对抗性提示注入攻击多模态大语言模型
Covert Visual Prompt Injection against Commercial Multimodal Large Language Models
AI总结：
本文研究了针对强大闭源多模态大语言模型的不可察觉视觉提示注入攻击，通过界文本叠加嵌入恶意提示并优化视觉扰动，提升攻击性能。
摘要：
尽管多模态大语言模型（MLLMs）在现实应用中日益普及，但其遵循指令的行为使其易受提示注入攻击。现有方法主要依赖于文本提示或可被人类观察到的视觉提示。本文研究了针对强大闭源MLLMs的不可察觉视觉提示注入，其中对抗性指令被嵌入视觉模态。我们的方法通过受限文本叠加将恶意提示嵌入输入图像，提供语义指导。同时，不可察觉的视觉扰动被迭代优化，以使受攻击图像的特征表示与恶意视觉和文本目标在粗粒度和细粒度层面对齐。具体而言，视觉目标被实例化为文本渲染图像，并在优化过程中逐步细化，以更忠实表示所需语义并提高可转移性。在两个多模态理解任务上对多个闭源MLLMs的广泛实验表明，与现有方法相比，我们的方法表现更优。
英文摘要：
Although multimodal large language models (MLLMs) are increasingly deployed in real-world applications, their instruction-following behavior leaves them vulnerable to prompt injection attacks. Existing prompt injection methods predominantly rely on textual prompts or perceptible visual prompts that are observable by human users. In this work, we study imperceptible visual prompt injection against powerful closed-source MLLMs, where adversarial instructions are embedded in the visual modality. Our method adaptively embeds the malicious prompt into the input image via a bounded text overlay to provide semantic guidance. Meanwhile, the imperceptible visual perturbation is iteratively optimized to align the feature representation of the attacked image with those of the malicious visual and textual targets at both coarse- and fine-grained levels. Specifically, the visual target is instantiated as a text-rendered image and progressively refined during optimization to more faithfully represent the desired semantics and improve transferability. Extensive experiments on two multimodal understanding tasks across multiple closed-source MLLMs demonstrate the superior performance of our approach compared to existing methods.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
