Fine-tuning large pre-trained computer vision models is infeasible for resource-limited users. Visual prompt learning (VPL) has thus emerged to provide an efficient and flexible alternative to model fine-tuning through Visual Prompt as a Service (VPPTaaS). Specifically, the VPPTaaS provider optimizes a visual prompt given downstream data, and downstream users can use this prompt together with the large pre-trained model for prediction. However, this new learning paradigm may also pose security risks when the VPPTaaS provider instead provides a malicious visual prompt. In this paper, we take the first step to explore such risks through the lens of backdoor attacks. Specifically, we propose BadVisualPrompt, a simple yet effective backdoor attack against VPL. For example, poisoning $5\%$ CIFAR10 training data leads to above $99\%$ attack success rates with only negligible model accuracy drop by $1.5\%$. In particular, we identify and then address a new technical challenge related to interactions between the backdoor trigger and visual prompt, which does not exist in conventional, model-level backdoors. Moreover, we provide in-depth analyses of seven backdoor defenses from model, prompt, and input levels. Overall, all these defenses are either ineffective or impractical to mitigate our BadVisualPrompt, implying the critical vulnerability of VPL.

翻译：微调大型预训练计算机视觉模型对于资源受限用户而言不可行。因此，视觉提示学习（VPL）应运而生，通过视觉提示即服务（VPPTaaS）提供了一种高效且灵活的替代方案，用于替代模型微调。具体而言，VPPTaaS提供者基于下游数据优化视觉提示，下游用户可将该提示与大型预训练模型结合用于预测。然而，当VPPTaaS提供者转而提供恶意视觉提示时，这种新型学习范式也可能带来安全风险。本文首次通过后门攻击的视角探索此类风险。具体而言，我们提出了BadVisualPrompt——一种针对VPL的简单而有效的后门攻击方法。例如，对CIFAR10训练数据进行5%的投毒即可实现超过99%的攻击成功率，而模型准确率仅下降1.5%。特别地，我们发现并解决了后门触发器与视觉提示之间交互作用这一新技术挑战，该问题在传统模型级后门中并不存在。此外，我们从模型级、提示级和输入级三个层面对七种后门防御方法进行了深入分析。总体而言，所有这些防御方法在缓解我们的BadVisualPrompt攻击时要么无效，要么不切实际，这揭示了VPL的关键脆弱性。