攻击视觉大模型注意力机制，可破坏多种下游任务
Attacking Attention of Foundation Models Disrupts Downstream Tasks
- 设计无任务依赖的攻击方法，直接干扰Transformer结构
- 在分类、检索、分割等5类任务中均实现有效破坏
- 适用于工业级视觉大模型，对安全研究者有参考价值
基础模型代表了人工智能领域最新的范式转变。这些大规模模型在广泛数据上预训练，可在多种下游任务中达到高精度，通常无需微调。因此，CLIP、DINO或视觉变换器（ViT）正成为众多工业级AI应用的核心。然而，依赖预训练基础模型也带来显著安全风险，因其易受对抗攻击。此类攻击通过精心构造输入误导AI系统，危及其可靠性。本文研究视觉基础模型（重点为CLIP和ViT）的漏洞，探索对抗攻击向下游任务的迁移性。我们提出一种新型攻击方法，以任务无关方式针对基于Transformer架构的结构。实验证明该攻击在分类、图像/文本检索、分割和深度估计等下游任务中均具有效性。代码已开源：https://github.com/HondamunigePrasannaSilva/attack-attention
原文摘要 · Abstract (English)
Foundation models represent the most prominent and recent paradigm shift in artificial intelligence. Foundation models are large models, trained on broad data that deliver high accuracy in many downstream tasks, often without fine-tuning. For this reason, models such as CLIP , DINO or Vision Transfomers (ViT), are becoming the bedrock of many industrial AI-powered applications. However, the reliance on pre-trained foundation models also introduces significant security concerns, as these models are vulnerable to adversarial attacks. Such attacks involve deliberately crafted inputs designed to deceive AI systems, jeopardizing their reliability. This paper studies the vulnerabilities of vision foundation models, focusing specifically on CLIP and ViTs, and explores the transferability of adversarial attacks to downstream tasks. We introduce a novel attack, targeting the structure of transformer-based architectures in a task-agnostic fashion. We demonstrate the effectiveness of our attack on several downstream tasks: classification, captioning, image/text retrieval, segmentation and depth estimation. Code available at:https://github.com/HondamunigePrasannaSilva/attack-attention
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。