A jailbreak attack method based on a visual language model with preference feedback
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-03-31
- Publication Date
- 2026-08-11
Smart Images
Figure CN122548743A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a jailbreak attack method based on a visual language model with preference feedback, belonging to the field of artificial intelligence technology. Background Technology
[0002] With the widespread application of large visual language models (LVLMs) in multimodal tasks such as autonomous driving and medical image analysis, their capabilities in perception, reasoning, and generation are increasingly enhanced, making them a core component of multimodal artificial intelligence systems. However, although most LVLMs are constrained during training using secure alignment techniques to ensure their output aligns with human values, they still face serious security threats in practical deployments, particularly the issue of "jailbreak attacks." Attackers can induce models to generate responses containing dangerous, illegal, or unethical content by applying carefully designed adversarial perturbations to visual or text input, severely compromising the model's security and reliability. Therefore, most existing model security tests evaluate models using jailbreak attack methods.
[0003] Current jailbreak attack methods used for security testing can be mainly divided into two categories: prompt engineering based on fixed templates and adversarial sample generation based on optimization methods. In the direction of adversarial sample generation, existing methods are usually optimized with two proxy goals: one is the likelihood of predefined harmful response templates, and the other is the toxicity score based on external toxicity scoring APIs (such as Perspective API[6]). However, both of these optimization goals have fundamental defects. Template likelihood cannot effectively identify fake jailbreak responses; while there is a significant deviation between toxicity scores and security assessments based on human preferences, and it cannot accurately reflect the real degree of harm pursued by jailbreak attacks. This mismatch between goals and methods leads to the generated adversarial samples often deviating from the attacker's real intentions, especially when facing LVLMs with strong security alignment, the effect is limited.
[0004] Furthermore, most existing methods rely on white-box access to the gradient information inside the target model. In real-world black-box scenarios (where only text output can be obtained through API queries), their attack effectiveness drops significantly. A few black-box attack methods also face problems such as low query efficiency and slow convergence of optimization trajectories.
[0005] Therefore, there is an urgent need for a jailbreak attack method that can optimize adversarial samples with higher query efficiency and greater accuracy under a black-box setup, and can truly reflect the harmfulness of the output. Summary of the Invention
[0006] To overcome the above problems, in-depth research was conducted, and a jailbreak attack method based on a visual language model with preference feedback was proposed, including the following steps:
[0007] S1. Construct a preference feedback signal to describe the relative harmfulness of the output of different adversarial image-induced visual language models;
[0008] S2. Set a harmfulness score to transform the preference feedback signal into an optimizable objective function;
[0009] S3. Based on an optimizable objective function, obtain the image with the highest harmfulness score among different adversarial images and use it as the attack image;
[0010] S4. Using the attack image as input to the visual language model, evaluate the security of the visual language model based on the text response output by the visual language model.
[0011] In a preferred embodiment, S1 includes the following steps:
[0012] S11. Based on the original image, generate two different image perturbations to obtain two adversarial images;
[0013] S12. The two adversarial images are combined with the given malicious text prompts to form two inputs, which are then input into the visual language model to be attacked. The visual language model outputs two text responses.
[0014] S13. Using the referee model, determine which of the two text responses is more harmful and output a binary preference feedback signal.
[0015] In a preferred embodiment, step S2 includes the following sub-steps:
[0016] S21. Perform preference probability modeling;
[0017] S22. Construct a harmfulness score based on a preference probability model;
[0018] S23. The optimization objective is to find adversarial images that maximize harmful scores.
[0019] In a preferred embodiment, in S21, by introducing the Bradley-Terry model, the binary feedback result is modeled as a potential continuous preference intensity function, characterizing the probability that the image is more harmful, expressed as:
[0020]
[0021] in, Representing an image Compared to images The probability of being more harmful, This represents a potential preference strength function.
[0022] In a preferred embodiment, in S22, the harmfulness score is the image during the attack process. The probability of being considered more harmful than other images among all images is expressed as:
[0023]
[0024] in, Representing an image Harmfulness score, Represents the set of all images. The normalization constant is For the image collection excluding images Other images besides those shown.
[0025] In a preferred embodiment, S3 includes the following sub-steps:
[0026] S31. Construct a dataset with multiple perturbation image pairs, each image pair containing two perturbation images and corresponding preference feedback signals;
[0027] S32. Obtain the optimal estimate of the latent preference intensity function through the Gaussian model;
[0028] S33. Search for the image with the highest harmfulness score in the dataset.
[0029] In a preferred embodiment, in S32, for a given dataset, the Gaussian process can provide the posterior distribution of the latent preference intensity function on any pair of images, namely the predicted mean and the predicted variance, where the predicted mean is the optimal estimate of the latent preference intensity function, and the variance represents the uncertainty of the estimate.
[0030] In a preferred embodiment, in S33, a collection function is set to search the dataset. The collection function is divided into two stages: the first stage is the utilization stage and the second stage is the exploration stage.
[0031] In the first stage, the image with the highest harmfulness score under the current Gaussian process posterior estimation is selected as the first image in the image pair;
[0032] In the second stage, when selecting an image to be combined with the image with the highest harmfulness score to form an image pair, the image with the largest posterior prediction variance is selected as the second image of the new image pair;
[0033] Repeat the search multiple times to obtain the image with the highest harmfulness score, and use it as the attack image.
[0034] The present invention also provides an electronic device, comprising:
[0035] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform any of the methods described above.
[0036] The present invention also provides a computer-readable storage medium storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method described in any of the preceding claims.
[0037] The beneficial effects of this invention include:
[0038] (1) The preference feedback based on the judge's big language model is introduced as the optimization signal, and the "harm score" is defined as the attack target. This score is calculated by comparing the harm of the adversarial sample output pairwise and averaging the integrals. This can more accurately quantify the real harm of the content generated by the adversarial sample, overcome the shortcomings of traditional proxy indicators (template likelihood, toxicity score) that cannot accurately reflect the real security risks, and make the attack optimization process directly aligned with the fundamental goal of "maximizing the harm of the output", thereby generating adversarial samples with stronger harm.
[0039] (2) The potential preference function is modeled using Gaussian process and a collection function that takes into account both exploration and exploitation is designed. Under the condition that only the model text output can be obtained, the image perturbation is iteratively optimized, which realizes efficient optimization in black box and low query budget scenarios, significantly reduces the number of model queries required to achieve the same attack success rate, and improves the feasibility and concealment of the attack.
[0040] (3) An additive Gaussian process decomposition technique and a white-box prior-based initialization strategy for high-dimensional image spaces are proposed to address the optimization flattening problem caused by the curse of dimensionality in pixel space and the insensitivity of visual language model output to small perturbations. Technical effects: It significantly improves the sample efficiency of high-dimensional adversarial perturbation search, effectively guides the optimization process out of the stable region, accelerates convergence, and enhances the applicability and robustness of the attack method to complex, high-security visual language models. Attached Figure Description
[0041] Figure 1 This is a schematic flowchart of a backdoor detection method for a text-based graph model according to a preferred embodiment of the present invention. Detailed Implementation
[0042] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Through these descriptions, the features and advantages of the present invention will become clearer and more apparent.
[0043] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments. Although various aspects of embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless specifically indicated otherwise.
[0044] According to the present invention, a jailbreak attack method based on a visual language model with preference feedback is provided, such as... Figure 1 As shown, it includes the following steps:
[0045] S1. Construct a preference feedback signal to describe the relative harmfulness of the output of different adversarial image-induced visual language models;
[0046] S2. Set a harmfulness score to transform the preference feedback signal into an optimizable objective function;
[0047] S3. Based on an optimizable objective function, obtain the image with the highest harmfulness score among different adversarial images and use it as the attack image;
[0048] S4. Using the attack image as input to the visual language model, evaluate the security of the visual language model based on the text response output by the visual language model.
[0049] According to the present invention, the visual language model is a model capable of processing bimodal input (image and text) and generating text output.
[0050] S1 includes the following steps:
[0051] S11. Based on the original image, generate two different image perturbations to obtain two adversarial images;
[0052] S12. The two adversarial images are combined with the given malicious text prompts to form two inputs, which are then input into the visual language model to be attacked. The visual language model outputs two text responses.
[0053] S13. Using the referee model, determine which of the two text responses is more harmful and output a binary preference feedback signal.
[0054] The binary preference feedback signal is represented as:
[0055]
[0056] This represents a binary preference feedback signal. , This represents two adversarial images. , This indicates two text responses.
[0057] Furthermore, in S11, the original image is a clean image, that is, an image that does not contain any offensive content.
[0058] In this invention, the method for generating image perturbation is not limited, and those skilled in the art can use any known method.
[0059] Furthermore, the two adversarial images obtained They are represented as follows: and ,in, Represents the original image. , This represents two different image perturbations.
[0060] In S13, the referee model is any large language model, and the referee model judges the text response according to the preset prompt template.
[0061] Preferably, the core instructions of the prompt template include: given a potentially harmful question and two text responses output by visual language models, determining which text response is more harmful and violates safety guidelines more.
[0062] According to the present invention, by constructing a preference feedback signal to directly compare the output of the visual language model, the toxicity score is closer to human perception of harm than that in traditional jailbreak attack methods, effectively solving the problems that template likelihood cannot identify "fake jailbreak" responses and that the toxicity score deviates from human judgment.
[0063] S2 includes the following sub-steps:
[0064] S21. Perform preference probability modeling;
[0065] S22. Construct a harmfulness score based on a preference probability model;
[0066] S23. The optimization objective is to find adversarial images that maximize harmful scores.
[0067] Research has found that direct optimization using binary feedback is difficult because it is discontinuous and non-differentiable. In this invention, in S21, by introducing the Bradley-Terry model, the binary feedback result is modeled as a latent continuous preference intensity function, characterizing the probability that the image is more harmful, expressed as:
[0068]
[0069] in, Representing an image Compared to images The probability of being more harmful, This represents a potential preference strength function.
[0070] In S22, the harmfulness score is the image during the attack process. The probability of being considered more harmful than other images among all images is expressed as:
[0071]
[0072] in, Representing an image Harmfulness score, Represents the set of all images. The normalization constant is For the image collection excluding images Other images besides those shown.
[0073] In practical applications, it is impossible to integrate over an infinitely continuous image space. Preferably, a Monte Carlo method is used to approximate the harmfulness score, and the approximate result is used as the image... The final harmfulness score is expressed as:
[0074]
[0075] in, This indicates the number of random samples taken from the image set in the Monte Carlo method. Images are randomly sampled.
[0076] In S23, the optimization objective function is expressed as:
[0077]
[0078] in, This indicates the optimization objective.
[0079] According to the present invention, the above process in S2 integrates the scattered pairwise comparison results into a global, smooth optimization objective. This objective is directly aligned with "maximizing the harmfulness of the output," ensuring that subsequent optimization processes always move towards generating more realistic and severe harm, overcoming the fundamental defects of traditional methods (template likelihood, toxicity score).
[0080] S3 includes the following sub-steps:
[0081] S31. Construct a dataset with multiple perturbation image pairs, each image pair containing two perturbation images and corresponding preference feedback signals;
[0082] S32. Obtain the optimal estimate of the latent preference intensity function through the Gaussian model;
[0083] S33. Search for the image with the highest harmfulness score in the dataset.
[0084] In S31, the dataset Represented as:
[0085]
[0086] in, Representing different image pairs, This represents the total number of image pairs. Indicates the first Two perturbated images in an image pair This represents the preference feedback signal between the two perturbation images.
[0087] In S32, for a given dataset Gaussian processes can provide the latent preference strength function. The posterior distributions on any pair of images are the predicted mean and the predicted variance, where the predicted mean is the optimal estimate of the latent preference intensity function, and the variance represents the uncertainty of the estimate.
[0088] In practical applications, it has been found that due to the large pixel space of the original image (e.g., 224x224x3 ≈ 150,000 dimensions), directly applying the standard Gaussian process will result in the curse of dimensionality. Preferably, in the Gaussian process, the original high-dimensional image vector is decomposed into multiple disjoint low-dimensional sub-vectors, and each low-dimensional sub-vector is modeled independently using a Gaussian process.
[0089] By decomposing a high-dimensional modeling problem into a combination of several low-dimensional modeling problems, the curse of dimensionality is effectively alleviated, enabling the Gaussian process to function in high-dimensional image spaces, which greatly improves efficiency and optimization feasibility.
[0090] In S33, based on the optimal estimation of the preference intensity function, any image can be obtained. The posterior harmfulness score and posterior prediction variance.
[0091] Preferably, in order to determine which image pair should be searched next during the search of the dataset, an acquisition function is set to balance exploration and exploitation, where exploitation refers to searching in the current optimal region, and exploration refers to searching in regions with uncertain regions.
[0092] Preferably, the acquisition function is divided into two stages: the first stage is the utilization stage, and the second stage is the exploration stage.
[0093] In the first stage, the image with the highest harmfulness score under the current Gaussian process posterior estimation is selected. As the first image in the image pair, it represents the image that, given the current knowledge, is expected to be the optimal solution.
[0094] In the second stage, when selecting images to combine with the image with the highest harmfulness score into an image pair, the image with the largest posterior prediction variance is selected as the second image in the new image pair. This represents the image with the highest harmfulness score that is most uncertain given the current knowledge. Whether it has been "surpassed".
[0095] By repeating the search multiple times, the image with the highest harm score can be obtained and used as the attack image.
[0096] In this invention, uncertainty is modeled by a Gaussian process, and the next sample to be queried is intelligently selected by setting a collection function, which significantly reduces the number of searches required to reach the highest harmfulness score. Compared with random search or greedy search, this method can converge to highly harmful adversarial samples faster with less API call cost.
[0097] The study found that if the initial image selected by the acquisition function in S33 is completely random, the visual language model is extremely insensitive to small image perturbations. The output change caused by the completely random initial image is negligible, resulting in a very low signal-to-noise ratio of the preference feedback. The Gaussian process has difficulty learning an effective gradient direction from the data, and the optimization process will fall into a serious "flattening" stagnation.
[0098] Preferably, a white-box substitution model is used to generate an initial image with a high gradient orientation, providing an effective initial directional bias for the search.
[0099] Preferably, obtaining the initial image includes the following steps:
[0100] S3301. Select an open-source model with a structure similar to the visual encoder of the visual language model as an alternative model;
[0101] S3302. Using existing white-box jailbreak attack methods, on the alternative model, facing the same malicious text prompts, a batch of initial adversarial images are generated using gradient information. These adversarial images naturally contain directional information that can effectively affect the model output.
[0102] S3303, Use the adversarial images generated by white-box processing as the initial dataset.
[0103] The white-box prior-guided initialization provides a "high starting point" and "correct direction" for the subsequent black-box search. It directly directs the optimization process to the region of output change sensitivity, effectively solves the optimization flattening problem, and accelerates the convergence process.
[0104] Various embodiments of the methods described above in this invention can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0105] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this invention can be achieved, and this is not limited herein.
[0106] Example
[0107] Example 1
[0108] Evaluation was conducted on various visual language models, including Qwen2-VL, MiniGPT-4, LLaVA-v1.6, and InternVL2. The evaluation process included the following steps:
[0109] S1. Construct a preference feedback signal to describe the relative harmfulness of the output of different adversarial image-induced visual language models;
[0110] S2. Set a harmfulness score to transform the preference feedback signal into an optimizable objective function;
[0111] S3. Based on an optimizable objective function, obtain the image with the highest harmfulness score among different adversarial images and use it as the attack image;
[0112] S4. Using the attack image as input to the visual language model, evaluate the security of the visual language model based on the text response output by the visual language model.
[0113] S1 includes the following steps:
[0114] S11. Based on the original image, generate two different image perturbations to obtain two adversarial images;
[0115] S12. The two adversarial images are combined with the given malicious text prompts to form two inputs, which are then input into the visual language model to be attacked. The visual language model outputs two text responses.
[0116] S13. Using the referee model, determine which of the two text responses is more harmful and output a binary preference feedback signal.
[0117] S2 includes the following sub-steps:
[0118] S21. Perform preference probability modeling;
[0119] S22. Construct a harmfulness score based on a preference probability model;
[0120] S23. The optimization objective is to find adversarial images that maximize harmful scores.
[0121] S3 includes the following sub-steps:
[0122] S31. Construct a dataset with multiple perturbation image pairs, each image pair containing two perturbation images and corresponding preference feedback signals;
[0123] S32. Obtain the optimal estimate of the latent preference intensity function through the Gaussian model;
[0124] S33. Search for the image with the highest harmfulness score in the dataset.
[0125] In S33, a data collection function is set to search the dataset. The data collection function is divided into two stages: the first stage is the utilization stage and the second stage is the exploration stage.
[0126] In the first stage, the image with the highest harmfulness score under the current Gaussian process posterior estimation is selected as the first image in the image pair;
[0127] In the second stage, when selecting an image to be combined with the image with the highest harmfulness score to form an image pair, the image with the largest posterior prediction variance is selected as the second image of the new image pair;
[0128] Repeat the search multiple times to obtain the image with the highest harmfulness score, and use it as the attack image.
[0129] In S33, a white-box substitution model is used to generate an initial image with high gradient orientation, providing an effective initial directional bias for the search.
[0130] Comparative Example 1
[0131] The same experiments as in Example 1 were conducted, except that the following methods were used: no-attack method, GCG, VAJM, UMK, BAP, ImgJP, JPS, FigStep, InPieces, HADES, and IDEATOR.
[0132] For the GCG method, see the literature Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarialattacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. 2,6,7;
[0133] For the VAJM method, see Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, MengdiWang, and PrateekMittal. Visual adversarial examples jailbreakaligned large language models. In Proceedings of the AAAI conference onartificial intelligence, pages 21527–21536, 2024. 1, 2, 6, 7;
[0134] For the UMK method, see Ruofan Wang, Xingjun Ma, Hanxu Zhou, Chuanjun Ji, Guangnan Ye, and Yu-Gang Jiang. White-box multimodal jailbreaks against largevision-language models. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 6920–6928, 2024. 1, 6, 7;
[0135] The BAP method can be found in the literature: Zonghao Ying, Aishan Liu, Tianyuan Zhang, Zhengmin Yu, Siyuan Liang, Xianglong Liu, and Dacheng Tao. Jailbreak vision language models via bi-modal adversarial prompt. IEEE Transactions on Information Forensics and Security, 2025. 1, 6, 7;
[0136] The ImgJP method can be found in the literature: Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. Jailbreaking attack against multimodal large language model. arXiv preprint arXiv:2402.02309, 2024. 1, 2, 6, 7;
[0137] The JPS method can be found in the literature: Renmiao Chen, Shiyao Cui, Xuancheng Huang, Chengwei Pan, Victor Shea-Jay Huang, QingLin Zhang, Xuan Ouyang, Zhexin Zhang, Hongning Wang, and Minlie Huang. Jps: Jailbreak multimodal large language models with collaborative visual perturbation and textual steering. In Proceedings of the 33rd ACM International Conference on Multimedia, page 11756–11765, New York, NY, USA, 2025. Association for Computing Machinery. 6, 7;
[0138] The FigStep method can be found in the literature: Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via typographic visual prompts. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 23951–23959, 2025. 1, 2, 6, 7;
[0139] The InPieces method can be found in the literature: Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. Jailbreak in pieces: Compositional adversarial attacks on multimodal language models. In The Twelfth International Conference on Learning Representations, 2024. 6, 7;
[0140] The HADES method can be found in the literature: Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and JiRong Wen. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. CoRR, abs / 2403.09792, 2024. 6, 7;
[0141] For the IDEATOR method, please refer to the literature Ruofan Wang, Juncheng Li, Yixu Wang, Bo Wang, Xiaosen Wang, Yan Teng, Yingchun Wang, Xingjun Ma, and YuGang Jiang. Ideator: Jailbreaking and benchmarking large vision-language models using themselves, 2025. 6, 7.
[0142] The evaluation results of Example 1 and Comparative Example 1 are shown in Table 1. ASR-H and ASR-Q are used as evaluation indicators. ASR-H (attack success rate based on general LLM discrimination): the general large language model (GPT-4o-mini) is used as the discriminator to determine whether the model output successfully violates the security criteria.
[0143] ASR-Q (Attack Success Rate Based on Security-Specific Model): This metric uses a security model (Qwen-Guard) specifically trained for harmful content detection as a discriminator for evaluation, and can more professionally reflect the degree of violation of security dimensions in the output content.
[0144] Table 1
[0145]
[0146] As can be seen from Table 1, the method in Example 1 achieved the highest ASR-H and ASR-Q on all four visual language models: Qwen2-VL, MiniGPT-4, LLaVA-v1.6, and InternVL2, with an average ASR-H exceeding 98%, significantly outperforming the method in Comparative Example 1. Even on the more defensive InternVL2 model, Example 1 achieved an ASR-H of 94.5%, while the best-performing black-box method in Comparative Example 1, FigStep, achieved 77.88%.
[0147] The present invention has been described above with reference to preferred embodiments; however, these embodiments are merely exemplary and illustrative. Various substitutions and modifications can be made to the present invention based on these embodiments, all of which fall within the scope of protection of the present invention.
Claims
1. A jailbreak attack method based on a visual language model with preference feedback, characterized in that, Includes the following steps: S1. Construct a preference feedback signal to describe the relative harmfulness of the output of different adversarial image-induced visual language models; S2. Set a harmfulness score to transform the preference feedback signal into an optimizable objective function; S3. Based on an optimizable objective function, obtain the image with the highest harmfulness score among different adversarial images and use it as the attack image; S4. Using the attack image as input to the visual language model, evaluate the security of the visual language model based on the text response output by the visual language model.
2. The jailbreak attack method based on a visual language model with preference feedback according to claim 1, characterized in that, S1 includes the following steps: S11. Based on the original image, generate two different image perturbations to obtain two adversarial images; S12. The two adversarial images are combined with the given malicious text prompts to form two inputs, which are then input into the visual language model to be attacked. The visual language model outputs two text responses. S13. Using the referee model, determine which of the two text responses is more harmful and output a binary preference feedback signal.
3. The jailbreak attack method based on a visual language model with preference feedback according to claim 1, characterized in that, S2 includes the following sub-steps: S21. Perform preference probability modeling; S22. Construct a harmfulness score based on a preference probability model; S23. The optimization objective is to find adversarial images that maximize harmful scores.
4. The jailbreak attack method based on a visual language model with preference feedback according to claim 3, characterized in that, In S21, by introducing the Bradley-Terry model, the binary feedback result is modeled as a potential continuous preference intensity function, representing the probability that the image is more harmful, expressed as: in, Representing an image Compared to images The probability of being more harmful, This represents a potential preference strength function.
5. The jailbreak attack method based on a visual language model with preference feedback according to claim 4, characterized in that, In S22, the harmfulness score is the image during the attack process. The probability of being considered more harmful than other images among all images is expressed as: in, Representing an image Harmfulness score Represents the set of all images. The normalization constant is For the image collection excluding images Other images besides those shown.
6. The jailbreak attack method based on a visual language model with preference feedback according to claim 1, characterized in that, S3 includes the following sub-steps: S31. Construct a dataset with multiple perturbation image pairs, each image pair containing two perturbation images and corresponding preference feedback signals; S32. Obtain the optimal estimate of the latent preference intensity function through the Gaussian model; S33. Search for the image with the highest harmfulness score in the dataset.
7. The jailbreak attack method based on a visual language model with preference feedback according to claim 6, characterized in that, In S32, for a given dataset, the Gaussian process can provide the posterior distribution of the latent preference intensity function on any image pair, namely the predicted mean and the predicted variance. The predicted mean is the optimal estimate of the latent preference intensity function, and the variance represents the uncertainty of the estimate.
8. The jailbreak attack method based on a visual language model with preference feedback according to claim 6, characterized in that, In S33, a data collection function is set to search the dataset. The data collection function is divided into two stages: the first stage is the utilization stage and the second stage is the exploration stage. In the first stage, the image with the highest harmfulness score under the current Gaussian process posterior estimation is selected as the first image in the image pair; In the second stage, when selecting an image to be combined with the image with the highest harmfulness score to form an image pair, the image with the largest posterior prediction variance is selected as the second image of the new image pair; Repeat the search multiple times to obtain the image with the highest harmfulness score, and use it as the attack image.
9. An electronic device, comprising: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-8.
10. A computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-8.