通过交替图文攻击逐步突破视觉语言模型的安全防护，成功率提升15%-30%。
Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models
- 每轮交替使用文本和图像进行攻击，激发更恶意响应
- 多轮迭代优化攻击路径，逐步放大输出恶意程度
- 适用于测试大模型安全漏洞，研究者可快速复现
多轮越狱攻击在纯文本大语言模型中已证明有效，但将其拓展至视觉语言模型（LVLM）仍缺乏深入探索。本文发现，直接引入视觉内容易触发安全对齐机制，导致模型反应过于保守。为此提出多轮自适应提示攻击（MAPA），其核心设计包括：1）每轮交替采用文本与视觉攻击动作，以激发最恶意响应；2）跨轮次通过双向迭代精炼攻击轨迹，逐步增强输出恶意性。该双层结构使MAPA在多个前沿基准上持续优于现有方法，对LLaVA-v1.6-Mistral-7B、Qwen2.5-VL-7B-Instruct、Llama-3.2-Vision-11B-Instruct和GPT-4o-mini的攻击成功率提升15%-30%。代码已开源：https://github.com/thomaschoi143/MAPA。
原文摘要 · Abstract (English)
Multi-turn jailbreak attacks have proven effective against text-only large language models (LLMs), where malicious content is gradually introduced to bypass safety alignment. However, effectively extending such attacks to large vision-language models (LVLMs) remains underexplored. In this paper, we find that naively incorporating visual inputs can make multi-turn jailbreaks easier to defend against; for example, overly malicious visual content will easily trigger the defense mechanism in safety-aligned LVLMs, resulting in more conservative responses. Based on this finding, we propose multi-turn adaptive prompting attack (MAPA) that 1) at each turn, alternates text-vision attack actions to elicit the most malicious response; and 2) across turns, adjusts the attack trajectory through iterative back-and-forth refinement to gradually amplify response maliciousness. This two-level design enables MAPA to consistently outperform state-of-the-art methods, improving attack success rates by 15-30% on recent benchmarks against LLaVA-v1.6-Mistral-7B, Qwen2.5-VL-7B-Instruct, Llama-3.2-Vision-11B-Instruct and GPT-4o-mini. Our code is available at: https://github.com/thomaschoi143/MAPA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。