V-Attack：针对解耦值特征实现对LVLM的可控对抗攻击
V-Attack: Targeting Disentangled Value Features for Controllable Adversarial Attacks on LVLMs
针对LVLM视觉编码器中自注意力value特征进行对抗操控，绕过纠缠的patch特征实现局部语义编辑，为研究多模态模型的语义可控性与安全漏洞提供了可复用的攻击面。
原文依据 value features, computed within the transformer attention block, provide much more precise handles for manipulation
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论对抗攻击已从单纯破坏传统任务特定模型的预测，发展到更复杂的目标：操控大型视觉语言模型（LVLM）中的图像语义。然而，现有方法在可控性上存在不足，无法精确操控图像中特定概念的语义。我们将这一局限归因于对抗攻击通常所操作的图像块词元表示中的语义纠缠：视觉编码器中自注意力聚合的全局上下文主导了图像块特征，使其难以可靠地用于精确的局部语义操控。我们的系统性研究揭示了一个关键洞见：在Transformer注意力块内计算的值特征为操控提供了更为精确的抓手。我们表明，这些值特征抑制了全局上下文通道，从而保留了高熵、解耦的局部语义信息。基于这一发现，我们提出了V-Attack，一种用于精确局部语义攻击的新方法。V-Attack以值特征为目标，并引入两个核心组件：（1）自值增强模块，用于提炼值特征内在的语义丰富性；（2）文本引导的值操控模块，利用文本提示定位源概念并将其优化至目标概念。通过绕过纠缠的图像块特征，V-Attack实现了高效的语义控制。在包括LLaVA、InternVL、DeepSeek-VL和GPT-4o在内的多种LVLM上的大量实验表明，V-Attack相比最优方法平均将攻击成功率提升了36%，揭示了现代视觉语言理解中的关键漏洞。
英文原文摘要 1715 字符
Adversarial attacks have evolved from simply disrupting predictions on conventional task-specific models to the more complex goal of manipulating image semantics in Large Vision-Language Models (LVLMs). However, existing methods struggle with controllability and cannot precisely manipulate the semantics of specific concepts in an image. We attribute this limitation to semantic entanglement in the patch-token representations that adversarial attacks typically operate on: global context aggregated by self-attention in the vision encoder dominates patch features, making them unreliable for precise local semantic manipulation. Our systematic investigation reveals a key insight: value features, computed within the transformer attention block, provide much more precise handles for manipulation. We show that these value features suppress global-context channels, allowing them to retain high-entropy, disentangled local semantic information. Building on this discovery, we propose V-Attack, a novel method for precise local semantic attacks. V-Attack targets value features and introduces two core components: (1) a Self-Value Enhancement module to refine the intrinsic semantic richness of value features, and (2) a Text-Guided Value Manipulation module that uses text prompts to locate the source concept and optimize it toward a target concept. By bypassing entangled patch features, V-Attack achieves highly effective semantic control. Extensive experiments across diverse LVLMs, including LLaVA, InternVL, DeepSeek-VL, and GPT-4o, show that V-Attack improves attack success rate by an average of 36% over state-of-the-art methods, exposing critical vulnerabilities in modern vision-language understanding.