对抗风格优化：通过基于GRPO的风格触发优化增强VLM越狱
Adversarial Style Optimization: Enhancing VLM Jailbreaks by GRPO-based Stylistic Triggers Optimization
浏览论文内容
中文总结 AI 辅助
研究MLLMs安全对齐易受越狱攻击问题，提出基于GRPO的对抗风格优化（ASO）方法，通过优化风格触发增强视觉越狱，实验证明该方法显著提高攻击成功率，凸显风格偏差对MLLMs红队测试的作用。
中文摘要 AI 辅助
多模态大语言模型（MLLMs）性能出色，但安全对齐易受越狱攻击。现有基于内容的越狱方法存在不足。本文发现MLLMs在理解能力和安全能力上存在风格不一致，能稳健理解内容却易被特定风格触发绕过防御。提出对抗风格优化（ASO），利用基于组相对策略优化（GRPO）的风格触发优化增强现有视觉越狱。通过实验表明ASO显著提高了攻击成功率，证明风格偏差是对MLLMs进行红队测试的可扩展向量。
英文摘要
Multimodal Large Language Models (MLLMs) have achieved impressive performance, but their safety alignment remains vulnerable to jailbreak attacks. Existing content-based jailbreaks are often inconsistent and show unsatisfying performance against the rapidly evolving MLLMs, failing to exploit non-content-based vulnerabilities. Unlike previous research, we empirically find that MLLMs exhibit a Stylistic Inconsistency between their comprehension ability and safety ability: MLLMs can robustly understand content regardless of visual style, yet their defense mechanisms can be easily bypassed by specific stylistic triggers. Based on this finding, we propose Adversarial Style Optimization (ASO), a plug-and-play enhancement module to amplify existing visual jailbreaks. ASO fine-tunes an image-editing model to superimpose an optimized stylistic modification onto a given adversarial image, using a Group Relative Policy Optimization (GRPO) agent guided by a Structurally-Tiered Reward Function that combines a logit-based signal for detecting explicit refusals with a high-fidelity semantic evaluation from a powerful judge model. Extensive experiments show that ASO significantly enhances the ASR of SOTA attacks, demonstrating that stylistic biases are a scalable vector for red-teaming MLLMs. Our code is available at https://github.com/bingjunluo/ASO.
发表机构
- Tsinghua University（清华大学）
- Harbin Engineering University（哈尔滨工程大学）
- Shandong University（山东大学）
- Xidian University（西安电子科技大学）
机构由 AI 辅助整理，请以论文原文为准。
