Omni-Attack：黑盒多模态大语言模型中开放端视觉问答的对抗攻击
Omni-Attack: Adversarial Attacks on Open-Ended VQA in Black-Box Multimodal LLMs
针对开放端视觉问答的黑盒迁移攻击方法，其目标构建流程和位置感知扰动策略可被复用于评估和提升多模态大模型的对抗鲁棒性。
原文依据 Omni-Attack achieves strong targeted attack success rates (up to 71.8% on GPT-4.1 at \varepsilon=8/255)
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论多模态大语言模型（MLLMs）在从自动驾驶到文档理解等多种应用中取得了显著成功。随着这些模型部署在安全关键场景中，理解其对抗鲁棒性变得至关重要。然而，当前的评估主要集中于粗粒度分类等简单任务，并采用不一致的评估协议，阻碍了攻击方法的严格比较。我们提出了 AdvRobustBench，一个全面的 MLLMs 对抗鲁棒性基准，包含来自广泛使用的 MLLM 基准（MMBench、MMStar、OCRBench-v2）的视觉问答（VQA）和光学字符识别（OCR）任务的 1,000 个示例。我们进一步提出了 Omni-Attack，一种新颖的基于迁移的黑盒攻击方法，解决了攻击开放端问答系统的关键挑战。我们的方法引入了 (i) 一个目标构建流程，生成以问题为条件的文本和视觉目标以提供更强的优化信号，以及 (ii) 一种针对 OCR 的位置感知攻击策略，实现空间精确的扰动。大量实验表明，Omni-Attack 在专有模型（GPT-4.1、Claude 3.7、Gemini 2.0）和开源 MLLMs 上均实现了强大的定向攻击成功率（在 ε=8/255 时对 GPT-4.1 高达 71.8%），揭示了当前多模态系统中的显著漏洞。我们的基准和发现为开发更鲁棒的 MLLMs 奠定了基础。代码可在 https://github.com/hukkai/transferable_mllm_attack 获取。
英文原文摘要 1613 字符
Multimodal large language models (MLLMs) have achieved remarkable success across diverse applications, from autonomous driving to document understanding. As these models are deployed in safety-critical contexts, understanding their adversarial robustness becomes crucial. However, current evaluations focus primarily on simple tasks like coarse-grained classification, and employ inconsistent evaluation protocols, hindering rigorous comparison of attack methods. We introduce AdvRobustBench, a comprehensive adversarial robustness benchmark for MLLMs comprising 1,000 examples across visual question answering (VQA) and optical character recognition (OCR) tasks, drawn from widely-used MLLM benchmarks (MMBench, MMStar, OCRBench-v2). We further propose Omni-Attack, a novel transfer-based black-box attack method that addresses key challenges in attacking open-ended question-answering systems. Our approach introduces (i) a target-construction pipeline that generates question-conditioned textual and visual targets to provide stronger optimization signals, and (ii) a location-aware attack strategy for OCR that enables spatially-precise perturbations. Extensive experiments demonstrate that Omni-Attack achieves strong targeted attack success rates (up to 71.8% on GPT-4.1 at \varepsilon=8/255) across both proprietary models (GPT-4.1, Claude 3.7, Gemini 2.0) and open-source MLLMs, revealing significant vulnerabilities in current multimodal systems. Our benchmark and findings establish a foundation for developing more robust MLLMs. Codes are available at https://github.com/hukkai/transferable_mllm_attack