DMN: 一种用于多图像输入多模态大语言模型的组合框架
DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
AI总结：
本文提出DMN框架，通过分布式指令、多模态证据和数字链任务，提升多图像输入多模态大语言模型的 jailbreak 性能，实验表明其在GPT-4o、Gemini-2.5-pro和Claude Sonnet 4上的攻击成功率超过90%。
摘要：
多模态大语言模型（MLLMs）易受jailbreak攻击，此类攻击可引发有害响应。许多MLLMs支持多图像输入，但因对多图像安全对齐的重视不足，无意中引入了新的漏洞。先前的MLLM jailbreak方法仅使用单张图像，限制了攻击空间：无法将有害请求分散到多个图像中、承载丰富信息或利用额外的视觉推理任务来分散MLLMs。为了解决这些限制，本文提出了一种组合jailbreak框架，DMN，利用分布式指令、多模态证据和数字链任务来全面提升jailbreak性能。大量实验表明，DMN在MLLM jailbreaking中表现优异，例如在GPT-4o、Gemini-2.5-pro和Claude Sonnet 4上的攻击成功率超过90%，远超其他基线方法。这种组合、多图像jailbreak策略揭示了其安全机制的根本性弱点。
英文摘要：
Multimodal Large Language Models (MLLMs) are vulnerable to jailbreak attacks, which can elicit harmful responses from MLLMs. Many MLLMs support multi-image inputs, inadvertently introducing new vulnerabilities due to less efforts on multi-image safety alignment. Previous MLLM jailbreak methods only uses a single image, which restricts the attack space: they cannot distribute harmful requests across multiple images, carry abundant information, or exploit additional visual reasoning tasks to distract MLLMs. To address these limitations, in this paper, we propose a compositional jailbreak framework, \textbf{DMN}, which leverages \textbf{D}istributed instruction, \textbf{M}ultimodal evidence and a \textbf{N}umber chain task to fully enhance the jailbreak performance. Extensive experiments show that DMN is highly effective for MLLM jailbreaking, e.g. achieving attack success rates of over 90\% on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4, surpassing other baselines by a large margin. This compositional, multi-image jailbreak strategy reveals fundamental weaknesses in their safety mechanisms.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
