{"id":14043886,"url":"https://github.com/sail-sg/Agent-Smith","last_synced_at":"2025-07-27T15:31:58.369Z","repository":{"id":222297461,"uuid":"751656291","full_name":"sail-sg/Agent-Smith","owner":"sail-sg","description":"[ICML2024] Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","archived":false,"fork":false,"pushed_at":"2024-03-26T03:54:24.000Z","size":30763,"stargazers_count":66,"open_issues_count":0,"forks_count":9,"subscribers_count":6,"default_branch":"main","last_synced_at":"2024-08-12T08:13:05.784Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://sail-sg.github.io/Agent-Smith/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sail-sg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-02-02T03:20:14.000Z","updated_at":"2024-08-09T11:47:54.000Z","dependencies_parsed_at":"2024-03-26T04:48:17.166Z","dependency_job_id":null,"html_url":"https://github.com/sail-sg/Agent-Smith","commit_stats":null,"previous_names":["sail-sg/agent-smith"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sail-sg%2FAgent-Smith","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sail-sg%2FAgent-Smith/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sail-sg%2FAgent-Smith/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sail-sg%2FAgent-Smith/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sail-sg","download_url":"https://codeload.github.com/sail-sg/Agent-Smith/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":227814492,"owners_count":17823912,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-12T08:06:36.780Z","updated_at":"2024-12-02T22:31:49.072Z","avatar_url":"https://github.com/sail-sg.png","language":"Python","funding_links":[],"categories":["Attack","Jailbreak-Attack","📚 Research \u0026 Publications"],"sub_categories":["🔒 OWASP Top 10 for AI Agents (Non official)"],"readme":"\u003cp align=\"center\" width=\"100%\"\u003e\n\u003cimg src=\"assets/logo_.png\" alt=\"Agent-Smith\" style=\"width: 50%; min-width: 300px; display: block; margin: auto;\"\u003e\n\u003c/p\u003e\n\n\u003ch1 align='center' style=\"text-align:center; font-weight:bold; font-size:2.0em;letter-spacing:2.0px;\"\u003e\n                Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast \u003c/h1\u003e\n\n\u003c!-- \u003cp align='center' style=font-size:1.2em;\u003e\n\u003cb\u003e\n\u003cem\u003earXiv-Preprint, 2024\u003c/em\u003e \u003cbr\u003e\n\u003c/b\u003e\n\u003c/p\u003e --\u003e\n\n\u003cp align='left' style=\"text-align:left;font-size:1.2em;\"\u003e\n\u003cb\u003e\n    [\u003ca href=\"https://sail-sg.github.io/Agent-Smith\" target=\"_blank\" style=\"text-decoration: none;\"\u003eProject Page\u003c/a\u003e] |\n    [\u003ca href=\"https://arxiv.org/abs/2402.08567\" target=\"_blank\" style=\"text-decoration: none;\"\u003earXiv\u003c/a\u003e]\n\u003c/b\u003e\n\u003c/p\u003e\n\n----------------------------------------------------------------------\n\n\u003c!-- ### TL, DR: \n```\nIn this work, we report an even more severe safety issue in multi-agent environments, referred to as infectious jailbreak. It entails the adversary simply jailbreaking a single agent, and without any further intervention from the adversary, (almost) all agents will become infected exponentially fast and exhibit harmful behaviors.\n``` --\u003e\n\n## Setup\nWe run all our experiments on A100 GPUs with 40GB memory. To get started, follow these steps:\n\n1. **Clone the GitHub Repository:**\n   ```shell\n   git clone https://github.com/sail-sg/Agent-Smith.git\n   ```\n2. **Set Up Python Environment:**\n   ```shell\n   conda create -n agentsmith python=3.10 -y\n   conda activate agentsmith\n   conda install -c \"nvidia/label/cuda-12.1.0\" cuda-toolkit\n   ```\n3. **Install Dependencies:**\n   ```shell\n   pip install torch==2.1.0 torchvision\n   pip install git+https://github.com/huggingface/transformers.git@c90268de7560c3fef21a927e0bfcf2b611a8711e\n   pip install accelerate==0.22.0\n   pip install git+https://github.com/necla-ml/Diff-JPEG\n   pip install protobuf pandas kornia\n   ```\n\n## Datasets\n\nWe run most of our experiments using [ArtBench](https://github.com/liaopeiyuan/artbench) as the image pool and [AdvBench](https://github.com/llm-attacks/llm-attacks) as the target pool. \n\n## Attack\n\nIn the `attack` folder, we have already saved benign chat records generated by 64 agents employing [LLaVA-1.5 7B](https://huggingface.co/llava-hf/llava-1.5-7b-hf) on high diversity scenario at `simulation_high.csv` and low diversity scenario at `simulation_low.csv`. Please feel free to regenerate the data.\n\nWe employ [accelerate](https://huggingface.co/docs/accelerate) with FSDP to implement our attack. We have provided the configuration file `accelerate_config.yaml`. By default, we set `num_processes` as 4.\n\n\n### Border Attack\n\nTo utilize border attack to craft adversarial images, run the following command\n\n```\naccelerate launch --config_file accelerate_config.yaml optimize.py --border=$border --div=$div --unconstrained\n```\n\nHere `$border` refers to the perturbation budget and `$div` refers to the chat textual diversity. We use default hyperparameters as shown in our paper, feel free to change the hyperparameters in `optimize.py`.\n\n### Pixel Attack\n\nTo utilize pixel attack to craft adversarial images, run the following command\n\n```\naccelerate launch --config_file accelerate_config.yaml optimize.py --epsilon=$epsilon --div=$div --pixel_attack\n```\n\nHere `$epsilon` refers to the perturbation budget, ranging from [1, 255], we will divide it by 255 in our implementation. \n\n### Attack with image augmentation\n\nTo enable image augmentation, run the following command\n\n```\naccelerate launch --config_file accelerate_config.yaml optimize.py --border=$border --div=$div --unconstrained --prob_random_flip=$prob_random_flip --enable_random_size --upper_random_resize=$upper_random_resize --lower_random_resize=$lower_random_resize --prob_random_jpeg=$prob_random_jpeg\n```\n\nWe set `$prob_random_flip` as 0.5, `$prob_random_jpeg` as 0.5, `$upper_random_resize` as 448, and `$lower_random_resize` as 224.\n\n\n### Validation\n\nWhen validating the crafted adversarial images, we need to use the same parameters compared to the attack command. For example, if the attack command is\n\n```\naccelerate launch --config_file accelerate_config.yaml optimize.py --border=$border --div=$div --unconstrained\n```\n\nthen the validation command is\n\n```\npython validate.py --border=$border --div=$div --unconstrained\n```\n\nAfterward, we will save the selected adversarial image named `adv_image.png` in the experimental folder.\n\n\n## Simulation\n\n### Simulation of benign multi-agent system\nRun the following command to generate ensemble records for crafting adversarial images.\n\n```shell\ntime accelerate launch --num_processes=4 simulation/simulation_batch.py --high \n```\n\n### Simulation of infectious jailbreak\nRun the following command to evaluate the crafted adversarial images.\n\n```shell\ntime accelerate launch --num_processes=4 simulation/simulation_test_batch.py --attack_image ./data/attack_image/group1_index2/high_border6_group1_index2.png --num_agents 256 --high\n```\nCheck [Analyze.ipynb](Analyze.ipynb) to plot the infection curves.\n\n\n# Bibtex\nIf you find this project useful in your research, please consider citing our paper:\n\n```\n@article{\n      gu2024agent,\n      title={Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast},\n      author={Gu, Xiangming and Zheng, Xiaosen and Pang, Tianyu \n        and Du, Chao and Liu, Qian and Wang, Ye and Jiang, Jing and Lin, Min},\n      journal={arXiv preprint arXiv:2402.08567},\n      year={2024},\n      }\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsail-sg%2FAgent-Smith","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsail-sg%2FAgent-Smith","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsail-sg%2FAgent-Smith/lists"}