OCR 與排版攻擊

from PIL import Image, ImageDraw, ImageFont
 
def typographic_attack(
    image_path: str,
    overlay_text: str,
    position: str = "bottom",
    font_size: int = 32,
    bg_opacity: int = 180
) -> Image.Image:
    """於圖像覆蓋對抗文字。"""
    img = Image.open(image_path).convert("RGBA")
    overlay = Image.new("RGBA", img.size, (0, 0, 0, 0))
    draw = ImageDraw.Draw(overlay)
 
    try:
        font = ImageFont.truetype(
            "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf", font_size
        )
    except OSError:
        font = ImageFont.load_default()
 
    bbox = draw.textbbox((0, 0), overlay_text, font=font)
    text_w = bbox[2] - bbox[0]
    text_h = bbox[3] - bbox[1]
 
    # 位置計算
    if position == "bottom":
        x = (img.width - text_w) // 2
        y = img.height - text_h - 20
    elif position == "top":
        x = (img.width - text_w) // 2
        y = 20
    else:  # center
        x = (img.width - text_w) // 2
        y = (img.height - text_h) // 2
 
    # 半透明背景以供可讀性
    padding = 10
    draw.rectangle(
        [x - padding, y - padding, x + text_w + padding, y + text_h + padding],
        fill=(0, 0, 0, bg_opacity)
    )
    draw.text((x, y), overlay_text, fill=(255, 255, 255, 255), font=font)
 
    return Image.alpha_composite(img, overlay).convert("RGB")

def create_confusing_text_image(
    display_text: str,
    actual_instruction: str,
    width: int = 600,
    height: int = 100
) -> Image.Image:
    """
    建立可見文字與 VLM 讀取之文字不同之圖像。
 
    使用 VLM 可能以不同於人類所讀方式解讀之 Unicode 相似字元。
    """
    # Unicode 相似字：看起來相似但不同之字元
    confusables = {
        'a': '\u0430',  # Cyrillic а
        'e': '\u0435',  # Cyrillic е
        'o': '\u043e',  # Cyrillic о
        'p': '\u0440',  # Cyrillic р
        'c': '\u0441',  # Cyrillic с
        'x': '\u0445',  # Cyrillic х
    }
 
    img = Image.new("RGB", (width, height), "white")
    draw = ImageDraw.Draw(img)
    draw.text((10, 10), display_text, fill="black")
    return img

def size_hierarchy_attack(
    benign_text: str,
    malicious_text: str,
    width: int = 800,
    height: int = 400
) -> Image.Image:
    """
    利用文字大小階層——VLM 常優先處理較大文字。
    將惡意指令置於大字體、善意內容置於小字體。
    """
    img = Image.new("RGB", (width, height), "white")
    draw = ImageDraw.Draw(img)
 
    try:
        large_font = ImageFont.truetype(
            "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf", 48
        )
        small_font = ImageFont.truetype(
            "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf", 10
        )
    except OSError:
        large_font = ImageFont.load_default()
        small_font = large_font
 
    # 大而顯眼之惡意文字
    draw.text((50, 50), malicious_text, fill="black", font=large_font)
    # 小而不顯眼之善意文字
    draw.text((50, 300), benign_text, fill=(180, 180, 180), font=small_font)
 
    return img

def rotated_text_attack(text: str, angle: float = 180) -> Image.Image:
    """建立 VLM 可能誤讀之顛倒或旋轉文字。"""
    img = Image.new("RGB", (400, 100), "white")
    draw = ImageDraw.Draw(img)
    draw.text((10, 10), text, fill="black")
    return img.rotate(angle, expand=True, fillcolor="white")

def fragmented_injection(parts: list[str], img_size=(800, 600)) -> Image.Image:
    """將注入文字分割於圖像四象限。"""
    img = Image.new("RGB", img_size, "white")
    draw = ImageDraw.Draw(img)
 
    positions = [
        (50, 50),                           # 左上
        (img_size[0] - 200, 50),            # 右上
        (50, img_size[1] - 50),             # 左下
        (img_size[0] - 200, img_size[1] - 50)  # 右下
    ]
 
    for i, (part, pos) in enumerate(zip(parts, positions)):
        draw.text(pos, f"({i+1}) {part}", fill="black")
 
    return img