少即是多——直至崩潰：大型視覺語言模型中視覺標記壓縮的安全隱患

摘要

视觉标记压缩技术被广泛用于提升大型视觉语言模型（LVLMs）的推理效率，使其能够部署在延迟敏感和资源受限的场景中。然而现有研究主要关注效率与性能，视觉标记压缩的安全隐患却尚未得到充分探索。本研究首次揭示视觉标记压缩会显著降低LVLMs的鲁棒性：在未压缩状态下表现稳健的模型，一旦启用压缩就会变得极度脆弱。这种脆弱性具有状态特异性——失效模式仅出现在压缩环境下，关闭压缩后即完全消失，使其具有高度隐蔽性和诊断难度。通过分析压缩流程的关键环节，我们发现标记重要性排序的不稳定性是导致鲁棒性下降的主因。微小且难以察觉的扰动即可显著改变标记排序，导致压缩机制误删任务关键信息，最终引发模型失效。基于此发现，我们提出压缩感知攻击（CAA）来系统研究和利用该漏洞。CAA直接针对标记选择机制，能专门在压缩推理环境下诱发失效。我们进一步将这种方法扩展到更现实的黑盒场景，提出迁移CAA方案，即使目标模型和压缩配置均不可访问时仍能生效。针对潜在防御措施的评估表明，现有防护手段效果有限。跨模型、数据集和压缩方法的广泛实验证明，视觉标记压缩会显著削弱模型鲁棒性，揭示出此前被忽视的效率与安全性之间的权衡关系。

English

Visual token compression is widely adopted to improve the inference efficiency of Large Vision-Language Models (LVLMs), enabling their deployment in latency-sensitive and resource-constrained scenarios. However, existing work has mainly focused on efficiency and performance, while the security implications of visual token compression remain largely unexplored. In this work, we first reveal that visual token compression substantially degrades the robustness of LVLMs: models that are robust under uncompressed inference become highly vulnerable once compression is enabled. These vulnerabilities are state-specific; failure modes emerge only in the compressed setting and completely disappear when compression is disabled, making them particularly hidden and difficult to diagnose. By analyzing the key stages of the compression process, we identify instability in token importance ranking as the primary cause of this robustness degradation. Small and imperceptible perturbations can significantly alter token rankings, leading the compression mechanism to mistakenly discard task-critical information and ultimately causing model failure. Motivated by this observation, we propose a Compression-Aware Attack to systematically study and exploit this vulnerability. CAA directly targets the token selection mechanism and induces failures exclusively under compressed inference. We further extend this approach to more realistic black-box settings and introduce Transfer CAA, where neither the target model nor the compression configuration is accessible. We further evaluate potential defenses and find that they provide only limited protection. Extensive experiments across models, datasets, and compression methods show that visual token compression significantly undermines robustness, revealing a previously overlooked efficiency-security trade-off.

少即是多——直至崩潰：大型視覺語言模型中視覺標記壓縮的安全隱患

Less Is More -- Until It Breaks: Security Pitfalls of Vision Token Compression in Large Vision-Language Models

摘要

Support