面向鲁棒多模态大语言模型的越狱攻击防御
Towards Robust Multimodal Large Language Models Against Jailbreak Attacks
对做多模态大模型安全的研究者，这篇提供了可复用的对抗训练循环：用对比目标在词元嵌入空间优化出对抗扰动（CoE-Attack），再更新模型参数中和扰动，可作为白盒越狱防御的基线方案。
原文依据 SAFEMLLM generates adversarial perturbations through a newly proposed contrastive embedding attack (CoE-Attack), which optimizes token embeddings under a contrastive objective.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论尽管多模态大语言模型（MLLMs）在近期进展中取得了显著成功，但其对越狱攻击的脆弱性已逐渐显现。在此类攻击中，攻击者利用精心构造的提示词迫使模型生成有害或不良内容。现有防御机制往往依赖外部推理步骤或安全对齐训练，而这两者在面对白盒场景中复杂的对抗扰动时效果不佳且不切实际。为应对这些挑战并增强 MLLM 的鲁棒性，我们提出 SAFEMLLM，采用一种在生成对抗噪声的攻击步骤与模型更新步骤之间交替进行的对抗训练框架。在攻击步骤中，SAFEMLLM 通过新提出的对比嵌入攻击（CoE-Attack）生成对抗扰动，该攻击在对比目标下优化词元嵌入。随后 SAFEMLLM 更新模型参数以中和扰动影响，同时保持在良性输入上的模型效用。我们在多个 MLLM 和跨多种模态的六种越狱方法上评估 SAFEMLLM。实验结果表明，SAFEMLLM 能有效防御多样化攻击，保持稳健的性能与效用。
英文原文摘要 1292 字符
While multimodal large language models (MLLMs) have achieved remarkable success in recent advancements, their susceptibility to jailbreak attacks has come to light. In such attacks, adversaries exploit carefully crafted prompts to coerce models into generating harmful or undesirable content. Existing defense mechanisms often rely on external inference steps or safety alignment training, both of which are less effective and impractical when facing sophisticated adversarial perturbations in white-box scenarios. To address these challenges and bolster MLLM robustness, we introduce SAFEMLLM by adopting an adversarial training framework that alternates between an attack step for generating adversarial noise and a model updating step. At the attack step, SAFEMLLM generates adversarial perturbations through a newly proposed contrastive embedding attack (CoE-Attack), which optimizes token embeddings under a contrastive objective. SAFEMLLM then updates model parameters to neutralize the perturbation effects while preserving model utility on benign inputs. We evaluate SAFEMLLM across multiple MLLMs and six jailbreak methods spanning multiple modalities. Experimental results show that SAFEMLLM effectively defends against diverse attacks, maintaining robust performance and utilities.