As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?
<|reference_start|>As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?: Foundation models pre-trained on web-scale vision-language data, such as CLIP, are widely used as cornerstones of powerful machine learning systems. While pre-training offers clear advantages for downstream learning, it also endows downstream models with shared adversarial vulnerabilities that can be easily identified through the open-sourced foundation model. In this work, we expose such vulnerabilities in CLIP's downstream models and show that foundation models can serve as a basis for attacking their downstream systems. In particular, we propose a simple yet effective adversarial attack strategy termed Patch Representation Misalignment (PRM). Solely based on open-sourced CLIP vision encoders, this method produces adversaries that simultaneously fool more than 20 downstream models spanning 4 common vision-language tasks (semantic segmentation, object detection, image captioning and visual question-answering). Our findings highlight the concerning safety risks introduced by the extensive usage of public foundational models in the development of downstream systems, calling for extra caution in these scenarios.<|reference_end|>
@article{hu2024as,
    title={As Firm As Their Foundations: Can open-sourced foundation models be used
  to create adversarial examples for downstream tasks?},
    author={Anjun Hu, Jindong Gu, Francesco Pinto, Konstantinos Kamnitsas, Philip
  Torr},
    journal={arXiv preprint arXiv:2403.12693},
    year={2024},
    archivePrefix={arXiv},
    eprint={2403.12693},
    primaryClass={cs.CV}
}