JailDAM：具備適應性記憶的視覺語言模型越獄檢測

摘要

多模態大型語言模型（MLLMs）在視覺-語言任務中表現卓越，但也存在生成有害內容的重大風險，尤其是通過越獄攻擊。越獄攻擊指的是故意操縱模型以繞過其安全機制，從而生成不當或不安全的內容。檢測此類攻擊對於確保MLLMs的負責任部署至關重要。現有的越獄檢測方法面臨三大挑戰：(1) 許多方法依賴於模型的隱藏狀態或梯度，這限制了它們僅適用於白盒模型，即模型的內部運作是可訪問的；(2) 它們涉及基於不確定性分析的高計算開銷，這限制了實時檢測的能力；以及(3) 它們需要完全標記的有害數據集，這在現實場景中往往稀缺。為解決這些問題，我們引入了一種名為JAILDAM的測試時自適應框架。我們的方法利用基於記憶的策略驅動的不安全知識表示，消除了對有害數據的顯式暴露需求。通過在測試時動態更新不安全知識，我們的框架提高了對未見過的越獄策略的泛化能力，同時保持了效率。在多個VLM越獄基準上的實驗表明，JAILDAM在有害內容檢測方面達到了最先進的性能，提升了準確性和速度。

English

Multimodal large language models (MLLMs) excel in vision-language tasks but also pose significant risks of generating harmful content, particularly through jailbreak attacks. Jailbreak attacks refer to intentional manipulations that bypass safety mechanisms in models, leading to the generation of inappropriate or unsafe content. Detecting such attacks is critical to ensuring the responsible deployment of MLLMs. Existing jailbreak detection methods face three primary challenges: (1) Many rely on model hidden states or gradients, limiting their applicability to white-box models, where the internal workings of the model are accessible; (2) They involve high computational overhead from uncertainty-based analysis, which limits real-time detection, and (3) They require fully labeled harmful datasets, which are often scarce in real-world settings. To address these issues, we introduce a test-time adaptive framework called JAILDAM. Our method leverages a memory-based approach guided by policy-driven unsafe knowledge representations, eliminating the need for explicit exposure to harmful data. By dynamically updating unsafe knowledge during test-time, our framework improves generalization to unseen jailbreak strategies while maintaining efficiency. Experiments on multiple VLM jailbreak benchmarks demonstrate that JAILDAM delivers state-of-the-art performance in harmful content detection, improving both accuracy and speed.

JailDAM：具備適應性記憶的視覺語言模型越獄檢測

JailDAM: Jailbreak Detection with Adaptive Memory for Vision-Language Model

摘要

Summary

Support

Support