Multi-mode black box attack method and device for large visual language model

Abstract

The invention provides a multi-mode black box attack method and device for a large visual language model, and the method is characterized in that the method comprises the steps: S1, constructing a corresponding system cue word and a dialogue template; s2, generating a first round of attack text prompt and attack image prompt for each attack strategy according to a jail break target structure and a visual language model; s3, generating a corresponding attack image according to the attack image prompt; s4, respectively inputting the attack image-text pairs into the target model to obtain corresponding response replies; s5, adding the corresponding attack image-text pairs and response replies to historical data; s6, judging whether the jailbreak attack succeeds or not, if yes, obtaining jailbreak image-text pairs, and if not, executing the step S7; and S7, generating a next round of attack text prompt and attack image prompt for the attack strategy of prison break failure, and executing the step S3. In a word, the method can generate the prison break image-text pairs and detect the safety performance of the visual language model.

Description

Technical Field

[0001] The present invention belongs to the field of AI security, and specifically relates to a multimodal black box attack method and device for a large visual language model. Background Art

[0002] With the widespread adoption of OpenAI's GPT-4 and Google's Gemini, increasing attention has been focused on large visual language models (VLMs) and their trusted deployment in real-world applications. Although VLMs are built on highly aligned large language models, the combination of text and visual modalities introduces new security vulnerabilities. Recent research shows that VLMs are extremely vulnerable to jailbreak attacks. Through malicious jailbreak prompts, the model can be induced to output harmful content that it is originally restricted from, making these risks a critical issue for the safe release of VLMs.

[0003] Greshake et al. explored the effectiveness of manually injecting deceptive text into input images. In contrast, other studies have proposed more sophisticated adversarial attack methods in the image domain. Carlini et al., Bagdasaryan et al., and Bailey et al. fixed a target output chosen by the attacker and optimized the input image to increase the probability of generating it. Another white-box attack proposed by Qi et al. aims to find a universal adversarial visual input. Specifically, this attack no longer focuses on a specific output sentence, but instead attempts to maximize the probability of generating derogatory output from a corpus containing multiple harmful sample sentences. This strategy is inspired by Wallace et al., who also used a discrete search-based optimization algorithm to find universal adversarial triggers that increase the probability of generating a small set of harmful sentences. Shayegani et al. proposed attacking publicly available visual encoders, such as CLIP used in multimodal models, thereby eliminating the need for full white-box access.

[0004] The above existing methods mainly focus on exploring the robustness under white-box attacks based on adversarial images. This strategy is based on full or partial white-box access to the model, which is often unrealistic in real scenarios. In addition, the semantics of adversarial images are often distorted, making them easier to detect or defend against. Summary of the invention

[0005] The present invention is made to solve the above-mentioned problems, and its purpose is to provide a multimodal black-box attack method and device for large-scale visual language models.

[0006] The present invention provides a multimodal black box attack method for a large visual language model, which is used to generate a jailbreak image-text pair for a target model according to a jailbreak target and a visual language model, and has the following characteristics: step S1, constructing corresponding system prompt words and dialogue templates according to different attack strategies; step S2, for each attack strategy, constructing input data according to the corresponding system prompt words and dialogue templates combined with the jailbreak target, and inputting the input data into the visual language model to generate a first round of attack text prompts and attack image prompts; step S3, generating a corresponding attack image according to the attack image prompt through an existing text-based graph model, and using the attack image together with the corresponding attack text prompt of the round as an attack graph text pair; step S4, in the current round, input each attack image-text pair corresponding to the round into the target model respectively to obtain the corresponding response reply; step S5, for each attack strategy, add the corresponding attack image-text pair and response reply to the historical data; step S6, analyze the historical data corresponding to each attack strategy through the visual language model to determine whether the jailbreak attack is successful. If so, use the attack image pair of the last round corresponding to the attack strategy as the jailbreak image-text pair. If not, execute step S7; step S7, for the attack strategy that fails to jailbreak, analyze the corresponding historical data through the visual language model, generate the attack text prompt and attack image prompt for the next round according to the analysis results, and execute step S3.

[0007] The multimodal black-box attack method for a large visual language model provided by the present invention may also have the following features: wherein the attack strategies include typesetting attacks, role playing, and emotional manipulation.

[0008] The multimodal black box attack method for a large visual language model provided by the present invention may also have the following features: wherein, in step S7, the visual language model constructs a CoT thinking chain based on historical data to perform reasoning and obtain an analysis result.

[0009] The present invention also provides a multimodal black box attack device for a large visual language model, which is used to generate a jailbreak image-text pair for a target model according to a jailbreak target and a visual language model, and has the following characteristics, including: a model storage module, an initial text image generation module, an attack image generation module, a reply generation module, a historical data addition module, a judgment module and an optimization module, wherein the model storage module is used to store the visual language model and the target model; the initial text image generation module stores corresponding system prompt words and dialogue templates constructed according to different attack strategies, and is used to construct input data for each attack strategy according to the corresponding system prompt words and dialogue templates combined with the jailbreak target, and input the input data into the visual language model to generate the first round of attack text prompts and attack image prompts; the attack image generation module includes an existing text image model, which is used to generate a first round of attack text prompts and attack image prompts according to the attack image prompts Generate a corresponding attack image, and use the attack image and the corresponding attack text prompt of this round as an attack image-text pair; the reply generation module is used to input each attack image-text pair corresponding to this round into the target model in the current round, and obtain the corresponding response reply; the historical data adding module is used to add the corresponding attack image-text pair and response reply to the historical data for each attack strategy; the judgment module is used to analyze the historical data corresponding to each attack strategy through the visual language model to determine whether the jailbreak attack is successful. If so, the attack image pair of the last round corresponding to the attack strategy is used as the jailbreak image-text pair. If not, the optimization module is executed; the optimization module is used to analyze the corresponding historical data of the attack strategy that failed to jailbreak through the visual language model, and generate the attack text prompt and attack image prompt for the next round according to the analysis results, and execute the attack image generation module.

[0010] Functions and Effects of the Invention

[0011] According to the multimodal black-box attack method and device for large-scale visual language models involved in the present invention, because, on the one hand, attack text prompts and attack image prompts are generated according to different attack strategies, and then iterative optimization is performed in combination with the response reply of the target model, so as to generate more targeted attack text prompts and attack image prompts; on the other hand, attack text prompts and attack image prompts are generated synchronously, and then the attack image prompts are converted into corresponding attack images through the text graph, so that the semantics of the attack image is not distorted, reducing the possibility of being detected or defended. Therefore, the multimodal black-box attack method and device for large-scale visual language models of the present invention can generate jailbreak image-text pairs that have a good effect on the visual language model, and further detect and improve the security performance of the visual language model. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a schematic diagram of the working principle of generating jailbreak image-text pairs in an embodiment of the present invention;

[0013] Figure 2 is a block diagram of a multimodal black box attack device in an embodiment of the present invention;

[0014] Figure 3 4 is a flowchart of a multimodal black-box attack method for a large visual language model in an embodiment of the present invention. DETAILED DESCRIPTION

[0015] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the following embodiments and the accompanying drawings specifically illustrate the multimodal black box attack method and device for a large visual language model of the present invention.

[0016] This embodiment provides a multimodal black box attack device for a large visual language model, which is used to generate a jailbreak image-text pair for the target model according to the jailbreak target and the visual language model.

[0017] Figure 1 It is a schematic diagram of the working principle of generating jailbreak image-text pairs in an embodiment of the present invention.

[0018] like Figure 1 As shown, the large visual language red team model, i.e., the visual language model, generates text prompts and image prompts, and converts the image prompts into images through the text-to-image model. Subsequently, the images and text prompts are input into the target visual language model, i.e., the target model, to generate target responses. The large visual language red team model then analyzes the target responses and further optimizes and generates new text prompts and image prompts. This cycle is iterated until the preset termination condition is reached, and the images corresponding to the finally optimized text prompts and image prompts are used as jailbreak text-image pairs.

[0019] Figure 2 is a block diagram of a multimodal black box attack device in an embodiment of the present invention.

[0020] like Figure 2 As shown, the multimodal black-box attack device 100 for a large visual language model includes a model storage module 11, an initial text image generation module 12, an attack image generation module 13, a reply generation module 14, a historical data addition module 15, a judgment module 16, an optimization module 17 and a control module 18 for controlling the operation of the above modules.

[0021] The model storage module 11 is used to store the visual language model and the target model.

[0022] The initial text image generation module 12 stores corresponding system prompt words and dialogue templates according to different attack strategies, and is used to construct input data for each attack strategy according to the corresponding system prompt words and dialogue templates combined with the jailbreak target, and input the input data into the visual language model to generate the first round of attack text prompts, i.e., text prompts, and attack image prompts, i.e., image prompts. Among them, the attack strategies include typographic attack, role-playing, and emotional manipulation.

[0023] In this embodiment, the initial text image generation module 12 generates the attack text prompt and the attack image prompt according to each attack strategy as follows:

[0024]

[0025] Where M A is the visual language model, For image input is empty, For jailbreak purposes, The analysis of the previous round of attacks is empty. This is the text prompt for the first round of attacks. This is the image prompt for the first round of attacks.

[0026] The attack image generation module 13 includes an existing text-based graph model, which is used to generate a corresponding attack image according to the attack image prompt, and use the attack image and the corresponding attack text prompt of the round as an attack image-text pair.

[0027] The reply generation module 14 is used to input each attack graph-text pair corresponding to the current round into the target model respectively, and obtain the corresponding response reply, that is, the target response.

[0028] The expression for generating the response reply in this embodiment is:

[0029]

[0030] In the formula is the response reply corresponding to the nth round, M V is the target model, I n is the attack image corresponding to the nth round, It is the attack text prompt corresponding to the nth round.

[0031] The historical data adding module 15 is used to add the corresponding attack image-text pair and the response reply to the historical data for each attack strategy.

[0032] The judgment module 16 is used to analyze the historical data corresponding to each attack strategy through the visual language model to determine whether the jailbreak attack is successful. If so, the last round of attack image pairs corresponding to the attack strategy are used as jailbreak image-text pairs. If not, the optimization module 17 is executed.

[0033] The optimization module 17 is used to analyze the corresponding historical data of the unsuccessful jailbreak attack strategy through the visual language model, and generate the next round of attack text prompts and attack image prompts according to the analysis results, and execute the attack image generation module 13. Among them, the visual language model constructs the CoT thinking chain according to the historical data to reason and obtain the analysis results. In this embodiment, for any unsuccessful jailbreak attack strategy, the visual language model optimizes the previous round of attack text prompts and attack image prompts within the scope of the attack strategy according to the analysis results, and generates the next round of attack text prompts and attack image prompts.

[0034] In this embodiment, the optimization module 17 generates the expression of the attack text prompt and the attack image prompt for the next round as follows:

[0035]

[0036] Where I n-1 is the attack image corresponding to the n-1th round, is the response reply corresponding to the n-1th round, is the visual language model M A The results of the analysis of historical data, is the attack text prompt corresponding to the nth round, It is the attack image prompt corresponding to the nth round.

[0037] The control module 18 stores a control program for controlling the operation of each module.

[0038] The following describes the process of using the multimodal black box attack method device 100 to perform a multimodal black box attack method on a large visual language model in conjunction with the accompanying drawings.

[0039] Figure 3 4 is a flowchart of a multimodal black-box attack method for a large visual language model in an embodiment of the present invention.

[0040] like Figure 3 As shown in FIG. 1 , a multimodal black-box attack method for a large visual language model includes the following steps:

[0041] Step S1, construct corresponding system prompt words and dialogue templates according to different attack strategies and set them in the initial text image generation module 12.

[0042] Step S2, using the initial text image generation module 12 to construct input data for each attack strategy according to the corresponding system prompt words and dialogue template combined with the jailbreak target, and input the input data into the visual language model to generate the first round of attack text prompts and attack image prompts.

[0043] Step S3, using the attack image generation module 13 to generate a corresponding attack image according to the attack image prompt, and using the attack image and the attack text prompt corresponding to the round as an attack image-text pair.

[0044] Step S4, using the reply generation module 14 in the current round, input each attack graph-text pair corresponding to the round into the target model respectively to obtain the corresponding response reply.

[0045] Step S5, using the historical data adding module 15 to add the corresponding attack image-text pair and response reply to the historical data for each attack strategy.

[0046] Step S6, using the judgment module 16 to analyze the historical data corresponding to each attack strategy through the visual language model to determine whether the jailbreak attack is successful. If so, the last round of attack image pairs corresponding to the attack strategy are used as jailbreak image-text pairs. If not, execute step S7.

[0047] Step S7, using the optimization module 17 to analyze the corresponding historical data of the unsuccessful jailbreak attack strategy through the visual language model, and generating the next round of attack text prompts and attack image prompts according to the analysis results, and executing step S3.

[0048] In this embodiment, a multimodal black-box attack method for a large visual language model is used to jailbreak the existing large visual language model MiniGPT-4, and a 94% attack success rate can be achieved. In addition, according to this method, migration attacks are performed on the existing large models LLaVA and InstructBLIP, with success rates of 82% and 88%, respectively. It can be seen that the multimodal black-box attack method for a large visual language model in this embodiment has good jailbreak attack performance.

[0049] In this embodiment, the jailbreak image-text pairs generated by the multimodal black-box attack method for a large visual language model can be used to detect the target model's defense capability against jailbreak attacks, and then the target model is optimized in combination with the jailbreak image-text pairs to improve the security performance of the target model.

[0050] Functions and Effects of the Embodiments

[0051] According to the multimodal black-box attack method and device for a large visual language model involved in this embodiment, on the one hand, attack text prompts and attack image prompts are generated according to different attack strategies, and then iterative optimization is performed in combination with the response reply of the target model, so as to generate more targeted attack text prompts and attack image prompts; on the other hand, attack text prompts and attack image prompts are generated synchronously, and then the attack image prompts are converted into corresponding attack images through the text graph, so that the semantics of the attack image is not distorted, reducing the possibility of being detected or defended. In short, this method can generate jailbreak image-text pairs that have a good effect on the visual language model, and further detect and improve the security performance of the visual language model.

[0052] Those skilled in the art should understand that the present invention is not limited to the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, and these changes and improvements fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A multimodal black-box attack method for a large visual language model, which is used to generate a jailbreak image-text pair for the target model based on the jailbreak target and the visual language model, characterized in that: The following steps are involved: Step S1, construct corresponding system prompt words and dialogue templates according to different attack strategies; Step S2, for each of the attack strategies, construct input data according to the corresponding system prompt words and the dialogue template in combination with the jailbreak target, and input the input data into the visual language model to generate a first round of attack text prompts and attack image prompts; Step S3, using an existing text-based graph model, generating a corresponding attack image according to the attack image prompt, and using the attack image and the attack text prompt corresponding to the round as an attack image-text pair; Step S4, in the current round, inputting each of the attack graph-text pairs corresponding to the round into the target model respectively to obtain a corresponding response reply; Step S5, for each of the attack strategies, adding the corresponding attack graph-text pair and the response reply to the historical data; Step S6, analyzing the historical data corresponding to each of the attack strategies through the visual language model to determine whether the jailbreak attack is successful. If so, using the last round of attack image pairs corresponding to the attack strategy as the jailbreak image-text pairs; if not, executing step S7; Step S7, for the attack strategy that fails to jailbreak, the corresponding historical data is analyzed through the visual language model, and the attack text prompt and the attack image prompt for the next round are generated according to the analysis results, and the step S3 is executed.

2. The multimodal black-box attack method for a large visual language model according to claim 1, characterized in that: in, The attack strategies include typographical attacks, role playing, and emotional manipulation.

3. The multimodal black-box attack method for a large visual language model according to claim 1, characterized in that: in, In step S7, the visual language model constructs a CoT thinking chain according to the historical data to perform reasoning to obtain the analysis result.

4. A multimodal black-box attack device for a large visual language model, used to generate a jailbreak image-text pair for the target model based on the jailbreak target and the visual language model, characterized in that: include: Model storage module, initial text image generation module, attack image generation module, reply generation module, historical data addition module, judgment module and optimization module, Wherein, the model storage module is used to store the visual language model and the target model; The initial text image generation module stores corresponding system prompt words and dialogue templates constructed according to different attack strategies, and is used to construct input data for each attack strategy according to the corresponding system prompt words and dialogue templates combined with the jailbreak target, and input the input data into the visual language model to generate the first round of attack text prompts and attack image prompts; The attack image generation module includes an existing text graph model, which is used to generate a corresponding attack image according to the attack image prompt, and use the attack image and the attack text prompt corresponding to the round as an attack image-text pair; The reply generation module is used to input each of the attack graph-text pairs corresponding to the round into the target model in the current round to obtain a corresponding response reply; The historical data adding module is used to add the corresponding attack image-text pair and the response reply to the historical data for each attack strategy; The judgment module is used to analyze the historical data corresponding to each of the attack strategies through the visual language model to determine whether the jailbreak attack is successful. If so, the last round of attack image pairs corresponding to the attack strategy are used as the jailbreak image-text pairs. If not, the optimization module is executed; The optimization module is used to analyze the corresponding historical data for the attack strategy of unsuccessful jailbreak through the visual language model, generate the next round of attack text prompts and attack image prompts according to the analysis results, and execute the attack image generation module.

Images