针对深度OCR系统的对抗攻击

中文摘要 AI 辅助

Deep-OCR（DeepSeek-OCR）将视觉模态视为光学压缩介质，以低token成本实现长上下文OCR，推进了文档识别，但日益增加的复杂性可能引入新的安全漏洞。本文中，我们提出了据我们所知首个针对生成式OCR视觉语言模型的纯黑盒对抗攻击，仅可查询解码字符串，无法获取梯度、logits或模型内部信息。我们将该攻击重构为零阶优化问题，该问题由直接基于字符串输出、通过序列相似度定义的有界标量损失驱动，并采用随机方向有限差分法估计梯度，其查询成本与图像维度无关。结合ℓ∞投影的Adam更新可为无目标和有目标目标生成难以察觉的扰动。在Deep-OCR上开展的初步实验验证了仅字符串攻击和评估流程，并揭示了解码器存在严重的定性故障，包括重复、截断和提示泄露；实验还表明，可控有目标改写仍远比无目标退化困难，在完成预注册评估前，我们暂不宣称有目标攻击成功。

英文摘要

Deep-OCR (DeepSeek-OCR) advances document recognition by treating the visual modality as an optical compression medium, enabling long-context OCR at low token cost. However, its increased complexity may introduce new security vulnerabilities. In this paper, we present, to the best of our knowledge, the first pure black-box adversarial attack against a generative OCR vision-language model, where only the decoded string can be queried and no gradients, logits, or model internals are available. We recast the attack as a zeroth-order optimization problem driven by a bounded scalar loss defined directly on the string output via sequence similarity, and estimate the gradient with a random-direction finite-difference scheme whose query cost is independent of the image dimension. An Adam update with ell_infinity projection yields imperceptible perturbations for both untargeted and targeted objectives. Pilot experiments on Deep-OCR validate the string-only attack and evaluation pipeline and expose severe qualitative decoder failures, including repetition, truncation, and prompt leakage. They also show that controlled targeted rewriting remains substantially harder than untargeted degradation; we avoid claiming targeted success until the pre-registered evaluation is complete.

发表机构

• Nanjing University of Aeronautics and Astronautics（南京航空航天大学）
• Northwestern Polytechnical University（西北工业大学）
• The Chinese University of Hong Kong（香港中文大学）
• The University of Hong Kong（香港大学）
• City University of Hong Kong（香港城市大学）
• Chinese Academy of Sciences（中国科学院）
• The Hong Kong Polytechnic University（香港理工大学）

机构由 AI 辅助整理，请以论文原文为准。