用图像模态分离危险内容,绕过文本生成模型的安全过滤。
Multimodal Prompt Decoupling Attack on the Safety Filters in Text-to-Image Models
- 通过大语言模型将不安全提示拆分为看似安全和有害两部分。
- 利用自然对抗性提示引导模型生成NSFW图像,成功绕过安全过滤。
- 结合视觉语言模型迭代优化,保持图像与原始提示语义一致。
文本到图像(T2I)模型在多个领域广泛应用,但可能被滥用生成不适宜工作场合(NSFW)内容。现有越狱方法主要针对文本提示,忽视了图像输入的潜在漏洞。为此,我们提出多模态提示解耦攻击(MPDA),利用图像模态将原始不安全提示中的有害语义成分分离。MPDA包含三个核心步骤:首先,大语言模型(LLM)将不安全提示分解为看似安全的子提示和含有不安全语义的子提示;前者可绕过过滤器,后者触发过滤机制。其次,LLM将有害提示重写为自然对抗性提示,引导T2I模型将基础图像修改为NSFW输出。最后,视觉语言模型生成图像描述,为LLM提供新路径以迭代重写和优化生成内容,确保生成图像与原始不安全提示的语义一致性。
原文摘要 · Abstract (English)
Text-to-image (T2I) models have been widely applied in generating high-fidelity images across various domains. However, these models may also be abused to produce Not-Safe-for-Work (NSFW) content via jailbreak attacks. Existing jailbreak methods primarily manipulate the textual prompt, leaving potential vulnerabilities in image-based inputs largely unexplored. Moreover, text-based methods face challenges in bypassing the model's safety filters. In response to these limitations, we propose the Multimodal Prompt Decoupling Attack (MPDA), which utilizes image modality to separate the harmful semantic components of the original unsafe prompt. MPDA follows three core steps: firstly, a large language model (LLM) decouples unsafe prompts into pseudo-safe prompts and harmful prompts. The former are seemingly harmless sub-prompts that can bypass filters, while the latter are sub-prompts with unsafe semantics that trigger filters. Subsequently, the LLM rewrites the harmful prompts into natural adversarial prompts to bypass safety filters, which guide the T2I model to modify the base image into an NSFW output. Finally, to ensure semantic consistency between the generated NSFW images and the original unsafe prompts, the visual language model generates image captions, providing a new pathway to guide the LLM in iterative rewriting and refining the generated content.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。