TreeTeaming：通过分层策略探索实现视觉语言模型的自主红队测试
TreeTeaming: Autonomous Red-Teaming of Vision-Language Models via Hierarchical Strategy Exploration
AI总结：
TreeTeaming通过动态演化策略探索方法，实现对视觉语言模型的自主红队测试，显著提升攻击成功率和策略多样性，同时降低攻击毒性。
摘要：
视觉语言模型（VLMs）的快速发展使其安全漏洞受到关注。然而，现有红队方法受限于线性探索范式，难以发现新颖多样的漏洞。TreeTeaming引入自动化红队框架，将策略探索从静态测试转向动态演化过程。其核心是战略协调器，由大语言模型驱动，自主决定是否演化攻击路径或探索多样策略分支，动态构建扩展策略树。多模态执行器执行复杂策略。在12个主流VLMs上的实验中，TreeTeaming在11个模型上达到最先进的攻击成功率，优于现有方法，GPT-4o达87.60%。框架在公共劫持策略联合上表现出更优的战略多样性。生成的攻击平均毒性降低23.09%，展现其隐蔽性和细微性。本工作引入自动化漏洞发现新范式，强调需超越静态启发式方法，以保障前沿AI模型安全。
英文摘要：
The rapid advancement of Vision-Language Models (VLMs) has brought their safety vulnerabilities into sharp focus. However, existing red teaming methods are fundamentally constrained by an inherent linear exploration paradigm, confining them to optimizing within a predefined strategy set and preventing the discovery of novel, diverse exploits. To transcend this limitation, we introduce TreeTeaming, an automated red teaming framework that reframes strategy exploration from static testing to a dynamic, evolutionary discovery process. At its core lies a strategic Orchestrator, powered by a Large Language Model (LLM), which autonomously decides whether to evolve promising attack paths or explore diverse strategic branches, thereby dynamically constructing and expanding a strategy tree. A multimodal actuator is then tasked with executing these complex strategies. In the experiments across 12 prominent VLMs, TreeTeaming achieves state-of-the-art attack success rates on 11 models, outperforming existing methods and reaching up to 87.60\% on GPT-4o. The framework also demonstrates superior strategic diversity over the union of previously public jailbreak strategies. Furthermore, the generated attacks exhibit an average toxicity reduction of 23.09\%, showcasing their stealth and subtlety. Our work introduces a new paradigm for automated vulnerability discovery, underscoring the necessity of proactive exploration beyond static heuristics to secure frontier AI models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
