Attacking Attention of Foundation Models Disrupts Downstream Tasks

2025/06/03 by Hondamunige Prasanna Silva, Silva, Hondamunige Prasanna, Federico Becattini +3 · 1 citation
Computer Science · Social Sciences · #Adversarial Robustness in Machine Learning #Cryptography and Security (cs.CR) #Ethics and Social Impacts of AI #Explainable Artificial Intelligence (XAI) #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · pdf · doi:10.48550/arxiv.2506.05394

openalex publication_date 2025/06/03 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Foundation models represent the most prominent and recent paradigm shift in artificial intelligence. Foundation models are large models, trained on broad data that deliver high accuracy in many downstream tasks, often without fine-tuning. For this reason, models such as CLIP , DINO or Vision Transfomers (ViT), are becoming the bedrock of many industrial AI-powered applications. However, the reliance on pre-trained foundation models also introduces significant security concerns, as these models are vulnerable to adversarial attacks. Such attacks involve deliberately crafted inputs designed to deceive AI systems, jeopardizing their reliability. This paper studies the vulnerabilities of vision foundation models, focusing specifically on CLIP and ViTs, and explores the transferability of adversarial attacks to downstream tasks. We introduce a novel attack, targeting the structure of transformer-based architectures in a task-agnostic fashion. We demonstrate the effectiveness of our attack on several downstream tasks: classification, captioning, image/text retrieval, segmentation and depth estimation. Code available at:https://github.com/HondamunigePrasannaSilva/attack-attention

Citations

• Benchmarking Robust Self-Supervised Learning Across Diverse Downstream Tasks
• Universal Adversarial Perturbations for Vision-Language Pre-trained Models
• Benchmarking Zero-Shot Robustness of Multimodal Foundation Models: A Pilot Study
• SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentation
• Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learning
• Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Models
• DINOv2: Learning Robust Visual Features without Supervision
• Micrograph segmentations for DDEVD
• Segment Anything
• Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularization
• Poisoning Web-Scale Training Datasets is Practical
• BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Models
• Curved Representation Space of Vision Transformers
• Towards Adversarial Attack on Vision-Language Pre-training Models
• Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?
• Vision-Language Pre-Training with Triple Contrastive Learning
• Florence: A New Foundation Model for Computer Vision
• Are Transformers More Robust Than CNNs?
• Towards Transferable Adversarial Attacks on Vision Transformers
• Align before Fuse: Vision and Language Representation Learning with Momentum Distillation
• On Improving Adversarial Transferability of Vision Transformers
• Reveal of Vision Transformers Robustness against Adversarial Attacks
• Emerging Properties in Self-Supervised Vision Transformers
• On the Robustness of Vision Transformers to Adversarial Examples
• Understanding Robustness of Transformers for Image Classification
• Reading Isn't Believing: Adversarial Attacks On Multi-Modal Neurons
• Learning Transferable Visual Models From Natural Language Supervision
• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• Language Models are Few-Shot Learners
• Black-box Adversarial Attacks with Limited Queries and Information
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Semantic Understanding of Scenes through the ADE20K Dataset
• Semantic Understanding of Scenes Through the ADE20K Dataset
• Towards Evaluating the Robustness of Neural Networks
• Adversarial examples in the physical world
• DeepFool: a simple and accurate method to fool deep neural networks
• Explaining and Harnessing Adversarial Examples
• ImageNet Large Scale Visual Recognition Challenge
• ImageNet Large Scale Visual Recognition Challenge
• CNN Features off-the-shelf: an Astounding Baseline for Recognition
• Exploring the Relationship between Architecture and Adversarially Robust Generalization
• On the Adversarial Robustness of Vision Transformers
• Exploring Adversarial Robustness of Vision Transformers in the Spectral Perspective
• BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding

Cited by

• VIP: Visual Information Protection through Adversarial Attacks on Vision-Language Models

Related

• Task-Agnostic Attacks Against Vision Foundation Models
• As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?
• Adversarial Attacks on Foundational Vision Models
• Probing the Robustness of Vision-Language Pretrained Models: A Multimodal Adversarial Attack Approach
• Protego: Detecting Adversarial Examples for Vision Transformers via Intrinsic Capabilities