Physical environment-oriented multi-modal thinking chain large model attack method

Abstract

The invention discloses a multi-modal thinking chain large model attack method oriented to a physical environment, and the method comprises the steps: building a cross-modal toxicity digestion mechanism, decoupling input harmful information into a harmless component through semantic hierarchical analysis and image-text collaborative coding, and achieving the distributed embedding of risk factors; a physical space confrontation induction system is developed, a physical environment printable confrontation sample is introduced into a visual channel, and a final physical attack prompt is generated through a modal alignment mechanism, so that a multi-modal verification mechanism is interfered, and hidden transmission of dangerous intentions is realized; and designing a pseudo-security logic construction engine, guiding a dangerous target identification result to a semantic neighbor security category by means of a physical printable sample, embedding a security logic chain into a preset thinking breakpoint by adopting a generated physical environment printable jail break sample, and disguising security verification to trigger a vulnerability path through a dual logic architecture. According to the method, the defect that a traditional single-mode attack scheme is easy to detect is overcome, baseline detection of the model can be avoided in a physical environment, hidden attacks are achieved, and a key theoretical support and a technical verification path are provided for perfecting a security protection system of a multi-mode large model.

Description

Technical Field

[0001] This invention belongs to the field of adversarial learning, specifically relating to a method for attacking large-scale multimodal thought chains in a physical environment. Background Technology

[0002] Traditional adversarial attack techniques primarily focus on misleading single-stage decisions in the digital space. For example, in image recognition tasks, attackers can guide the model to produce erroneous outputs by adding minute perturbations to images. However, with the widespread application of artificial intelligence in physical environment systems (such as autonomous vehicles and service robots), the model's decision-making process is no longer limited to a single stage but relies on a multimodal inference chain, including perception, logical reasoning, and decision execution. Existing research still has shortcomings in the security analysis of multimodal inference chains in physical environments. On the one hand, physical factors such as sensor noise, illumination changes, and background interference weaken the stability of adversarial perturbations during imaging and encoding, making it difficult to continuously trigger the expected misleading effect in real-world scenarios. On the other hand, the multi-stage cognitive reasoning process lacks an operational modeling and evaluation framework, making it difficult for attackers to accurately characterize and control the hierarchical propagation path of perturbations from low-level perceptual biases to high-level semantic understanding and decision output. Therefore, effectively characterizing the vulnerability features of multimodal inference chains in physical environments and designing a physical attack method that can be systematically implemented and optimized in physical environments to target the inference chains of large multimodal models remains a challenging task. Summary of the Invention

[0003] To reveal the vulnerability mechanism of multimodal reasoning chains in physical environments and improve their security, this invention considers the construction characteristics of multimodal reasoning chains in physical environment systems and proposes a large-scale attack method for multimodal thinking chains in physical environments. This method utilizes semantic hierarchical parsing and image-text co-coding to achieve distributed embedding of risk elements, thus mitigating cross-modal toxicity. A physically printable sample is generated through perturbation and secure text alignment, which interferes with the multimodal verification mechanism to covertly transmit malicious intent. Finally, a pseudo-secure logic chain is embedded into a pre-defined thought breakpoint using a physically printable jailbreak sample, triggering a pre-defined vulnerability execution path.

[0004] A method for attacking large-scale multimodal thought chains in a physical environment includes the following steps:

[0005] Step 1: First, establish a cross-modal toxicity mitigation mechanism. Decouple harmful information into harmless components through semantic hierarchical parsing technology, and realize the distributed embedding of risk elements by utilizing the co-coding characteristics of image and text.

[0006] Step 2: Develop a physical space adversarial inducement system, introduce printable adversarial samples of the physical environment into the visual channel, and generate the final physical attack prompt through a modal alignment mechanism;

[0007] Step 3: Design a pseudo-security logic construction engine. Using physically printable samples, the results of dangerous target identification are directed to the security category of semantic neighbors. Furthermore, physical environment-printable jailbreak samples are used to embed the security logic chain into pre-defined thought breakpoints.

[0008] Compared with the prior art, the beneficial effects of the present invention are: (1) Establishing a cross-modal toxicity resolution mechanism, decoupling harmful information into harmless fragments through semantic layering, and embedding risk elements in a distributed manner with the help of graphic-text co-coding, avoiding baseline detection and outputting a pseudo-secure logical chain while maintaining semantic coherence. (2) Introducing printable adversarial samples in the visual channel, and generating final physical attack prompts through modal alignment mechanism, interfering with the multimodal consistency verification mechanism without changing the nature of the attack, and realizing the covert transmission of dangerous intent. (3) Guiding the dangerous target identification results to the semantic nearest security category through feature space mapping, and embedding the security logical chain into the preset thought breakpoint through printable jailbreak samples in the physical environment, which not only meets the security verification requirements of the model, but also triggers the preset vulnerability execution path, realizing the vulnerability mechanism mining and progressive attack modeling of the multimodal reasoning chain in the physical environment, and providing key theoretical support and technical verification path for improving the security protection system of the multimodal large model. Attached Figure Description

[0009] Figure 1 This is a flowchart of a specific embodiment of the present invention. Detailed Implementation

[0010] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings.

[0011] like Figure 1 This is a flowchart of the multimodal thinking chain large model attack method for physical environment in this embodiment, which mainly includes three stages: cross-modal toxicity mitigation mechanism, physical space adversarial induction system, and pseudo-security logic construction engine.

[0012] A multimodal thinking chain attack method for physical environments utilizes semantic hierarchical parsing and image-text co-coding to achieve distributed embedding of risk elements, interferes with the multimodal verification mechanism by leveraging physically printable samples, and triggers the vulnerability path by disguising security verification through a dual logical architecture. The method includes the following steps:

[0013] Step 1: First, establish a cross-modal toxicity mitigation mechanism. Decouple harmful information into harmless components through semantic hierarchical parsing technology, and realize the distributed embedding of risk elements by utilizing the co-coding characteristics of image and text.

[0014] Step 1.1: Decouple the input statement S from risk by generating independent semantic units using a dynamic semantic segmentation algorithm. The input is segmented to generate candidate segments, which are then risk-labeled. Candidate phrases labeled as risky are merged to form a risk phrase set. The remaining text that does not belong to any risk label will be merged into a set of safe text fragments. The formula for the dynamic semantic partitioning algorithm is:

[0015]

[0016] in, Represents the cross-modal correlation operator. This represents the n secure text fragments that have been disassembled, where the index i is the index of the secure text fragment, i∈{1,2,...,n}. Let j represent the set of m risk phrases that have been decomposed, where the index j is the index of the risk phrase, and j∈{1,2,...,m}.

[0017] Step 1.2: The segmented safe text fragments and risk phrase sets are co-encoded by an image-text co-encoder, and the feature representation of each fragment is calculated. The risk semantics are distributed into multiple regions of the input to achieve distributed embedding of risk elements.

[0018] Step 1.3, using the multimodal discriminator M d The confidence level of the decomposition results is verified to ensure the safety of the text fragment L. i and risk phrase set P j After discriminator M d The calculated values ​​are all less than a predefined threshold.

[0019] max(M d (L i ),M d (P j ))<γ

[0020] Where γ is a pre-set threshold.

[0021] Step 2: Develop a physical space adversarial inducement system, introduce printable adversarial samples of the physical environment into the visual channel, and generate the final physical attack prompt through a modal alignment mechanism.

[0022] Step 2.1: Construct semantically equivalent visual adversarial examples using a pre-trained generative model:

[0023]

[0024] Among them, P risk Let G be the risk phrase space, and G represent a pre-trained generative model used to generate high-risk phrases P.j Converted into corresponding visual adversarial sample I j E represents the cross-modal encoder, and η controls the semantic similarity gradient.

[0025] Step 2.2: Through a multimodal fusion mechanism, combine visual adversarial examples and corresponding designs of an equal number of secure alternative phrases T. k Alignment generates final physical attack hints:

[0026]

[0027] Where F is an alignment function used to align the generated visual adversarial sample I k Safety Alternative Phrase T k Alignment, ω k It is a weighted coefficient, passed by the multimodal discriminator M d Safety alternative phrase T k gradient information The normalized function σ is calculated. The subscript k is the alignment unit index, k∈{1,2,...,m}.

[0028] Step 3: Design a pseudo-security logic construction engine. Using physically printable samples, the results of dangerous target identification are directed to the semantically nearest security category. Physically printable jailbreak samples are used to embed the security logic chain into pre-defined thought breakpoints.

[0029] Step 3.1: Add the pixels of the final physical attack cues to the original danger image input, fuse the final physical attack cues and the original danger image input to construct a physical space adversarial example, and simultaneously input the example into multiple victim model sets. A multi-model joint optimization objective is constructed, and pixel perturbations that satisfy amplitude constraints are solved to guide the dangerous target identification results to the semantic nearest neighbor safety category:

[0030]

[0031] Where x is the original dangerous image input; Δ is the final physical attack hint generated in step 2.2 and requiring continuous optimization; ||·|| ∞ ≤ε means that the largest absolute value among all components does not exceed a preset value ε, used to constrain the magnitude of the perturbation; Q is the number of victim models, q is the model index; f θ(q) Denotes the q-th victim model; β q These are the weighting coefficients for the model; y safe This is a collection of safety category tags. It is the square of the Euclidean distance, and we need to minimize the Euclidean distance between the two as much as possible.

[0032] Step 3.2, at the level of physical executability constraints, generate printable adversarial examples and jailbreak attack adversarial examples in a physical environment, using the following formula:

[0033] Φ′=arg min Φ [L attack (f θ (x′+Φ),y safe )+λ1ΔE(Φ)+λ2‖F(Φ)-F printer ||2]

[0034] Where, Φ′=arg min Φ [·] indicates the optimal printable perturbation; x′ indicates the final perturbation Δ added in step 3.1. * The adversarial example; Φ represents the physical executable perturbation to be optimized applied to x′; This represents the perturbation synthesis operator, which adds the perturbation Φ to x′ to generate a new perturbation image; y safe A collection of safety category labels; f θ L represents the victim model that processes the new perturbation image; attack (·) is the attack target loss function, used to measure the difference between the model output and the security category label y. safe The difference; ΔE(·) calculates the color distortion, F printer λ1 and λ2 represent the printer's color gamut feature space, and are balancing factors used to balance attack effectiveness and physical realizability.

[0035] The final generated perturbation Φ′ is added to the adversarial sample x′ to obtain the final printable adversarial sample and jailbreak attack adversarial sample I. final The formula is:

[0036]

[0037] Step 3.3, compare the final printable adversarial sample with the jailbreak attack adversarial sample I. final It embeds itself into a pre-defined thought breakpoint, that is, into the image input link in the reasoning process of the multimodal large model thought chain, thereby carrying out a jailbreak attack on the multimodal large model thought chain in a physical environment.

[0038] The above description is only a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. Any equivalent modifications or changes made by those skilled in the art based on the content disclosed in the present invention should be included within the scope of protection set forth in the claims.

Claims

1. A method for attacking large-scale multimodal thought chains in a physical environment, characterized by: The method includes the following steps: Step 1: First, establish a cross-modal toxicity mitigation mechanism. Decouple harmful information into harmless components through semantic hierarchical parsing technology, and realize the distributed embedding of risk elements by utilizing the co-coding characteristics of image and text. Step 2: Develop a physical space adversarial inducement system, introduce printable adversarial samples of the physical environment into the visual channel, and generate the final physical attack prompt through a modal alignment mechanism; Step 3: Design a pseudo-security logic construction engine. Using physically printable samples, the results of dangerous target identification are directed to the semantically nearest security category. Physically printable jailbreak samples are used to embed the security logic chain into pre-defined thought breakpoints.

2. The method for attacking large-scale multimodal thought chains in a physical environment according to claim 1, characterized in that: Step 1 includes the following sub-steps: Step 1.1: Decouple the input statement S from risk by generating independent semantic units using a dynamic semantic segmentation algorithm. The input is segmented to generate candidate segments, which are then risk-labeled. Candidate phrases labeled as risky are merged to form a risk phrase set. The remaining text that does not belong to any risk label will be merged into a set of safe text fragments. The formula for the dynamic semantic partitioning algorithm is: in, Represents the cross-modal correlation operator. This represents the n secure text fragments that have been disassembled, where the index i is the index of the secure text fragment, i∈{1,2,...,n}. Let j represent the set of m risk phrases that have been decomposed, where the index j is the index of the risk phrase, and j∈{1,2,...,m}. Step 1.2: The segmented safe text fragments and risk phrase sets are co-encoded by an image-text co-encoder, and the feature representation of each fragment is calculated. The risk semantics are distributed into multiple regions of the input to achieve distributed embedding of risk elements. Step 1.3, using the multimodal discriminator M d The confidence level of the decomposition results is verified to ensure the safety of the text fragment L. i and risk phrase set P j After discriminator M d The calculated values ​​are all less than a predefined threshold. max(M d (L i ),M d (P j ))<c Where γ is a pre-set threshold.

3. The method for attacking large-scale multimodal thought chains in a physical environment according to claim 1, characterized in that: Step 2 includes the following sub-steps: Step 2.1: Construct semantically equivalent visual adversarial examples using a pre-trained generative model: Among them, P risk Let G be the risk phrase space, and G represent a pre-trained generative model used to generate high-risk phrases P. j Converted into corresponding visual adversarial sample I j E represents the cross-modal encoder, and η controls the semantic similarity gradient. Step 2.2: Through a multimodal fusion mechanism, combine visual adversarial examples and corresponding designs of an equal number of secure alternative phrases T. k Alignment generates final physical attack hints: Where F is an alignment function used to align the generated visual adversarial sample I k Safety Alternative Phrase T k Alignment, ω k It is a weighted coefficient, passed by the multimodal discriminator M d Safety alternative phrase T k gradient information The normalized function σ is calculated. The subscript k is the alignment unit index, k∈{1,2,...,m}.

4. The method for attacking large-scale multimodal thought chains in a physical environment according to claim 1, characterized in that: Step 3 includes the following sub-steps: Step 3.1: Add the pixels of the final physical attack cues to the original danger image input, fuse the final physical attack cues and the original danger image input to construct a physical space adversarial example, and simultaneously input the example into multiple victim model sets. A multi-model joint optimization objective is constructed, and pixel perturbations that satisfy amplitude constraints are solved to guide the dangerous target identification results to the semantic nearest neighbor safety category: Where x is the original dangerous image input; Δ is the final physical attack hint generated in step 2.2 and requiring continuous optimization; ||·|| ∞ ≤ε means that the largest absolute value among all components does not exceed a preset value ε, used to constrain the magnitude of the perturbation; Q is the number of victim models, q is the model index; f θ(q) Denotes the q-th victim model; β q These are the weighting coefficients for the model; y safe This is a collection of safety category tags. It is the square of the Euclidean distance, and we need to minimize the Euclidean distance between the two as much as possible. Step 3.2, at the level of physical executability constraints, generate printable adversarial examples and jailbreak attack adversarial examples in a physical environment, using the following formula: Φ′=argmin Φ [L attack (f θ (x′+Φ),y safe )+λ1ΔE(Φ)+λ2‖F(Φ)-F printer ‖2] Where, Φ′=argmin Φ [·] indicates the optimal printable perturbation; x′ indicates the final perturbation Δ added in step 3.

1. * The adversarial example; Φ represents the physical executable perturbation to be optimized applied to x′; This represents the perturbation synthesis operator, which adds the perturbation Φ to x′ to generate a new perturbation image; y safe A collection of safety category labels; f θ L represents the victim model that processes the new perturbation image; attack (·) is the attack target loss function, used to measure the difference between the model output and the security category label y. safe The difference; ΔE(·) calculates the color distortion, F printer λ1 and λ2 represent the printer's color gamut feature space, and are balancing factors used to balance attack effectiveness and physical realizability. The final generated perturbation Φ′ is added to the adversarial sample x′ to obtain the final printable adversarial sample and jailbreak attack adversarial sample I. final The formula is: Step 3.3, compare the final printable adversarial sample with the jailbreak attack adversarial sample I. final It embeds itself into a pre-defined thought breakpoint, that is, into the image input link in the reasoning process of the multimodal large model thought chain, thereby carrying out a jailbreak attack on the multimodal large model thought chain in a physical environment.

Images