标题： PiCo：通过 $\textbf{Pi}$ctorial $\textbf{Co}$de 语境化破解多模态大型语言模型 显示英文标题

标题： PiCo: Jailbreaking Multimodal Large Language Models via $\textbf{Pi}$ctorial $\textbf{Co}$de Contextualization

摘要： 多模态大语言模型（MLLMs），即将视觉和其他模态整合到大语言模型（LLMs）中的模型，显著增强了人工智能能力，但也引入了新的安全漏洞。 通过利用视觉模态的漏洞和代码训练数据的长尾分布特性，我们提出了PiCo，一种新颖的越狱框架，旨在逐步绕过先进MLLMs中的多层级防御机制。 PiCo采用逐层越狱策略，使用令牌级别的排版攻击来规避输入过滤，并在编程上下文指令中嵌入有害意图以绕过运行时监控。 为了全面评估攻击的影响，进一步提出了一种新的评估指标，用于评估攻击后模型输出的毒性和有用性。 通过在代码风格的视觉指令中嵌入有害意图， PiCo在Gemini-Pro Vision上的平均攻击成功率（ASR）达到84.13%，在GPT-4上的平均攻击成功率为52.66%，超过了之前的方法。 实验结果突显了当前防御中的关键漏洞，强调了需要更强大的策略来保护先进的MLLMs。 显示英文摘要

摘要： Multimodal Large Language Models (MLLMs), which integrate vision and other modalities into Large Language Models (LLMs), significantly enhance AI capabilities but also introduce new security vulnerabilities. By exploiting the vulnerabilities of the visual modality and the long-tail distribution characteristic of code training data, we present PiCo, a novel jailbreaking framework designed to progressively bypass multi-tiered defense mechanisms in advanced MLLMs. PiCo employs a tier-by-tier jailbreak strategy, using token-level typographic attacks to evade input filtering and embedding harmful intent within programming context instructions to bypass runtime monitoring. To comprehensively assess the impact of attacks, a new evaluation metric is further proposed to assess both the toxicity and helpfulness of model outputs post-attack. By embedding harmful intent within code-style visual instructions, PiCo achieves an average Attack Success Rate (ASR) of 84.13% on Gemini-Pro Vision and 52.66% on GPT-4, surpassing previous methods. Experimental results highlight the critical gaps in current defenses, underscoring the need for more robust strategies to secure advanced MLLMs.