标题： 学习检测大型视觉-语言模型中的未知越狱攻击：一种统一且准确的方法 显示英文标题

标题： Learning to Detect Unknown Jailbreak Attacks in Large Vision-Language Models: A Unified and Accurate Approach

摘要： 尽管进行了大量对齐努力，大型视觉语言模型（LVLMs）仍然容易受到越狱攻击，这带来了严重的安全风险。 虽然最近的检测工作由于其丰富的跨模态信息而转向内部表示，但大多数方法依赖于启发式规则而不是原则性目标，导致性能不佳。 为了解决这些限制，我们提出了学习检测（LoD），一种新的无监督框架，将越狱检测形式化为异常检测。 LoD引入了两个关键组件：多模态安全概念激活向量（MSCAV），它捕捉跨模态的逐层安全相关表示，以及安全模式自编码器，它建模从安全输入中得出的MSCAV分布，并通过重建误差检测异常。 通过仅在安全样本上训练自编码器（AE）而无需攻击标签，LoD自然地将越狱输入识别为分布异常，从而实现准确且统一的越狱攻击检测。 在三个不同的LVLMs和五个基准上的全面实验表明，LoD实现了最先进的性能，平均AUROC为0.9951，在最强基线的最小AUROC上提高了高达38.89%。 显示英文摘要

摘要： Despite extensive alignment efforts, Large Vision-Language Models (LVLMs) remain vulnerable to jailbreak attacks, posing serious safety risks. Although recent detection works have shifted to internal representations due to their rich cross-modal information, most methods rely on heuristic rules rather than principled objectives, resulting in suboptimal performance. To address these limitations, we propose Learning to Detect (LoD), a novel unsupervised framework that formulates jailbreak detection as anomaly detection. LoD introduces two key components: Multi-modal Safety Concept Activation Vectors (MSCAV), which capture layer-wise safety-related representations across modalities, and the Safety Pattern Auto-Encoder, which models the distribution of MSCAV derived from safe inputs and detects anomalies via reconstruction errors. By training the auto-encoder (AE) solely on safe samples without attack labels, LoD naturally identifies jailbreak inputs as distributional anomalies, enabling accurate and unified detection of jailbreak attacks. Comprehensive experiments on three different LVLMs and five benchmarks demonstrate that LoD achieves state-of-the-art performance, with an average AUROC of 0.9951 and an improvement of up to 38.89% in the minimum AUROC over the strongest baselines.