测试大模型在图像隐私泄露上的脆弱性，发现主流模型易泄露个人信息。
VisualLeakBench: Auditing the Fragility of Large Vision-Language Models against PII Leakage and Social Engineering
- 构建1000张合成对抗图像，覆盖8类敏感信息，评估视觉语言模型隐私风险。
- Claude 4虽误识别率低（14.2%），但个人身份信息泄露率达74.4%，先泄露后警告。
- 防御提示可显著降低部分模型泄露，但效果依赖具体场景，真实图像表现更优。
随着大型视觉语言模型（LVLMs）在智能体工作流等实际场景中广泛应用，其对语义视觉攻击的鲁棒性仍缺乏充分评估——现有测试多聚焦于显式有害内容，而非隐私敏感的多模态场景。本文提出VisualLeakBench，一个评估套件，通过1,000张合成对抗图像（涵盖8类个人身份信息，PII）检测OCR注入与上下文隐私泄露问题，并在50张真实世界截图（IRL）上验证。评估了四个前沿系统（GPT-5.2、Claude~4、Gemini-3 Flash、Grok-4），使用威尔逊95%置信区间。结果表明：Claude~4的OCR错误率最低（14.2%），但PII泄露率最高（74.4%），呈现“先披露后警告”模式；Grok-4的PII泄露率最低（20.4%）。引入防御提示可消除两个模型的泄露，使Claude~4从74.4%降至2.2%，但对Gemini-3 Flash在合成数据上无效。令人惊讶的是，真实图像验证显示，该提示能使Gemini-3 Flash的泄露从50%降至0%，说明缓解策略的鲁棒性取决于具体模板，而非普遍失效。论文开源数据集与代码，支持可复现的部署级视觉语言系统安全评估。
原文摘要 · Abstract (English)
As Large Vision-Language Models (LVLMs) are increasingly deployed in agent-integrated workflows and other deployment-relevant settings, their robustness against semantic visual attacks remains under-evaluated -- alignment is typically tested on explicit harmful content rather than privacy-critical multimodal scenarios. We introduce VisualLeakBench, an evaluation suite to audit LVLMs against OCR Injection and Contextual PII Leakage using 1,000 synthetically generated adversarial images with 8 PII types, validated on 50 in-the-wild (IRL) real-world screenshots spanning diverse visual contexts. We evaluate four frontier systems (GPT-5.2, Claude~4, Gemini-3 Flash, Grok-4) with Wilson 95% confidence intervals. Claude~4 achieves the lowest OCR ASR (14.2%) but the highest PII ASR (74.4%), exhibiting a comply-then-warn pattern -- where verbatim data disclosure precedes any safety-oriented language. Grok-4 achieves the lowest PII ASR (20.4%). A defensive system prompt eliminates PII leakage for two models, reduces Claude~4's leakage from 74.4% to 2.2%, but has no effect on Gemini-3 Flash on synthetic data. Strikingly, IRL validation reveals Gemini-3 Flash does respond to mitigation on real-world images (50% to 0%), indicating that mitigation robustness is template-sensitive rather than uniformly absent. We release our dataset and code for reproducible robustness and safety evaluation of deployment-relevant vision-language systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。