arXiv 2504.013082025-08-02cs.CV

保护视觉-语言模型：缓解基于扰动的攻击中对高斯噪声的脆弱性

Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks

University of Science and Technology of China（中国科学技术大学）；The Hong Kong Polytechnic University（香港理工大学）；University of Washington（华盛顿大学）；Nanjing University（南京大学）；Stanford University（斯坦福大学）；University of Chinese Academy of Sciences（中国科学院大学）

Jiawei Wang, Yushen Zuo, Yuanjun Chai, Zhendong Liu, Yicheng Fu, Yichun Feng, Kin-Man Lam

备注：: ICCV 2025

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

针对视觉-语言模型易受高斯噪声等扰动攻击的漏洞，提出Robust-VLGuard数据集与噪声增强微调，并利用扩散模型DiffPure-VLM转化对抗扰动，显著降低攻击成功率。

摘要：

视觉-语言模型（VLMs）通过整合视觉信息扩展了大语言模型（LLMs）的能力，但它们仍然容易受到越狱攻击，尤其是在处理嘈杂或损坏的图像时。尽管现有的视觉-语言模型在训练期间采取了安全措施来缓解此类攻击，但与噪声增强的视觉输入相关的漏洞却被忽视了。在这项工作中，我们指出缺少噪声增强训练会导致严重的安全漏洞：许多视觉-语言模型甚至容易受到诸如高斯噪声之类的简单扰动的影响。为了解决这一挑战，我们提出了Robust-VLGuard，一个包含对齐/不对齐图像-文本对的多模态安全数据集，并结合噪声增强微调，在降低攻击成功率的同时保持视觉-语言模型的功能。对于更强的基于优化的视觉扰动攻击，我们提出了DiffPure-VLM，利用扩散模型将对抗性扰动转换为类似高斯噪声的扰动，这可以通过具有噪声增强安全微调的视觉-语言模型进行防御。实验结果表明，扩散模型的分布转移特性与我们微调的视觉-语言模型很好地契合，显著缓解了不同强度下的对抗性扰动。数据集和代码可在https://github.com/JarvisUSTC/DiffPure-RobustVLM获取。

英文摘要：

Vision-Language Models (VLMs) extend the capabilities of Large Language Models (LLMs) by incorporating visual information, yet they remain vulnerable to jailbreak attacks, especially when processing noisy or corrupted images. Although existing VLMs adopt security measures during training to mitigate such attacks, vulnerabilities associated with noise-augmented visual inputs are overlooked. In this work, we identify that missing noise-augmented training causes critical security gaps: many VLMs are susceptible to even simple perturbations such as Gaussian noise. To address this challenge, we propose Robust-VLGuard, a multimodal safety dataset with aligned / misaligned image-text pairs, combined with noise-augmented fine-tuning that reduces attack success rates while preserving functionality of VLM. For stronger optimization-based visual perturbation attacks, we propose DiffPure-VLM, leveraging diffusion models to convert adversarial perturbations into Gaussian-like noise, which can be defended by VLMs with noise-augmented safety fine-tuning. Experimental results demonstrate that the distribution-shifting property of diffusion model aligns well with our fine-tuned VLMs, significantly mitigating adversarial perturbations across varying intensities. The dataset and code are available at https://github.com/JarvisUSTC/DiffPure-RobustVLM.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。