Open source software supply-chain attacks, once successful, can exact heavy costs in mission-critical applications. As open source ecosystems for deep learning flourish and become increasingly universal, they present attackers previously unexplored avenues to code-inject malicious backdoors in deep neural network models. This article proposes Flareon , a small, stealthy, seemingly harmless code modification that specifically targets the data augmentation pipeline with motion-based triggers. Flareon neither alters ground-truth labels, nor modifies the training loss objective, nor does it assume prior knowledge of the victim model architecture, training data, and training hyperparameters. Yet, it has a surprisingly large ramification on training—models trained under Flareon learn powerful target-conditioned (or “ all2all ”) backdoors. We also proposed a learnable variant of Flareon that is even stealthier in terms of added perturbations. The resulting models can exhibit high attack success rates for any target choices and better clean accuracies than backdoor attacks that not only seize greater control but also assume more restrictive attack capabilities. We also demonstrate the resilience of Flareon against a wide range of defenses. Flareon is fully open source and available online to the deep learning community.

In the age of pervasive machine learning applications, protecting digital content from unauthorized use has become a pressing concern. Unlearnable examples (UEs)—data modified with imperceptible perturbations to inhibit model training while preserving human usability—have emerged as a promising approach. However, existing UE methods assume unauthorized trainers have extensive exposure to UEs or that models are trained from scratch, which may not hold in practical scenarios, This paper investigates the effectiveness of UEs under the few-shot learning paradigm, pitching it against prompt learning (PL) models that leverage pretrained vision-language models (VLMs), like CLIP, capable of generalizing to new classes with minimal data. To address this, we introduce an adaptive UE framework to generate unlearnable examples that specifically target the PL process. In addition, we propose a novel UE countermeasure, A3, with cross-modal adversarial feature alignment, specifically designed to circumvent UEs under few-shot PL. Experimental evaluations on 7 datasets show that A3outperforms existing PL methods, achieving up to 33% higher performance in learning from UEs. For example, in the scenario involving ω→-bounded EM perturbations, A3has an average harmonic mean accuracy across 7 datasets of 82.43%, compared to CoCoOp’s baseline of 65.47%. Our findings highlight the limitations of existing UEs against PL and lay the foundation for future data protection mechanisms.

With the rapid development of large language models (LLMs), there has been a strong interest in integrating other modalities such as image comprehension capabilities. While they have shown impressive performance in various multimodal tasks, the robustness of Visual Language Models (VLMs) has not been thoroughly investigated. We mainly focus on the robustness of VLMs on visual adversarial examples. In this work, we explore the capability of adversarial examples targeting VLMs. We highlight that the multimodal nature of VLMs presents a unique attack surface to manipulate the outputs of the LLMs, and the continuous nature of visual inputs further enhances the effectiveness of adversarial attacks against language generative models. Furthermore, we demonstrate three application scenarios for adversarial examples targeting VLMs: image description, jailbreaking, and information hiding. We conduct experiments on several leading open-source VLMs and demonstrate the successful application of adversarial examples in all the proposed scenarios. We hope that our findings would enable the development of multimodal models more robust to adversarial attacks. Our code is available at https://github.com/lafeat/m3-break.

Diffusion models have become popular in computer vision applications due to their ability to generate high-quality images quickly, with some models achieving a high degree of realism. However, the use of these models for novel image manipulation and generation poses significant risks of being used for harmful purposes, such as the spread of misinformation or copyright infringement. Recent research has proposed techniques that involve adding imperceptible perturbations to images to mitigate privacy and copyright concerns. However, trivial image processing methods can largely destroy these protective perturbations. In this paper, we propose a new method called DiffCleaner, a destruction-restoration pipeline, that combines the advantages of image corruption and restoration methods. It can not only remove protective perturbations but also further preserve high quality generation, as well as fidelity of the original features in generated images. DiffCleaner produces specialized images with visualization and quantitative metrics closely matching unprotected results. We pitch a range of circumventing methods vs. two state-of-the-art data protection methods against diffusion models, and show that both are fragile and offer inadequate data protection. By providing a benchmark comprising a range of protective perturbations removal methods, we hope this paper will inspire and facilitate new research towards developing more resilient methods for data protection.