TreeTeaming：通过分层策略探索对视觉语言模型进行自主红队测试
TreeTeaming: Autonomous Red-Teaming of Vision-Language Models via Hierarchical Strategy Exploration
提出基于LLM编排器的树状策略探索框架，可自动发现视觉语言模型的多模态越狱攻击路径，为评估和提升VLM安全性提供可复用的红队测试方法。
原文依据 TreeTeaming achieves state-of-the-art attack success rates on 11 models, outperforming existing methods and reaching up to 87.60% on GPT-4o.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论视觉语言模型（VLM）的快速发展使其安全漏洞受到密切关注。然而，现有的红队测试方法从根本上受限于固有的线性探索范式，只能在预定义的策略集内进行优化，无法发现新颖且多样的攻击方式。为突破这一局限，我们提出TreeTeaming，一个自动化的红队测试框架，将策略探索从静态测试重新定义为动态的进化发现过程。其核心是一个由大语言模型（LLM）驱动的策略编排器，它自主决定是进化有潜力的攻击路径还是探索多样化的策略分支，从而动态构建并扩展一棵策略树。随后，一个多模态执行器负责执行这些复杂策略。在针对12个主流VLM的实验中，TreeTeaming在11个模型上取得了最优的攻击成功率，超越了现有方法，在GPT-4o上达到87.60%。该框架还展现出优于先前公开越狱策略并集的策略多样性。此外，生成的攻击平均降低了23.09%的毒性，体现了其隐蔽性和微妙性。我们的工作为自动化漏洞发现引入了新范式，强调了超越静态启发式方法进行主动探索以保障前沿AI模型安全的必要性。代码和数据可在https://github.com/ChunXiaostudy/TreeTeaming获取。警告：本文包含有害文本和图像示例，建议读者谨慎阅读。
英文原文摘要 1665 字符
The rapid advancement of Vision-Language Models (VLMs) has brought their safety vulnerabilities into sharp focus. However, existing red teaming methods are fundamentally constrained by an inherent linear exploration paradigm, confining them to optimizing within a predefined strategy set and preventing the discovery of novel, diverse exploits. To transcend this limitation, we introduce TreeTeaming, an automated red teaming framework that reframes strategy exploration from static testing to a dynamic, evolutionary discovery process. At its core lies a strategic Orchestrator, powered by a Large Language Model (LLM), which autonomously decides whether to evolve promising attack paths or explore diverse strategic branches, thereby dynamically constructing and expanding a strategy tree. A multimodal actuator is then tasked with executing these complex strategies. In the experiments across 12 prominent VLMs, TreeTeaming achieves state-of-the-art attack success rates on 11 models, outperforming existing methods and reaching up to 87.60% on GPT-4o. The framework also demonstrates superior strategic diversity over the union of previously public jailbreak strategies. Furthermore, the generated attacks exhibit an average toxicity reduction of 23.09%, showcasing their stealth and subtlety. Our work introduces a new paradigm for automated vulnerability discovery, underscoring the necessity of proactive exploration beyond static heuristics to secure frontier AI models. The code and data are available at: https://github.com/ChunXiaostudy/TreeTeaming. Warning: This paper contains examples of harmful texts and images, and reader discretion is recommended.