PBI-Attack：面向毒性最大化的先验引导双模态交互式黑盒越狱攻击
PBI-Attack: Prior-Guided Bimodal Interactive Black-Box Jailbreak Attack for Toxicity Maximization
AI总结：
针对现有大视觉语言模型越狱攻击依赖梯度或人工知识、未考虑多模态交互且黑盒场景效果差的问题，提出PBI-Attack黑盒越狱方法，通过先验特征嵌入和双模态交互优化提升毒性，在开源和闭源模型上均取得更高攻击成功率。
摘要：
理解大视觉语言模型（LVLMs）在越狱攻击下的脆弱性，对其负责任的现实部署至关重要。以往大多数研究需要获取模型梯度，或是基于人工知识（提示工程）完成越狱，且几乎未考虑图像与文本的交互，导致无法在黑盒场景下实现越狱，或是攻击效果不佳。为克服这些局限，我们提出一种面向毒性最大化的先验引导双模态交互式黑盒越狱攻击，简称PBI-Attack。我们的方法首先借助一个替代LVLM从有害语料库中提取恶意特征，并将这些特征作为先验信息嵌入到良性图像中。随后，我们通过双向跨模态交互优化增强这些特征——该过程通过贪心搜索以交替方式迭代优化双模态扰动，旨在最大化生成响应的毒性。毒性水平通过一个训练良好的评估模型进行量化。实验表明，PBI-Attack的性能优于以往的最优越狱方法：在三个开源LVLM上平均攻击成功率达92.5%，在三个闭源LVLM上约为67.3%。免责声明：本文包含可能令人不适及具有冒犯性的内容。
英文摘要：
Understanding the vulnerabilities of Large Vision Language Models (LVLMs) to jailbreak attacks is essential for their responsible real-world deployment. Most previous work requires access to model gradients, or is based on human knowledge (prompt engineering) to complete jailbreak, and they hardly consider the interaction of images and text, resulting in inability to jailbreak in black box scenarios or poor performance. To overcome these limitations, we propose a Prior-Guided Bimodal Interactive Black-Box Jailbreak Attack for toxicity maximization, referred to as PBI-Attack. Our method begins by extracting malicious features from a harmful corpus using an alternative LVLM and embedding these features into a benign image as prior information. Subsequently, we enhance these features through bidirectional cross-modal interaction optimization, which iteratively optimizes the bimodal perturbations in an alternating manner through greedy search, aiming to maximize the toxicity of the generated response. The toxicity level is quantified using a well-trained evaluation model. Experiments demonstrate that PBI-Attack outperforms previous state-of-the-art jailbreak methods, achieving an average attack success rate of 92.5% across three open-source LVLMs and around 67.3% on three closed-source LVLMs. Disclaimer: This paper contains potentially disturbing and offensive content.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
