PureProof：抗扩散净化的大型视觉语言模型黑盒目标攻击
PureProof: Diffusion-Resistant Black-box Targeted Attack on Large Vision-Language Models
提出针对扩散净化（DBP）的黑盒目标攻击框架 PureProof，其随机反向对齐（SRA）和自适应重加噪增强（ARA）可被复用为评估视觉语言模型在扩散防御下鲁棒性的攻击基线。
原文依据 PureProof, a black-box targeted attack on VLMs resilient to DBP
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论大型视觉语言模型（VLM）正日益部署于AI智能体等多样应用中，但仍易受目标对抗攻击影响。然而，此类攻击的实际鲁棒性往往不明确，在防御下的评估有限。基于扩散的净化（DBP）作为一种广泛采用的黑盒防御，通过生成式扩散去除对抗扰动，有效阻断了当前攻击。先前的DBP规避攻击针对白盒图像分类器，不适用于VLM，适配时计算成本高且梯度不稳定。本文提出PureProof，一种对DBP具有鲁棒性的VLM黑盒目标攻击。它包含三个核心组件。随机反向对齐（SRA）通过单步反向预测引导对抗优化，避免昂贵的全轨迹反向传播。自适应重加噪增强（ARA）通过时间步自适应重加噪缓解扩散随机性。自一致性正则化（SCR）通过促进局部时序一致性来稳定优化。在开源和商用VLM上的大量实验表明，PureProof持续优于先前针对DBP的攻击，并实现强噪声鲁棒性，揭示了VLM的关键漏洞，并为包括新兴智能体场景在内的真实世界VLM部署提供了更广泛的安全启示。
英文原文摘要 1422 字符
Large Vision-Language Models (VLMs) are increasingly deployed across diverse applications, such as AI agents, yet remain vulnerable to targeted adversarial attacks. However, the practical robustness of such attacks often remains unclear with limited evaluation under defenses. Diffusion-based purification (DBP), a widely adopted black-box defense, effectively blocks current attacks by removing adversarial perturbations via generative diffusion. Prior DBP evasion attacks target white-box image classifiers and are ill-suited to VLMs, incurring high computational costs and gradient instability when adapted. In this paper, we present PureProof, a black-box targeted attack on VLMs resilient to DBP. It consists of three core components. Stochastic Reverse Alignment (SRA) guides adversarial optimization via single-step reverse prediction, avoiding costly full-trajectory backpropagation. Adaptive Re-noising Augmentation (ARA) mitigates diffusion stochasticity through timestep-adaptive re-noising. Self-Consistency Regularization (SCR) stabilizes optimization by promoting local temporal coherence. Extensive experiments on open-source and commercial VLMs show that PureProof consistently outperforms prior attacks against DBP and achieves strong noise resilience, revealing critical vulnerabilities in VLMs and offering broader safety implications for real-world VLM deployments, including emerging agentic settings.