🤖 AI Summary
Visual-language models (VLMs) exhibit critical security vulnerabilities under jailbreaking attacks, yet the fundamental trade-off between attack effectiveness and prompt stealth remains poorly understood.
Method: We establish the first information-theoretic analysis framework grounded in Fano’s inequality to formally characterize the “attack-stealth paradox.” Leveraging this insight, we derive a theoretically guaranteed detection criterion for non-stealthy jailbreaking attacks—bypassing empirical hyperparameter tuning—and design a lightweight, black-box detection algorithm requiring neither model fine-tuning nor access to internal parameters.
Contribution/Results: Our method achieves significant improvements in detecting non-stealthy jailbreaking attacks across multiple state-of-the-art VLMs. Experiments empirically validate the theoretical prediction: highly effective attacks inevitably sacrifice stealth. This work provides both a verifiable theoretical foundation for VLM security and a practical, deployable detection tool.
📝 Abstract
Vision-Language Models (VLMs) have achieved remarkable performance on a variety of tasks, yet they remain vulnerable to jailbreak attacks that compromise safety and reliability. In this paper, we provide an information-theoretic framework for understanding the fundamental trade-off between the effectiveness of these attacks and their stealthiness. Drawing on Fano's inequality, we demonstrate how an attacker's success probability is intrinsically linked to the stealthiness of generated prompts. Building on this, we propose an efficient algorithm for detecting non-stealthy jailbreak attacks, offering significant improvements in model robustness. Experimental results highlight the tension between strong attacks and their detectability, providing insights into both adversarial strategies and defense mechanisms.