Self-interpreting Adversarial Images

2024/07/12 by Zhang, Tingwei, Zhang, Collin, Morris, John X. +2 · 2 citations
#Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · doi:10.48550/arxiv.2407.08970

Abstract

We introduce a new type of indirect, cross-modal injection attacks against visual language models that enable creation of self-interpreting images. These images contain hidden "meta-instructions" that control how models answer users' questions about the image and steer models' outputs to express an adversary-chosen style, sentiment, or point of view. Self-interpreting images act as soft prompts, conditioning the model to satisfy the adversary's (meta-)objective while still producing answers based on the image's visual content. Meta-instructions are thus a stronger form of prompt injection. Adversarial images look natural and the model's answers are coherent and plausible, yet they also follow the adversary-chosen interpretation, e.g., political spin, or even objectives that are not achievable with explicit text instructions. We evaluate the efficacy of self-interpreting images for a variety of models, interpretations, and user prompts. We describe how these attacks could cause harm by enabling creation of self-interpreting content that carries spam, misinformation, or spin. Finally, we discuss defenses.

Cited by

• Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents
• Hidden Tail: Adversarial Image Causing Stealthy Resource Consumption in Vision-Language Models

Related

• SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentation
• Adversarial Attacks on Image Generation With Made-Up Words
• Image-based Prompt Injection: Hijacking Multimodal LLMs through Visually Embedded Adversarial Instructions
• Seeing is Deceiving: Exploitation of Visual Pathways in Multi-Modal Language Models
• Image Hijacks: Adversarial Images can Control Generative Models at Runtime