Adversarial Attacks on Hidden Tasks in Multi-Task Learning

TL;DR

The paper addresses the vulnerability of multitask classifiers to adversarial inputs when the target (hidden) task data and head are inaccessible. It introduces Catastrophic Forgetting (CF) and CF delta attacks that exploit forgetting induced by fine-tuning on non-target tasks to degrade the hidden task while preserving visible tasks, leveraging a shared backbone $B(\cdot)$ and non-target headers $H_{no\text{-}tgt}$. Through experiments on CelebA and DeepFashion, the authors show that CF/CF delta achieve substantial degradation of the hidden task with limited impact on non-hidden tasks, under both white-box and black-box settings, and provide hyperparameter-tuning guidance without access to the target task data. The work highlights a practical risk of pre-trained backbones in public models and motivates developing defenses against hidden-task attacks in multitask learning. Overall, the study demonstrates that targeted forgetting-based perturbations can effectively compromise hidden tasks while maintaining stealth for visible tasks, with implications for privacy and security in multi-task systems.

Abstract

Deep learning models are susceptible to adversarial attacks, where slight perturbations to input data lead to misclassification. Adversarial attacks become increasingly effective with access to information about the targeted classifier. In the context of multi-task learning, where a single model learns multiple tasks simultaneously, attackers may aim to exploit vulnerabilities in specific tasks with limited information. This paper investigates the feasibility of attacking hidden tasks within multi-task classifiers, where model access regarding the hidden target task and labeled data for the hidden target task are not available, but model access regarding the non-target tasks is available. We propose a novel adversarial attack method that leverages knowledge from non-target tasks and the shared backbone network of the multi-task model to force the model to forget knowledge related to the target task. Experimental results on CelebA and DeepFashion datasets demonstrate the effectiveness of our method in degrading the accuracy of hidden tasks while preserving the performance of visible tasks, contributing to the understanding of adversarial vulnerabilities in multi-task classifiers.

Figures (6)

• Figure 1: The structure of a typical multi-task classifier. The gray part represents the backbone network $B(\circ)$, which involves model parameters shared across all tasks, while the blue, green, and yellow parts represent the headers for each task.
• Figure 2: The illustration of proposed CF attack. We first fine-tune $B$ on non-target tasks only and get $B'$. $B'$ is not able to extract features related to the target task. We aim to design adversarial perturbation $\eta$ so that $B(x+\eta)$ is close to $B'(x)$. Such features will cause the target head to give the wrong prediction.
• Figure 3: Distribution of the inner product of the feature vector before and after catastrophic forgetting and the weight vector of the header of each task in CelebA. The larger this inner product, the greater the predictive probability of predicting the label 1(yes). Each row represents the target task, and each column represents the header of the task used to compute the inner product. The distribution of the inner product for the target task (diagonal elements) has its center away from zero before fine-tuning but after fine-tuning, its center shifts towards zero. This indicates that constructing the adversarial example using the post-fine-tuning model may degrade the target task's classification performance. On the other hand, the distribution of the inner product (off-diagonal elements) in the non-target task does not change much with fine-tuning, which means that fine-tuning has little impact on the non-target task, which is expected to attain highly stealthy behavior when used in attacks.
• Figure 4: Number of fine-tuning epochs (horizontal axis) vs Adv Accuracy against Clean Accuracy $\text{Accuracy}^{\text{adv}}_{\text{tgt}}- \text{Accuracy}^{\text{clean}}_{\ text{tgt}}$ (vertical axis) in the three tasks of DeepFashion (lower is larger attack effect for the target task and less stealthiness for the non-target tasks). The target task was set as Category, Sleeve, and Neckline, from left to right.
• Figure 5: $\beta$ (the extent to which the change in the feature vector before and after fine-tuning is magnified, horizontal axis) vs Adv Accuracy against Clean Accuracy $\text{Accuracy}^{\text{adv}}_{\text{tgt}}- \text{Accuracy}^{\text{clean}}_{\ text{tgt}}$ (vertical axis) in the three tasks of DeepFashion (lower is larger attack effect for the target task and less stealthiness for the non-target tasks). The target task was set as Category, Sleeve, and Neckline, from left to right.