Research map / Adversarial robustness and security / Attacks on text and graphs
TARP-VP: Towards Evaluation of Transferred Adversarial Robustness and Privacy on Label Mapping Visual Prompting Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Evaluates adversarial robustness and membership inference privacy of label-mapping visual prompting (LM-VP) models across pre-trained backbones, and proposes transfer adversarial training for LM-VP, which improves transferred robustness and MIA resistance together.
Problem
Adversarial training improves robustness but increases membership inference privacy risk, a negative trade-off. The security (adversarial robustness and privacy) of label-mapping visual prompting models, which reprogram frozen pre-trained models, is unexplored.
Approach
Treats the frozen pre-trained model plus visual prompt and label mapping as a unified LM-VP model; shows white-box robustness depends heavily on the backbone and standard AT fails, so proposes transfer AT (adversarial examples from a fixed external threat model, ResNet18) that improves transferred robustness and reduces threshold-based MIA success.
Key results
- Standard adversarial training on LM-VP drastically degrades performance (e.g., ResNet50 natural 23.10%, PGD-20 0.8% on CIFAR-10 white-box), while best white-box robustness varies with backbone with no clear pattern.
- Transfer AT on LM-VP raises transferred PGD-20 robustness by roughly 20-35% for small backbones and 3-6% for large ones on CIFAR-10, and reduces MIA success on ConvNext from 80.14% to 50.32% (natural).
- On Tiny-ImageNet, transfer AT improves transferred robustness by 3%-24% and reduces MIA success by 3%-12% relative to standard training.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply transfer adversarial training instead of standard training | LM-VP with ResNet50 pre-training · CIFAR-10, transferred PGD-20 | accuracy (%): 35.61 -> 63.01 | Helped |
| Apply transfer adversarial training instead of standard training | LM-VP with ResNet152 pre-training · CIFAR-10, transferred PGD-20 | accuracy (%): 35.99 -> 63.95 | Helped |
| Apply transfer adversarial training instead of standard training | LM-VP with WRN-50-2 pre-training · CIFAR-10, transferred PGD-20 | accuracy (%): 39.76 -> 62.86 | Helped |
| Apply transfer adversarial training instead of standard training | LM-VP with ViT pre-training · CIFAR-10, transferred PGD-20 | accuracy (%): 51.95 -> 75.34 | Helped |
| Apply transfer adversarial training instead of standard training | LM-VP with Swin pre-training · CIFAR-10, transferred PGD-20 | accuracy (%): 57.80 -> 79.14 | Helped |
| Apply transfer adversarial training instead of standard training | LM-VP with ConvNext pre-training · CIFAR-10, transferred PGD-20 | accuracy (%): 89.11 -> 91.63 | Helped |
| Apply transfer adversarial training instead of standard training | LM-VP with EVA pre-training · CIFAR-10, transferred PGD-20 | accuracy (%): 87.40 -> 92.43 | Helped |
| Apply transfer adversarial training instead of standard training | LM-VP with ResNet50 pre-training · CIFAR-10, natural test | accuracy (%): 86.30 -> 70.37 | Hurt |
| Apply transfer adversarial training instead of standard training | LM-VP with ConvNext pre-training · CIFAR-10, MIA on natural examples | MIA success rate (%): 80.14 -> 50.32 | Helped |
| Apply standard adversarial training | LM-VP · CIFAR-10, white-box PGD-20 | accuracy (%) | Hurt |
| Use transfer adversarial training rather than standard training | LM-VP with ResNet50 pre-training · Tiny-ImageNet, transferred PGD-20 | accuracy (%): 10.26 -> 34.60 | Helped |
| Use transfer adversarial training rather than standard training | LM-VP with ConvNext pre-training · Tiny-ImageNet, MIA on natural examples | MIA success rate (%): 58.47 -> 52.04 | Helped |
Surprising findings
- Standard adversarial training is essentially invalid for LM-VP, yielding near-zero robustness and poor natural accuracy.
- Unlike general models, the usual robustness-privacy trade-off does not hold for LM-VP: standard-trained LM-VP with ViT and Swin resists MIA near 50%, and transfer AT improves both robustness and privacy.
Limitations
- White-box robustness of LM-VP is dominated by the choice of pre-trained backbone, giving no consistent conclusions.
- Evaluation limited to CIFAR-10 and Tiny-ImageNet with a single threat model (ResNet18) for transfer AT and a single threshold-based MIA.
- Code not yet released at submission; theoretical explanation of the privacy findings is absent.
Experimental setup
Datasets: CIFAR-10 Tiny-ImageNet ImageNet (source pre-training of backbones)
Benchmarks: CIFAR-10 Tiny-ImageNet
Metrics: natural accuracy PGD-20 accuracy CW-20 accuracy MIA success rate
Baselines: standard training LM-VP standard adversarial training LM-VP
Builds on: visual prompting adversarial training (PGD-AT) label mapping (Li et al. 2023 / Arif et al.) threshold-based membership inference (Yeom et al.)
Closest papers by meaning
- One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Models (CVPR 2024 · similarity 0.85)
- R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning (CVPR 2025 · similarity 0.85)
- Rethinking Adversarial Robustness in the Context of the Right to be Forgotten (ICML 2024 · similarity 0.84)
- Visual Prompting Upgrades Neural Network Sparsification: A Data-Model Perspective (AAAI 2025 · similarity 0.84)
- Robust NAS under adversarial training: benchmark, theory, and beyond (ICLR 2024 · similarity 0.84)
- Tracking the Copyright of Large Vision-Language Models through Parameter Learning Adversarial Images (ICLR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.