VEAttack: 面向大视觉语言模型的下游任务无关视觉编码器攻击
VEAttack: Downstream-agnostic Vision Encoder Attack against Large Vision Language Models
AI总结：
VEAttack是一种针对大视觉语言模型视觉编码器的简单有效攻击方法，通过优化图像令牌降低计算开销，实现对多种下游任务的泛化攻击。
摘要：
大视觉-语言模型（LVLMs）在多模态理解和生成方面展示了显著的能力，但其对对抗攻击的脆弱性引发了重大鲁棒性担忧。尽管现有有效的攻击方法总是专注于任务特定的白盒设置，但这些方法在LVLMs的背景下受到限制，因为LVLMs被设计用于多样化的下游任务，且需要昂贵的完整模型梯度计算。受LVLMs中视觉编码器关键作用和广泛采用的启发，我们提出了一种简单而有效的视觉编码器攻击（VEAttack），专门针对LVLMs的视觉编码器。具体而言，我们通过最小化干净和扰动视觉特征之间的余弦相似性来生成对抗样本，而无需访问后续的大语言模型、任务信息和标签。这显著降低了计算开销，同时消除了传统白盒攻击在LVLMs中的任务和标签依赖性。为了使这种简单攻击有效，我们提出通过优化图像令牌而不是分类令牌来扰动图像。我们提供了实证和理论证据表明，VEAttack可以轻松泛化到各种任务。VEAttack在图像描述任务上实现了94.5%的性能下降，在视觉问答任务上实现了75.7%的性能下降。我们还揭示了一些关键观察结果，为LVLM攻击/防御提供了见解：1）LLM隐藏层变化，2）令牌注意力差异，3）转移攻击中的莫比乌斯带，4）对攻击步骤的低敏感性。代码可在https://github.com/hefeimei06/VEAttack-LVLM上获得。
英文摘要：
Large Vision-Language Models (LVLMs) have demonstrated remarkable capabilities in multimodal understanding and generation, yet their vulnerability to adversarial attacks raises significant robustness concerns. While existing effective attacks always focus on task-specific white-box settings, these approaches are limited in the context of LVLMs, which are designed for diverse downstream tasks and require expensive full-model gradient computations. Motivated by the pivotal role and wide adoption of the vision encoder in LVLMs, we propose a simple yet effective Vision Encoder Attack (VEAttack), which targets the vision encoder of LVLMs only. Specifically, we propose to generate adversarial examples by minimizing the cosine similarity between the clean and perturbed visual features, without accessing the following large language models, task information, and labels. It significantly reduces the computational overhead while eliminating the task and label dependence of traditional white-box attacks in LVLMs. To make this simple attack effective, we propose to perturb images by optimizing image tokens instead of the classification token. We provide both empirical and theoretical evidence that VEAttack can easily generalize to various tasks. VEAttack has achieved a performance degradation of 94.5% on image caption task and 75.7% on visual question answering task. We also reveal some key observations to provide insights into LVLM attack/defense: 1) hidden layer variations of LLM, 2) token attention differential, 3) Möbius band in transfer attack, 4) low sensitivity to attack steps. The code is available at https://github.com/hefeimei06/VEAttack-LVLM.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
