标题： VERA-V：用于破解视觉-语言模型的变分推理框架 显示英文标题

标题： VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models

摘要： 视觉-语言模型（VLMs）通过视觉推理扩展了大型语言模型，但其多模态设计也引入了新的、未充分探索的漏洞。 现有的多模态红队方法大多依赖于脆弱的模板，专注于单一攻击设置，并仅暴露了一小部分漏洞。 为解决这些限制，我们引入了VERA-V，这是一种变分推理框架，将多模态越狱发现重新表述为学习配对文本-图像提示的联合后验分布。 这种概率观点使得能够生成隐蔽的、耦合的对抗性输入，以绕过模型的防护机制。 我们训练了一个轻量级攻击者来近似后验分布，从而能够高效地采样多样化的越狱，并提供关于漏洞的分布见解。 VERA-V进一步集成了三种互补策略：(i) 基于排版的文本提示，嵌入有害线索，(ii) 基于扩散的图像生成，引入对抗信号，(iii) 结构化干扰项以分散VLM注意力。 在HarmBench和HADES基准测试中的实验表明，VERA-V在开源和前沿VLM上始终优于最先进的基线方法，在GPT-4o上的攻击成功率（ASR）比最佳基线高出高达53.75%。 显示英文摘要

摘要： Vision-Language Models (VLMs) extend large language models with visual reasoning, but their multimodal design also introduces new, underexplored vulnerabilities. Existing multimodal red-teaming methods largely rely on brittle templates, focus on single-attack settings, and expose only a narrow subset of vulnerabilities. To address these limitations, we introduce VERA-V, a variational inference framework that recasts multimodal jailbreak discovery as learning a joint posterior distribution over paired text-image prompts. This probabilistic view enables the generation of stealthy, coupled adversarial inputs that bypass model guardrails. We train a lightweight attacker to approximate the posterior, allowing efficient sampling of diverse jailbreaks and providing distributional insights into vulnerabilities. VERA-V further integrates three complementary strategies: (i) typography-based text prompts that embed harmful cues, (ii) diffusion-based image synthesis that introduces adversarial signals, and (iii) structured distractors to fragment VLM attention. Experiments on HarmBench and HADES benchmarks show that VERA-V consistently outperforms state-of-the-art baselines on both open-source and frontier VLMs, achieving up to 53.75% higher attack success rate (ASR) over the best baseline on GPT-4o.