PIP：通过无关探测问题的注意力模式检测大型视觉-语言模型中的对抗样本
PIP: Detecting Adversarial Examples in Large Vision-Language Models via Attention Patterns of Irrelevant Probe Questions
AI总结：
针对大型视觉-语言模型易受对抗样本攻击的问题，本文提出 PIP，利用随机无关探测问题引发的注意力模式并结合 SVM，仅需一次额外推理即可在黑盒和开放数据集场景下高效检测对抗样本。
摘要：
大型视觉-语言模型（LVLMs）已展示出强大的多模态能力。然而，它们也面临严重的安全问题，因为攻击者可以通过精心设计的对抗样本诱发 LVLMs 的鲁棒性问题。因此，LVLMs 迫切需要对抗样本检测工具，以防止错误回答。在本研究中，我们首先发现，当面对探测问题时，LVLMs 对干净图像会表现出规律性的注意力模式。我们提出了一种名为 PIP 的非传统方法，该方法利用一个随机选择的无关探测问题（例如“那里有钟吗？”）的注意力模式，将对抗样本与干净样本区分开来。无论待测图像及其对应问题是什么，PIP 只需对待测图像和探测问题进行一次额外推理，即可成功检测对抗样本。即使在黑盒攻击和开放数据集场景下，我们的 PIP 结合一个简单的 SVM，仍能实现超过 98% 的召回率和超过 90% 的精确率。我们的 PIP 是首次尝试通过简单的无关探测问题检测针对 LVLMs 的对抗攻击，为更深入地理解和内省 LVLMs 提供了启示。代码可在 https://github.com/btzyd/pip 获取。
英文摘要：
Large Vision-Language Models (LVLMs) have demonstrated their powerful multimodal capabilities. However, they also face serious safety problems, as adversaries can induce robustness issues in LVLMs through the use of well-designed adversarial examples. Therefore, LVLMs are in urgent need of detection tools for adversarial examples to prevent incorrect responses. In this work, we first discover that LVLMs exhibit regular attention patterns for clean images when presented with probe questions. We propose an unconventional method named PIP, which utilizes the attention patterns of one randomly selected irrelevant probe question (e.g., "Is there a clock?") to distinguish adversarial examples from clean examples. Regardless of the image to be tested and its corresponding question, PIP only needs to perform one additional inference of the image to be tested and the probe question, and then achieves successful detection of adversarial examples. Even under black-box attacks and open dataset scenarios, our PIP, coupled with a simple SVM, still achieves more than 98% recall and a precision of over 90%. Our PIP is the first attempt to detect adversarial attacks on LVLMs via simple irrelevant probe questions, shedding light on deeper understanding and introspection within LVLMs. The code is available at https://github.com/btzyd/pip.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
