通过分析模型内部状态，无需微调即可检测视觉语言模型的越狱攻击。
HiddenDetect: Detecting Jailbreak Attacks against Large Vision-Language Models via Monitoring Hidden States
- 监控模型推理时的隐藏状态变化，识别不安全输入
- 在多个数据集上检测准确率优于现有方法
- 适合关注多模态模型安全性的研究者和开发者
视觉语言大模型（LVLM）因融合多模态信息，相比纯语言模型更易遭受越狱攻击等安全威胁。现有研究多聚焦于事后对齐技术，而模型内部的安全机制仍不明确。本文探究了LVLM在推理过程中是否内在编码安全相关信号。实验发现，处理不安全提示时，模型激活模式存在显著差异，可被用于检测与防御恶意输入，且无需额外微调。基于此，我们提出HiddenDetect——一种无需调优的框架，利用模型内部激活实现安全增强。实验证明，该方法在多个基准上超越当前最优方案，能高效、可扩展地提升LVLM对多模态攻击的鲁棒性。代码将公开于https://github.com/leigest519/HiddenDetect。
原文摘要 · Abstract (English)
The integration of additional modalities increases the susceptibility of large vision-language models (LVLMs) to safety risks, such as jailbreak attacks, compared to their language-only counterparts. While existing research primarily focuses on post-hoc alignment techniques, the underlying safety mechanisms within LVLMs remain largely unexplored. In this work , we investigate whether LVLMs inherently encode safety-relevant signals within their internal activations during inference. Our findings reveal that LVLMs exhibit distinct activation patterns when processing unsafe prompts, which can be leveraged to detect and mitigate adversarial inputs without requiring extensive fine-tuning. Building on this insight, we introduce HiddenDetect, a novel tuning-free framework that harnesses internal model activations to enhance safety. Experimental results show that {HiddenDetect} surpasses state-of-the-art methods in detecting jailbreak attacks against LVLMs. By utilizing intrinsic safety-aware patterns, our method provides an efficient and scalable solution for strengthening LVLM robustness against multimodal threats. Our code will be released publicly at https://github.com/leigest519/HiddenDetect.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。