通过噪声扰动与聚类聚合提升多模态模型抗攻击能力
SmoothGuard: Defending Multimodal Large Language Models with Noise Perturbation and Clustering Aggregation
- 对图像等连续模态注入高斯噪声，生成多个候选输出
- 基于嵌入聚类筛选出多数一致的预测结果，提升稳定性
- 适用于各类多模态大模型，尤其适合安全敏感场景
多模态大语言模型（MLLM）在联合处理文本与视觉输入时表现出色，但对对抗性攻击仍极为脆弱，影响其部署安全性。本文首先在HuggingFace生态中推广了一种生成对抗图像的方法，并提出SmoothGuard，一种轻量且模型无关的防御框架。该方法对图像、音频等连续模态注入高斯噪声，生成多个候选输出，并利用基于嵌入的聚类技术过滤受攻击影响的预测结果。最终答案从多数簇中选取，确保在恶意扰动下仍能保持稳定响应。在POPE、LLaVA-Bench（In-the-Wild）和MM-SafetyBench上的大量实验表明，SmoothGuard显著提升了模型对对抗攻击的鲁棒性，同时保持了良好实用性。消融实验进一步识别出最优噪声范围（0.1-0.2），在鲁棒性与性能间取得平衡。
原文摘要 · Abstract (English)
Multimodal large language models (MLLMs) have achieved impressive performance across diverse tasks by jointly reasoning over textual and visual inputs. Despite their success, these models remain highly vulnerable to adversarial manipulations, raising concerns about their safety and reliability in deployment. In this work, we first generalize an approach for generating adversarial images within the HuggingFace ecosystem and then introduce SmoothGuard, a lightweight and model-agnostic defense framework that enhances the robustness of MLLMs through randomized noise injection and clustering-based prediction aggregation. Our method perturbs continuous modalities (e.g., images and audio) with Gaussian noise, generates multiple candidate outputs, and applies embedding-based clustering to filter out adversarially influenced predictions. The final answer is selected from the majority cluster, ensuring stable responses even under malicious perturbations. Extensive experiments on POPE, LLaVA-Bench (In-the-Wild), and MM-SafetyBench demonstrate that SmoothGuard improves resilience to adversarial attacks while maintaining competitive utility. Ablation studies further identify an optimal noise range (0.1-0.2) that balances robustness and utility.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。