通过操控注意力机制，让大模型无视安全指令生成有害内容。
Seeing No Evil: Blinding Large Vision-Language Models to Safety Instructions via Adversarial Attention Hijacking
- 直接干扰注意力分配，避开安全机制的对抗性攻击
- 在Qwen-VL上实现94.4%攻击成功率，迭代次数减少40%
- 适用于研究模型安全漏洞或对抗攻击的人员
大型视觉语言模型（LVLMs）依赖基于注意力的检索机制来维持生成过程中的对齐。现有攻击通常优化图像扰动以最大化有害输出概率，但因对抗目标与模型安全检索机制间的梯度冲突，导致收敛缓慢。本文提出注意力引导的视觉越狱方法，不强行突破安全对齐，而是直接操纵注意力模式。该方法引入两个简单辅助目标：(1)抑制对对齐相关前缀令牌的注意力；(2)将生成锚定在对抗性图像特征上。这一简洁有效的推拉式设计使梯度冲突降低45%，在Qwen-VL上实现94.4%的攻击成功率（基线为68.8%），迭代次数减少40%。在更严格的扰动预算（ε=8/255）下，仍保持59.0%的攻击成功率，优于标准方法的45.7%。机制分析揭示一种称为“安全盲区”的失效模式：成功攻击会使系统提示注意力下降80%，导致模型并非主动违背规则，而是未能检索到安全指令。
原文摘要 · Abstract (English)
Large Vision-Language Models (LVLMs) rely on attention-based retrieval of safety instructions to maintain alignment during generation. Existing attacks typically optimize image perturbations to maximize harmful output likelihood, but suffer from slow convergence due to gradient conflict between adversarial objectives and the model's safety-retrieval mechanism. We propose Attention-Guided Visual Jailbreaking, which circumvents rather than overpowers safety alignment by directly manipulating attention patterns. Our method introduces two simple auxiliary objectives: (1) suppressing attention to alignment-relevant prefix tokens and (2) anchoring generation on adversarial image features. This simple yet effective push-pull formulation reduces gradient conflict by 45% and achieves 94.4% attack success rate on Qwen-VL (vs. 68.8% baseline) with 40% fewer iterations. At tighter perturbation budgets ($ε=8/255$), we maintain 59.0% ASR compared to 45.7% for standard methods. Mechanistic analysis reveals a failure mode we term safety blindness: successful attacks suppress system-prompt attention by 80%, causing models to generate harmful content not by overriding safety rules, but by failing to retrieve them.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。