Malicious Image Analysis via Vision-Language Segmentation Fusion: Detection, Element, and Location in One-shot

TL;DR

This paper presents a zero-shot vision-language segmentation method for detecting, identifying, and localizing malicious objects in images with high accuracy and robustness, aiding fine-grained moderation of illicit visual content.

Contribution

The authors introduce a novel one-pass pipeline combining foundation segmentation and vision-language models for fine-grained malicious content detection and localization, with ensemble robustness against attacks.

Findings

Achieves 85.8% element-level recall and 78.1% precision on malicious content detection.

Outperforms direct zero-shot VLM localization by 27.4% recall at similar precision.

Demonstrates robustness with less than 10% performance drop under adversarial attacks.

Abstract

Detecting illicit visual content demands more than image-level NSFW flags; moderators must also know what objects make an image illegal and where those objects occur. We introduce a zero-shot pipeline that simultaneously (i) detects if an image contains harmful content, (ii) identifies each critical element involved, and (iii) localizes those elements with pixel-accurate masks - all in one pass. The system first applies foundation segmentation model (SAM) to generate candidate object masks and refines them into larger independent regions. Each region is scored for malicious relevance by a vision-language model using open-vocabulary prompts; these scores weight a fusion step that produces a consolidated malicious object map. An ensemble across multiple segmenters hardens the pipeline against adaptive attacks that target any single segmentation method. Evaluated on a newly-annotated 790-image dataset spanning drug, sexual, violent and extremist content, our method attains 85.8% element-level recall, 78.1% precision and a 92.1% segment-success rate - exceeding direct zero-shot VLM localization by 27.4% recall at comparable precision. Against PGD adversarial perturbations crafted to break SAM and VLM, our method's precision and recall decreased by no more than 10%, demonstrating high robustness against attacks. The full pipeline processes an image in seconds, plugs seamlessly into existing VLM workflows, and constitutes the first practical tool for fine-grained, explainable malicious-image moderation.