Contrastive Vision-Language Pre-training, known as CLIP, has shown promising
effectiveness in addressing downstream image recognition tasks. However, recent
works revealed that the CLIP model can be implanted with a downstream-oriented
backdoor. On downstream tasks, one victim model performs well on clean samples
but predicts a specific target class whenever a specific trigger is present.
For injecting a backdoor, existing attacks depend on a large amount of
additional data to maliciously fine-tune the entire pre-trained CLIP model,
which makes them inapplicable to data-limited scenarios. In this work,
motivated by the recent success of learnable prompts, we address this problem
by injecting a backdoor into the CLIP model in the prompt learning stage. Our
method named BadCLIP is built on a novel and effective mechanism in backdoor
attacks on CLIP, i.e., influencing both the image and text encoders with the
trigger. It consists of a learnable trigger applied to images and a
trigger-aware context generator, such that the trigger can change text features
via trigger-aware prompts, resulting in a powerful and generalizable attack.
Extensive experiments conducted on 11 datasets verify that the clean accuracy
of BadCLIP is similar to those of advanced prompt learning methods and the
attack success rate is higher than 99% in most cases. BadCLIP is also
generalizable to unseen classes, and shows a strong generalization capability
under cross-dataset and cross-domain settings.

本研究提出了一种名为 BadCLIP 的方法，针对 CLIP 模型在 prompt 学习阶段注入后门，通过影响图像和文本编码器的方式生成可触发的上下文，实现对图片和文本特征的修改，从而进行高效且具有泛化能力的攻击。实验证实，BadCLIP 在多个数据集上表现出与先进的 prompt 学习方法相近的准确性，攻击成功率在大多数情况下超过 99%；BadCLIP 在未知类别上也具有泛化能力，并在跨数据集和跨领域场景下展现了强大的泛化能力。