Attacking Attention of Foundation Models Disrupts Downstream Tasks
Not on the map. Why?
Abstract (arXiv)
Foundation models represent the most prominent and recent paradigm shift in artificial intelligence. Foundation models are large models, trained on broad data that deliver high accuracy in many downstream tasks, often without fine-tuning. For this reason, models such as CLIP , DINO or Vision Transfomers (ViT), are becoming the bedrock of many industrial AI-powered applications. However, the reliance on pre-trained foundation models also introduces significant security concerns, as these models are vulnerable to adversarial attacks. Such attacks involve deliberately crafted inputs designed to deceive AI systems, jeopardizing their reliability. This paper studies the vulnerabilities of vision foundation models, focusing specifically on CLIP and ViTs, and explores the transferability of adversarial attacks to downstream tasks. We introduce a novel attack, targeting the structure of transformer-based architectures in a task-agnostic fashion. We demonstrate the effectiveness of our attack on several downstream tasks: classification, captioning, image/text retrieval, segmentation and depth estimation. Code available at:https://github.com/HondamunigePrasannaSilva/attack-attention
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 41 of its 52 references that are in the map. First posted on arXiv 3 Jun 2025.
Builds on
41 of 52 references.
References · 41
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
- 2023Segment Anythingcited by 8,234
- 2023DINOv2: Learning Robust Visual Features without Supervisioncited by 7,974
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2021Emerging Properties in Self-Supervised Vision Transformerscited by 6,968
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
29 more
- 2016Adversarial examples in the physical worldcited by 1,769
- 2021Align before Fuse: Vision and Language Representation Learning with Momentum Distillationcited by 1,619
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
- 2016Semantic Understanding of Scenes through the ADE20K Datasetcited by 1,069
- 2021Florence: A New Foundation Model for Computer Visioncited by 804
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
- 2014CNN Features off-the-shelf: an Astounding Baseline for Recognitioncited by 316
- 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
- 2021Understanding Robustness of Transformers for Image Classificationcited by 249
- 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
- 2022Vision-Language Pre-Training with Triple Contrastive Learningcited by 212
- 2021Are Transformers More Robust Than CNNs?cited by 187
- 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
- 2022Towards Adversarial Attack on Vision-Language Pre-training Modelscited by 144
- 2023Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Modelscited by 108
- 2021On the Adversarial Robustness of Vision Transformerscited by 106
- 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
- 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
- 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 49
- 2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
- 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
- 2021Are Vision Transformers Robust to Patch Perturbations?cited by 39
- 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
- 2024Universal Adversarial Perturbations for Vision-Language Pre-trained Modelscited by 31
- 2021Reading Isn't Believing: Adversarial Attacks On Multi-Modal Neuronscited by 29
- 2023Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learningcited by 16
- 2022Curved Representation Space of Vision Transformerscited by 8
- 2024Benchmarking Zero-Shot Robustness of Multimodal Foundation Models: A Pilot Studycited by 5
- 2024Benchmarking Robust Self-Supervised Learning Across Diverse Downstream Taskscited by 5
Built on by
Citing papers per year: 2026: 2.
2 papers.