打破视觉感知：针对大视觉语言模型编码视觉令牌的对抗性攻击
Break the Visual Perception: Adversarial Attacks Targeting Encoded Visual Tokens of Large Vision-Language Models
AI总结：
针对大视觉语言模型视觉模块的鲁棒性问题，提出仅需访问图像编码器的非定向VT-Attack方法，从多维度破坏视觉令牌，实验证明其攻击性能优于基线，可为模型鲁棒性提升提供指导。
摘要：
大视觉语言模型（LVLMs）将视觉信息整合到大语言模型中，展现出卓越的多模态对话能力。然而，视觉模块为LVLMs的鲁棒性带来了新挑战：攻击者可制作视觉上干净的对抗图像，误导模型生成错误答案。通常而言，LVLMs依赖视觉编码器将图像转换为视觉令牌，这对语言模型有效感知图像内容至关重要。因此，我们好奇一个问题：当编码后的视觉令牌遭到攻击、视觉信息被破坏时，LVLMs还能否生成正确响应？为此，我们提出一种名为VT-Attack（视觉令牌攻击）的非定向攻击方法，该方法从多个角度构建对抗样本，旨在全面破坏图像编码器输出的视觉令牌的特征表示、内在关联及语义属性。所提攻击仅需访问图像编码器，生成的对抗样本在使用同一图像编码器的各类LVLMs间具有迁移性，且在不同任务间具备通用性。大量实验验证了VT-Attack相比基线方法更优的攻击性能，证明了其在攻击带图像编码器的LVLMs方面的有效性，这反过来能为LVLMs的鲁棒性，尤其是视觉特征空间的稳定性提供指导。
英文摘要：
Large vision-language models (LVLMs) integrate visual information into large language models, showcasing remarkable multi-modal conversational capabilities. However, the visual modules introduces new challenges in terms of robustness for LVLMs, as attackers can craft adversarial images that are visually clean but may mislead the model to generate incorrect answers. In general, LVLMs rely on vision encoders to transform images into visual tokens, which are crucial for the language models to perceive image contents effectively. Therefore, we are curious about one question: Can LVLMs still generate correct responses when the encoded visual tokens are attacked and disrupting the visual information? To this end, we propose a non-targeted attack method referred to as VT-Attack (Visual Tokens Attack), which constructs adversarial examples from multiple perspectives, with the goal of comprehensively disrupting feature representations and inherent relationships as well as the semantic properties of visual tokens output by image encoders. Using only access to the image encoder in the proposed attack, the generated adversarial examples exhibit transferability across diverse LVLMs utilizing the same image encoder and generality across different tasks. Extensive experiments validate the superior attack performance of the VT-Attack over baseline methods, demonstrating its effectiveness in attacking LVLMs with image encoders, which in turn can provide guidance on the robustness of LVLMs, particularly in terms of the stability of the visual feature space.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
