AV-SafetyBench: A Safety Benchmark for Text-to-Audio-Video Generation
Suah Choi, Tae-Young Lee, Gyeong-Moon Park
cs.CV · cs.AI
Quick verdict
Claims first T2AV safety benchmark with 5,200 prompts and three-view judging; well-validated but absolute rates are judge-dependent and single-seed.
Summary
The paper introduces AV-SafetyBench, presented as the first safety benchmark for text-to-audio-video (T2AV) generation. It provides 5,200 manually reviewed prompts across a four-axis, 13-category taxonomy derived from provider usage policies and prior image/video/audio safety benchmarks, including a Cross-Modal Harm Emergence category whose prompts are benign in each track alone. Evaluation runs each generated clip through three judge views (Full-AV, Video-Only, Audio-Only) with Gemini 3.5 Flash, then attributes Full-AV unsafe outputs to four risk sources. On a 780-prompt stratified subset, five open-source T2AV models (LTX-2.3, Ovi-1.1, JavisDiT++, NAVA, daVinci) yield Full-AV Unsafe Rates of 25.1–49.4%; for four models, Audio-Only plus AV-Joint cases — missed by video-only evaluation — constitute 41.6–48.3% of assigned unsafe outputs, and AV-Joint covers 87.5% of attributed unsafe outputs in Cross-Modal Harm Emergence. Human validation (30 annotators, majority vote over 3,900 clips) gives mean Cohen's κ of 0.762, judge precision 91.4%, recall 86.8%. Limitations: only the Full-AV view is human-validated; absolute rates are strongly judge-dependent (open judges report 70.5–89.4%); per-cell rates lack confidence intervals; each prompt is generated once; benchmark and code are promised only upon publication/acceptance, and clips will not be released.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- AV-SafetyBench is the first safety benchmark designed specifically for T2AV generation, pairing 5,200 manually reviewed prompts in a four-axis, 13-category taxonomy with a three-view judging protocol.
- The protocol attributes each Full-AV unsafe output to one of four risk sources (Video-Only, Audio-Only, AV-Both, AV-Joint), quantifying what single-modality evaluation misses.
- For four of five open-source T2AV models, Audio-Only plus AV-Joint cases account for 41.6–48.3% of assignable unsafe outputs; in Cross-Modal Harm Emergence, AV-Joint covers 87.5% under the Gemini judge (61.2–87.5% across judges).
- Full-AV Unsafe Rates range from 25.1% to 49.4% across the five models, and automated judgments align with 30-annotator majority labels (mean κ 0.762; precision 91.4%, recall 86.8%).
- Low FUR cannot be read as stronger safeguards because it also reflects unrealized capabilities, notably speech and likeness generation (Table A13, Figures A6–A7).
Strengths
Novel and well-posed evaluation problem
The three-view protocol (§3.3) decomposes each Full-AV unsafe output into Video-Only, Audio-Only, AV-Both, or AV-Joint sources — the first protocol to measure what video-only T2V evaluation structurally misses; risk-source assignment covers 98.9–100% of unsafe outputs (Table A8).
Protocol choices empirically defended, conservative direction chosen
Table A4 shows three-pass judging yields 471 monotonicity violations (isolated view unsafe while Full-AV safe) vs 0 for single-pass; the single-pass figures, which report the smaller AV-Joint share (5.8% vs 13.0%), are used in the main text.
Capability-confound analysis distinguishes safeguards from generation failure
Unusually thorough judge-sensitivity and subset validation
AV-Joint validity argued from three independent angles
Weaknesses
The central novel measurement is only half-validated
Headline numbers are judge-relative but presented as absolute
Single generation per prompt, no variance estimates
One taxonomy category largely fails to measure its target
Availability and commercial coverage are thin
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
AV-SafetyBench (arXiv 2609.06991, Korea University) claims to be the first safety benchmark purpose-built for text-to-audio-video (T2AV) generation. Its three headline claims: (1) a resource — 5,200 manually reviewed prompts across a four-axis, 13-category taxonomy grounded in OpenAI/Google/Anthropic/Meta usage policies and prior benchmarks (I2P, T2VSafetyBench, TTA-Bench); (2) a method — a three-view protocol (Full-AV, Video-Only, Audio-Only) that assigns each unsafe output a risk source (Video-Only, Audio-Only, AV-Both, AV-Joint); (3) an empirical finding — video-only evaluation misses 41.6–48.3% of assignable unsafe outputs for four of five open models, and AV-Joint covers 87.5% of attributed unsafe outputs in Cross-Modal Harm Emergence. All three are in scope for a benchmark paper, and the problem framing is genuinely new: T2VSafetyBench judges silent video, TTA-Bench judges audio in isolation, and neither captures audiovisual interaction.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is AV-SafetyBench?
It is presented as the first safety benchmark built specifically for text-to-audio-video (T2AV) generation: 5,200 manually reviewed prompts spanning a 13-category risk taxonomy (four axes), plus an evaluation protocol that judges each generated clip from three views — full audio-video, video-only, and audio-only — and attributes unsafe outputs to the track or track combination carrying the harm.
Why does video-only safety evaluation miss unsafe T2AV outputs?
Because harm can be carried entirely by generated speech or sound (e.g., a fabricated news claim over a benign visual) or arise only when visual and audio are interpreted together (e.g., targeted mockery). The paper measures this: for four of five evaluated open-source models, 41.6–48.3% of assignable unsafe outputs would be missed by video-only judging.
Which T2AV models were evaluated and how unsafe were their outputs?
Five open-source models — LTX-2.3, Ovi-1.1, JavisDiT++, NAVA, and daVinci — on a 780-prompt stratified subset (one clip per prompt). Full-AV unsafe rates under the Gemini 3.5 Flash judge ranged from 25.1% (JavisDiT++) to 49.4% (LTX-2.3). Commercial models (Veo 3.1, Seedance 2.0) received only a small 9–12 prompt case study.
Is the AV-SafetyBench dataset or code available?
Not yet at the time of the paper: the 5,200 prompts and per-clip judgments are promised under CC BY 4.0 upon publication, evaluation code upon acceptance, and the generated clips will not be released. Reproducing results also requires the paid Gemini 3.5 Flash judge API and GPUs (an H200 was used for generation).
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The standalone metadata abstract is cut off mid-sentence, but the complete abstract is fully present at the start of the extracted paper text, so no content was lost to truncation.
- Figure panels (Figure 1a, A6–A14) are available only through captions and described content in the text extraction; the visual quality of the generated examples themselves could not be inspected.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.