针对大视觉-语言模型的跨模态提示注入攻击：仅图像扰动
A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation
AI总结：
本文提出CrossMPI攻击，通过仅图像扰动实现跨模态提示注入，改进模型隐藏状态空间优化并采用层选择策略与距离递减扰动策略，有效提升攻击性能。
摘要：
大型视觉-语言模型（LVLMs）已发展为多模态智能的强大范式，但其日益增长的部署也扩大了提示注入攻击的攻击面。尽管存在日益增长的担忧，现有攻击仍受到关键限制：注入的提示仅能引导模型对单一输入的解释。相反，这些攻击虽然多模态，但未能实现跨模态提示扰动。为此，我们引入了新颖的跨模态提示注入攻击CrossMPI，通过仅图像提示注入引导模型对文本和视觉输入的解释。我们的设计基于以下关键突破：首先，我们将注入提示扰动优化的焦点从视觉嵌入空间（通常仅有10^5个参数）转向模型隐藏状态空间（用于多模态信息整合，具有10^7个参数）。然后，采用两种策略以缓解由更大参数空间带来的优化挑战。为了约束优化的模型参数空间，我们引入了一种层选择策略，识别对多模态整合最关键的层。有趣的是，与以往经验不同，我们的分析表明，最优的LVLM提示扰动层位于模型中间而非最后。为了约束图像扰动空间，我们提出了一种新的距离递减扰动预算分配策略，该策略随着像素距离到语义关键区域的增加而递减分配预算。在多个LVLM和数据集上的广泛实验表明，我们的方法显著优于基线方法。
英文摘要：
Large vision-language models (LVLMs) have emerged as a powerful paradigm for multimodal intelligence, but their growing deployment also expands the attack surface of prompt injection. Despite this growing concern, existing attacks still suffer from a critical limitation: the injected prompt for one modality only steers the model's interpretation of that singular input. Alternatively, these attacks remain multimodal but fail to achieve cross-modal prompt perturbation. To bridge this gap, we introduce a novel cross-modal prompt injection attack CrossMPI, which can steer the model's interpretation of both textual and visual inputs via image-only prompt injection. Our design is underpinned by the following key breakthroughs. First, we turn the focus of the injected prompt perturbation optimization from the visual embedding space (typically with only $10^5$ parameters) to the model hidden state space (for multimodal information integration and with $10^7$ parameters). Then, two strategies are adopted to mitigate the optimization challenges posed by the larger parameter space. To constrain the optimized model parameter space, we introduce a layer selection strategy that identifies the layers most critical to multimodal integration. Interestingly, deviating from the past experience, our analysis reveals that the optimal layers for LVLM prompt perturbation reside in the middle of the model rather than the last. To constrain the image perturbation space, we propose a new distance-decremental perturbation budget assignment strategy that allocates budgets decrementally as the pixel distance to semantic-critical regions increases. Extensive experiments across multiple LVLMs and datasets show that our method significantly outperforms baseline approaches.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
