arXiv 2305.169342023-10-29cs.CVcs.CLcs.CRcs.LGcs.MM

关于大型视觉-语言模型对抗鲁棒性的评估

On Evaluating Adversarial Robustness of Large Vision-Language Models

Tsinghua University（清华大学）；Renmin University of China（中国人民大学）；Sea AI Lab, Singapore（新加坡Sea AI实验室）；Singapore University of Technology and Design（新加坡科技设计大学）

Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Cheung, Min Lin

备注：: NeurIPS 2023

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文通过黑盒设置下制作并迁移针对CLIP、BLIP的对抗样本，评估了MiniGPT-4、LLaVA等大型视觉-语言模型的对抗鲁棒性，揭示了其高成功率的目标响应生成漏洞，并呼吁部署前加强安全审查。

摘要：

大型视觉-语言模型（VLMs）如GPT-4在响应生成方面取得了前所未有的性能，尤其是在视觉输入下，使得比ChatGPT等大型语言模型更具创造性和适应性的交互成为可能。然而，多模态生成加剧了安全担忧，因为对手可能通过微妙地操纵最脆弱的模态（例如视觉）来成功规避整个系统。为此，我们提出在最现实和高风险的设置下评估开源大型VLMs的鲁棒性，其中对手仅拥有黑盒系统访问权限，并试图欺骗模型返回目标响应。特别是，我们首先针对预训练模型如CLIP和BLIP制作有针对性的对抗样本，然后将这些对抗样本迁移到其他VLMs，如MiniGPT-4、LLaVA、UniDiffuser、BLIP-2和Img2Prompt。此外，我们观察到对这些VLMs的黑盒查询可以进一步提高目标规避的有效性，从而在生成目标响应方面取得令人惊讶的高成功率。我们的发现为大型VLMs的对抗脆弱性提供了定量理解，并呼吁在实际部署之前对其潜在安全缺陷进行更彻底的检查。代码位于https://github.com/yunqing-me/AttackVLM。

英文摘要：

Large vision-language models (VLMs) such as GPT-4 have achieved unprecedented performance in response generation, especially with visual inputs, enabling more creative and adaptable interaction than large language models such as ChatGPT. Nonetheless, multimodal generation exacerbates safety concerns, since adversaries may successfully evade the entire system by subtly manipulating the most vulnerable modality (e.g., vision). To this end, we propose evaluating the robustness of open-source large VLMs in the most realistic and high-risk setting, where adversaries have only black-box system access and seek to deceive the model into returning the targeted responses. In particular, we first craft targeted adversarial examples against pretrained models such as CLIP and BLIP, and then transfer these adversarial examples to other VLMs such as MiniGPT-4, LLaVA, UniDiffuser, BLIP-2, and Img2Prompt. In addition, we observe that black-box queries on these VLMs can further improve the effectiveness of targeted evasion, resulting in a surprisingly high success rate for generating targeted responses. Our findings provide a quantitative understanding regarding the adversarial vulnerability of large VLMs and call for a more thorough examination of their potential security flaws before deployment in practice. Code is at https://github.com/yunqing-me/AttackVLM.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。