Technical Summary: BADBONE

Problem Statement

Prompt learning has emerged as a efficient paradigm for adapting large-scale pre-trained backbone models (e.g., ViT, CLIP, ResNet) to downstream tasks without fine-tuning the backbone parameters. Instead, it learns a lightweight input perturbation (a "prompt") to shift the input distribution. While this approach saves computational resources and offers flexibility, its security vulnerabilities remain underexplored.

Existing backdoor attacks on prompt learning typically inject the backdoor directly into the prompt itself. These attacks are limited because they only affect a specific visual prompt; if a victim chooses a different prompt design, the attack fails. Conversely, traditional backdoor attacks on backbone models often compromise the model's utility or are easily detectable because the trigger activates the backdoor independently of the downstream adaptation process.

The paper identifies a gap: there is no effective method to implant a backdoor into the backbone model such that the vulnerability is inherited by any downstream task employing prompt learning, while maintaining high utility and stealth.

Methodology: BADBONE

The authors propose BADBONE, the first backdoor attack targeting the backbone model in visual prompt learning. The core innovation is a bi-level optimization framework that simultaneously optimizes the prompt generation process and the backbone poisoning process.

1. Threat Model

• Attacker: A malicious model provider who supplies a backdoored backbone model ($f'$) to a victim.
• Victim: A user with limited ML expertise who uses the provided backbone to generate their own visual prompt ($g'$) for a specific downstream task.
• Capabilities: The attacker has access to a shadow dataset ($D$) similar to the victim's downstream data and the original pre-training dataset. The attacker cannot influence the victim's prompt generation process but can control the backbone weights.
• Goal:
  • Utility: The backdoored backbone must perform competitively on both pre-training and downstream tasks (with a clean prompt).
  • Effectiveness: The model must misclassify triggered samples (targeted or untargeted).
  • Stealthiness: The backdoor must remain dormant unless both a learned downstream prompt and a specific trigger are present.

2. Bi-Level Optimization Framework

The attack is formulated as a nested optimization problem where the prompt parameters ($\phi$) are the upper-level variables and the backbone parameters ($\theta$) are the lower-level variables:
$$\phi^* = \arg\min_{\phi} \ell_{prompt}(\theta^*, \phi)$$
$$\text{s.t. } \theta^* = \arg\min_{\theta} \ell_{poisoning}(\theta, \phi)$$

The solution is approximated via an iterative process alternating between two phases:

• Phase A: Prompt Learning (Upper Level):
  The attacker freezes the backbone model ($f_\theta$) and optimizes a prompt ($g_\phi$) using a shadow dataset ($D$). This phase mimics the victim's behavior to ensure the learned prompt is compatible with the poisoned backbone. The loss is a standard categorical cross-entropy ($\ell_{prompt}$).

• Phase B: Poisoning Phase (Lower Level):
  The attacker freezes the learned prompt ($g_\phi$) and fine-tunes the backbone model ($f_\theta$) using a composite poisoning dataset ($D_{poisoning}$). This dataset consists of three subsets:

  1. Triggered Dataset ($D_t$): Images with a trigger added and labels flipped to a target class (for targeted attacks) or flipped randomly/sequentially (for untargeted attacks).
  2. Clean Dataset ($D_c$): Clean images from the shadow dataset to maintain downstream task utility.
  3. Pre-training Dataset ($D_p$): Images from the original pre-training set to maintain pre-training utility.

  The poisoning loss ($\ell_{poisoning}$) is a weighted sum:
  $$\ell_{poisoning} = \gamma \ell_{D_t} + \beta \ell_{D_c} + \alpha \ell_{D_p}$$
  where $\gamma, \beta, \alpha$ balance attack effectiveness, downstream utility, and pre-training utility, respectively.

3. Activation Mechanism

The backdoor employs a "prompt-and-trigger co-activation" mechanism.

• Trigger Alone: If a trigger is applied to the backbone without a learned prompt (e.g., on the pre-training task), the backdoor remains dormant, and the model behaves normally.
• Prompt Alone: If a learned prompt is used without a trigger, the model maintains high accuracy on clean inputs.
• Co-activation: The malicious behavior is only exhibited when the victim uses the poisoned backbone to generate a prompt for a downstream task and the input image contains the trigger.

Key Contributions

1. First Backbone-Level Attack: BADBONE is the first work to propose a targeted/untargeted backdoor attack against the backbone model in visual prompt learning, rather than the prompt itself.
2. Bi-Level Optimization: The authors introduce a bi-level optimization strategy to handle the interaction between backbone poisoning and downstream prompt adaptation, enabling the backdoor to be inherited by the victim's learned prompt.
3. Stealthiness: The attack features a co-activation mechanism that makes the backdoor difficult to detect by standard defenses, as it does not activate under single-condition scenarios (trigger-only or prompt-only).
4. Transferability: The attack demonstrates high transferability across different backbone architectures (ResNet18, ResNet50, BiT-M-RN50), datasets (CIFAR-10, SVHN, EuroSAT), and prompt designs (padding, patches).

Experimental Results

The authors evaluated BADBONE on three backbone models and three downstream datasets.

• Effectiveness:
  • Targeted Attacks: Achieved high Attack Success Rates (ASR). For example, on CIFAR-10 with ResNet50, the ASR reached 98.66% (baseline: 12.44%).
  • Untargeted Attacks: Achieved high Misclassification Rates (MR). For example, on EuroSAT with ResNet18, the MR reached 93.16% (baseline: 26.68%).
• Utility:
  • The backdoored models maintained competitive performance on pre-training tasks ($Acc_{pre}$) and downstream tasks with clean prompts ($Acc_{target}$). In many cases, the utility was comparable to or slightly better than clean baselines due to the inclusion of clean data in the poisoning phase.
• Stealthiness Evaluation:
  • Trigger-Only: When tested on the pre-training task with triggers but no prompt, the ASR was negligible (e.g., 0.10%), indistinguishable from clean models.
  • Prompt-Only: The models maintained high accuracy on clean test sets.
• Defense Evasion:
  • The authors evaluated six state-of-the-art defenses: Neural Cleanse, ABS, MNTD, NAD, CLP, and D-BR.
  • Detection: Neural Cleanse, ABS, and MNTD largely failed to detect the backdoors, predicting the models as clean.
  • Removal: NAD, CLP, and D-BR failed to remove the backdoor without severely degrading model utility. Specifically, CLP removed the backdoor but destroyed utility, while D-BR failed to remove the backdoor and also harmed utility.

Significance and Claims

The paper claims that BADBONE exposes a critical, previously unexplored vulnerability in the prompt learning paradigm. By targeting the backbone model rather than the prompt, the attack ensures that the vulnerability is inherited by any downstream task that utilizes the poisoned backbone, regardless of the specific prompt design chosen by the victim.

The authors emphasize that the co-activation mechanism is the key to the attack's stealthiness, rendering existing detection methods (which often rely on trigger-only or global perturbation analysis) ineffective. The work concludes that current defense mechanisms are insufficient for this new attack vector and highlights the urgent need for developing advanced defenses specifically tailored to the interaction between backbone models and prompt learning. The authors release their code to facilitate reproducibility and defensive research.