对抗风格优化：通过基于GRPO的风格触发器优化增强VLM越狱
Adversarial Style Optimization: Enhancing VLM Jailbreaks by GRPO-based Stylistic Triggers Optimization
提出了一种基于GRPO优化图像编辑模型来叠加风格触发器的即插即用模块，可增强现有视觉越狱攻击的成功率，为多模态大模型的安全评估和红队测试提供了可复用的风格扰动优化框架。
原文依据 we propose Adversarial Style Optimization (ASO), a plug-and-play enhancement module to amplify existing visual jailbreaks.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论多模态大语言模型（MLLMs）已取得令人瞩目的性能，但其安全对齐仍易受越狱攻击影响。现有的基于内容的越狱方法往往效果不稳定，且面对快速演进的MLLMs时表现不尽如人意，未能利用非内容层面的漏洞。与先前研究不同，我们通过实验发现，MLLMs在理解能力与安全能力之间存在风格不一致性：MLLMs能够稳健地理解内容，而不受视觉风格影响，但其防御机制却容易被特定的风格触发器绕过。基于这一发现，我们提出了对抗风格优化（ASO），一种即插即用的增强模块，用于放大现有的视觉越狱攻击。ASO微调一个图像编辑模型，将优化后的风格修改叠加到给定的对抗图像上，使用由结构化分层奖励函数引导的组相对策略优化（GRPO）智能体，该奖励函数结合了基于logit的信号（用于检测显式拒绝）和来自强大评判模型的高保真语义评估。大量实验表明，ASO显著提升了最先进攻击的成功率（ASR），证明风格偏差是红队测试MLLMs的一种可扩展向量。我们的代码可在 https://github.com/bingjunluo/ASO 获取。
英文原文摘要 1357 字符
Multimodal Large Language Models (MLLMs) have achieved impressive performance, but their safety alignment remains vulnerable to jailbreak attacks. Existing content-based jailbreaks are often inconsistent and show unsatisfying performance against the rapidly evolving MLLMs, failing to exploit non-content-based vulnerabilities. Unlike previous research, we empirically find that MLLMs exhibit a Stylistic Inconsistency between their comprehension ability and safety ability: MLLMs can robustly understand content regardless of visual style, yet their defense mechanisms can be easily bypassed by specific stylistic triggers. Based on this finding, we propose Adversarial Style Optimization (ASO), a plug-and-play enhancement module to amplify existing visual jailbreaks. ASO fine-tunes an image-editing model to superimpose an optimized stylistic modification onto a given adversarial image, using a Group Relative Policy Optimization (GRPO) agent guided by a Structurally-Tiered Reward Function that combines a logit-based signal for detecting explicit refusals with a high-fidelity semantic evaluation from a powerful judge model. Extensive experiments show that ASO significantly enhances the ASR of SOTA attacks, demonstrating that stylistic biases are a scalable vector for red-teaming MLLMs. Our code is available at https://github.com/bingjunluo/ASO.