超越裁决：视觉提示注入护栏的证据对齐评估
Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails
浏览论文内容
中文总结 AI 辅助
针对视觉提示注入护栏，提出证据对齐评估方法，引入Mind2Web-Injection基准，发现模型在证据定位上差异显著，并提出两种无需训练的干预措施以改善接地和一致性。
中文摘要 AI 辅助
仅基于裁决的评估无法揭示视觉语言模型（VLM）是否使用了本应支持其决策的视觉证据。我们在Web代理护栏中研究这一问题，其中VLM判断屏幕上的文本是否与用户指令冲突。我们引入了Mind2Web-Injection基准，包含9,954对指令-截图对，具有指令相对标签、像素级精确的证据框以及匹配的图像侧反事实。在六个VLM中，两个平均精度几乎相同的模型在证据对齐检测（EAD）上相差九倍，EAD衡量攻击被检测并正确定位的比例。为了测试裁决是否依赖于被引用为证据的命令，我们将指令替换为认可该命令的指令。Qwen3-VL-32B，最强的开放权重定位器，仅在58.7%的情况下返回对齐，而GPT-5.6-luna在99.9%的情况下返回对齐。为了诊断这些失败，我们提出了两种无需训练的干预措施。ReadGate在不改变裁决的情况下改善接地，而CmdCompare测试显式的指令-命令比较是否能解决指令侧的不一致性。这些结果促使分别报告裁决正确性、证据定位和反事实响应性。
英文摘要
Verdict-only evaluation does not reveal whether a vision-language model (VLM) used the visual evidence that should support its decision. We study this problem in web-agent guardrails, where a VLM judges whether on-screen text conflicts with a user instruction. We introduce Mind2Web-Injection, a benchmark of 9,954 instruction-screenshot pairs with instruction-relative labels, pixel-exact evidence boxes, and matched image-side counterfactuals. Across six VLMs, two models with nearly identical average precision differ ninefold in Evidence-Aligned Detection (EAD), the fraction of attacks both detected and correctly localized. To test whether a verdict depends on the command cited as evidence, we replace the instruction with one that endorses that command. Qwen3-VL-32B, the strongest open-weight localizer, returns aligned in only 58.7% of cases, whereas GPT-5.6-luna does so in 99.9%. To diagnose these failures, we propose two training-free interventions. ReadGate improves grounding without changing verdicts, while CmdCompare tests whether explicit instruction-command comparison resolves instruction-side inconsistency. These results motivate reporting verdict correctness, evidence localization, and counterfactual responsiveness separately.
发表机构
- Tynapse
机构由 AI 辅助整理，请以论文原文为准。
