如其基础般坚固：开源基础模型能否被用于为下游任务创建对抗样本？
As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?
AI总结：
本文揭示CLIP等开源基础模型可被利用生成对抗样本，攻击其下游模型，提出补丁表示错位方法，能同时欺骗20多个下游模型，警示公共基础模型的安全风险。
摘要：
在Web规模视觉-语言数据上预训练的基础模型（如CLIP）被广泛用作强大机器学习系统的基石。虽然预训练为下游学习提供了明显优势，但它也使下游模型共享对抗性漏洞，这些漏洞可以通过开源基础模型轻松识别。在这项工作中，我们揭示了CLIP下游模型中的此类漏洞，并表明基础模型可以作为攻击其下游系统的基础。具体而言，我们提出了一种简单而有效的对抗攻击策略，称为补丁表示错位（Patch Representation Misalignment, PRM）。仅基于开源的CLIP视觉编码器，该方法生成的对抗样本能同时欺骗超过20个下游模型，涵盖4种常见的视觉-语言任务（语义分割、目标检测、图像描述和视觉问答）。我们的发现强调了在开发下游系统中广泛使用公共基础模型所带来的令人担忧的安全风险，呼吁在这些场景中需要格外谨慎。
英文摘要：
Foundation models pre-trained on web-scale vision-language data, such as CLIP, are widely used as cornerstones of powerful machine learning systems. While pre-training offers clear advantages for downstream learning, it also endows downstream models with shared adversarial vulnerabilities that can be easily identified through the open-sourced foundation model. In this work, we expose such vulnerabilities in CLIP's downstream models and show that foundation models can serve as a basis for attacking their downstream systems. In particular, we propose a simple yet effective adversarial attack strategy termed Patch Representation Misalignment (PRM). Solely based on open-sourced CLIP vision encoders, this method produces adversaries that simultaneously fool more than 20 downstream models spanning 4 common vision-language tasks (semantic segmentation, object detection, image captioning and visual question-answering). Our findings highlight the concerning safety risks introduced by the extensive usage of public foundational models in the development of downstream systems, calling for extra caution in these scenarios.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
