AEGIS：一种针对文本到图像模型中视觉同义词越狱的机制引导防御
AEGIS: A Mechanism-Guided Defense against Visual Synonym Jailbreaks in Text-to-Image Models
AI总结：
研究针对文本到图像模型中视觉同义词越狱问题，提出AEGIS防御机制，通过动态追踪不安全语义生成过程，利用稀疏语义注入注意力头，在推理时仅对易受攻击头部应用相似性感知排斥，提升了模型安全与效用。
摘要：
文本到图像扩散模型已实现高视觉保真度并被广泛采用，但当对手利用它们合成非法内容时，仍容易出现安全违规问题。现有的对齐范式在很大程度上是围绕在过滤、编辑或定位过程中明确暴露的不安全概念组织的。这为视觉同义词攻击（VSA）留下了盲点，即看似良性的提示通过隐式视觉关联引发违禁图像的越狱攻击。因此，当前的防御面临安全与效用的困境。本文从静态抑制预定义的不安全概念转向动态追踪不安全语义在生成过程中如何出现。通过机制分析表明VSA和显式不安全提示通过稀疏语义注入注意力头收敛。基于此提出AEGIS，一种推理时防御，仅在识别出的易受攻击的头部应用相似性感知排斥。在与16个基线进行评估时，AEGIS提高了安全性和效用。在SD 1.4上，将域内暴力/裸体VSA的攻击成功率（ASR）降低到0.00/0.03，在域外显式和对抗攻击上ASR≤0.09。它保留了良性保真度，避免抑制硬负概念，并在为每个骨干重新识别关键头部后转移到SD 2.1和FLUX.1。
英文摘要：
Text-to-image diffusion models have achieved high visual fidelity and broad adoption, but remain vulnerable to safety violations when adversaries exploit them to synthesize illicit content. Existing alignment paradigms, from input sanitization to structural feature pruning, are largely organized around unsafe concepts explicitly exposed during filtering, editing, or localization. This leaves a blind spot for visual synonym attacks (VSA), a jailbreak where benign-looking prompts elicit prohibited imagery through implicit visual associations. As a result, current defenses face a safety-utility dilemma: they may either under-mitigate VSA threats or over-suppress visually similar benign concepts. The core challenge is that VSA hides the unsafe target at the textual surface while revealing it through generation-time visual-semantic convergence. In this work, we therefore shift from static suppression of pre-specified unsafe concepts to dynamic tracing of how unsafe semantics emerge during generation. Our mechanistic analysis shows that VSA and explicit unsafe prompts converge through sparse semantic-injecting attention heads, which serve as inference-time bottlenecks for prohibited visual semantics. Based on this insight, we propose AEGIS (Adaptive Evasion Guard via Identification and Steering), an inference-time defense that applies similarity-aware repulsion only at the identified vulnerable heads. Evaluated against 16 baselines, AEGIS improves both safety and utility. On SD 1.4, it reduces ASR to $\mathbf{0.00}/\mathbf{0.03}$ for in-domain violence/nudity VSA and achieves ASRs $\le \mathbf{0.09}$ on out-of-domain explicit and adversarial attacks. It preserves benign fidelity, avoids suppressing hard-negative concepts, and transfers to SD 2.1 and FLUX.1 after re-identifying the critical heads for each backbone.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
