We introduce a new type of indirect, cross-modal injection attacks against visual language models that enable creation of self-interpreting images. These images contain hidden "meta-instructions" that control how models answer users' questions about the image and steer models' outputs to express an adversary-chosen style, sentiment, or point of view.
Self-interpreting images act as soft prompts, conditioning the model to satisfy the adversary's (meta-)objective while still producing answers based on the image's visual content. Meta-instructions are thus a stronger form of prompt injection. Adversarial images look natural and the model's answers are coherent and plausible, yet they also follow the adversary-chosen interpretation, e.g., political spin, or even objectives that are not achievable with explicit text instructions.
We evaluate the efficacy of self-interpreting images for a variety of models, interpretations, and user prompts. We describe how these attacks could cause harm by enabling creation of self-interpreting content that carries spam, misinformation, or spin. Finally, we discuss defenses.
Ohio State University（俄亥俄州立大学）；Rutgers University（罗格斯大学）；Linux Foundation（Linux基金会）；University of Manchester（曼彻斯特大学）；Columbia University（哥伦比亚大学）；McGill University（麦吉尔大学）
RAEDiff: Denoising Diffusion Probabilistic Models Based Reversible Adversarial Examples Self-Generation and Self-Recovery
The School of Cyberspace Security, Hainan University（海南大学网络空间安全学院）；Science and Technology Communication Department of Hainan Provincial Public Security Department（海南省公安厅科技通信处）
SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentation
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；Nanyang Technological University（南洋理工大学）；National University of Singapore（新加坡国立大学）；Sun Yat-sen University（中山大学）
Detection of Adversarial Supports in Few-shot Classifiers Using Self-Similarity and Filtering
ST Engineering-SUTD Cyber Security Laboratory（ST Engineering-新加坡科技设计大学网络安全实验室）；Singapore University of Technology and Design（新加坡科技设计大学）；Ben-Gurion University（本-古里安大学）；University of Oslo（奥斯陆大学）
Boosting Generative Adversarial Transferability with Self-supervised Vision Transformer Features
School of Cyberspace Science and Technology, Beijing Institute of Technology（网络安全科学与技术学院，北京理工大学）；School of Computer Science and Technology, Beijing Institute of Technology（计算机科学与技术学院，北京理工大学）
