攻击者可用特定图像在推理时操控多模态大模型的输出偏好。
Phi: Preference Hijacking in Multi-modal Large Language Models at Inference Time
- 通过精心设计的图像，在不修改模型的前提下操纵模型响应偏好。
- 攻击可跨任务通用，生成看似合理但带有偏见的输出结果。
- 适合关注AI安全、对抗攻击的研究者与系统开发者参考。
多模态大语言模型（MLLMs）在多个领域受到广泛关注，但其广泛应用也引发了严重安全问题。本文揭示了一种新型安全风险：攻击者可通过精心优化的图像，在推理阶段任意操控MLLM的输出偏好。此类攻击生成的回复在语境上合理，但存在偏见，既非明显有害也非伦理违规，因而难以检测。我们提出一种名为偏好劫持（Preference Hijacking, Phi）的新方法，利用偏好劫持图像在推理时干扰模型输出。该方法无需修改模型，且引入了一种通用劫持扰动——可嵌入不同图像中的可迁移组件，使模型响应向攻击者指定的偏好倾斜。跨多种任务的实验验证了该方法的有效性。相关代码已开源：https://github.com/Yifan-Lan/Phi。
原文摘要 · Abstract (English)
Recently, Multimodal Large Language Models (MLLMs) have gained significant attention across various domains. However, their widespread adoption has also raised serious safety concerns. In this paper, we uncover a new safety risk of MLLMs: the output preference of MLLMs can be arbitrarily manipulated by carefully optimized images. Such attacks often generate contextually relevant yet biased responses that are neither overtly harmful nor unethical, making them difficult to detect. Specifically, we introduce a novel method, Preference Hijacking (Phi), for manipulating the MLLM response preferences using a preference hijacked image. Our method works at inference time and requires no model modifications. Additionally, we introduce a universal hijacking perturbation -- a transferable component that can be embedded into different images to hijack MLLM responses toward any attacker-specified preferences. Experimental results across various tasks demonstrate the effectiveness of our approach. The code for Phi is accessible at https://github.com/Yifan-Lan/Phi.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。