[论文解读] Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models

Erfan Shayegani, Yue Dong+1 more|arXiv (Cornell University)|Jul 26, 2023

Adversarial Robustness in Machine Learning被引用 11

一句话总结

本文介绍跨模态、嵌入空间对抗攻击，通过将良性提示与对抗性图像配对来越狱视觉-语言模型，而无需访问语言模型。它通过瞄准嵌入空间和四种触发类型，在多个VLM上展现出高越狱成功率。

ABSTRACT

We introduce new jailbreak attacks on vision language models (VLMs), which use aligned LLMs and are resilient to text-only jailbreak attacks. Specifically, we develop cross-modality attacks on alignment where we pair adversarial images going through the vision encoder with textual prompts to break the alignment of the language model. Our attacks employ a novel compositional strategy that combines an image, adversarially targeted towards toxic embeddings, with generic prompts to accomplish the jailbreak. Thus, the LLM draws the context to answer the generic prompt from the adversarial image. The generation of benign-appearing adversarial images leverages a novel embedding-space-based methodology, operating with no access to the LLM model. Instead, the attacks require access only to the vision encoder and utilize one of our four embedding space targeting strategies. By not requiring access to the LLM, the attacks lower the entry barrier for attackers, particularly when vision encoders such as CLIP are embedded in closed-source LLMs. The attacks achieve a high success rate across different VLMs, highlighting the risk of cross-modality alignment vulnerabilities, and the need for new alignment approaches for multi-modal models.

研究动机与目标

• 激励并形式化视觉-语言模型（VLMs）中的跨模态漏洞。
• 提出一种嵌入空间的组合式攻击，只需可视编码器即可构建对抗性图像。
• 演示四种恶意触发策略，并在多种VLMs上展示高越狱成功率。
• 强调防御影响以及跨模态对齐方法的需求。

提出的方法

• 将恶意提示表示为通用文本指令嵌入和对抗性图像嵌入在联合嵌入空间中的组合。
• 在联合嵌入空间中定义四种恶意触发类型：文本触发、OCR文本触发、视觉触发，以及OCR文本与视觉触发的组合。
• 使用端到端梯度更新（嵌入空间匹配），优化对抗性图像以使其嵌入对齐到目标恶意嵌入。
• 用嵌入空间损失来约束更新，并使用 CLIP 的图像编码器来生成看似无害但有效的对抗性图像。
• 在两个 VLMs（LLaVA 和 LLaMA-Adapter V2）上评估攻击，使用人类和自动毒性评估覆盖八个越狱类别。

Figure 1: Overview of our proposed methods: (A) We propose four types of malicious triggers within the joint embedding space for attack decomposition: textual trigger, OCR textual trigger, visual trigger, and combined OCR textual-visual trigger. (B) We employ an end-to-end gradient-based attack to u

实验结果

研究问题

• RQ1 在没有对 LLM 的白盒访问的情况下，跨模态、嵌入空间的攻击是否能够打破 VLMs 的文本安全对齐？
• RQ2 基于图像的对抗触发（包括 OCR 和组合触发）相较于文本触发，在越狱 VLMs 方面的效果有多高？
• RQ3 嵌入空间攻击是否对不同提示类型和触发保持泛化性和可组合性？

主要发现

Table 1: Trigger Scenario	S	H	V	SH	HR	S3	H2	V2	Avg.
Textual trigger	0.02	0.01	0.00	0.00	0.00	0.02	0.00	0.01	0.007
OCR text. trigger	0.86	0.91	0.97	0.74	0.88	0.78	0.88	0.77	0.849
Visual trigger	0.91	0.95	0.89	0.71	0.90	0.80	0.88	0.75	0.849
Combined trigger	0.92	0.98	0.96	0.74	0.88	0.82	0.89	0.77	0.870
Textual trigger (LLaMA-Adapter V2)	0.01	0.01	0.00	0.00	0.00	0.01	0.01	0.01	0.006
OCR text. trigger (LLaMA-Adapter V2)	0.64	0.62	0.81	0.48	0.58	0.54	0.52	0.64	0.604
Visual trigger (LLaMA-Adapter V2)	0.72	0.68	0.74	0.50	0.57	0.61	0.46	0.58	0.608
Combined trigger (LLaMA-Adapter V2)	0.74	0.69	0.79	0.51	0.54	0.63	0.54	0.62	0.633

• 针对基于图像的触发（OCR、视觉或组合）优化的对抗性图像在八个类别上实现高越狱成功率，优于文本触发。
• OCR 文本触发和视觉组合触发在触发类型中产生最高的攻击成功率。
• LLaVA 相较于 LLaMA-Adapter V2 更脆弱，但两者都容易受到基于视觉的触发；模态差距限制了文本触发的有效性。
• 自动毒性评估显示 OCR 和视觉触发可以带来更高的毒性分数，组合触发最为有效。
• 通过图像进行的隐藏提示注入显示了潜在的提示泄露和间接提示注入能力。

Figure 2: Context contamination . Once jailbroken, the model continues to provide toxic output through further text prompts. The added vision modality gives the attacker the opportunity to jump over the “Textual Gate” of alignment. Other examples are provided by Figure 9 in Appendix C .