Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Character

Siyuan Ma,Weidi Luo,Yu Wang,Xiaogeng Liu

2024-06-12

Abstract:With the advent and widespread deployment of Multimodal Large Language Models (MLLMs), ensuring their safety has become increasingly critical. To achieve this objective, it requires us to proactively discover the vulnerability of MLLMs by exploring the attack methods. Thus, structure-based jailbreak attacks, where harmful semantic content is embedded within images, have been proposed to mislead the models. However, previous structure-based jailbreak methods mainly focus on transforming the format of malicious queries, such as converting harmful content into images through typography, which lacks sufficient jailbreak effectiveness and generalizability. To address these limitations, we first introduce the concept of "Role-play" into MLLM jailbreak attacks and propose a novel and effective method called Visual Role-play (VRP). Specifically, VRP leverages Large Language Models to generate detailed descriptions of high-risk characters and create corresponding images based on the descriptions. When paired with benign role-play instruction texts, these high-risk character images effectively mislead MLLMs into generating malicious responses by enacting characters with negative attributes. We further extend our VRP method into a universal setup to demonstrate its generalizability. Extensive experiments on popular benchmarks show that VRP outperforms the strongest baseline, Query relevant and FigStep, by an average Attack Success Rate (ASR) margin of 14.3% across all models.

Cryptography and Security,Artificial Intelligence

What problem does this paper attempt to address?

The paper aims to address the security issues of Multimodal Large Language Models (MLLMs) when faced with structured jailbreak attacks. Specifically, existing structured jailbreak methods mainly transform the format of malicious queries (e.g., converting harmful content into images), lacking sufficient effectiveness and generality. To solve these problems, the researchers proposed a new method called "Visual Role-play" (VRP). VRP utilizes large language models to generate detailed high-risk role descriptions and creates corresponding images based on these descriptions. When these high-risk role images are paired with benign role-playing instruction texts, they can effectively mislead MLLMs into generating harmful responses. Additionally, VRP has been extended to general settings to demonstrate its broad applicability.

Extensive experiments show that VRP outperforms the strongest baseline methods, such as Query relevant and FigStep, in popular benchmarks, with an average attack success rate improvement of 14.3% across all models. Therefore, the main contribution of this paper is to propose a simple and effective jailbreak attack method against MLLMs and to introduce the concept of "role-playing" for the first time to enhance the effectiveness of jailbreak attacks.