RISE：面向现代文生图模型的迭代策略演化红队测试

中文摘要 AI 辅助

在现代生产级文生图系统中，成功的策略违规行为十分罕见，且先前有效的人工编写的种子提示往往已被修补。当前的自动化红队测试方法在两个方面与该环境不匹配：不可靠的成功度量和较差的探索能力。首先，我们发现先前T2I红队测试工作中广泛使用的评判器在模糊的不安全内容目标下不可靠：它们要么遗漏真正的违规行为，要么在加固的API上奖励良性的边缘图像。因此，我们定义了严格的类别特定成功标准，并针对人类标签校准了强大的VLM评判器。其次，我们表明广泛使用的提示修改流水线并不能解决探索问题：在更严格的防护栏设置下，它们仍然局限于种子提示，无法迁移，或者无法引导出正例。我们引入了RISE，它演化可复用的策略以生成提示，而不是逐一重写提示。发现的最佳策略随后被复用于在新场景中生成攻击。在DALL-E 3、Nano Banana 2（谷歌）和GPT-Image-2上，RISE达到了高达13%的人工验证攻击成功率（ASR）；在相同的校准评估下，先前报告ASR高达约30%的方法降至接近零。

英文摘要

On modern production text-to-image systems, successful policy violations are rare, and previously effective human-written seeds are often patched out. Current automated red-teamers are poorly matched to this regime in two ways: unreliable success measurement and poor exploration. First, we find that judges widely used in prior T2I red-teaming work are unreliable under vague unsafe-content targets: they either miss true violations or reward benign borderline images on hardened APIs. We therefore define strict category-specific success criteria and calibrate strong VLM judges against human labels. Second, we show that broadly used prompt-modification pipelines do not solve the exploration problem: on harder guardrail settings they remain tied to seed prompts, fail to transfer, or cannot bootstrap positive examples. We introduce RISE, which evolves reusable strategies used to generate prompts rather than rewriting them one by one. The best discovered strategies are then reused to generate attacks across new scenarios. On DALL-E 3, Nano Banana 2 (Google) and GPT-Image-2, RISE reaches up to 13% human-verified ASR; under the same calibrated evaluation, prior methods with reported ASR as high as roughly 30% fall to near zero.

发表机构

• White Circle

机构由 AI 辅助整理，请以论文原文为准。