10 Security and Privacy Problems in Large Foundation Models

Abstract

Foundation models--such as GPT, CLIP, and DINO--have achieved revolutionary progress in the past several years and are commonly believed to be a promising approach for general-purpose AI. In particular, self-supervised learning is adopted to pre-train a foundation model using a large amount of unlabeled data. A pre-trained foundation model is like an ``operating system'' of the AI ecosystem. Specifically, a foundation model can be used as a feature extractor for many downstream tasks with little or no labeled training data. Existing studies on foundation models mainly focused on pre-training a better foundation model to improve its performance on downstream tasks in non-adversarial settings, leaving its security and privacy in adversarial settings largely unexplored. A security or privacy issue of a pre-trained foundation model leads to a single point of failure for the AI ecosystem. In this book chapter, we discuss 10 basic security and privacy problems for the pre-trained foundation models, including six confidentiality problems, three integrity problems, and one availability problem. For each problem, we discuss potential opportunities and challenges. We hope our book chapter will inspire future research on the security and privacy of foundation models.

A book chapter

References in corpus (41)

• Learning Transferable Visual Models From Natural Language Supervision
• Bootstrap your own latent: A new approach to self-supervised Learning
• On the Opportunities and Risks of Foundation Models
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• Graph Contrastive Learning with Adaptive Augmentation
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Adversarial Attacks on Neural Networks for Graph Data
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Theoretically Principled Trade-off between Robustness and Accuracy
• How To Backdoor Federated Learning
• Poisoning Attacks against Support Vector Machines
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Certified Defenses against Adversarial Examples
• Spectral Signatures in Backdoor Attacks
• GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models
• Poisoning Attacks to Graph-Based Recommender Systems
• Data Poisoning Attacks on Factorization-Based Collaborative Filtering
• Transferable Clean-Label Poisoning Attacks on Deep Neural Nets
• Data Poisoning Attacks to Deep Learning Based Recommender Systems
• Thieves on Sesame Street! Model Extraction of BERT-based APIs
• AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Practical Blind Membership Inference Attack via Differential Comparisons
• Overlearning Reveals Sensitive Attributes
• Certified Defenses for Adversarial Patches
• You are Who You Know and How You Behave: Attribute Inference Attacks via Users' Social Friends and Behaviors
• (De)Randomized Smoothing for Certifiable Defense against Patch Attacks
• Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
• On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
• Label-Consistent Backdoor Attacks
• Towards Probabilistic Verification of Machine Unlearning
• Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing
• Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning
• Radioactive data: tracing through training
• Adversarial Neural Network Inversion via Auxiliary Knowledge Alignment
• Poisoning and Backdooring Contrastive Learning
• Intrinsic Certified Robustness of Bagging against Data Poisoning Attacks
• Black-box Model Inversion Attribute Inference Attacks on Classification Models
• Quantifying and Mitigating Privacy Risks of Contrastive Learning
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations