Pass off Fish Eyes for Pearls: Attacking Model Selection of Pre-trained Models

Pass off Fish Eyes for Pearls: Attacking Model Selection of Pre-trained Models Biru Zhu1∗, Yujia Qin2,3,4∗, Fanchao Qi2,3,4, Yangdong Deng1†, Zhiyuan Liu2,3,4,5,6,7†, Maosong Sun2,3,4,5,6, Ming Gu1 1 School of Software, Tsinghua University, Beijing, China 2 Department of Computer Science and Technology, Tsinghua University, Beijing, China 3 Beijing National Research Center for Information Science and Technology 4 Institute for Artificial Intelligence, Tsinghua University, Beijing, China 5 Institute Guo Qiang, Tsinghua University, Beijing, China 6 International Innovation Center of Tsinghua University, Shanghai, China 7 Beijing Academy of Artificial Intelligence {zbr19, qyj20, qfc17}@mails.tsinghua.edu.cn {dengyd, liuzy, sms, guming}@tsinghua.edu.cn Abstract Selecting an appropriate pre-trained model (PTM) for a specific downstream task typi- cally requires significant efforts of fine-tuning. To accelerate this process, researchers propose feature-based model selection (FMS) methods, which assess PTMs’ transferability to a specific task in a fast way without fine-tuning. In this work, we argue that current FMS methods are vulnerable, as the assessment mainly relies on the static features extracted from PTMs. How- ever, such features are derived without training PTMs on downstream tasks, and are not neces- sarily reliable indicators for the PTM’s transfer- ability. To validate our viewpoints, we design two methods to evaluate the robustness of FMS: (1) model disguise attack, which post-trains an inferior PTM with a contrastive objective, and (2) evaluation data selection, which selects a subset of the data points for FMS evaluation based on K-means clustering. Experimental results prove that both methods can success- fully make FMS mistakenly judge the transfer- ability of PTMs. Moreover, we find that these two methods can further be combined with the backdoor attack to misguide the FMS to select poisoned models. To the best of our knowledge, this is the first work to demonstrate the defects of current FMS algorithms and evaluate their potential security risks. By identifying previ- ously unseen risks of FMS, our study indicates new directions for improving the robustness of FMS. 1 Introduction Pre-trained models (PTMs) have shown superior performance on various tasks of natural language ∗Indicates equal contribution. †Corresponding author. processing (NLP) and computer vision (CV) (De- vlin et al., 2019; Raffel et al., 2020; Li et al., 2019; Zabir et al., 2018; Han et al., 2021). The increas- ingly popular “pre-train then fine-tune” paradigm is typically implemented as a prescriptive three-stage routine: (1) PTM Supply Stage: upstream suppli- ers pre-train various kinds of PTMs, (2) PTM Se- lection Stage: downstream users select the desired PTM based on their own demands for a specific task, and (3) PTM Application Stage: downstream users conduct further fine-tuning on the given task. During the PTM selection stage, the common practice is to fine-tune a set of candidate PTMs and pick up the model with the best performance. Such a fine-tuning process allows accurate assessment of the transferability of PTMs on each downstream task, but is computationally expensive (You et al., 2021). To resolve this issue, researchers recently propose feature-based model selection (FMS) meth- ods to efficiently select a PTM for a specific down- stream task (Bao …

Content truncated to 500 words