arXiv:2606.15608cs.CV2026-06被引 1

首次系统评估多模态大模型作为评判者时的对抗脆弱性,揭示其易被欺骗并提出新攻击方法。

On the Adversarial Robustness of Multimodal LLM Judges

论文配图:On the Adversarial Robustness of Multimodal LLM Judges
图 1 · 摘自论文原文
  • 提出MGSIA攻击法,结合语义诱导与高分流形对齐实现高效欺骗
  • 实验证明多模态模型评判者极易被提升分数的对抗攻击误导
  • 适用于图像质量与安全评估场景,适合研究评测系统安全性的学者

多模态大语言模型(MLLMs)正被广泛用于自动评判图像质量与安全性,但其对抗鲁棒性尚未充分研究,威胁评测公平性与可靠性。为此,我们提出RobustMLLMJudge——首个通用框架,用于评估通用型MLLM在充当评判者时的对抗鲁棒性,涵盖多种攻击类型及典型评判场景。实验发现:(i)不同MLLM评判者对提升评分的对抗攻击高度脆弱;(ii)尽管现有攻击有效,但受限于评判协议的独特约束。为此,我们提出MGSIA(Manifold-Guided Semantic Induction Attack),核心思想是将肯定性语义诱导与高分流形对齐相结合:最大化模型对二元语义问题给出“是”类响应的概率,同时将对抗表示正则化至由代理协议估计的高分中心。该方法生成具有强迁移性的评分提升扰动。大量实验表明MGSIA在多种场景下均能有效欺骗先进MLLM评判者,凸显构建鲁棒评判系统的必要性。代码与数据将公开于https://github.com/mala-lab/RobustMLLMJudge。

原文摘要 · Abstract (English)

Multimodal Large Language Models (MLLMs) are increasingly used as automated judges, e.g., for image quality and safety assessment. However, their adversarial robustness remains largely unexplored, threatening the fairness and reliability of automated judging. To bridge this gap, we introduce RobustMLLMJudge, the first general framework for evaluating the adversarial robustness of general-purpose MLLMs when functioning as judges. It covers diverse attacks against popular judge approaches across quality and safety evaluation scenarios. Using RobustMLLMJudge, we reveal that i) different MLLM judges are highly vulnerable to score-inflating adversarial attacks; and ii) although effective, these attack methods face a critical challenge due to unique constraints in the evaluation protocols of MLLM judges. We further propose MGSIA, namely Manifold-Guided Semantic Induction Attack, a novel method that bypasses these constraints to enable more effective and transferable attacks on MLLM judges. The core idea of MGSIA is to combine affirmative semantic induction with high-score manifold alignment: it maximizes the probability that judges yield affirmative responses (e.g., "Yes") to binary semantic queries, while regularizing adversarial representations toward high-score centers estimated from proxy protocols. Together, these objectives yield transferable score-inflating perturbations. Extensive experiments demonstrate the superiority and generalizability of MGSIA in deceiving advanced MLLM judges under different evaluation scenarios, highlighting the need for robust MLLM judges. Code and data will be made available at https://github.com/mala-lab/RobustMLLMJudge.

多模态对抗攻击大模型评测安全性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。