AI Insight
Researchers have developed Prompt-Adapted (ProAda) adversarial images that can selectively protect visual privacy in vision-language models by rejecting harmful questions while still allowing legitimate inquiries about the same image. Unlike existing approaches that indiscriminately block all questions, ProAda uses an iterative optimization process that adapts to specific text prompts, incorporating a classifier to assess prompt harmfulness. The method successfully rejects over 90% of harmful prompts while permitting over 90% of legitimate ones, demonstrating improved performance over current prompt-agnostic adversarial protections.
Why it matters
This technology could enable more nuanced privacy protection for images shared online, allowing owners to control how their images are analyzed by AI systems without completely blocking all potential uses. The approach addresses a critical gap in current adversarial image techniques, which either allow all access or block everything, providing a more practical solution for real-world privacy concerns.
Understand the Science
⚠️ Preprint – Noch nicht peer-reviewed
Dieser Artikel wurde noch nicht von unabhängigen Experten begutachtet. Die Ergebnisse sind vorläufig und sollten mit Vorsicht interpretiert werden.
Abstract: With the advancement in language modeling, research on adversarial images has recently shifted from image classifiers to vision-language models (VLMs). Despite the new, text-prompt-driven nature of VLMs, we find that existing VLM adversaries have largely overlooked the dynamics of text prompts. In a typical use case, adversarial images can protect visual privacy by rejecting VLMs from answering questions about the image. However, existing protections are prompt-agnostic, i.e., indiscriminately rejecting any question, including those for potential legitimate use of the image. To address this limitation, we propose Prompt-Adapted (ProAda) adversarial images, which are optimized to balance the rejection of harmful prompts and the correct response of legitimate prompts. In particular, to achieve a more accurate adversarial direction, the text prompt is also iteratively updated with a simple classifier judging whether the harmfulness of the prompt remains. Extensive experiments on visual-privacy-related datasets validate that ProAda can reject over 90% of harmful prompts while allowing over 90% of legitimate ones, demonstrating superior overall performance compared to existing prompt-agnostic VLM adversaries. In addition, our ProAda achieves competitive overall cross-model transferability and improved robustness against countermeasures.
Source: Answer It or Not? Towards Prompt-Adapted Adversarial Images on Vision Language Models