VisCRA：一种用于越狱多模态大语言模型的视觉思维链推理攻击
VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models
AI总结：
本文揭示了多模态大语言模型视觉推理能力提升与越狱脆弱性之间的权衡，并提出 VisCRA 越狱框架，结合视觉注意力掩蔽与两阶段推理诱导策略，在多个领先闭源模型上实现高攻击成功率。
摘要：
多模态大语言模型（MLRMs）的出现通过整合强化学习和思维链（CoT）监督，实现了复杂的视觉推理能力。然而，尽管这些增强的推理能力提升了性能，但也引入了新的且尚未充分探索的安全风险。在这项工作中，我们系统地研究了 MLRMs 中高级视觉推理的安全影响。我们的分析揭示了一个基本的权衡：随着视觉推理能力的提升，模型对越狱攻击的脆弱性也随之增加。受这一关键发现的启发，我们引入了 VisCRA（视觉思维链推理攻击），这是一种新颖的越狱框架，利用视觉推理链来绕过安全机制。VisCRA 将针对性的视觉注意力掩蔽与两阶段推理诱导策略相结合，以精确控制有害输出。大量实验证明了 VisCRA 的显著有效性，在领先的闭源 MLRMs 上实现了高攻击成功率：在 Gemini 2.0 Flash Thinking 上为 76.48%，在 QvQ-Max 上为 68.56%，在 GPT-4o 上为 56.60%。我们的发现强调了一个关键洞察：赋予 MLRMs 能力的核心机制——视觉推理——本身也可以作为一种攻击向量，构成重大的安全风险。
英文摘要：
The emergence of Multimodal Large Language Models (MLRMs) has enabled sophisticated visual reasoning capabilities by integrating reinforcement learning and Chain-of-Thought (CoT) supervision. However, while these enhanced reasoning capabilities improve performance, they also introduce new and underexplored safety risks. In this work, we systematically investigate the security implications of advanced visual reasoning in MLRMs. Our analysis reveals a fundamental trade-off: as visual reasoning improves, models become more vulnerable to jailbreak attacks. Motivated by this critical finding, we introduce VisCRA (Visual Chain Reasoning Attack), a novel jailbreak framework that exploits the visual reasoning chains to bypass safety mechanisms. VisCRA combines targeted visual attention masking with a two-stage reasoning induction strategy to precisely control harmful outputs. Extensive experiments demonstrate VisCRA's significant effectiveness, achieving high attack success rates on leading closed-source MLRMs: 76.48% on Gemini 2.0 Flash Thinking, 68.56% on QvQ-Max, and 56.60% on GPT-4o. Our findings highlight a critical insight: the very capability that empowers MLRMs -- their visual reasoning -- can also serve as an attack vector, posing significant security risks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
