HTS-Attack：用于越狱文本到图像模型的启发式令牌搜索
HTS-Attack: Heuristic Token Search for Jailbreaking Text-to-Image Models
AI总结：
提出HTS-Attack启发式令牌搜索方法，通过初始化移除敏感令牌及重组变异搜索，在黑盒条件下有效越狱文本到图像模型，绕过多种防御。
摘要：
文本到图像（T2I）模型在图像生成和编辑方面取得了显著成功，然而这些模型仍存在许多潜在问题，尤其是在生成不适当或不宜工作场所（NSFW）内容方面。加强攻击并揭示此类漏洞可以推动可靠且实用的T2I模型的发展。以往的大多数工作将T2I模型视为白盒系统，利用梯度优化来生成对抗性提示。然而，在现实场景中，访问模型的梯度往往是不可能的。此外，现有的防御方法，如使用梯度掩蔽的方法，旨在防止攻击者获取准确的梯度信息。虽然已有一些黑盒越狱攻击被探索，但由于离散空间中的优化困难，它们在越狱T2I模型方面性能有限。为解决这一问题，我们提出了HTS-Attack，一种启发式令牌搜索攻击方法。HTS-Attack首先通过初始化移除敏感令牌，随后进行启发式搜索，其中表现优异的候选者被重组和变异。此过程生成新的候选池，并根据其有效性更新最优对抗性提示。通过结合最优和次优候选者，HTS-Attack避免了局部最优，并提高了绕过防御的鲁棒性。大量实验验证了我们的方法在攻击最新提示检查器、事后图像检查器、安全训练的T2I模型以及在线商业模型方面的有效性。
英文摘要：
Text-to-Image(T2I) models have achieved remarkable success in image generation and editing, yet these models still have many potential issues, particularly in generating inappropriate or Not-Safe-For-Work(NSFW) content. Strengthening attacks and uncovering such vulnerabilities can advance the development of reliable and practical T2I models. Most of the previous works treat T2I models as white-box systems, using gradient optimization to generate adversarial prompts. However, accessing the model's gradient is often impossible in real-world scenarios. Moreover, existing defense methods, those using gradient masking, are designed to prevent attackers from obtaining accurate gradient information. While several black-box jailbreak attacks have been explored, they achieve the limited performance of jailbreaking T2I models due to difficulties associated with optimization in discrete spaces. To address this, we propose HTS-Attack, a heuristic token search attack method. HTS-Attack begins with an initialization that removes sensitive tokens, followed by a heuristic search where high-performing candidates are recombined and mutated. This process generates a new pool of candidates, and the optimal adversarial prompt is updated based on their effectiveness. By incorporating both optimal and suboptimal candidates, HTS-Attack avoids local optima and improves robustness in bypassing defenses. Extensive experiments validate the effectiveness of our method in attacking the latest prompt checkers, post-hoc image checkers, securely trained T2I models, and online commercial models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
