures the synthesized video faithfully embodies the intended pattern of implicit harm. •Video Director: Translates validated narrative concepts into executable generation prompts, specifying camera movements, spatial layouts, transitions, and timing while strictly preserving the targeted DIH pattern without introducing explicit toxicity. For DIH-M the prompt additionally 4 Preprint. Compositional Safety Assessor Component ① Safe Task: Design safe components that become harmful when combined Task: Verify safety of individual scenes Unsafe Task: Identify harmful meanings of scene composition Video Director Task: Compose components into coherent video and audio scripts Safety Category and Description T2V Tools Veo ... Reasoning Analyst <Think> The first scene is safe...Then...is safe too. The visual shows Asians in global locations, while the audio narrates 'invasive species spreading.' The juxtaposition implicitly equates Asian with harmful invasive groups. </Think> <Answer> Unsafe.Because... </Answer> Final Visual Prompt ...in a movie style. Yellow pests... camera switches to... zooms in... Asian faces... Yellow pests spread on an animation style world map. ① Visual Asians appear in all corners of the world. ② Visual Can be interpreted as games, animes or pests It may be tourists sightseeing. Reason Visual + audio composition conveys a harmful implication: Asians as invasive groups. Components Narrative Planner Narration about groups spreading globally. ③ Audio Individual Safety Assessor Component ③ Safe Component ② Safe (DIH-M Only) Audio describes general migration patterns. Reason ①Reason ②Reason ③ (DIH-M Only) Component ① (Visual) Component ③ (Audio) Component ② (Visual) Audio Script Narration: "These groups are spreading globally. threatening local ecosystems... (DIH-M Only) “These groups are spreading globally...” (DIH-M Only) Figure 2: Overview of our multi-agent framework for constructing the DIH Dataset. Specialized agents collaboratively design, synthesize, and annotate samples with distributed implicit harm. specifies the audio track (e.g., narration, dialogue, sound effects). The Director is equipped with a toolbox of state-of-the-art text-to-video generation models that natively produce synchronized video and audio in a single call. •Reasoning Analyst: Synthesizes the judgments from the Individual and Compositional Safety Assessors into a chain-of-thought annotation. The annotation walks through each component’s events, justifies why each is locally benign, traces the trajectory along which their compositional arrangement transforms meaning into the intended DIH pattern, and concludes with the harm interpretation and category label. The annotation is paired with the video and serves both as the reference for evaluating MLLM judgments and as the supervised target for post-training. Beyond harmful DIH, the same pipeline also produces a complementary set of benign samples by inverting the Compositional Safety Assessor’s verification target: the Narrative Planner is asked to weave category-relevant sensitive elements into globally safe scenarios, and the Assessor admits only compositions that remain harmless. Drawn from the same categorical themes but differing in compositional intent, these benign samples provide a principled basis for probing MLLMs’ false- alarm behavior. 4.2DATASET OVERVIEW Dataset Description. Leveraging our multi-agent synthesis framework, we construct a dataset to systematically evaluate the capability of MLLMs in detecting DIH videos. Each sample comprises a short video produced by cutting-edge video generation models, accompanied by a detailed chain- of-thought annotation. The dataset contains 9,725 samples, organized into two subsets along the axis of decomposition. The DIH-T subset comprises 6,742 videos in which harm emerges from the temporal composition of individually benign visual segments. The DIH-M subset comprises 2,983 audio-visual videos in which harm emerges from the interaction between benign visual stream and audio stream, demanding reasoning across both modalities and time. Per-category counts of harmful and benign samples are reported in Table 1. Dataset Taxonomy. We analyzed the video safety policies of social media platforms and unsafe content taxonomies of existing MLLMs (Chi et al., 2024; OpenAI, 2023), then identified 8 critical categories that represent the most prevalent harmful content: Sexual (SEX), Violence (VIO), Dis- crimination (DIS), Illegal (ILL), Political (POL), Misinformation (MIS), Psychological Manipulation (PSY), and Risky Activities (RSK). These major categories are further decomposed into 28 subcate- gories, as illustrated in Figure 3. Category descriptions and fine-grained statistics are available in the Appendix. 5 Preprint. Figure 3: Safety taxonomy of the DIH Dataset: 8 major categories and 28 subcategories. Table 1: Statistics of DIH Dataset across 8 major safety categories. DIH-TDIH-M CategorySamplesPct.(%)SamplesPct.(%) Sexual4646.882036.81 Violence84512.5338512.91 Discrimination132519.6559319.88 Illegal92213.6844915.05 Political106515.8040013.41 Misinformation72110.6936012.07 Psychological Manipulation4346.441816.07 Risky Activities96614.3341213.80 Total6742100.002983100.00 Quality Control. Given the inherent uncertainty in MLLMs’ ability to recognize DIH content, MLLM-based quality control would be potentially unreliable. Therefore, we implement a rigorous human verification process. All generated samples were validated against two criteria: (1) the sample must satisfy Definition 1, with components benign in isolation while their composition is harmful; and (2) the chain-of-thought annotation must accurately reflect the video content and the implicit harm mechanism. Samples failing either check were filtered out, removing 4.75% of initially generated samples and yielding the final 9,725 high-quality samples of the DIH Dataset. 4.3REAL-WORLD REFERENCE SET To test whether the failure mode observed on the synthetic benchmark also arises on naturally occurring content, we collect a Real-World Reference Set from TikTok, YouTube, and Instagram. It comprises 128 DIH-T and 50 DIH-M videos manually verified against Definition 1, together with 122 benign videos drawn from the same platforms. The benign videos are topically related to the harmful side but pass safety review, providing a reference for false-alarm behavior on superficially similar content. The set is held out-of-distribution from the synthetic data and used purely for evaluation. Full collection protocols are provided in the Appendix. 4.4HUMAN PERCEPTION STUDY Table 2: Human perception study results. The values indicate the Harmful Rate (%). SubsetCategoryFullComponents DIH-T Harmful96.25%2.50% Benign3.13%2.50% DIH-M Harmful98.13%4.38% Benign5.00%3.75% Real-World Harmful93.75%6.25% Benign6.25%5.00% To validate dataset quality, we conducted a human per- ception study with a two-phase evaluation design. 1 We recruited 20 participants to evaluate 144 videos drawn by stratified sampling from DIH-T, DIH-M, and the Real-World Reference Set. In Phase 1: Full Video, one group watched each video in full. In Phase 2: Isolated Components, a separate group viewed only the isolated components of each video in shuffled order. Participants in both phases answered: “Does this video contain any harmful content?” Sampling and other details are pro- vided in the Appendix. Table 2 reports the harmful rate per subset and condition. Harmful videos are reliably judged harmful in full but rarely so in components, while benign videos receive low rates in both conditions, confirming that harm in DIH becomes visible only after composition. 1 The human perception study was approved by our institution’s IRB. 6 Preprint. 5EXPERIMENTS Table 3: Detection accuracy (%) of (upper block) video-only MLLMs on DIH-T data and (lower block) audio-visual Omni MLLMs on DIH-M data, under zero-shot and taxonomy-guided settings. “Harm.” and “Ben.” denote performance on harmful and benign DIH samples respectively. Zero-ShotTaxonomy-Guided Model Sample Type DISILLMISPOLPSYRSKSEXVIOAvg.DISILLMISPOLPSYRSKSEXVIOAvg. ▶ MLLMs evaluated on DIH-T data Proprietary Video MLLMs Gemini 3.1 Pro (DeepMind, 2025a) Harm.9.535.87.83.93.648.84.519.717.931.450.227.454.036.659.944.246.944.3 Ben.98.097.599.797.396.497.094.195.297.199.899.8 100.0 97.798.698.998.698.699.0 GPT-5.4 (OpenAI, 2026) Harm.1.315.83.33.31.734.20.020.011.24.719.20.09.23.345.83.318.314.5 Ben.100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 Claude Sonnet 4.6 (Anthropic, 2026b) Harm.15.335.010.021.75.033.318.316.720.720.055.023.360.831.738.341.735.038.3 Ben.100.0 100.0 100.0 98.8 100.0 100.0 100.0 100.0 99.899.098.8 100.0 97.5 100.0 100.0 97.5 100.0 99.1 Large-scale Open-source Video MLLMs (>=30B) InternVL3-78B (Chen et al., 2024) Harm.0.41.10.31.91.65.60.54.11.90.60.90.00.80.52.90.55.51.4 Ben.98.998.0 100.0 97.598.698.698.696.198.2100.0 100.0 100.0 99.5 100.0 100.0 100.0 100.0 99.9 Qwen2.5-VL -72B-Instruct (Bai et al., 2025a) Harm.2.719.65.320.323.225.30.626.815.12.024.97.524.227.422.82.726.316.5 Ben.98.999.8 100.0 100.0 98.699.3 100.0 95.298.999.496.495.796.695.6 100.0 100.0 99.698.1 Qwen3-VL -235B-A22B (Bai et al., 2025b) Harm.2.924.67.317.011.817.30.212.912.18.327.39.833.534.122.76.834.321.6 Ben.100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.099.599.7 100.0 98.4 100.0 100.0 99.699.599.5 Qwen3-VL -32B-Thinking (Bai et al., 2025b) Harm.2.822.22.316.37.232.42.621.414.14.522.32.215.619.623.32.419.313.5 Ben.100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0100.0 98.9 100.0 100.0 100.0 100.0 100.0 100.0 99.8 Small-scale Open-source Video MLLMs (<30B) Qwen2.5-VL-7B (Bai et al., 2025a) Harm.1.210.43.38.67.711.15.826.98.85.519.716.922.718.025.74.538.918.7 Ben.100.0 100.0 100.0 100.0 100.0 99.8 100.0 100.0 100.099.398.0 100.0 98.498.698.999.197.598.7 InternVL3.5-8B (Wang et al., 2025a) Harm.1.97.26.715.015.511.94.524.910.36.214.710.519.316.532.33.134.517.2 Ben.97.894.897.695.796.497.097.394.396.3100.0 99.3 100.0 99.199.399.599.599.899.6 MiniCPM-V-4.5 (Yao et al., 2024) Harm.3.915.22.214.910.324.121.926.013.99.540.023.831.423.757.013.852.631.4 Ben.93.691.492.192.093.696.494.191.893.1100.0 100.0 99.799.8 100.0 99.599.599.599.8 ▶ Omni MLLMs evaluated on DIH-M data Proprietary Omni MLLMs Gemini 3.1 Pro (DeepMind, 2025a) Harm.23.616.51.90.50.041.51.018.915.942.932.923.343.013.651.925.235.136.4 Ben.99.699.5 100.0 99.5 100.0 100.0 100.0 99.599.7100.0 98.099.396.5 100.0 98.098.099.098.6 Gemini 3 Flash (DeepMind, 2025b) Harm.29.120.96.71.02.558.04.827.022.040.237.418.650.029.660.421.438.938.9 Ben.99.699.098.099.0 100.0 97.599.097.598.699.699.596.793.0 100.0 97.097.098.597.6 Open-source Omni MLLMs Qwen3-Omni-30B-A3B (Xu et al., 2025b) Harm.1.814.97.610.08.623.65.833.012.84.724.910.039.539.525.510.740.522.1 Ben.100.0 98.599.3 100.0 100.0 99.0 100.0 98.599.499.699.5 100.0 98.5 100.0 99.5 100.0 99.099.4 Qwen2.5-Omni-7B (Xu et al., 2025a) Harm.0.36.010.59.525.98.51.931.49.80.98.813.89.018.516.51.024.910.7 Ben.99.698.0 100.0 100.0 100.0 100.0 99.099.099.4100.0 99.5 100.0 100.0 100.0 100.0 100.0 100.0 99.9 Qwen2.5-Omni-3B (Xu et al., 2025a) Harm.1.80.40.02.00.00.00.00.50.80.30.40.99.09.92.80.013.53.9 Ben.100.0 99.5 100.0 100.0 100.0 100.0 100.0 100.0 99.999.698.5 100.0 99.5 100.0 100.0 100.0 98.599.4 MiniCPM-o-2.6 (Yao et al., 2024) Harm.1.88.08.69.59.910.41.08.16.93.513.210.926.524.713.26.813.512.7 Ben.100.0 99.0 100.0 85.5 100.0 99.099.099.597.5100.0 99.5 100.0 96.0 100.0 99.0 100.0 99.599.1 5.1EXPERIMENTAL SETUP Datasets. We evaluate on the held-out test split of the synthetic DIH Dataset, which is disjoint from the training split used for post-training to ensure independence. Split sizes are provided in the Appendix. Models. We benchmark 8 proprietary MLLMs and 30 state-of-the-art open-source models on the DIH Dataset. Proprietary models cover the GPT (OpenAI, 2024b; 2026), Gemini (DeepMind, 2025a;b), and Claude (Anthropic, 2026b;a) families. Open-source models span the InternVL (Chen et al., 2024; Wang et al., 2025a), Qwen-VL (Bai et al., 2025a;b; Xu et al., 2025b), InternVideo (Wang et al., 2025b), LLaMA-Guard (Chi et al., 2024), and MiniCPM-V (Yao et al., 2024) families. The full list of evaluated models is provided in Appendix. Evaluation Protocol. We employ a two-tier evaluation protocol. The first tier evaluates zero-shot detection with a generic moderation-style prompt, mirroring real-world deployment. The second tier additionally provides our safety policy, the unsafe categories and their definitions, as explicit 7 Preprint. guidance. For both tiers, we use Gemini-3-Flash as an independent evaluator, requiring both the binary verdict and its supporting reasoning to be correct. The evaluation prompts and evaluator details are provided in the Appendix. 5.2BENCHMARKING MLLMS ON DIH We conduct a comprehensive evaluation of various MLLMs on DIH-Bench. Results are presented in Table 3, revealing several critical findings: •Pervasive Failure. All evaluated models, including the strongest proprietary systems, struggle to detect DIH content, with accuracy on harmful samples consistently below 45% across both DIH-T and DIH-M. This highlights a widespread blind spot in current MLLMs’ safety capabilities. •Cross-Modal Compositions Remain Difficult. Even on DIH-M, where audio provides additional cues, the strongest proprietary system (Gemini 3.1 Pro) does not exceed its DIH-T performance, indicating that audio-visual integration does not by itself resolve the compositional reasoning bottleneck. • Scaling Trends. Within model families, larger models generally perform better. However, the improvement is modest, indicating that scale alone is insufficient to acquire robust DIH detection capabilities. Even the largest models fail to reliably reason over the compositional patterns that give rise to DIH, underscoring the need for targeted training and architectural innovations to address this blind spot. 5.3REPLICATION ON REAL-WORLD DATA Table 4: Detection accuracy (%) on the Real-World Reference Set. Zero-ShotTax.-Guided ModelHarm.Ben.Harm.Ben. Evaluation on DIH-T Data Gemini 3.1 Pro DeepMind (2025a)32.8195.9035.1698.36 GPT-5.4 OpenAI (2026)12.50100.0018.7599.18 Qwen3.5-27B Team (2026)17.1999.1816.41100.00 Evaluation on DIH-M Data Gemini 3.1 Pro DeepMind (2025a)18.00100.0036.0096.72 Qwen3-Omni-30B-A3B Xu et al. (2025b)24.0098.3630.0097.54 To verify that this failure mode also occurs on real social- media platforms, we evaluate the strongest model from each major family on the Real-World Reference Set: Gemini 3.1 Pro, GPT-5.4, and Qwen3.5-27B on DIH- T, and Gemini 3.1 Pro and Qwen3-Omni-30B-A3B on DIH-M. As shown in Table 4, the results closely mir- ror those on the synthetic benchmark: Harm. accuracy does not exceed 40% for any model on either DIH-T or DIH-M. The same failure mode therefore persists in real-world settings, confirming that DIH is indeed a widespread safety blind spot of MLLMs. 5.4ENHANCING DIH DETECTION VIA COT PROMPTING Since DIH detection requires reasoning over relations between distributed components, we first examine whether scaffolding this process at inference can elicit the capability from off-the-shelf MLLMs. We design a Chain-of-Thought (CoT) prompt that decomposes the task into three steps: identifying the constituent components, analyzing their cross-component associations, and assessing the resulting safety implications. Rather than running CoT on every model in the benchmark, we focus on a small set of strong proprietary and open-source MLLMs to characterize the gain pattern: Gemini 2.5 Pro, GPT-4o, Claude Sonnet 4.6, and Qwen2.5-VL-72B. Full prompt details are provided in the Appendix. Figure 4: Comparison of detection performance across models before and after CoT prompting. Figure 4 shows that CoT yields consistent improvements across all tested models, con- firming that compositional reasoning over dis- tributed components is the operative bottle- neck. The pattern is consistent across families: CoT yields non-trivial gains on weaker base- lines, diminishing returns on stronger base- lines, and a substantial gap remains to post- training, suggesting that compositional safety reasoning is internalizable but not reliably elic- itable through prompting alone. This moti- vates the training-based approach below. 8 Preprint. Figure 5: Detection accuracy on DIH-T after post- training across five model scales. Figure 6: Detection accuracy on real-world videos before and after post-training. 5.5ENHANCING DIH DETECTION VIA POST-TRAINING Since CoT prompting yields only limited gains, we next investigate whether the missing capability can be acquired through post-training on the chain-of-thought annotations of the DIH Dataset. We post-train Qwen3.5 at five scales from 0.8B to 27B in two stages: supervised fine-tuning (SFT) on the Reasoning Analyst’s chain-of-thought annotations from the DIH training split, followed by Group Relative Policy Optimization (GRPO) (Shao et al., 2024) from the SFT checkpoint. We adopt the standard GRPO objective with KL regularization and a composite reward, r i = 0.5R reason (o i ) + 0.3R bin (o i ) + 0.15R cat (o i ) + 0.05R format (o i ),(1) whereR reason is the LLM-as-a-judge score on the compositional reasoning,R bin andR cat verify the predicted safety verdict and harm category, andR format rewards complete structured outputs. The full GRPO objective, reward definitions, format constraints, and hyperparameters are provided in the Appendix. Figure 5 reports detection accuracy on DIH-T across the five models. SFT alone substantially improves Harm. accuracy at every scale, approaching the level of the strongest zero-shot baselines. GRPO gains then scale with the strength of the SFT initialization: marginal on the smallest backbones (where weak priors yield low intra-group reward variance and thus uninformative advantages), but substantial at≥9B. Ben. accuracy is preserved across all scales. We further evaluate the post-trained models on our real-world reference set. As shown in Figure 6, Un- safe detection accuracy rises sharply after post-training while Safe accuracy is preserved, confirming that the compositional reasoning learned on DIH generalizes to in-the-wild distributions. 5.6ABLATION STUDIES Ablation on Frame Numbers. To study how the number of input frames affects DIH detection, we conduct an ablation on the DIH-T data, varying the number of uniformly sampled frames from 2 to 64 on three representative models: Gemini 3.1 Pro, GPT-4o, and Qwen2.5-VL-72B-Instruct. As shown in Figure 7(a), accuracy rises sharply when the frame count is below 8, after which the effect of frame count becomes very small. FromN=8toN=64, the largest change across the three models is only1.7%, indicating that the visual information the models use for judgment is already sufficient. Adding more frames does not yield further gains, and in some cases mildly degrades performance, suggesting that beyond a certain point the additional frames inject redundant visual context that can dilute rather than aid the model’s reasoning over the relevant segments. Frame count is therefore not what limits DIH detection. (a) Effect of frame count.(b) Effect of input resolution. Figure 7: Ablation studies. Ablation on Resolution.We further investigate the effect of resolution on DIH detection by downsam- pling the DIH-T inputs at resolutions ranging from 240Pto1080Pand testing the same three models. Figure 7(b) shows that accuracy stabilizes from480P, with no measurable gain at higher resolutions. This is consistent with how DIH harm arises: it is carried by the relational composition of distributed components rather than by fine-grained pixel-level cues, so reso- lution beyond a moderate threshold contributes little to detection. Together with the frame-count ablation, 9 Preprint. this places the bottleneck in compositional reasoning over already-perceived components, not in perceiving them. 6CONCLUSION We present the first systematic study of Distributed Implicit Harm (DIH), a previously overlooked but practically important challenge for multimodal video safety, where harmful meaning emerges only through the composition of individually benign components. To enable large-scale study of this problem, we develop a scalable multi-agent synthesis pipeline and construct the DIH Dataset and DIH-Bench, covering both temporally distributed (DIH-T) and cross-modal (DIH-M) harm with structured reasoning annotations. Our experiments reveal a substantial and consistent gap in current MLLMs’ ability to detect such compositional harm, and the same failure mode persists on real-world social media videos, indicating that DIH is not merely a synthetic artifact. We further show that targeted post-training on the DIH Dataset substantially improves DIH detection without degrading performance on benign content, establishing a strong baseline for compositional video safety. Several directions remain for future work. First, DIH may arise along many other axes of video composition, such as speaker, viewpoint, and on-screen text, and extending our formulation beyond temporal and cross-modal settings is a natural next step. Second, whether a composition constitutes DIH may depend on social and cultural context, motivating future work on incorporating such contextual knowledge into both benchmark design and data generation. Finally, an important systems direction is to integrate DIH-aware reasoning into real-time moderation pipelines for scalable deployment on streaming and social media platforms. 10 Preprint. REFERENCES Anthropic.Introducing claude sonnet 4.5, 2025.https://w.anthropic.com/news/ claude-sonnet-4-5. Anthropic.Introducing claude opus 4.6, 2026a.https://w.anthropic.com/news/ claude-opus-4-6. Anthropic.Introducing claude sonnet 4.6, 2026b.https://w.anthropic.com/news/ claude-sonnet-4-6. Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, et al. Qwen2.5-vl technical report. arXiv preprint arXiv:2502.13923, 2025a. Shuai Bai, Peng Wang, Keqin Chen, Sinan Tan, Shijie Wang, et al. Qwen3-vl technical report. arXiv preprint arXiv:2511.21631, 2025b. Davide Caffagni, Federico Cocchi, Luca Barsellotti, Nicholas Moratelli, Sara Sarto, Lorenzo Baraldi, Marcella Cornia, and Rita Cucchiara. The revolution of multimodal large language models: A survey. In Findings of the Association for Computational Linguistics: ACL 2024, 2024. Wei Cai, Jian Zhao, Yuchu Jiang, Tianle Zhang, and Xuelong Li. Safe semantics, unsafe interpretations: Tackling implicit reasoning safety in large vision-language models. In ACM International Conference on Multimedia, 2025. Zhaorun Chen, Francesco Pinto, Minzhou Pan, and Bo Li. Safewatch: An efficient safety-policy following video guardrail model with transparent explanations. In International Conference on Learning Representations, 2025. Zhe Chen, Jiannan Wu, Wenhai Wang, Weijie Su, Guo Chen, et al. Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024. Jianfeng Chi, Ujjwal Karn, Hongyuan Zhan, Eric Smith, Javier Rando, et al. Llama guard 3 vision: Safeguarding human-ai image understanding conversations. arXiv preprint arXiv:2411.10414, 2024. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arXiv preprint arXiv:2507.06261, 2025. Josef Dai, Tianle Chen, Xuyao Wang, Ziran Yang, Taiye Chen, Jiaming Ji, and Yaodong Yang. Safesora: Towards safety alignment of text2video generation via a human preference dataset. In Advances in Neural Information Processing Systems, 2024. Google DeepMind. Gemini 3.1 pro, 2025a. https://deepmind.google/models/gemini/pro/. Google DeepMind. Gemini 3 flash, 2025b. https://deepmind.google/models/gemini/flash/. Google DeepMind. Veo 3 and 3.1, 2025c. https://aistudio.google.com/models/veo-3. Xuhao Hu, Dongrui Liu, Hao Li, Xuanjing Huang, and Jing Shao. Vlsbench: Unveiling visual leakage in multimodal safety. arXiv preprint arXiv:2411.19939, 2024. Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, et al. Beavertails: Towards improved safety alignment of llm via a human-preference dataset. In Advances in Neural Information Processing Systems, 2023. Kuaishou. Kling, 2024. https://app.klingai.com/cn. Bo Li, Yuanhan Zhang, Dong Guo, Renrui Zhang, Feng Li, Hao Zhang, Kaichen Zhang, Yanwei Li, Ziwei Liu, and Chunyuan Li. Llava-onevision: Easy visual task transfer. Transactions on Machine Learning Research, 2025. Feng Li, Renrui Zhang, Hao Zhang, Yuanhan Zhang, Bo Li, et al. Llava-next-interleave: Tackling multi-image, video, and 3d in large multimodal models. arXiv preprint arXiv:2407.07895, 2024a. Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. In European Conference on Computer Vision, 2024b. 11 Preprint. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, et al. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, 2024. Xuannan Liu, Zekun Li, Zheqi He, Peipei Li, Shuhan Xia, Xing Cui, Huaibo Huang, Xi Yang, and Ran He. Video-safetybench: A benchmark for safety evaluation of video lvlms. In Advances in Neural Information Processing Systems, 2025. Xingyu Lu, Tianke Zhang, Chang Meng, Xiaobei Wang, Jinpeng Wang, YiFan Zhang, Shisong Tang, Changyi Liu, Haojie Ding, Kaiyu Jiang, Kaiyu Tang, Bin Wen, Hai-Tao Zheng, Fan Yang, Tingting Gao, Di Zhang, and Kun Gai. Vlm as policy: Common-law content moderation framework for short video platform. In ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2025. Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. Jailbreakv: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. In Conference on Language Modeling, 2024. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. In International Conference on Machine Learning, 2024. MiniMax. Hailuo ai, 2025. https://hailuoai.video/. OpenAI. Openai usage policy, 2023. https://openai.com/policies/usage-policies. OpenAI. Sora: Creating video from text, 2024a. https://openai.com/sora. OpenAI. Gpt-4o, 2024b. https://openai.com/index/hello-gpt-4o. OpenAI. Gpt-5, 2025a. https://openai.com/index/introducing-gpt-5/. OpenAI.Openai omni-moderation, 2025b.https://platform.openai.com/docs/guides/ moderation. OpenAI. Introducing gpt-5.4, 2026. https://openai.com/index/introducing-gpt-5-4/. Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, et al. Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300, 2024. Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, et al. Gemini: A family of highly capable multimodal models. arXiv preprint arXiv:2312.11805, 2023. Qwen Team. Qwen3.5: Towards native multimodal agents, 2026.https://qwen.ai/blog?id=qwen3. 5. Haoqin Tu, Chenhang Cui, Zijun Wang, Yiyang Zhou, Bingchen Zhao, et al. How many unicorns are in this image? a safety evaluation benchmark for vision llms. In European Conference on Computer Vision, 2024. Bertie Vidgen, Adarsh Agrawal, Ahmed M Ahmed, Victor Akinwande, Namir Al-Nuaimi, et al. Introducing v0.5 of the ai safety benchmark from mlcommons. arXiv preprint arXiv:2404.12241, 2024. Weiyun Wang, Zhangwei Gao, Lixin Gu, Hengjun Pu, Long Cui, et al. Internvl3.5: Advancing open-source multimodal models in versatility, reasoning, and efficiency. arXiv preprint arXiv:2508.18265, 2025a. Yi Wang, Kunchang Li, Xinhao Li, Jiashuo Yu, Yinan He, et al. Internvideo2: Scaling foundation models for multimodal video understanding. In European Conference on Computer Vision, 2024. Yi Wang, Xinhao Li, Ziang Yan, Yinan He, Jiashuo Yu, et al. Internvideo2.5: Empowering video mllms with long and rich context modeling. arXiv preprint arXiv:2501.12386, 2025b. Yixu Wang, Jiaxin Song, Yifeng Gao, Xin Wang, Yang Yao, Yan Teng, Xingjun Ma, Yingchun Wang, and Yu-Gang Jiang. Safevid: Toward safety aligned video large multimodal models. In Advances in Neural Information Processing Systems, 2025c. Zixuan Wang, Jinghao Shi, Hanzhong Liang, Xiang Shen, Vera Wen, Zhiqian Chen, Yifan Wu, Zhixin Zhang, and Hongyu Xiong. Filter-and-refine: A mllm based cascade system for industrial-scale video content moderation. In Annual Meeting of the Association for Computational Linguistics: Industry Track, 2025d. Jin Xu, Zhifang Guo, Jinzheng He, Hangrui Hu, Ting He, et al. Qwen2.5-omni technical report. arXiv preprint arXiv:2503.20215, 2025a. 12 Preprint. Jin Xu, Zhifang Guo, Hangrui Hu, Yunfei Lin, Xian Yang, et al. Qwen3-omni technical report. arXiv preprint arXiv:2509.17765, 2025b. Zihui Xue, Mi Luo, and Kristen Grauman. Seeing the arrow of time in large multimodal models. In Advances in Neural Information Processing Systems, 2025. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388, 2025. Yuan Yao, Tianyu Yu, Ao Zhang, Chongyi Wang, Junbo Cui, et al. Minicpm-v: A gpt-4v level mllm on your phone. arXiv preprint arXiv:2408.01800, 2024. Jiabo Ye, Haiyang Xu, Haowei Liu, Anwen Hu, Ming Yan, et al. mplug-owl3: Towards long image-sequence un- derstanding in multi-modal large language models. In International Conference on Learning Representations, 2025. Chen Yeh, You-Ming Chang, Wei-Chen Chiu, and Ning Yu. T2vs meet vlms: A scalable multimodal dataset for visual harmfulness recognition. In Advances in Neural Information Processing Systems, 2024. Wenjun Zeng, Dana Kurniawan, Ryan Mullins, Yuchi Liu, Tamoghna Saha, Dirichi Ike-Njoku, Jindong Gu, Yiwen Song, Cai Xu, Jingjing Zhou, Aparna Joshi, Shravan Dheep, Mani Malek, Hamid Palangi, Joon Baek, Rick Pereira, and Karthik Narasimhan. Shieldgemma 2: Robust and tractable image content moderation. arXiv preprint arXiv:2504.01081, 2025. Boqiang Zhang, Kehan Li, Zesen Cheng, Zhiqiang Hu, Yuqian Yuan, et al. Videollama 3: Frontier multimodal foundation models for image and video understanding. arXiv preprint arXiv:2501.13106, 2025. Duzhen Zhang, Yahan Yu, Jiahua Dong, Chenxing Li, Dan Su, Chenhui Chu, and Dong Yu. Mm-llms: Recent advances in multimodal large language models. In Findings of the Association for Computational Linguistics: ACL 2024, 2024a. Hang Zhang, Xin Li, and Lidong Bing. Video-llama: An instruction-tuned audio-visual language model for video understanding. In Conference on Empirical Methods in Natural Language Processing: System Demonstrations, 2023. Jingyi Zhang, Jiaxing Huang, Sheng Jin, and Shijian Lu. Vision-language models for vision tasks: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(8):5625–5644, 2024b. Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Anderson Compalas, Dawn Song, and Xin Eric Wang. Multimodal situational safety. In International Conference on Learning Representations, 2025. 13

Instant research discovery