SLANT：虚假标志分析工具包
SLANT: Spurious Logo ANalysis Toolkit
AI总结：
本文提出SLANT虚假标志分析工具包，通过半自动机制挖掘视觉语言模型中与标志相关的虚假相关性，揭示其导致的误分类风险，并提供两种防御策略。
摘要：
在线内容中充斥着标志，从广告和社交媒体帖子到网站品牌和产品植入。因此，这些标志在用于预训练视觉语言模型（Vision-Language Models，VLM）的大规模网络抓取数据集中普遍存在，而这些模型被广泛用于各种任务（内容审核、对象分类）。尽管已有研究表明这些模型在各种任务中会学习到有害的相关性，但这些相关性是否包含标志仍未得到充分研究。由于标志常被品牌和政府机构等面向公众的实体使用，理解这一点尤为重要。为此，我们开发了SLANT：一个虚假标志分析工具包。我们的关键发现是，某些标志确实会导致虚假的错误预测，例如，将阿迪达斯标志添加到人物照片中会导致模型将该人分类为贪婪的。SLANT包含一个半自动机制来挖掘此类“虚假”标志。该机制由一个综合标志库CC12M-LogoBank和一个算法组成，该算法在库中搜索VLM与用户提供的下游识别目标虚假相关的标志。我们发现了各种看似无害的标志，视觉语言模型将其1）与负面的人类形容词相关联；2）与“无害性”概念相关联，导致模型将有害的在线内容误分类为无害；3）与用户提供的对象概念相关联，导致ImageNet零样本分类的识别准确率降低。此外，SLANT的标志可被视为对基础模型的有效攻击；攻击者可以在有害内容上放置虚假标志，导致模型将其误分类为无害。考虑到标志攻击的简单性，这种威胁令人担忧，因为它扩大了视觉语言模型的攻击面。作为防御措施，我们在工具包中包含了两种有效的缓解策略，这些策略可与基础模型的零样本推理无缝集成。
英文摘要：
Online content is filled with logos, from ads and social media posts to website branding and product placements. Consequently, these logos are prevalent in the extensive web-scraped datasets used to pretrain Vision-Language Models, which are used for a wide array of tasks (content moderation, object classification). While these models have been shown to learn harmful correlations in various tasks, whether these correlations include logos remains understudied. Understanding this is especially important due to logos often being used by public-facing entities like brands and government agencies. To that end, we develop SLANT: A Spurious Logo ANalysis Toolkit. Our key finding is that some logos indeed lead to spurious incorrect predictions, for example, adding the Adidas logo to a photo of a person causes a model classify the person as greedy. SLANT contains a semi-automatic mechanism for mining such "spurious" logos. The mechanism consists of a comprehensive logo bank, CC12M-LogoBank, and an algorithm that searches the bank for logos that VLMs spuriously correlate with a user-provided downstream recognition target. We uncover various seemingly harmless logos that VL models correlate 1) with negative human adjectives 2) with the concept of `harmlessness'; causing models to misclassify harmful online content as harmless, and 3) with user-provided object concepts; causing lower recognition accuracy on ImageNet zero-shot classification. Furthermore, SLANT's logos can be seen as effective attacks against foundational models; an attacker could place a spurious logo on harmful content, causing the model to misclassify it as harmless. This threat is alarming considering the simplicity of logo attacks, increasing the attack surface of VL models. As a defense, we include in our Toolkit two effective mitigation strategies that seamlessly integrate with zero-shot inference of foundation models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
