通过跨模态提示注入操纵多模态智能体
Manipulating Multimodal Agents via Cross-Modal Prompt Injection
AI总结：
本文提出 CrossInject 跨模态提示注入框架，通过视觉隐式对齐与文本引导增强劫持多模态智能体决策，攻击成功率较现有方法至少提升 30.1%。
摘要：
多模态大语言模型的出现重新定义了智能体范式：它将语言和视觉模态与外部数据源相集成，使智能体能够更好地理解人类指令并执行日益复杂的任务。然而，本文在多模态智能体中发现了一个关键但此前被忽视的安全漏洞：跨模态提示注入攻击。为利用该漏洞，我们提出 CrossInject，这是一种新型攻击框架，攻击者在其中跨多种模态嵌入对抗性扰动，以与目标恶意内容对齐，从而使外部指令能够劫持智能体的决策过程并执行未经授权的任务。我们的方法包含两个关键的协同组件。首先，我们提出 Visual Latent Alignment（视觉隐式对齐）：基于文本到图像生成模型，在视觉嵌入空间中将对抗性特征优化到恶意指令，确保对抗性图像隐蔽地编码执行恶意任务的线索。随后，我们提出 Textual Guidance Enhancement（文本引导增强）：利用大语言模型，通过对抗性元提示构建黑盒防御系统提示，并生成恶意文本命令，引导智能体输出更好地服从攻击者请求。大量实验表明，我们的方法优于最先进攻击，在多种任务上的攻击成功率至少提升 30.1%。此外，我们在真实世界多模态自主智能体中验证了攻击有效性，凸显其对安全关键应用的潜在影响。
英文摘要：
The emergence of multimodal large language models has redefined the agent paradigm by integrating language and vision modalities with external data sources, enabling agents to better interpret human instructions and execute increasingly complex tasks. However, in this paper, we identify a critical yet previously overlooked security vulnerability in multimodal agents: cross-modal prompt injection attacks. To exploit this vulnerability, we propose CrossInject, a novel attack framework in which attackers embed adversarial perturbations across multiple modalities to align with target malicious content, allowing external instructions to hijack the agent's decision-making process and execute unauthorized tasks. Our approach incorporates two key coordinated components. First, we introduce Visual Latent Alignment, where we optimize adversarial features to the malicious instructions in the visual embedding space based on a text-to-image generative model, ensuring that adversarial images subtly encode cues for malicious task execution. Subsequently, we present Textual Guidance Enhancement, where a large language model is leveraged to construct the black-box defensive system prompt through adversarial meta prompting and generate an malicious textual command that steers the agent's output toward better compliance with attackers' requests. Extensive experiments demonstrate that our method outperforms state-of-the-art attacks, achieving at least a +30.1% increase in attack success rates across diverse tasks. Furthermore, we validate our attack's effectiveness in real-world multimodal autonomous agents, highlighting its potential implications for safety-critical applications.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
