Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models

Abstract: We introduce new jailbreak attacks on vision LLMs (VLMs), which use aligned LLMs and are resilient to text-only jailbreak attacks. Specifically, we develop cross-modality attacks on alignment where we pair adversarial images going through the vision encoder with textual prompts to break the alignment of the LLM. Our attacks employ a novel compositional strategy that combines an image, adversarially targeted towards toxic embeddings, with generic prompts to accomplish the jailbreak. Thus, the LLM draws the context to answer the generic prompt from the adversarial image. The generation of benign-appearing adversarial images leverages a novel embedding-space-based methodology, operating with no access to the LLM model. Instead, the attacks require access only to the vision encoder and utilize one of our four embedding space targeting strategies. By not requiring access to the LLM, the attacks lower the entry barrier for attackers, particularly when vision encoders such as CLIP are embedded in closed-source LLMs. The attacks achieve a high success rate across different VLMs, highlighting the risk of cross-modality alignment vulnerabilities, and the need for new alignment approaches for multi-modal models.

• The paper introduces a novel approach that decomposes adversarial attacks into benign images with malicious embedding triggers, exposing vulnerabilities in multi-modal systems.
• It employs an end-to-end gradient-based optimization to craft triggers from textual, OCR, and visual cues, achieving high success rates across various VLMs.
• The findings underscore the urgent need for robust multi-modal alignment strategies to secure AI systems against composite adversarial threats.

Jailbreak in Pieces: Compositional Adversarial Attacks on Multi-Modal LLMs

Introduction

The paper "Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal LLMs" (2307.14539) introduces novel adversarial attacks on Vision LLMs (VLMs) that exploit cross-modality interactions between vision and language components. These attacks bypass traditional text-only defenses by coupling adversarial images with textual prompts to disrupt model alignment, thereby inducing unintended outputs. The authors propose a compositional strategy utilizing embedding-space-based attacks that highlight a crucial vulnerability in the design of multi-modal systems.

Attack Methodologies

The central technique involves decomposing an adversarial attack into benign-looking images embedding malicious triggers, combined with generic textual prompts. This approach exploits the joint embedding space shared by the vision and text components of VLMs like CLIP. The adversarial images are generated to inhabit regions of the embedding space that correlate with malicious intents when processed by the vision encoder. The goal is to induce the model to draw unintended but harmful conclusions when responding to benign-sounding prompts.

Figure 1: Overview of the proposed methods for embedding-space-based adversarial attacks on VLMs.

Embedding-Space-Based Adversarial Attacks

The authors employ an end-to-end gradient-based optimization strategy to craft adversarial images that closely match the embeddings of harmful triggers. The approach involves four categories of triggers: textual, Optical Character Recognition (OCR) text, visual content, and combined OCR visual triggers. By focusing on embedding-based triggers, these attacks do not require direct access to the underlying LLM, which marks a significant departure from traditional white-box attacks.

Experimental Results

The paper reports high success rates of adversarial attacks across various VLMs, particularly when employing visual and combined OCR visual triggers. Human evaluators confirmed these results, with the OCR visual triggers being particularly effective due to their ability to bypass traditional text-based alignment mechanisms.

Figure 2: Success rates for different malicious trigger strategies across multiple attack scenarios.

Discussion

The implications of these findings underline the vulnerability of multi-modal systems to composite attacks that exploit cross-modality coupling. Since the proposed attacks do not require access to the LLM, they pose a low-entry barrier compared to traditional adversarial strategies. The paper highlights the need for developing robust alignment techniques capable of encompassing the entire model, mitigating risks across both text and image modalities.

Future Directions

The research opens several avenues for future work, including:

• Developing comprehensive alignment strategies that integrate safeguards across all modes of input in multi-modal systems.
• Exploring the feasibility of embedding-based defenses against compositional adversarial attacks.
• Investigating the compositionality and generalization of attacks across other modalities, such as audio or video, in similar multi-modal systems.

Conclusion

The paper demonstrates that adversarial attacks on VLMs leveraging compositional strategies across embedding spaces are not only feasible but highly effective. This work highlights the need for advancing multi-modal alignment techniques to secure AI systems against subtle and sophisticated adversarial threats. The approach underscores the critical importance of considering entire systems, rather than isolated components, in the development of robust and secure AI models.