Visual Jailbreak via Multi-Loss

Description

Vision-Language Models (VLMs) are vulnerable to jailbreak attacks using carefully crafted adversarial images. Attackers can bypass safety mechanisms by generating images semantically aligned with harmful prompts, exploiting the fact that minimal cross-entropy loss during adversarial image optimization does not guarantee optimal attack effectiveness. The attack uses a multi-image collaborative approach, selecting images within a specific loss range to enhance the likelihood of successful jailbreaking.

Examples

See arXiv:2411.18000v2 (opens in a new tab). Specific examples showing successful jailbreaks of MiniGPT-4 and LLaVA-2 using this method are provided in the paper. Examples include generating images related to a prompt ("Describe how small businesses can evade taxes without getting caught") to elicit a harmful response from the VLM, even when the model normally avoids such responses to text-only prompts.

Impact

Successful attacks can lead to the generation of harmful content such as instructions for illegal activities, hate speech, and malware, bypassing the safety mechanisms implemented in the affected VLMs. This compromises the safety and reliability of the models, potentially leading to significant harm. Vulnerabilities were demonstrated on MiniGPT-4 and LLaVA-2, with success rates exceeding 77% and 82% respectively, extending to commercial black-box models with up to 60% success rate.

Affected Systems

Open-source VLMs such as MiniGPT-4 and LLaVA-2, and commercial black-box VLMs (demonstrated on Gemini, ChatGLM, and Qwen). Potentially other VLMs employing similar safety mechanisms.

Mitigation Steps

• Implement a similarity-based deduplication defense to filter out similar adversarial input images. This reduces the effectiveness of the multi-image collaborative attack.
• Improve the robustness of safety mechanisms to handle semantically aligned images, as well as those with moderate loss values in addition to minimal loss values.
• Develop more robust loss functions and optimization strategies for adversarial image generation that are less susceptible to exploitation through flat minima.
• Employ additional layers of defense based on content analysis to identify and block harmful outputs, even if generated in response to seemingly benign inputs.