JailDAM：面向视觉-语言模型的自适应记忆越狱检测

摘要

多模态大语言模型（MLLMs）在视觉-语言任务中表现出色，但也存在生成有害内容的重大风险，尤其是通过越狱攻击。越狱攻击指的是有意绕过模型安全机制的操纵行为，导致生成不当或不安全的内容。检测此类攻击对于确保MLLMs的负责任部署至关重要。现有的越狱检测方法面临三大挑战：（1）许多方法依赖于模型的隐藏状态或梯度，限制了它们仅适用于白盒模型，即模型内部机制可访问的情况；（2）基于不确定性分析的高计算开销，限制了实时检测的能力；（3）需要完全标注的有害数据集，而这些数据在现实场景中往往稀缺。为解决这些问题，我们引入了一种名为JAILDAM的测试时自适应框架。该方法采用基于记忆的策略驱动不安全知识表示，无需显式接触有害数据。通过在测试时动态更新不安全知识，我们的框架在保持效率的同时，提升了对未见越狱策略的泛化能力。在多个VLM越狱基准上的实验表明，JAILDAM在有害内容检测方面实现了最先进的性能，同时提高了准确性和速度。

English

Multimodal large language models (MLLMs) excel in vision-language tasks but also pose significant risks of generating harmful content, particularly through jailbreak attacks. Jailbreak attacks refer to intentional manipulations that bypass safety mechanisms in models, leading to the generation of inappropriate or unsafe content. Detecting such attacks is critical to ensuring the responsible deployment of MLLMs. Existing jailbreak detection methods face three primary challenges: (1) Many rely on model hidden states or gradients, limiting their applicability to white-box models, where the internal workings of the model are accessible; (2) They involve high computational overhead from uncertainty-based analysis, which limits real-time detection, and (3) They require fully labeled harmful datasets, which are often scarce in real-world settings. To address these issues, we introduce a test-time adaptive framework called JAILDAM. Our method leverages a memory-based approach guided by policy-driven unsafe knowledge representations, eliminating the need for explicit exposure to harmful data. By dynamically updating unsafe knowledge during test-time, our framework improves generalization to unseen jailbreak strategies while maintaining efficiency. Experiments on multiple VLM jailbreak benchmarks demonstrate that JAILDAM delivers state-of-the-art performance in harmful content detection, improving both accuracy and speed.

JailDAM：面向视觉-语言模型的自适应记忆越狱检测

JailDAM: Jailbreak Detection with Adaptive Memory for Vision-Language Model

摘要

Summary

Support

Support