Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?
This work addresses the lack of a universal evaluation benchmark for jailbreak attacks on LLMs and MLLMs, providing a standardized dataset and analysis that is significant for researchers and developers focused on AI safety, though it is incremental in building upon existing red-teaming methods.
This paper tackles the problem of evaluating the safety of large language models (LLMs) and multimodal large language models (MLLMs) against jailbreak attacks by building a comprehensive dataset with 1,445 harmful questions across 11 safety policies and conducting extensive red-teaming experiments on 11 models. The result shows that GPT-4 and GPT-4V demonstrate better robustness against these attacks compared to open-source models, with GPT-4V being particularly resilient, and that visual jailbreak methods have limited transferability compared to textual ones.
Various jailbreak attacks have been proposed to red-team Large Language Models (LLMs) and revealed the vulnerable safeguards of LLMs. Besides, some methods are not limited to the textual modality and extend the jailbreak attack to Multimodal Large Language Models (MLLMs) by perturbing the visual input. However, the absence of a universal evaluation benchmark complicates the performance reproduction and fair comparison. Besides, there is a lack of comprehensive evaluation of closed-source state-of-the-art (SOTA) models, especially MLLMs, such as GPT-4V. To address these issues, this work first builds a comprehensive jailbreak evaluation dataset with 1445 harmful questions covering 11 different safety policies. Based on this dataset, extensive red-teaming experiments are conducted on 11 different LLMs and MLLMs, including both SOTA proprietary models and open-source models. We then conduct a deep analysis of the evaluated results and find that (1) GPT4 and GPT-4V demonstrate better robustness against jailbreak attacks compared to open-source LLMs and MLLMs. (2) Llama2 and Qwen-VL-Chat are more robust compared to other open-source models. (3) The transferability of visual jailbreak methods is relatively limited compared to textual jailbreak methods. The dataset and code can be found https://github.com/chenxshuo/RedTeamingGPT4V