SceneTAP：面向真实世界环境中视觉语言模型的场景连贯排版对抗规划器
SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environments
AI总结：
本文提出SceneTAP，一种免训练的多模态LLM驱动场景连贯排版对抗规划方法，通过场景理解、对抗规划和无缝集成三阶段生成自然融入场景的对抗文本，在真实环境中有效误导ChatGPT-4o等先进视觉语言模型。
摘要：
大型视觉语言模型（LVLMs）在解释视觉内容方面展现出卓越能力。尽管已有工作表明这些模型容易受到刻意放置的对抗性文本的攻击，但此类文本往往容易被识别为异常。本文首次提出一种生成场景连贯的排版对抗攻击的方法，该方法借助基于LLM的智能体能力，在保持视觉自然性的同时误导先进LVLMs。我们的方法解决三个关键问题：生成什么对抗文本、将其放置在场景中的何处，以及如何无缝集成。我们提出一种免训练、多模态LLM驱动的场景连贯排版对抗规划（SceneTAP），采用三阶段流程：场景理解、对抗规划和无缝集成。SceneTAP利用思维链推理来理解场景、制定有效的对抗文本、策略性地规划其放置位置，并提供在图像内自然集成的详细指令。随后，场景连贯的TextDiffuser利用局部扩散机制执行攻击。我们将方法扩展到真实世界场景，通过在物理环境中打印并放置生成的补丁，展示其实际意义。大量实验表明，即使在拍摄物理装置的新图像后，我们的场景连贯对抗文本仍能成功误导最先进的LVLMs，包括ChatGPT-4o。我们的评估表明，在保持视觉自然性和上下文适当性的同时，攻击成功率显著提高。这项工作揭示了当前视觉语言模型对复杂、场景连贯对抗攻击的脆弱性，并为潜在防御机制提供了见解。
英文摘要：
Large vision-language models (LVLMs) have shown remarkable capabilities in interpreting visual content. While existing works demonstrate these models' vulnerability to deliberately placed adversarial texts, such texts are often easily identifiable as anomalous. In this paper, we present the first approach to generate scene-coherent typographic adversarial attacks that mislead advanced LVLMs while maintaining visual naturalness through the capability of the LLM-based agent. Our approach addresses three critical questions: what adversarial text to generate, where to place it within the scene, and how to integrate it seamlessly. We propose a training-free, multi-modal LLM-driven scene-coherent typographic adversarial planning (SceneTAP) that employs a three-stage process: scene understanding, adversarial planning, and seamless integration. The SceneTAP utilizes chain-of-thought reasoning to comprehend the scene, formulate effective adversarial text, strategically plan its placement, and provide detailed instructions for natural integration within the image. This is followed by a scene-coherent TextDiffuser that executes the attack using a local diffusion mechanism. We extend our method to real-world scenarios by printing and placing generated patches in physical environments, demonstrating its practical implications. Extensive experiments show that our scene-coherent adversarial text successfully misleads state-of-the-art LVLMs, including ChatGPT-4o, even after capturing new images of physical setups. Our evaluations demonstrate a significant increase in attack success rates while maintaining visual naturalness and contextual appropriateness. This work highlights vulnerabilities in current vision-language models to sophisticated, scene-coherent adversarial attacks and provides insights into potential defense mechanisms.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
