用连续优化生成可绕过多模态模型的攻击图像。
Gradient-based Jailbreak Images for Multimodal Fusion Models
- 设计令牌化捷径，实现图像的端到端梯度攻击
- 72.5%提示下诱发出有害信息，效率比文本攻击高3倍
- 适用于研究对抗攻击与防御迁移的从业者
将图像输入引入语言模型可能通过连续优化引发更有效的越狱攻击，而文本输入需离散优化。然而，新型多模态融合模型使用非可微函数对所有模态进行分词，阻碍了直接攻击。本文提出一种分词器捷径，以连续函数近似分词过程，实现连续优化。基于此，我们首次构建针对多模态融合模型的端到端梯度图像攻击。在Chameleon模型上评估显示，72.5%的提示可被诱导输出有害内容。该图像越狱攻击优于相同目标下的文本越狱，且优化时计算开销低3倍，可处理50倍更多输入标记。此外，仅在文本攻击上训练的表示工程防御（如Circuit Breakers）能有效迁移至对抗性图像输入。
原文摘要 · Abstract (English)
Augmenting language models with image inputs may enable more effective jailbreak attacks through continuous optimization, unlike text inputs that require discrete optimization. However, new multimodal fusion models tokenize all input modalities using non-differentiable functions, which hinders straightforward attacks. In this work, we introduce the notion of a tokenizer shortcut that approximates tokenization with a continuous function and enables continuous optimization. We use tokenizer shortcuts to create the first end-to-end gradient image attacks against multimodal fusion models. We evaluate our attacks on Chameleon models and obtain jailbreak images that elicit harmful information for 72.5% of prompts. Jailbreak images outperform text jailbreaks optimized with the same objective and require 3x lower compute budget to optimize 50x more input tokens. Finally, we find that representation engineering defenses, like Circuit Breakers, trained only on text attacks can effectively transfer to adversarial image inputs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。