arXiv 2507.215402026-04-08cs.CRcs.CV

PRISM：基于图像序列操作的程序化推理用于LVLM劫持

PRISM: Programmatic Reasoning with Image Sequence Manipulation for LVLM Jailbreaking

Quanchen Zou, Zonghao Ying, Moyang Chen, Wenzhuo Xu, Yisong Xiao, Yakai Li, Deyue Zhang, Dongdong Yang, Zhao Liu, Xiangzheng Zhang

备注：: This version is withdrawn to consolidate the submission under the corresponding author's primary account. The most recent and maintained version of this work can be found at arXiv:2603.09246

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出PRISM框架，通过分解有害指令为多个无害视觉组件，利用模型推理过程生成有害输出，有效提升LVLM劫持成功率。

摘要：

随着大视觉-语言模型（LVLMs）的复杂性增加，安全对齐机制的进步未能有效防止有害内容生成。现有劫持方法依赖直接且语义明确的提示，忽略了LVLMs在多步推理中信息组合的细微漏洞。本文提出受返回导向编程（ROP）技术启发的新框架，将有害指令分解为一系列单独无害的视觉组件。精心设计的文本提示引导输入序列，促使模型通过推理过程整合这些无害视觉组件，生成连贯且有害的输出。恶意意图在多个组件中涌现，难以从单一组件检测。通过SafeBench和MM-SafetyBench等基准测试，结果表明该方法在最先进模型上显著优于现有基线，攻击成功率超过0.90，ASR提升达0.39。研究揭示了利用LVLMs组合推理能力的关键漏洞，强调了保护整个推理过程的防御需求。

英文摘要：

The increasing sophistication of large vision-language models (LVLMs) has been accompanied by advances in safety alignment mechanisms designed to prevent harmful content generation. However, these defenses remain vulnerable to sophisticated adversarial attacks. Existing jailbreak methods typically rely on direct and semantically explicit prompts, overlooking subtle vulnerabilities in how LVLMs compose information over multiple reasoning steps. In this paper, we propose a novel and effective jailbreak framework inspired by Return-Oriented Programming (ROP) techniques from software security. Our approach decomposes a harmful instruction into a sequence of individually benign visual gadgets. A carefully engineered textual prompt directs the sequence of inputs, prompting the model to integrate the benign visual gadgets through its reasoning process to produce a coherent and harmful output. This makes the malicious intent emergent and difficult to detect from any single component. We validate our method through extensive experiments on established benchmarks including SafeBench and MM-SafetyBench, targeting popular LVLMs. Results show that our approach consistently and substantially outperforms existing baselines on state-of-the-art models, achieving near-perfect attack success rates (over 0.90 on SafeBench) and improving ASR by up to 0.39. Our findings reveal a critical and underexplored vulnerability that exploits the compositional reasoning abilities of LVLMs, highlighting the urgent need for defenses that secure the entire reasoning process.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。