通过关闭特定注意力头，让CLIP模型免疫文字攻击，无需重新训练。
Dyslexify: A Mechanistic Defense Against Typographic Attacks in CLIP
- 定位并关闭模型中传递文字信息的关键注意力头
- 在图像分类任务上提升22.06%抗攻击性能，主任务损失<1%
- 适合医疗等安全敏感场景，可直接替换现有模型
文字攻击通过向图像注入文本，导致多模态系统误分类、生成恶意内容甚至触发视觉语言模型越狱。本文分析了CLIP视觉编码器在文字攻击下的行为，发现模型后半部分的若干注意力头会因果性地提取并传递文字信息至分类标记。基于此，提出Dyslexify防御方法：通过选择性移除包含这些注意力头的“文字回路”来抵御攻击。该方法无需微调，在ImageNet-100的文字变体数据集上性能提升最高达22.06%，标准ImageNet-100准确率下降不足1%，并在皮肤病变诊断的医疗基础模型中验证了有效性。所提出的无训练防御方案在对抗性鲁棒性上媲美依赖微调的前沿方法。为此，我们发布了系列抗文字攻击的Dyslexic CLIP模型，可直接用于对文本操纵风险敏感的安全关键应用。
原文摘要 · Abstract (English)
Typographic attacks exploit multi-modal systems by injecting text into images, leading to targeted misclassifications, malicious content generation and even Vision-Language Model jailbreaks. In this work, we analyze how CLIP vision encoders behave under typographic attacks, locating specialized attention heads in the latter half of the model's layers that causally extract and transmit typographic information to the cls token. Building on these insights, we introduce Dyslexify - a method to defend CLIP models against typographic attacks by selectively ablating a typographic circuit, consisting of attention heads. Without requiring finetuning, dyslexify improves performance by up to 22.06% on a typographic variant of ImageNet-100, while reducing standard ImageNet-100 accuracy by less than 1%, and demonstrate its utility in a medical foundation model for skin lesion diagnosis. Notably, our training-free approach remains competitive with current state-of-the-art typographic defenses that rely on finetuning. To this end, we release a family of dyslexic CLIP models which are significantly more robust against typographic attacks. These models serve as suitable drop-in replacements for a broad range of safety-critical applications, where the risks of text-based manipulation outweigh the utility of text recognition.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。