VL-Trojan：针对自回归视觉语言模型的多模态指令后门攻击
VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models
AI总结：
本文提出VL-Trojan多模态指令后门攻击，通过隔离聚类学习图像触发器和迭代字符级文本触发器生成，在自回归视觉语言模型上实现高效黑盒攻击，ASR超越基线62.52%，并具备跨模型规模和少样本场景的鲁棒性。
摘要：
自回归视觉语言模型（VLMs）在多模态场景中展现出令人印象深刻的少样本学习能力。最近，多模态指令微调被提出以进一步增强指令遵循能力。然而，我们揭示了在指令微调期间针对自回归VLM的后门攻击所带来的潜在威胁。攻击者可以通过注入带有嵌入在指令或图像中的触发器的中毒样本来植入后门，从而能够利用预定义触发器恶意操纵受害模型的预测。然而，自回归VLM中冻结的视觉编码器对传统图像触发器的学习施加了约束。此外，攻击者在访问受害模型的参数和架构方面可能面临限制。为应对这些挑战，我们提出了一种多模态指令后门攻击，即VL-Trojan。我们的方法通过隔离和聚类策略促进图像触发器学习，并通过迭代的字符级文本触发器生成方法增强黑盒攻击效果。我们的攻击在推理过程中成功诱导目标输出，在ASR上显著超越基线（+62.52%）。此外，它在各种模型规模和少样本上下文推理场景中表现出鲁棒性。
英文摘要：
Autoregressive Visual Language Models (VLMs) showcase impressive few-shot learning capabilities in a multimodal context. Recently, multimodal instruction tuning has been proposed to further enhance instruction-following abilities. However, we uncover the potential threat posed by backdoor attacks on autoregressive VLMs during instruction tuning. Adversaries can implant a backdoor by injecting poisoned samples with triggers embedded in instructions or images, enabling malicious manipulation of the victim model's predictions with predefined triggers. Nevertheless, the frozen visual encoder in autoregressive VLMs imposes constraints on the learning of conventional image triggers. Additionally, adversaries may encounter restrictions in accessing the parameters and architectures of the victim model. To address these challenges, we propose a multimodal instruction backdoor attack, namely VL-Trojan. Our approach facilitates image trigger learning through an isolating and clustering strategy and enhance black-box-attack efficacy via an iterative character-level text trigger generation method. Our attack successfully induces target outputs during inference, significantly surpassing baselines (+62.52\%) in ASR. Moreover, it demonstrates robustness across various model scales and few-shot in-context reasoning scenarios.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
