BadBone: A backdoor attack targeting backbone models in visual prompt learning

The researchers propose BadBone, a stealthy, adaptive backdoor attack method targeting backbone models in visual prompt learning. Rather than directly attacking the prompt learning process, the method implants a backdoor into the backbone model via bilevel optimization, so that target downstream tasks using prompt learning inherit this vulnerability. Experiments on three models and datasets from three different domains show that the targeted and untargeted backdoor models achieve high attack performance while maintaining utility on pretraining and downstream tasks. The authors also evaluate six state-of-the-art model-level defenses—Neural Cleanse, ABS, MNTD, NAD, CLP, and D-BR—and the results show that these defenses are largely ineffective against the backdoor models, and that effective defenses remain an important direction for future work.