REALM: 面向物理世界视觉语言模型的统一红队基准
REALM: A Unified Red-Teaming Benchmark for Physical-World VLMs
AI总结：
提出REALM，首个统一红队基准，集成12种攻击方法、3种防御和13个视觉语言模型，通过代理目标生成管道实现公平比较，发现文本注入攻击最有效。
摘要：
视觉语言模型（VLM）越来越多地被用作安全关键物理系统中具身智能的感知-推理骨干，其中感知或推理错误可能导致不安全的决策或行动。尽管已经开发了许多红队方法来探测VLM的漏洞，但它们的评估在数据集、指标和威胁模型上仍然分散，使得直接比较变得困难，并掩盖了观察到的差异是否源于更强的攻击、更脆弱的模型或不兼容的评估设置。现有的以聊天机器人为中心的红队基准主要标准化了越狱和内容安全评估，但它们没有系统地捕捉物理基础的函数故障或覆盖针对物理世界VLM的红队方法。这提出了在统一协议下比较不同攻击方法同时针对相同场景特定故障的关键挑战。我们介绍了REALM，据我们所知，这是第一个面向物理世界VLM的统一红队基准。REALM在实用的黑盒威胁模型下集成了12种红队方法、3种模型无关的防御和13个VLM，并共享数据集和指标。为了对齐不同攻击家族的对抗目标，REALM引入了一个代理目标生成管道，为每个场景构建共享的、场景特定的、物理基础的攻击目标，从而在一致的对抗目标下实现不同红队方法的公平比较。我们的评估表明，文本和排版注入攻击引发最多的故障，多模态协同优化产生最强的视觉扰动迁移，单次攻击以更低的成本接近迭代方法，而模型规模本身并不赋予对抗鲁棒性。代码可在以下网址获取：此 https URL。
英文摘要：
Vision-language models (VLMs) are increasingly used as perception-reasoning backbones for embodied intelligence in safety-critical physical systems, where perception or reasoning errors can lead to unsafe decisions or actions. Although many red-teaming methods have been developed to probe VLM vulnerabilities, their evaluation remains fragmented across datasets, metrics, and threat models, making direct comparison difficult and obscuring whether observed differences arise from stronger attacks, more vulnerable models, or incompatible evaluation settings. Existing chatbot-centric red-teaming benchmarks mainly standardize jailbreak and content-safety evaluation, but they do not systematically capture physically grounded functional failures or cover red-teaming methods that target physical-world VLMs. This raises the key challenge of comparing diverse attack methods under a unified protocol while targeting the same scenario-specific failures. We introduce REALM, to our knowledge the first unified red-teaming benchmark for physical-world VLMs. REALM integrates 12 red-teaming methods, 3 model-agnostic defenses, and 13 VLMs under a practical black-box threat model with shared datasets and metrics. To align adversarial objectives across attack families, REALM introduces an agentic target-generation pipeline that constructs shared, scenario-specific, and physically grounded attack objectives for each scene, enabling fair comparison of diverse red-teaming methods under aligned adversarial goals. Our evaluation shows that text and typographic injection attacks induce the most failures, multimodal co-optimization yields the strongest visual-perturbation transfer, single-pass attacks approach iterative methods at much lower cost, and model scale alone does not confer adversarial robustness. Code is available at https://github.com/UCF-ML-Research/REALM.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
