提出无需知道问题的视觉攻击，让大模型对任意问题都答错。
QAVA: Query-Agnostic Visual Attack to Large Vision-Language Models
- 设计不依赖具体问题的对抗样本，攻击更通用
- 在未知问题下仍能实现与已知问题攻击相当的效果
- 揭示大模型在实际场景中的新安全漏洞
在典型多模态任务如视觉问答（VQA）中，针对特定图像和问题的对抗攻击可使大型视觉语言模型（LVLMs）给出错误答案。然而，一张图像常对应多个问题，即使被特定问题攻击，模型仍可能正确回答其他问题。为此，我们提出查询无关的视觉攻击（QAVA），旨在生成对未指定、未知问题均导致错误响应的鲁棒对抗样本。相比传统针对特定图像与问题的攻击，QAVA显著提升了在问题未知时的攻击效果与效率，性能接近针对已知目标问题的攻击。本研究拓展了实际场景中对LVLMs的视觉对抗攻击范围，揭示了此前被忽视的安全隐患。代码已公开于 https://github.com/btzyd/qava。
原文摘要 · Abstract (English)
In typical multimodal tasks, such as Visual Question Answering (VQA), adversarial attacks targeting a specific image and question can lead large vision-language models (LVLMs) to provide incorrect answers. However, it is common for a single image to be associated with multiple questions, and LVLMs may still answer other questions correctly even for an adversarial image attacked by a specific question. To address this, we introduce the query-agnostic visual attack (QAVA), which aims to create robust adversarial examples that generate incorrect responses to unspecified and unknown questions. Compared to traditional adversarial attacks focused on specific images and questions, QAVA significantly enhances the effectiveness and efficiency of attacks on images when the question is unknown, achieving performance comparable to attacks on known target questions. Our research broadens the scope of visual adversarial attacks on LVLMs in practical settings, uncovering previously overlooked vulnerabilities, particularly in the context of visual adversarial threats. The code is available at https://github.com/btzyd/qava.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。