提出推理时评估与对齐安全的新框架，有效防御视觉攻击。
ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time
- 分两阶段在推理时评估输入与输出，建立多模态安全感知。
- 降低87.5%跨模态攻击下的不安全率，GPT-4评测中96.6%胜平。
- 适合关注多模态模型安全的开发者与研究者。
视觉语言模型（VLMs）已成为多模态智能的核心，但安全挑战限制其实际应用。尽管文本输入常被有效防护，对抗性视觉输入却易绕过防御机制。现有方法或资源消耗大，或无法同时保障安全性与响应有用性。为此，我们提出一种新的推理时对齐框架ETA：1）评估输入视觉内容与输出响应，建立多模态环境下的安全意识；2）通过干扰前缀控制生成分布，并结合句级best-of-N搜索最安全且有用的生成路径，在浅层与深层实现行为对齐。大量实验表明，ETA在无害性、有用性和效率上均优于基线方法，在跨模态攻击下不安全率降低87.5%，在GPT-4有用性评估中达到96.6%胜平。代码已公开于https://github.com/DripNowhy/ETA。
原文摘要 · Abstract (English)
Vision Language Models (VLMs) have become essential backbones for multimodal intelligence, yet significant safety challenges limit their real-world application. While textual inputs are often effectively safeguarded, adversarial visual inputs can easily bypass VLM defense mechanisms. Existing defense methods are either resource-intensive, requiring substantial data and compute, or fail to simultaneously ensure safety and usefulness in responses. To address these limitations, we propose a novel two-phase inference-time alignment framework, Evaluating Then Aligning (ETA): 1) Evaluating input visual contents and output responses to establish a robust safety awareness in multimodal settings, and 2) Aligning unsafe behaviors at both shallow and deep levels by conditioning the VLMs' generative distribution with an interference prefix and performing sentence-level best-of-N to search the most harmless and helpful generation paths. Extensive experiments show that ETA outperforms baseline methods in terms of harmlessness, helpfulness, and efficiency, reducing the unsafe rate by 87.5% in cross-modality attacks and achieving 96.6% win-ties in GPT-4 helpfulness evaluation. The code is publicly available at https://github.com/DripNowhy/ETA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。