模糊测试遇上基于LLM的智能体：一种针对文本到图像生成模型越狱的自动化高效框架
Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models
AI总结：
本文提出JailFuzzer，一种由LLM智能体驱动的模糊测试框架，通过种子池、引导式变异引擎和判定函数在黑盒设置下高效生成自然的越狱提示词，以最小查询开销实现高成功率的T2I模型越狱攻击。
摘要：
文本到图像（T2I）生成模型通过将文本描述转化为高质量图像，彻底改变了内容创作。然而，这些模型容易受到越狱攻击，精心构造的提示词会绕过安全机制生成不安全内容。尽管研究人员开发了多种越狱攻击方法来揭示这一风险，但这些方法面临显著局限，包括不切实际的访问要求、易被检测的不自然提示词、受限的搜索空间以及对目标系统的高查询需求。本文提出JailFuzzer，一种由大语言模型（LLM）智能体驱动的新型模糊测试框架，旨在黑盒设置下高效生成自然且语义有意义的越狱提示词。具体而言，JailFuzzer采用模糊测试原理，包含三个组件：用于初始和越狱提示词的种子池、用于生成有意义变体的引导式变异引擎，以及评估越狱成功的判定函数。此外，我们通过基于LLM的智能体构建引导式变异引擎和判定函数，进一步确保了黑盒环境下的效率与适应性。大量实验表明，JailFuzzer在越狱T2I模型方面具有显著优势。它生成自然且语义连贯的提示词，降低了被传统防御检测的可能性。此外，它以最少的查询开销实现了高成功率的越狱攻击，在所有关键指标上均优于现有方法。本研究强调了生成模型需要更强安全机制的必要性，并为未来防御复杂越狱攻击的研究奠定基础。JailFuzzer已开源，仓库地址：https://github.com/YingkaiD/JailFuzzer。
英文摘要：
Text-to-image (T2I) generative models have revolutionized content creation by transforming textual descriptions into high-quality images. However, these models are vulnerable to jailbreaking attacks, where carefully crafted prompts bypass safety mechanisms to produce unsafe content. While researchers have developed various jailbreak attacks to expose this risk, these methods face significant limitations, including impractical access requirements, easily detectable unnatural prompts, restricted search spaces, and high query demands on the target system. In this paper, we propose JailFuzzer, a novel fuzzing framework driven by large language model (LLM) agents, designed to efficiently generate natural and semantically meaningful jailbreak prompts in a black-box setting. Specifically, JailFuzzer employs fuzz-testing principles with three components: a seed pool for initial and jailbreak prompts, a guided mutation engine for generating meaningful variations, and an oracle function to evaluate jailbreak success. Furthermore, we construct the guided mutation engine and oracle function by LLM-based agents, which further ensures efficiency and adaptability in black-box settings. Extensive experiments demonstrate that JailFuzzer has significant advantages in jailbreaking T2I models. It generates natural and semantically coherent prompts, reducing the likelihood of detection by traditional defenses. Additionally, it achieves a high success rate in jailbreak attacks with minimal query overhead, outperforming existing methods across all key metrics. This study underscores the need for stronger safety mechanisms in generative models and provides a foundation for future research on defending against sophisticated jailbreaking attacks. JailFuzzer is open-source and available at this repository: https://github.com/YingkaiD/JailFuzzer.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
