Method and device for evaluating robustness of large visual language model based on multi-agent adversarial game

Abstract

This invention discloses a method and apparatus for robustness evaluation of large-scale visual language models based on multi-agent adversarial game theory. The proposed scheme includes: loading the source model and the target model to be evaluated, and constructing a test dataset; constructing an adversarial game environment and initializing the attacking agents; generating the final adversarial image by optimizing the latent feature similarity loss and the masked answer anti-recovery loss enhanced by the large language model; generating the final adversarial text through cognitive debate attack or input semantic attack; swapping the roles of the first and second attacking agents to generate a new round of adversarial image-text pairs, which are then input into the target visual language model for testing, simulating the game process of the attacker continuously adjusting their strategy; calculating the robustness evaluation index of the target model and generating a robustness evaluation report. This invention is used for high-intensity testing and robustness evaluation of the security of visual language models in near-realistic complex and dynamic adversarial environments.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology, specifically relating to a method and apparatus for robustness evaluation of large-scale visual language models based on multi-agent adversarial game theory. In particular, this invention systematically evaluates the security performance and robustness of large-scale visual language models against coordinated and persistent attacks by simulating dynamic and interactive multimodal adversarial environments. Background Technology

[0002] In today's society, with the widespread application of Large Vision-Language Models (LVLMs), adversarial robustness in LVLMs has become a key focus for their secure implementation. However, existing methods for evaluating model robustness have significant limitations, failing to accurately reflect their performance in complex, dynamic adversarial environments. Specific problems include:

[0003] 1. Static Evaluation Scenario: Most mainstream evaluation methods follow a static "single attack - single evaluation" model, where an adversarial sample is generated from an input sample and then tested. This method cannot simulate the continuous adversarial process between real attack and defense systems, nor the dynamic process of strategy evolution, and cannot measure the performance degradation and stability of the model under long-term game conditions.

[0004] 2. Isolation of Attack Patterns: Existing research mostly focuses on single-modal attacks (such as image perturbation and text rewriting) or simple combinations of multimodal attacks, lacking research on mechanisms for coordinating different attack strategies within a unified framework and enabling them to cooperate and evolve. This results in evaluation results failing to reveal the true vulnerability of models when facing coordinated multimodal attacks.

[0005] 3. Lack of strategic interaction: In current assessment frameworks, attackers are typically fixed, and their strategies are set and not changed. This ignores the fact that attackers can dynamically change their attack methods (such as switching between image attacks and text attacks), making the assessment environment too idealized and inconsistent with real threats.

[0006] In summary, there is an urgent need in this field for an evaluation framework capable of simulating dynamic, interactive, and policy-evolving adversarial environments. This framework can generate continuously evolving multimodal adversarial examples through multi-agent collaboration and competition, thereby enabling a more comprehensive and rigorous systematic evaluation of the robustness of large-scale visual language models and enhancing model security. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a method and system for robustness evaluation of large-scale visual language models based on multi-agent adversarial game theory. This method aims to simulate a real adversarial environment by constructing a dynamic game framework that includes role switching and strategy iteration, thereby achieving a high-intensity, systematic evaluation of the model's robustness.

[0008] The objective of this invention is achieved through the following technical solution:

[0009] This invention discloses a robustness evaluation method for large-scale visual language models based on multi-agent adversarial game theory. Its core lies in constructing a dynamic adversarial game framework comprising two attacking agents and a central evaluation module. The method is characterized by the following steps:

[0010] S1: Provide a pre-trained visual language model as the source model and multiple structurally heterogeneous visual language models as target models; construct a test dataset, including selecting image-text pairs that can be correctly predicted by all target models from the image-text pair set, and randomly selecting them from the selection results; preprocess the image data and text data in the test dataset respectively;

[0011] S2: Construct an adversarial game environment and assign initial attack roles to the first and second attacking agents;

[0012] S3: The first attacking agent receives the preprocessed image-text pair and the current iteration adversarial image-text pair as input. By optimizing the latent feature similarity loss and the masked answer anti-recovery loss enhanced by the large language model, it generates the final adversarial image.

[0013] S4: When the triggering condition is met, the second attacking agent receives the final adversarial image and the current adversarial text, and generates the final adversarial text through cognitive debate attack or input semantic attack;

[0014] S5: After completing the first round of attack, switch the roles of the first attacking agent and the second attacking agent, and repeat steps S3 to S4 to generate a new round of adversarial image-text pairs. Input the adversarial image-text pairs of the first round of attack and the new round of attack into the target visual language model for testing, simulating the game process of the attacker continuously adjusting the strategy.

[0015] S6: Based on the model output collected during the multi-round game, calculate the comprehensive evaluation index and generate a risk assessment report.

[0016] In step S1, a pre-trained visual language model is provided as the source model, and multiple structurally heterogeneous visual language models are provided as target models; a test dataset is constructed, including selecting image-text pairs that can be correctly predicted by all target models from the image-text pair set, and randomly selecting them from the selection results; the image data and text data in the test dataset are preprocessed respectively.

[0017] Furthermore, accurate predictions include:

[0018] A prediction is considered correct when all target models' predicted answers for image-text pairs match the answer with the highest VQA score.

[0019] VQA score is the frequency of occurrence in human-referenced answers;

[0020] Furthermore, the preprocessing includes:

[0021] Image data is standardized by normalizing pixel values ​​to the range of [0,1].

[0022] The text problem is segmented into words, and then encoded using the tokenizer corresponding to the model.

[0023] In step S2, an adversarial game environment is constructed, and initial attack roles are assigned to the first and second attacking agents.

[0024] This step assigns initial attack roles to the first and second attack agents. The first attack agent is initially responsible for image adversarial attacks, and the second attack agent is initially responsible for text adversarial attacks.

[0025] In step S3, the first attacking agent receives the preprocessed image-text pair and the current iteration adversarial image-text pair input, and generates the final adversarial image by optimizing the latent feature similarity loss and the masked answer anti-recovery loss enhanced by the large language model.

[0026] In the source model, clean image-text pairs and the current iterative adversarial image-text pairs are forward propagated as input. Latent features are extracted from each layer of the image encoder and the multimodal encoder, respectively. The latent feature loss and the gradient of the loss with respect to the current adversarial image are calculated. The image is updated using the projective gradient descent method. The image is cropped under preset step size and preset norm constraints to obtain the initial adversarial image.

[0027] Call the large language model API to build a prompt template, combine the current adversarial text and the correct answer into a coherent sentence, then mask the answer part, and input it into the source model along with the initial adversarial image to calculate the masked answer anti-recovery loss and the gradient of the loss with respect to the initial adversarial image input. Perform projective gradient descent update, and crop within a preset image perturbation budget under the same preset step size and preset norm constraints to obtain the enhanced adversarial image.

[0028] In step S4, when the triggering condition is met, the second attacking agent receives the final adversarial image and the current adversarial text, and generates the final adversarial text through cognitive debate attack or input semantic attack.

[0029] Furthermore, the triggering condition in step S4 is:

[0030]

[0031] M represents the total number of iterations, |W| represents the number of informative words in the text, i.e., the number of keywords that actually contribute to the answer after removing stop words, and · represents the floor function. The calculated interval value represents the number of iteration steps between two triggers of cross-modal joint attacks. The +1 operation is to avoid attacking the text only in the last iteration, ensuring that the triggering steps are evenly distributed throughout the iteration process; m represents the current iteration number, and mod represents the remainder operation. When the remainder is 0, that is, m mod interval value = 0, then the current step m is the trigger point. This formula dynamically controls the triggering frequency through the total number of iterations M and the number of information words |W|, ensuring that the text perturbation is updated only in the critical steps, while co-optimizing with image perturbation.

[0032] Furthermore, cognitive argumentative attacks include:

[0033] The debate process follows a four-round dialogue structure to ensure the depth and logical integrity of the arguments:

[0034] Round 1: The opening statement is given by the opposing agent;

[0035] Round Two: The agents who agree with the position will give their opening statements and refute the arguments from the first round;

[0036] The third round: The opposing agent refutes the arguments from the second round and further summarizes its own evidence;

[0037] The fourth round: The agents who agree with the position will make the final rebuttal and give their concluding remarks;

[0038] After the debate, the summary text generated by the opposing agent in the third round is taken as the adversarial text. This attack mode is suitable for the stability test of viewpoints, but not for the standard VQA task, in order to ensure the depth of the argument and the integrity of the logic.

[0039] Furthermore, input semantic attacks include:

[0040] The second attacking agent modifies the information words in the original text based on gradient information and synonym replacement, generating semantically similar adversarial questions as adversarial text.

[0041] In the initialization phase, the BERT-Attack strategy is used to predict the top-K context-similar words for each word in the original text, forming a candidate synonym set C = {c i,j |i∈W,1≤j≤K}, where W is the set of real word indices after filtering stop words, and this set remains fixed in subsequent iterations;

[0042] When the triggering condition is met in the current iteration, the gradient of the joint loss with respect to the word embedding is calculated, and the perturbed word vectors are estimated in the embedding space.

[0043] Calculate the cosine similarity between candidate words and estimated vectors, and sort them in descending order to obtain the replacement order;

[0044] The words with the highest similarity are selected sequentially from the replacement order and replaced with the original words to form new text;

[0045] If the similarity of the replaced sentence encoder is greater than the threshold, the replacement is accepted and the remaining candidates for that word are locked; otherwise, the process is repeated until the process is complete and the final adversarial text is output.

[0046] In step S5, after completing the first round of attack, the roles of the first attacking agent and the second attacking agent are swapped, and steps S3 to S4 are repeated to generate a new round of adversarial image-text pairs. The adversarial image-text pairs of the first round of attack and the new round of attack are then input into the target visual language model for testing, simulating the game process of the attacker continuously adjusting the strategy.

[0047] After completing the first round consisting of M iterations, the final adversarial image-text pair generated by steps S3 and S4 is input into the first target visual language model to be evaluated to obtain its first output answer. This adversarial image-text pair will cause the target model to make incorrect predictions.

[0048] The roles of the first and second attacking agents are swapped, and steps S3 to S4 are repeated to generate a second adversarial sample. This sample is then input into the second target visual language model to be evaluated, and its second output answer is obtained. This process simulates the attacker changing strategies in the game, thereby testing the robustness of the target model against different attack sources.

[0049] In step S6, based on the model output collected during the multi-round game, a comprehensive evaluation index is calculated, and a risk assessment report is generated.

[0050] The comprehensive evaluation metrics include: attack success rate, answer numerical offset, multi-round robustness decay rate, and output confidence fluctuation.

[0051] This invention also provides a robustness evaluation device for large-scale visual language models based on multi-agent adversarial games, the device comprising the following modules:

[0052] The model loading and dataset building module is used to load the source model and the target model to be evaluated, build the test dataset and perform preprocessing.

[0053] Initialization module: Constructs the adversarial game environment and initializes the attacking agent;

[0054] Image adversarial attack module, used to execute image adversarial attacks;

[0055] The text adversarial attack module is used to execute text adversarial attacks;

[0056] The role swapping and testing module is used to swap the roles of the first and second attacking agents and test the target model.

[0057] The central evaluation module is used to calculate the robustness evaluation index of the target model and generate a robustness evaluation report.

[0058] The above technical solution has the following advantages or beneficial effects:

[0059] 1. More realistic evaluation scenarios: By constructing a multi-agent adversarial game framework and introducing role swapping and multi-round iteration methods, a complex attack environment with dynamic, interactive, and strategy evolution is simulated. This solves the limitations of most existing static and single-modal evaluations, making the evaluation results more reflective of the model's security performance in the real world.

[0060] 2. Collaborative and Adaptive Attack Strategies: The framework allows for flexible selection of two text attack modes based on different principles, and can collaborate with image attacks. Through a role-swapping mechanism, the attack strategies are dynamically adjusted and evolved, automatically exploring effective attack combinations, thereby enhancing the strength and intelligence of the assessment.

[0061] 3. Comprehensive and in-depth evaluation dimensions: It not only focuses on the success rate of a single attack (ASR), but also introduces opinion shift quantification (Δscore), output confidence fluctuation (σconf), and multi-round robustness decay rate (RDR). It comprehensively quantifies the robustness of the model from multiple dimensions such as instantaneous misleading, changes in model cognition, and long-term performance degradation, making the evaluation more in-depth and systematic.

[0062] 4. Revealing deep vulnerabilities: Through multi-round game theory and RDR metrics, it is possible to reveal the "fatigue" effect and performance degradation patterns of the model when subjected to continuous and variant attacks, which helps to discover deeper and more hidden security vulnerabilities in the model. Attached Figure Description

[0063] Figure 1 This is a flowchart of the robustness evaluation method for large-scale visual language models based on multi-agent adversarial game theory provided by the present invention.

[0064] Figure 2 This is a detailed technical diagram of step S3.

[0065] Figure 3 This is a detailed technical diagram of step S4.

[0066] Figure 4 This is a flowchart of the internal structure and data processing of step S6.

[0067] The accompanying drawings illustrate the overall process and key technical details in a way that is clearer and more hierarchical, aiming to demonstrate the core method of the present invention more clearly and systematically. Detailed Implementation

[0068] The present invention will be further described below with reference to the accompanying drawings and specific preferred embodiments, but this does not limit the scope of protection of the present invention.

[0069] Existing large-scale model jailbreaking techniques have significant limitations in security testing: for example, their attack effects are limited to specific prompt patterns, making it difficult to comprehensively assess the model's security boundaries; excessive computational resource consumption leads to a significant increase in testing costs; and low algorithm training efficiency affects the timeliness of evaluation work. This invention proposes a robustness evaluation method and device for large-scale visual language models based on multi-agent adversarial game theory. The main innovations of this technology are as follows:

[0070] 1. A novel method and apparatus for evaluating the robustness of large-scale visual language models are proposed. It conventionally combines cross-modal adversarial attack techniques with a self-debate mechanism and constructs a multi-agent adversarial game framework to achieve dynamic, continuous, and multi-strategy collaborative robustness evaluation.

[0071] 2. The innovative introduction of role-swapping mechanism and cross-modal joint attack triggering strategy enables the attacking agent to dynamically adjust its attack strategy during the game, simulating the behavior patterns of attackers in the real world, and significantly improving the comprehensiveness and accuracy of the evaluation.

[0072] 3. A multi-round robust decay rate (RDR) quantification index is proposed, which can systematically evaluate the performance degradation law of the model in a continuous adversarial environment, and provide support for further in-depth research on model safety.

[0073] Terminology Explanation:

[0074] 1. Multi-agent adversarial game: refers to a technical framework that constructs multiple attacking agents in the evaluation system and continuously generates adversarial samples through role switching and strategy evolution to simulate a real adversarial environment.

[0075] 2. Cross-modal joint attack: A method that applies perturbations to both image and text modalities simultaneously and achieves a cooperative attack by optimizing the joint loss function.

[0076] 3. Masked Answer Anti-Recovery Loss: This loss function design enhances adversarial sample transferability by preventing the model from recovering the masked correct answer.

[0077] 4. Self-debate mechanism: An attack strategy that allows different instances of the same model to debate on a specific issue, thereby undermining the model's initial position.

[0078] 5. Multi-round Robustness Degradation Rate (RDR): An innovative metric proposed in this invention, used to quantify the rate at which a model's performance degrades under continuous multi-round attacks, reflecting the model's long-term robustness.

[0079] 6. Clip operation: also known as "trimming operation", is defined as:

[0080]

[0081] The core of this method lies in constructing a multi-agent adversarial game environment, organically integrating cross-modal attack techniques and debate-based cognitive perturbation mechanisms, and establishing a dynamic, continuous, and multi-strategy collaborative evaluation framework to achieve a comprehensive evaluation of the robustness of large-scale visual language models in complex adversarial scenarios.

[0082] Corresponding model framework as follows Figure 1 As shown. The function of each part is analyzed in detail below:

[0083] In step S1, a pre-trained visual language model is provided as the source model, and multiple structurally heterogeneous visual language models are provided as target models; a test dataset is constructed, including selecting image-text pairs that can be correctly predicted by all target models from the image-text pair set, and randomly selecting them from the selection results; the image data and text data in the test dataset are preprocessed respectively.

[0084] The specific implementation is as follows: Load the pre-trained visual language model and use it as the source model. Specify multiple structurally heterogeneous target models As the evaluation object, those that can be used by all target models are selected. Accurately predicted image-text pairs ensure consistency in the evaluation benchmark.

[0085] A correct prediction is defined as one where all predictions from the target model for an image-text pair match the answer with the highest VQA score, which is the frequency of occurrence of the human-referenced answer. Specifically, a correct prediction is defined as one where the model's predicted answer appears among the 10 true reference answers and has the highest VQA score.

[0086] The sample pairs that have been answered correctly by all target models are retained. 6000 sample pairs are randomly selected from the VQAv2 validation set and 1000 sample pairs are randomly selected from the TextVQA validation set to ensure that the subsequent attack effect is caused only by adversarial perturbation.

[0087] The image data is standardized by normalizing the pixel values ​​to the range of [0,1]; the text is segmented and encoded using the tokenizer corresponding to the model.

[0088] In step S2, an adversarial game environment is constructed, and initial attack roles are assigned to the first and second attacking agents.

[0089] This step assigns initial attack roles to the first and second attack agents. The first attack agent is initially responsible for image adversarial attacks, and the second attack agent is initially responsible for text adversarial attacks.

[0090] like Figure 2 As shown, in step S3, the first attacking agent receives the preprocessed image-text pair and the current iteration adversarial image-text pair input, and generates the final adversarial image by optimizing the latent feature similarity loss and the masked answer anti-recovery loss enhanced by the large language model.

[0091] In each iteration of the VQAttack algorithm's main loop, the first attacking agent performs an image adversarial attack.

[0092] VQATTACK means the following:

[0093]

[0094] Let σ be the iterative attack function, and M be the number of iterations. i and σ s These are two hyperparameters that control the quality of adversarial images and text, defined as follows:

[0095]

[0096] σ i For the image perturbation budget, σ s This is the threshold for text semantic similarity.

[0097] Specifically, in the source model, the clean image-text pair (I,T) after forward propagation preprocessing and the current iteration adversarial image-text pair are inputs. Latent features are extracted from each layer of the image encoder and multimodal encoder (such as the last layer of ViLT), and then the latent feature loss is calculated. Represented as:

[0098]

[0099] Among them, L p ,L q D represents the number of layers in the image encoder and the multimodal encoder, respectively. p D q They are the number of input tokens, f and Using clean input (I,T) and perturbed input respectively. The resulting feature vector;

[0100] Using the automatic differentiation function of frameworks such as PyTorch, the loss is calculated with respect to the current adversarial image input. gradient The image is then updated using projective gradient descent, as follows:

[0101]

[0102] Where ∈ is the step size, and clipσ i For in l ∞ The pruning operation under norm constraints minimizes the similarity of latent features between clean and perturbed inputs;

[0103] The step size ∈ is set to 0.05, and the norm constraint l is used. ∞ Image perturbation budget σ i The initial adversarial image is obtained by cropping within 16 / 255.

[0104] First, call the large language model API (such as GPT-4). Build the suggestion template. For example: "Please combine the question '{Q}' and the answer '{A}' into a fluent sentence.", where {Q} is replaced with the current adversarial text. Replace {A} with the correct answer y i This generates coherent sentences. Then, the answer portion is masked to obtain the masked text. Compare the masked text with the initial adversarial image Input source model Computing mask answer with recovery loss Represented as:

[0105]

[0106] Calculate the gradient of the loss with respect to the initial adversarial image input, and perform projective gradient descent updates to ensure the perturbation is within norm constraints, thus obtaining the final adversarial image. Represented as:

[0107]

[0108] in Let I be the adversarial image output for the current iteration, and let clipσ be the preprocessed clean image that does not change with iteration. i For in l ∞ Clipping operations under norm constraints, σ i The image perturbation budget is preferably set to 16 / 255, and the text semantic similarity constraint σ is... s ∈[0.75,0.85], the step size of the projected gradient descent ∈[0.01,0.1], preferably, σ s =0.8, ∈ =0.05;

[0109] The range of values ​​for the input variable x is defined in the range [-σ, σ]. Values ​​outside this range are forcibly assigned the boundary value -σ or σ. σ>0 is a preset disturbance budget used to control the maximum amplitude of the disturbance.

[0110] like Figure 3 As shown, in step S4, when the triggering condition is met, the second attacking agent receives the final adversarial image and the current adversarial text, and generates the final adversarial text through cognitive debate attack or input semantic attack.

[0111] The triggering condition is:

[0112]

[0113] M represents the total number of iterations, |W| represents the number of informative words in the text, i.e., the number of keywords that actually contribute to the answer after removing stop words, and · represents the floor function. The calculated interval value represents the number of iteration steps between two triggers of cross-modal joint attacks. The +1 operation is to avoid attacking the text only in the last iteration, ensuring that the triggering steps are evenly distributed throughout the iteration process; m represents the current iteration number, and mod represents the remainder operation. When the remainder is 0, that is, m mod interval value = 0, then the current step m is the trigger point. This formula dynamically controls the triggering frequency through the total number of iterations M and the number of information words |W|, ensuring that the text perturbation is updated only in the critical steps, while co-optimizing with image perturbation.

[0114] This step introduces two attack modes:

[0115] Cognitive Debate Attack: The structured debate process follows a four-round dialogue structure to ensure the depth and logical integrity of the arguments.

[0116] Round 1: The opening statement is given by the opposing agent.

[0117] The second round: The agents who agree with the position will make an opening statement and refute the arguments from the first round.

[0118] The third round: The opposing agent refutes the arguments from the second round and further summarizes its own evidence.

[0119] The fourth round: The agents who agree with the position will make the final rebuttal and give their concluding remarks.

[0120] After the debate, the summary text generated by the opposing agent in the third round is taken as the adversarial text. This model is suitable for testing the stability of viewpoints, but not for standard VQA tasks, in order to ensure the depth and logical integrity of the argument.

[0121] Input semantic attack: The second attacking agent modifies the information words in the original text T based on gradient information and synonym substitution, generating semantically similar adversarial questions as adversarial text.

[0122] Specifically, in the initialization phase, the BERT-Attack strategy is used to predict the top-K context-similar words for each word of the original text T, forming a candidate synonym set C = {c i,j ∣i∈W,1≤j≤K}, where W is the set of content word indices after filtering stop words; this set remains fixed in subsequent iterations.

[0123] Calculate the joint loss function when the triggering condition is met in the current iteration. Regarding the word t i Embedded gradients And estimate the perturbed word vectors in the embedding space:

[0124]

[0125] Calculate candidate synonyms c i,j With the estimated vector E(t) i cosine similarity Replacement is performed based on cosine similarity scores from highest to lowest to obtain the replacement order.

[0126] Replacement order Extract the words with the highest similarity and replace the original words to form a new text. If the similarity of the general sentence encoder is after replacement If a replacement is accepted, the remaining candidates for that word are locked; otherwise, the process moves to the next highest similarity word, and continues until all words have been traversed. Where σ... s The value can be adjusted within the range of [0.75, 0.85] according to task requirements, with 0.8 being the preferred setting. U(·) is the universal sentence encoder ("U(·) is Google UniversalSentence Encoder v4"), and the output is the final adversarial text.

[0127] In step S5, after completing the first round of attack, the roles of the first attacking agent and the second attacking agent are swapped, and steps S3 to S4 are repeated to generate a new round of adversarial image-text pairs. The adversarial image-text pairs of the first round of attack and the new round of attack are then input into the target visual language model for testing, simulating the game process of the attacker continuously adjusting the strategy.

[0128] After completing the first round consisting of M iterations, the final adversarial image-text pair generated by steps S3 and S4 is input into the first target visual language model to be evaluated to obtain its first output answer. This adversarial image-text pair will cause the target model to make incorrect predictions.

[0129] The roles of the first and second attacking agents are swapped, and steps S3 to S4 are repeated to generate a second adversarial sample. This sample is then input into the second target visual language model to be evaluated, and its second output answer is obtained. This process simulates the attacker changing strategies in the game, thereby testing the robustness of the target model against different attack sources.

[0130] like Figure 4 As shown, in step S6, based on the model output collected during the multi-round game, a comprehensive evaluation index is calculated and a risk assessment report is generated.

[0131] Based on the model output collected during multiple rounds of game play, a comprehensive evaluation index is calculated:

[0132] Attack Success Rate (ASR) is calculated using the following formula:

[0133]

[0134] Where I(·) is the indicator function, N total This represents the total number of test samples.

[0135] The formula for calculating the output confidence level fluctuation is as follows:

[0136]

[0137] The multi-round robust decay rate (RDR) is calculated using the following formula:

[0138]

[0139] P0 represents the accuracy of the model in the initial round before the attack on the visual question-answering task; P K Let K be the accuracy of the model on the same test set after K rounds of adversarial attacks, where K is the accuracy of the model after the Kth round of adversarial attacks. For the multimodal adversarial examples generated in the Kth round, Acc(·) is the standard VQA accuracy calculation; after a total of K rounds of attacks, the average robustness decay rate is defined. RDR ∈ [0,1], the larger the RDR value, the more significant the decrease in robustness of the model in dynamic, continuous adversarial environments; the number of game rounds K ∈ [3,20], with K = 5 being preferred; P0, P K All are Top-1 accuracy rates.

[0140] When performing a cognitive debate attack in step S4, the effectiveness of the text attack is evaluated by quantifying the viewpoint shift δ of the model on a continuous scale [-10, 10] before and after the debate process. The calculation formula is as follows:

[0141] δ=|Score post-debate -Score pre-debate |

[0142] This score is the model's self-rating in opinion tests and is not applicable to standard visual question answering tasks; it is only applicable to performing cognitive argumentation attacks.

[0143] Based on the above quantitative indicators, a comprehensive robustness assessment report is generated, identifying the model's vulnerabilities under different attack strategies and providing targeted suggestions for model improvement.

[0144] This invention also provides a robustness evaluation device for large-scale visual language models based on multi-agent adversarial games, the device comprising the following modules:

[0145] The model loading and dataset building module is used to load the source model and the target model to be evaluated, build the test dataset and perform preprocessing.

[0146] Initialization module: Constructs the adversarial game environment and initializes the attacking agent;

[0147] Image adversarial attack module, used to execute image adversarial attacks;

[0148] The text adversarial attack module is used to execute text adversarial attacks;

[0149] The role swapping and testing module is used to swap the roles of the first and second attacking agents and test the target model.

[0150] The central evaluation module is used to calculate the robustness evaluation index of the target model and generate a robustness evaluation report.

[0151] The robustness evaluation device for large-scale visual language models based on multi-agent adversarial games proposed in this invention corresponds one-to-one with the aforementioned robustness evaluation method for large-scale visual language models based on multi-agent adversarial games in terms of operation process and functional effect. Therefore, the structure and operation process of the robustness evaluation device for large-scale visual language models based on multi-agent adversarial games will not be described again.

[0152] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of a necessary general-purpose hardware platform, or by a combination of hardware and software. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a computer product. The present invention can be implemented in the form of a computer program product on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Other embodiments may also be used. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A robustness evaluation method for large-scale visual language models based on multi-agent adversarial game theory, characterized in that, Includes the following steps: S1: Provide a pre-trained visual language model as the source model, and provide multiple structurally heterogeneous visual language models as the target models; Constructing a test dataset includes selecting image-text pairs from the image-text pair set that can be correctly predicted by all the target models, and randomly selecting them from the selection results; preprocessing the image data and text data in the test dataset respectively; S2: Construct an adversarial game environment and assign initial attack roles to the first and second attacking agents; S3: The first attacking agent receives the preprocessed image-text pair and the current iterative adversarial image-text pair input, and generates the final adversarial image by optimizing the latent feature similarity loss and the masked answer anti-recovery loss enhanced by the large language model; S4: When the triggering condition is met, the second attacking agent receives the final adversarial image and the current adversarial text, and generates the final adversarial text through cognitive debate attack or input semantic attack; S5: After completing the first round of attack, switch the roles of the first attacking agent and the second attacking agent, and repeat steps S3 to S4 to generate a new round of adversarial image-text pairs. Input the adversarial image-text pairs of the first round of attack and the new round of attack into the target visual language model for testing, simulating the game process of the attacker continuously adjusting the strategy. S6: Based on the model output collected during the multi-round game, calculate the comprehensive evaluation index and generate a risk assessment report.

2. The robustness evaluation method for large-scale visual language models based on multi-agent adversarial game theory according to claim 1, characterized in that, In step S1: The correct predictions include: A prediction is considered correct when all the target models' predicted answers for the image-text pair match the answer with the highest VQA score. The VQA score is the frequency of occurrence in human-referenced answers; The preprocessing includes: Image data is standardized by normalizing pixel values ​​to the range of [0,1]. The text problem is segmented into words, and then encoded using the tokenizer corresponding to the model.

3. The robustness evaluation method for large-scale visual language models based on multi-agent adversarial game theory according to claim 1, characterized in that, In step S3: In the source model, clean image-text pairs and the current iterative adversarial image-text pairs are forward-propagated as inputs. Latent features are extracted from each layer of the image encoder and the multimodal encoder, respectively. The latent feature loss and the gradient of the loss with respect to the current adversarial image are calculated. The image is updated using the projective gradient descent method. The image is cropped within a preset image perturbation budget under preset step size and preset norm constraints to obtain the initial adversarial image. Call the large language model API to build a prompt template, combine the current adversarial text and the correct answer into a coherent sentence, then mask the answer part, and input it into the source model along with the initial adversarial image to calculate the masked answer anti-recovery loss and the gradient of the loss with respect to the initial adversarial image input. Perform projective gradient descent update, and crop within a preset image perturbation budget under the same preset step size and preset norm constraints to obtain the enhanced adversarial image.

4. The robustness evaluation method for large-scale visual language models based on multi-agent adversarial game theory according to claim 1, characterized in that, In step S4, the triggering condition is: M represents the total number of iterations, and |W| represents the number of informative words in the text, that is, the number of keywords that actually contribute to the answer after removing stop words. This represents the floor function. The calculated interval value represents the number of iteration steps between two triggers of cross-modal joint attacks. The +1 operation is to avoid attacking the text only in the last iteration, ensuring that the triggering steps are evenly distributed throughout the iteration process; m represents the current iteration number, and mod represents the remainder operation. When the remainder is 0, that is, m mod interval value = 0, then the current step m is the trigger point. This formula dynamically controls the triggering frequency through the total number of iterations M and the number of information words |W|, ensuring that the text perturbation is updated only in the critical steps, while co-optimizing with image perturbation.

5. The robustness evaluation method for large-scale visual language models based on multi-agent adversarial game theory according to claim 4, characterized in that, In step S4: Cognitive argumentative attacks include: The debate process follows a four-round dialogue structure to ensure the depth and logical integrity of the arguments: Round 1: The opening statement is given by the opposing agent; Round Two: The agents who agree with the position will give their opening statements and refute the arguments from the first round; The third round: The opposing agent refutes the arguments from the second round and further summarizes its own evidence; The fourth round: The agents who agree with the position will make the final rebuttal and give their concluding remarks; After the debate, the summary text generated by the opposing agent in the third round is taken as the adversarial text. This attack mode is suitable for the stability test of viewpoints, but not for the standard VQA task, in order to ensure the depth of the argument and the integrity of the logic. Input semantic attacks include: The second attacking agent modifies the information words in the original text based on gradient information and synonym replacement, generating semantically similar adversarial questions as adversarial text. In the initialization phase, the BERT-Attack strategy is used to predict the top-K context-similar words for each word in the original text, forming a candidate synonym set C = {c i,j |i∈W,1≤j≤K}, where W is the set of real word indices after filtering stop words, and this set remains fixed in subsequent iterations; When the triggering condition is met in the current iteration, the gradient of the joint loss with respect to the word embedding is calculated, and the perturbed word vector is estimated in the embedding space; Calculate the cosine similarity between candidate words and estimated vectors, and sort them in descending order to obtain the replacement order; The words with the highest similarity are sequentially selected from the replacement order and used to replace the original words to form new text; If the similarity of the replaced sentence encoder is greater than the threshold, the replacement is accepted and the remaining candidates for that word are locked; otherwise, the process is repeated until the process is complete and the final adversarial text is output.

6. The robustness evaluation method for large-scale visual language models based on multi-agent adversarial game theory according to claim 1, characterized in that, Step S5 includes: After completing the first round consisting of M iterations, the final adversarial image-text pair generated by steps S3 and S4 is input into the first target visual language model to be evaluated to obtain its first output answer. This adversarial image-text pair will cause the target model to make incorrect predictions. The roles of the first attack agent and the second attack agent are swapped, and steps S3 to S4 are repeated to generate a second adversarial sample. This sample is then input into the second target visual language model to be evaluated, and its second output answer is obtained. This process simulates the attacker changing strategies in a game, thereby testing the robustness of the target model against different attack sources.

7. The robustness evaluation method for large-scale visual language models based on multi-agent adversarial game theory according to claim 1, characterized in that, In step S6, the comprehensive evaluation indicators include: attack success rate, answer value offset, multi-round robustness decay rate, and output confidence fluctuation.

8. A robustness evaluation device for large-scale visual language models based on multi-agent adversarial game theory, characterized in that, Includes the following modules: The model loading and dataset building module is used to load the source model and the target model to be evaluated, build the test dataset and perform preprocessing. Initialization module: Constructs the adversarial game environment and initializes the attacking agent; Image adversarial attack module, used to execute image adversarial attacks; The text adversarial attack module is used to execute text adversarial attacks; The role swapping and testing module is used to swap the roles of the first and second attacking agents and test the target model. The central evaluation module is used to calculate the robustness evaluation index of the target model and generate a robustness evaluation report.

Images