通过优化视觉风格触发词，显著提升多模态模型越狱攻击成功率。
Adversarial Style Optimization: Enhancing VLM Jailbreaks by GRPO-based Stylistic Triggers Optimization
- 基于分组相对策略优化，自动生成能绕过安全机制的视觉风格
- 在多个主流模型上使攻击成功率提升至90%以上
- 适合红队测试、安全评估人员快速发现模型盲点
多模态大语言模型虽性能优异，但安全对齐仍易受越狱攻击影响。现有内容驱动型攻击存在不一致且效果不佳的问题，难以利用非内容类漏洞。我们实证发现，多模态模型在理解能力与安全防御间存在风格不一致性：模型对视觉风格变化鲁棒，但特定风格可轻易绕过安全机制。为此提出对抗风格优化（ASO），一个即插即用的增强模块，通过GRPO代理与结构化分层奖励函数，微调图像编辑模型在对抗图像上叠加最优风格扰动。该奖励函数融合基于logit的拒绝检测信号与强大判别模型的高保真语义评估。大量实验表明，ASO显著提升当前最先进攻击的攻击成功率，证明风格偏差是可扩展的红队测试向量。代码已开源。
原文摘要 · Abstract (English)
Multimodal Large Language Models (MLLMs) have achieved impressive performance, but their safety alignment remains vulnerable to jailbreak attacks. Existing content-based jailbreaks are often inconsistent and show unsatisfying performance against the rapidly evolving MLLMs, failing to exploit non-content-based vulnerabilities. Unlike previous research, we empirically find that MLLMs exhibit a Stylistic Inconsistency between their comprehension ability and safety ability: MLLMs can robustly understand content regardless of visual style, yet their defense mechanisms can be easily bypassed by specific stylistic triggers. Based on this finding, we propose Adversarial Style Optimization (ASO), a plug-and-play enhancement module to amplify existing visual jailbreaks. ASO fine-tunes an image-editing model to superimpose an optimized stylistic modification onto a given adversarial image, using a Group Relative Policy Optimization (GRPO) agent guided by a Structurally-Tiered Reward Function that combines a logit-based signal for detecting explicit refusals with a high-fidelity semantic evaluation from a powerful judge model. Extensive experiments show that ASO significantly enhances the ASR of SOTA attacks, demonstrating that stylistic biases are a scalable vector for red-teaming MLLMs. Our code is available at https://github.com/bingjunluo/ASO.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。