Rapid progress is being made in developing large, pretrained, task-agnostic foundational vision models such as CLIP, ALIGN, DINOv2, etc. In fact, we are approaching the point where these models do not have to be finetuned downstream, and can simply be used in zero-shot or with a lightweight probing head. Critically, given the complexity of working at this scale, there is a bottleneck where relatively few organizations in the world are executing the training then sharing the models on centralized platforms such as HuggingFace and torch.hub. The goal of this work is to identify several key adversarial vulnerabilities of these models in an effort to make future designs more robust. Intuitively, our attacks manipulate deep feature representations to fool an out-of-distribution (OOD) detector which will be required when using these open-world-aware models to solve closed-set downstream tasks. Our methods reliably make in-distribution (ID) images (w.r.t. a downstream task) be predicted as OOD and vice versa while existing in extremely low-knowledge-assumption threat models. We show our attacks to be potent in whitebox and blackbox settings, as well as when transferred across foundational model types (e.g., attack DINOv2 with CLIP)! This work is only just the beginning of a long journey towards adversarially robust foundational vision models.

翻译：大型预训练的任务无关基础视觉模型（如CLIP、ALIGN、DINOv2等）正取得快速进展。事实上，我们正接近这样一种状态：这些模型无需在下游任务中进行微调，仅需零样本使用或配备轻量级探测头即可应用。关键问题是，鉴于在如此规模下工作的复杂性，存在一个瓶颈：全球仅有少数组织执行训练，然后将模型共享于HuggingFace和torch.hub等集中式平台。本文旨在识别这些模型的若干关键对抗性漏洞，以推动未来设计更具鲁棒性。直观地，我们的攻击通过操纵深度特征表示来欺骗异常值（OOD）检测器——当使用这些具备开放世界意识的模型解决封闭式下游任务时，此检测器不可或缺。我们的方法在极低知识假设威胁模型下，能可靠地使分布内（ID）图像（相对于下游任务）被预测为OOD，反之亦然。我们展示了攻击在白盒和黑盒设置中的有效性，甚至能在基础模型类型间迁移（例如，用CLIP攻击DINOv2）！这项工作仅是迈向对抗鲁棒基础视觉模型漫长征程的开端。