为文生图模型设计防御机制，抵御参数可被篡改的攻击者。
Patronus: Safeguarding Text-to-Image Models against White-Box Adversaries
- 内置安全调节器，识别有害特征并置零，不影响正常生成。
- 采用不可微调的学习机制，防止恶意微调导致模型失控。
- 在多种攻击下仍保持生成安全内容的能力，适合高风险场景使用。
文生图（T2I）模型虽具强大创造力，但可能被用于生成不安全图像。现有安全措施如内容审核或模型对齐，在白盒攻击者知晓并可调整模型参数（如通过微调）时失效。本文提出新型防御框架Patronus，为T2I模型提供全面防护。我们设计内部调节器，将有害输入特征解码为零向量，同时保证良性输入的生成性能；并通过精心设计的非微调学习机制强化模型对齐，确保模型不会因恶意微调而被攻破。大量实验验证了其在安全内容生成上的性能完整性，以及拒绝生成不安全内容的有效性。结果还表明，Patronus能有效抵御各类白盒微调攻击。
原文摘要 · Abstract (English)
Text-to-image (T2I) models, though exhibiting remarkable creativity in image generation, can be exploited to produce unsafe images. Existing safety measures, e.g., content moderation or model alignment, fail in the presence of white-box adversaries who know and can adjust model parameters, e.g., by fine-tuning. This paper presents a novel defensive framework, named Patronus, which equips T2I models with holistic protection to defend against white-box adversaries. Specifically, we design an internal moderator that decodes unsafe input features into zero vectors while ensuring the decoding performance of benign input features. Furthermore, we strengthen the model alignment with a carefully designed non-fine-tunable learning mechanism, ensuring the T2I model will not be compromised by malicious fine-tuning. We conduct extensive experiments to validate the intactness of the performance on safe content generation and the effectiveness of rejecting unsafe content generation. Results also confirm the resilience of Patronus against various fine-tuning attacks by white-box adversaries.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。