无需攻击数据，用模型内部激活自动检测未知越狱攻击。
Learning to Detect Unseen Jailbreak Attacks in Large Vision-Language Models
- 通过多模态安全概念向量提取模型内部安全表示。
- 在多个LVLM上对未知攻击实现最高检出率（AUROC）。
- 适合安全研究者和模型部署团队快速集成检测能力。
尽管进行了大量对齐工作，大型视觉语言模型（LVLMs）仍易受越狱攻击影响。现有检测方法面临泛化性与准确率双重挑战：基于学习的方法在特定攻击上训练，无法泛化到未见攻击；基于手工规则的无学习方法则准确率有限且效率低下。为此，我们提出可学习的检测框架LoD，完全无需攻击数据或人工设计规则。LoD首先利用多模态安全概念激活向量分类器，从模型各层激活中直接提取安全表征；再通过安全模式自编码器将高维表征压缩为一维异常分数进行检测。大量实验表明，LoD在多个LVLM上对多种未见越狱攻击均实现领先的检测性能（AUROC），同时显著提升效率。代码已开源：https://github.com/ShuangLiangX/Learning-to-Detect。
原文摘要 · Abstract (English)
Despite extensive alignment efforts, Large Vision-Language Models (LVLMs) remain vulnerable to jailbreak attacks. To mitigate these risks, existing detection methods are essential, yet they face two major challenges: generalization and accuracy. While learning-based methods trained on specific attacks fail to generalize to unseen attacks, learning-free methods based on hand-crafted heuristics suffer from limited accuracy and reduced efficiency. To address these limitations, we propose Learning to Detect (LoD), a learnable framework that eliminates the need for any attack data or hand-crafted heuristics. LoD operates by first extracting layer-wise safety representations directly from the model's internal activations using Multi-modal Safety Concept Activation Vectors classifiers, and then converting the high-dimensional representations into a one-dimensional anomaly score for detection via a Safety Pattern Auto-Encoder. Extensive experiments demonstrate that LoD consistently achieves state-of-the-art detection performance (AUROC) across diverse unseen jailbreak attacks on multiple LVLMs, while also significantly improving efficiency. Code is available at https://github.com/ShuangLiangX/Learning-to-Detect.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。