arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2511.20002cs.CVcs.AIcs.CR

语义路由器:通过单一对抗扰动劫持多模态大语言模型的可行性研究

Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation

The Chinese University of Hong Kong, Shenzhen, China(香港中文大学(深圳));School of Data Science, School of Artificial Intelligence, The Chinese University of Hong Kong, Shenzhen, China(数据科学学院、人工智能学院、香港中文大学(深圳))

Changyue Li, Jiaying Li, Youliang Yuan, Jiaming He, Zhicong Huang, Pinjia He

AI总结:

提出语义感知通用扰动(SAUP),作为语义路由器同时劫持多个无状态决策,通过理论分析和SORT优化策略实现,在Qwen上对五个目标达到66%攻击成功率。

摘要:

多模态大语言模型(MLLMs)越来越多地部署在无状态系统中,例如自动驾驶和机器人技术。本文研究了一种新型威胁:语义感知劫持。我们探索了使用单一通用扰动同时劫持多个无状态决策的可行性。我们引入了语义感知通用扰动(SAUP),它充当语义路由器,“主动”感知输入语义并将其路由到不同的、攻击者定义的目标。为了实现这一点,我们对潜在空间中的几何特性进行了理论和实证分析。在这些见解的指导下,我们提出了语义导向(SORT)优化策略,并标注了一个具有细粒度语义的新数据集以评估性能。在三个代表性MLLM上的大量实验证明了这种攻击的基本可行性,在针对Qwen的五个目标上使用单帧实现了66%的攻击成功率。

英文摘要:

Multimodal Large Language Models (MLLMs) are increasingly deployed in stateless systems, such as autonomous driving and robotics. This paper investigates a novel threat: Semantic-Aware Hijacking. We explore the feasibility of hijacking multiple stateless decisions simultaneously using a single universal perturbation. We introduce the Semantic-Aware Universal Perturbation (SAUP), which acts as a semantic router, "actively" perceiving input semantics and routing them to distinct, attacker-defined targets. To achieve this, we conduct theoretical and empirical analysis on the geometric properties in the latent space. Guided by these insights, we propose the Semantic-Oriented (SORT) optimization strategy and annotate a new dataset with fine-grained semantics to evaluate performance. Extensive experiments on three representative MLLMs demonstrate the fundamental feasibility of this attack, achieving a 66% attack success rate over five targets using a single frame against Qwen.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑