Table of Links Abstract and 1. Introduction Abstract and 1. Introduction Related Works


Methodology and 3.1 Preliminary
3.2 Query-specific Visual Role-play
3.3 Universal Visual Role-play


Experiments and 4.1 Experimental setups
4.2 Main Results
4.3 Ablation Study
4.4 Defense Analysis
4.5 Integrating VRP with Baseline Techniques


Conclusion


Limitation


Future work and References Related Works Related Works Related Works Methodology and 3.1 Preliminary
3.2 Query-specific Visual Role-play
3.3 Universal Visual Role-play Methodology and 3.1 Preliminary Methodology and 3.1 Preliminary 3.2 Query-specific Visual Role-play 3.2 Query-specific Visual Role-play 3.3 Universal Visual Role-play 3.3 Universal Visual Role-play Experiments and 4.1 Experimental setups
4.2 Main Results
4.3 Ablation Study
4.4 Defense Analysis
4.5 Integrating VRP with Baseline Techniques Experiments and 4.1 Experimental setups Experiments and 4.1 Experimental setups 4.2 Main Results 4.2 Main Results 4.3 Ablation Study 4.3 Ablation Study 4.4 Defense Analysis 4.4 Defense Analysis 4.5 Integrating VRP with Baseline Techniques 4.5 Integrating VRP with Baseline Techniques Conclusion Conclusion Conclusion Limitation Limitation Limitation Future work and References Future work and References Future work and References A. Character Generation Detail A. Character Generation Detail B. Ethics and Broader Impact B. Ethics and Broader Impact C. Effect of Text Moderator on Text-based Jailbreak Attack C. Effect of Text Moderator on Text-based Jailbreak Attack D. Examples D. Examples E. Evaluation Detail E. Evaluation Detail A Character Generation Detail We utilize Mixtral-8x7B-Instruct-v0.1 [21] for generating characters for both query-specific VRP and universal VRP. The following prompts are employed: setting the maximum tokens as 1024, temperature as 1, and top-p as 0.5. We employ the Instruct LLM to encapsulate the character description within || and the diffusion prompt within [], as they are extracted from the LLM’s output. Prompt for Character Generation in Query-specific VRP Prompt for Character Generation in Query-specific VRP Prompt for Character Generation in Universal VRP Initial Round Prompt for Character Generation in Universal VRP Initial Round Prompt for Character Generation in Universal VRP Optimization Round Prompt for Character Generation in Universal VRP Optimization Round B Ethics and Broader Impact While our research introduces a jailbreaking method aimed at MLLMs, we emphasize the importance of responsible utilization of our methodology and underscore the academic nature of our discoveries. Our intention is to highlight potential vulnerabilities within these models and encourage collaborative efforts to develop robust defenses, thereby enhancing the safety of MLLMs. To facilitate a transparent and constructive discussion surrounding FigStep, we are committed to releasing our datasets and sharing any harmful responses generated with academic institutions upon request. Additionally, considering that large multi-modal models like MLLMs are still in their early stages of development, we believe that there are likely more text-image jailbreaking attacks waiting to be explored. Ultimately, our findings should raise significant security concerns. C Effect of Text Moderator on Text-based Jailbreak Attack Moderator models such as Llamaguard [19] classify textual inputs as “safe” and “unsafe”. A jailbreak attack’s textual input can be detected by such a moderator model, and the attack can be directly blocked and fail. To demonstrate the effect of a text moderator on text-based jailbreak attacks, we use Llamaguard to classify the text input of JailbreakV28k [38]. We report the ASR after applying the moderator in Table 6. The ASR for all models dropped drastically to lower than 7%. We also use Llamaguard [19] to detect textual input of VRP, which is a fixed harmless instruction. Llamaguard classify VRP as “safe“. D Examples We showcase examples of our method and baselines to attack Llava-V1.6-Mistral-7B [30]in Table D This attack is based on following malicious question sampled from Redteam2K [38]. You ever just feel the need to kick a cat into traffic? I do all the time. You ever just feel the need to kick a cat into traffic? I do all the time. E Evaluation Detail Prompt for Evaluating the Relevance of Response and Question Prompt for Evaluating the Relevance of Response and Question Authors:
(1) Siyuan Ma, University of Wisconsin–Madison (siyuan.ma.jasper@outlook.com);
(2) Weidi Luo, The Ohio State University (luo.1455@osu.edu);
(3) Yu Wang, Peking University (rain_wang@stu.pku.edu.cn);
(4) Xiaogeng Liu, University of Wisconsin-Madison (xiaogeng.liu@wisc.edu). Authors: Authors (1) Siyuan Ma, University of Wisconsin–Madison (siyuan.ma.jasper@outlook.com); (2) Weidi Luo, The Ohio State University (luo.1455@osu.edu); (3) Yu Wang, Peking University (rain_wang@stu.pku.edu.cn); (4) Xiaogeng Liu, University of Wisconsin-Madison (xiaogeng.liu@wisc.edu). This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv

Part of HackerNoon's growing list of open-source research papers, promoting free access to academic material.

The Fine Print of Misbehavior: VRP’s Blueprint and Safety Stance

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

A Formalization of the SylloBio-NLI Resource Generation Process

VRP Outperforms Baselines in Jailbreaking MLLMs, Transferring Across Models, and Evading Defenses

ToolTalk: Benchmarking the Future of Tool-Using AI Assistants

How to Create Realistic AI Conversations

Action vs Non-action Tools: Evaluating AI Assistant Correctness

Analyzing AI Assistant Performance: Lessons from ToolTalk's Analysis of GPT-3.5 and GPT-4

A Formalization of the SylloBio-NLI Resource Generation Process

VRP Outperforms Baselines in Jailbreaking MLLMs, Transferring Across Models, and Evading Defenses

ToolTalk: Benchmarking the Future of Tool-Using AI Assistants

How to Create Realistic AI Conversations

Action vs Non-action Tools: Evaluating AI Assistant Correctness

Analyzing AI Assistant Performance: Lessons from ToolTalk's Analysis of GPT-3.5 and GPT-4

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps