SafeLogo：通过微区域对抗训练将你的 Logo 变为越狱防护盾
SafeLogo: Turning Your Logos into Jailbreak Shields via Micro-Regional Adversarial Training
把极小区域（≤2% 像素）的可学习视觉提示词当作通用防御补丁，用 min-max 对抗训练在内外循环中动态挑选最强越狱攻击，为 VLM 安全对齐提供了一种无需全模型微调、可复用的轻量防御范式。
原文依据 tunes a logo-sized visual prompt into a universal shield against diverse jailbreak attacks through micro-regional adversarial training
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论近期，视觉语言模型（VLM）越来越容易受到越狱攻击，对抗性提示词利用细微操纵绕过安全对齐。此类越狱手段的多样性与适应性，要求防御机制具备强泛化能力。然而，微调大规模 VLM 的计算开销高昂，而引入过多的视觉或文本防御提示词又会损害图像真实感与模型可用性，并不现实。我们提出 SafeLogo，通过微区域对抗训练，将一个 Logo 尺寸的视觉提示词调校为抵御多种越狱攻击的通用防护盾。我们首次将 min-max 对抗优化引入视觉防御提示词生成。具体而言，在外层循环中，SafeLogo 向极小的图像区域（像素覆盖率 ≤ 2%）注入紧凑且有界的扰动，从而有效保持视觉保真度与语义一致性。同时，为克服先前防御受限于单一攻击方向或固定良性监督的局限，内层循环从多种越狱攻击中动态生成并挑选出最强的一种。在 LLaVA-1.5-13B、MiniGPT-4 与 Qwen3-VL 上的大量实验表明，SafeLogo 显著降低了在 MM-SafetyBench、VLGuard 与 FigStep 上的越狱成功率，同时在 MM-Vet 与 MME 上保持了良性性能。
英文原文摘要 1410 字符
Recent Vision-Language Models (VLMs) have become increasingly susceptible to jailbreak attacks, where adversarial prompts exploit subtle manipulation to circumvent safety alignment.The diversity and adaptability of such jailbreakers necessitate a defense mechanism with strong generalization capability.However, fine-tuning large-scale VLMs is computationally expensive, and introducing excessive visual or textual defense prompts is impractical for preserving image realism and model usability.We propose SafeLogo, which tunes a logo-sized visual prompt into a universal shield against diverse jailbreak attacks through micro-regional adversarial training.We are the first to integrate min-max adversarial optimization into visual defense prompt generation.Specifically, in the outer loop, SafeLogo injects compact, bounded perturbations into extremely small image regions (\leq 2% pixel coverage), effectively preserving both visual fidelity and semantic consistency.Meanwhile, overcoming the limitations of prior defenses constrained to a single attack direction or fixed benign supervision, the inner loop dynamically generates and selects the strongest one from a variety of jailbreakers.Extensive experiments on LLaVA-1.5-13B,MiniGPT-4, and Qwen3-VL show that SafeLogo markedly lowers jailbreak success rates on MM-SafetyBench, VLGuard, and FigStep, while preserving benign performance on MM-Vet and MME.