arXiv 2610.140942026-10-14cs.CV

场景作为攻击面：揭示多模态大语言模型（MLLM）中基于场景的安全缺陷

Scenes as an Attack Surface: Uncovering Scene-Grounded Safety Failures in MLLMs

Nanjing University（南京大学）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；China Academy of Launch Vehicle Technology（中国运载火箭技术研究院）；Beihang University（北京航空航天大学）

Tongxi Wu, Yuyang Cheng, Jiacheng Xian, Hu Huang, Zhihao Wu, Menglin Yang, Jian Zhang, Yang Gao

备注：: Preprint

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

该研究揭示MLLM存在基于场景的安全漏洞，构建SceneSafetyBench开展评估，提出SGA攻击方法，其平均攻击成功率达86.17%，凸显场景语义是MLLM被忽视的攻击面。

摘要：

现有的越狱攻击已暴露多模态大语言模型（MLLM）存在严重的安全弱点。大多数先前的攻击依赖于专门构建的视觉输入来承载或支持有害意图。在本文中，我们揭示了一种不同的漏洞：仅与任务相关的场景语义就能使MLLM从拒绝（执行）转为顺从，即使视觉输入未引入额外的攻击指令且原始任务意图保持不变。我们将此缺陷形式化为基于场景的视觉安全漏洞，并引入SceneSafetyBench来在8个风险类别和9个白盒、黑盒MLLM中对其进行研究。我们的分析表明，该缺陷与与任务相关的视觉证据影响下游安全表示的方式相关，这表明仅视觉基础无法完全解释观察到的安全转变。基于这一发现，我们提出了基于场景的攻击（SGA），其保留原始任务，同时构建经过验证的基于场景的查询并组合它们的独立响应。在9个目标MLLM上，SGA的平均攻击成功率（ASR）为86.17%，比最强基线高出8.55个百分点，且在8个模型上实现了最高ASR。我们的结果确定场景语义是MLLM中被忽视的攻击面，并强调了更强的视觉基础与稳健的多模态安全对齐之间日益加剧的紧张关系。

英文摘要：

Existing jailbreak attacks have exposed serious safety weaknesses in multimodal large language models (MLLMs). Most prior attacks rely on specially constructed visual inputs to carry or support harmful intent. In this paper, we uncover a different vulnerability: task-relevant scene semantics alone can shift an MLLM from refusal to compliance, even when the visual input introduces no additional attack instructions and the original task intent remains unchanged. We formalize this failure as a scene-grounded visual safety vulnerability and introduce SceneSafetyBench to investigate it across eight risk categories and nine white- and black-box MLLMs. Our analysis reveals that this failure is associated with how task-relevant visual evidence influences downstream safety representations, suggesting that visual grounding alone cannot fully explain the observed safety shift. Building on this finding, we propose Scene-Grounded Attacks (SGA), which preserve the original task while constructing validated scene-grounded queries and combining their independent responses. Across nine target MLLMs, SGA achieves an average attack success rate (ASR) of 86.17%, outperforming the strongest baseline by 8.55 percentage points and achieving the highest ASR on eight models. Our results identify scene semantics as an overlooked attack surface in MLLMs and highlight a growing tension between stronger visual grounding and robust multimodal safety alignment.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。