Search

Objective. Electroencephalography (EEG) is a widely used neuroimaging technique known for its cost-effectiveness and user-friendliness. However, various artifacts, particularly biological artifacts like Electromyography (EMG) signals, lead to a poor signal-to-noise ratio, limiting the precision of analyses and applications. The currently reported EEG data cleaning performance largely depends on the data used for validation, and in the case of machine learning approaches, also on the data used for training. The data are typically gathered either by recruiting subjects to perform specific artifact tasks or by integrating existing datasets. Prevailing approaches, however, tend to rely on intuitive, concept-oriented data collection with minimal justification for the selection of artifacts and their quantities. Given the substantial costs associated with biological data collection and the pressing need for effective data utilization, we propose an optimization procedure for data-oriented data collection design using deep learning-based artifact detection. Approach. We apply a binary classification between artifact epochs (time intervals containing artifacts) and non-artifact epochs (time intervals containing no artifact) using three different neural architectures. Our aim is to minimize data collection efforts while preserving the cleaning efficiency. Main results. We were able to reduce the number of artifact tasks from twelve to three and decrease repetitions of isometric contraction tasks from ten to three or sometimes even just one. Significance. Our work addresses the need for effective data utilization in biological data collection, offering a systematic and dynamic quantitative approach. By providing clear justifications for the choices of artifacts and their quantity, we aim to guide future studies toward more effective and economical data collection in EEG and EMG research., Comment: Several changes of wording. Caption of figure 10 corrected

The James Webb Space Telescope (JWST) has uncovered an abundant population of compact, extremely red, and X-ray weak objects at $z\gtrsim4$, knows as ``Little Red Dots" (LRDs). These objects exhibit spectral energy distributions that resemble both active galactic nuclei (AGN) and stellar population templates. However, whether dominated by AGN activity or compact star formation, the high redshifts and masses/luminosities of LRDs, coupled with their significant abundance, present potential challenges to the standard $\Lambda$CDM model. In this work, we proposes a novel cosmic interpretation of this anomaly, suggesting that these LRDs are likely massive galaxies seeded by supermassive primordial black holes (SMPBHs) came into being in the very early universe. We analyze 434 known LRDs from the 0.54 ${\rm deg}^2$ COSMOS-Web survey and test the hypothesis that they originated from SMPBHs assuming sub-Eddington accretion. According to our result, SMPBHs actually could lead to the existence of more LRDs, even at higher redshifts ($z>8$)., Comment: 7 pages, 4 figures

Score identity Distillation (SiD) is a data-free method that has achieved SOTA performance in image generation by leveraging only a pretrained diffusion model, without requiring any training data. However, its ultimate performance is constrained by how accurate the pretrained model captures the true data scores at different stages of the diffusion process. In this paper, we introduce SiDA (SiD with Adversarial Loss), which not only enhances generation quality but also improves distillation efficiency by incorporating real images and adversarial loss. SiDA utilizes the encoder from the generator's score network as a discriminator, boosting its ability to distinguish between real images and those generated by SiD. The adversarial loss is batch-normalized within each GPU and then combined with the original SiD loss. This integration effectively incorporates the average "fakeness" per GPU batch into the pixel-based SiD loss, enabling SiDA to distill a single-step generator either from scratch or by fine-tuning an existing one. SiDA converges significantly faster than its predecessor when trained from scratch, and swiftly improves upon the original model's performance after an initial warmup period during fine-tuning from a pre-distilled SiD generator. This one-step adversarial distillation method establishes new benchmarks in generation performance when distilling EDM diffusion models pretrained on CIFAR-10 (32x32) and ImageNet (64x64), achieving FID score of 1.110 on ImageNet 64x64. It sets record-low FID scores when distilling EDM2 models trained on ImageNet (512x512), surpassing even the largest teacher model, EDM2-XXL. Our SiDA's results record FID scores of 2.156 for EDM2-XS, 1.669 for S, 1.488 for M, 1.413 for L, 1.379 for XL, and 1.366 for XXL, demonstrating significant improvements across all model sizes. Our open-source code will be integrated into the SiD codebase.

Low-Rank Adaptation (LoRA) is the bread and butter of Large Language Model (LLM) finetuning. LoRA learns an additive low-rank perturbation, $AB$, of a pretrained matrix parameter $W$ to align the model to a new task or dataset with $W+AB$. We identify three core limitations to LoRA for finetuning--a setting that employs limited amount of data and training steps. First, LoRA employs Dropout to prevent overfitting. We prove that Dropout is only suitable for long training episodes but fails to converge to a reliable regularizer for short training episodes. Second, LoRA's initialization of $B$ at $0$ creates a slow training dynamic between $A$ and $B$. That dynamic is also exacerbated by Dropout that further slows the escape from $0$ for $B$ which is particularly harmful for short training episodes. Third, the scaling factor multiplying each LoRA additive perturbation creates ``short-sighted'' interactions between the LoRA modules of different layers. Motivated by principled analysis of those limitations, we find an elegant solution: a Dropout-free, scaling-free, LoRA with Adaptive Learning rate--coined ALLoRA. By scaling the per sample and per parameter gradients with a coefficient inversely proportional to parameters' $\ell_2$ norm, ALLoRA alleviates those three limitations. As a by-product, ALLoRA removes two hyper-parameters from LoRA: the scaling factor and the dropout rate. Empirical results show that ALLoRA admits better accuracy than LoRA on various settings, including against recent LoRA variants such as Weight-Decomposed Low-Rank Adaptation (DoRA). Ablation studies show our solution is the optimal in a family of weight-dependent / output-dependent approaches on various LLMs including the latest Llama3.

The high redshift ($z>10$) galaxies GHZ9 and UHZ1 observed by the James Webb Space Telescope (JWST) are very massive and have exceptionally high black hole-to-star mass ratios with the central black hole masses $M\gtrsim 10^7\rm~M_\odot$. In this paper, we explore the possibility that they are seeded by the supermassive primordial black holes (SMPBHs), which came into being in the very early universe, with initial masses $\sim 10^7\rm~M_\odot$. We present the self-similar accretion solutions for SMPBHs, and find that the mass growth of SMPBHs during pregalactic era may be negligible. These SMPBHs, when the redshift $z\lesssim 20$, can accelerate seeding high-redshift galaxies and their baryonic content, and consequently explain the central supermassive black holes (SMBHs) of high-redshift massive galaxies through sub-Eddington accretion. According to our results, SMPBHs actually could lead to the existence of more massive SMBHs at higher redshifts compared to other SMBH seed scenarios, specially SMBHs with masses $M\gtrsim 10^7~\rm M_\odot$ at $z>20$ might only origin from SMPBHs, thus the corresponding observation can serve as a potential probe to PBHs., Comment: 14 pages, 5 figures

The recent discovery of a superconductivity signature in La3Ni2O7-{\delta} under a pressure of 14 GPa, with a superconducting transition temperature of around 80 K, has attracted considerable attention. An important aspect of investigating electronic structures is discerning the extent to which the electronic ground state of La3Ni2O7-{\delta} resembles the parent state of the cuprate superconductor, a charge transfer insulator with long-range antiferromagnetism. Through X-ray absorption spectroscopy, we have uncovered the crucial influence of oxygen ligands on the electronic ground states of the Ni ions, displaying a charge transfer nature akin to cuprate but with distinct orbital configurations. Both in-plane and out-of-plane Zhang-Rice singlets associated with Ni d_(x^2-y^2 ) and d_(z^2) orbitals are identified, together with a strong interlayer coupling through inner apical oxygen. Additionally, in La3Ni2O7-{\delta} films, we have detected a superlattice reflection (1/4, 1/4, L) at the Ni L absorption edge using resonant X-ray scattering measurements. Further examination of the resonance profile indicates that the reflection originates from the Ni d orbitals. By evaluating the reflection's azimuthal angle dependence, we have confirmed the presence of collinear antiferromagnetic spin ordering and charge-like anisotropy ordered with the same periodicity. Notably, our findings reveal a microscopic relationship between these two components in the temperature dependence of the scattering intensity of the reflection. This investigation enriches our understanding of high-temperature superconductivity in La3Ni2O7-{\delta} under high pressure.

In this paper, we show that the initial clustering of supermassive primordial black holes (SMPBHs) beyond a Poisson distribution can efficiently enhance the matter power spectrum, and thus the halo mass function. As a result, the population of initially clustered SMPBHs with $M_{\rm PBH}\sim 10^9M_\odot$ and the fraction of energy density $f_{\rm PBH}\sim 10^{-3}$ (consistent with current constraints on SMPBHs) has the potential to naturally explain high-redshift massive galaxies observed by the James Webb Space Telescope., Comment: 8 pages, 3 figures

Generative retrieval, which has demonstrated effectiveness in text-to-text retrieval, utilizes a sequence-to-sequence model to directly generate candidate identifiers based on natural language queries. Without explicitly computing the similarity between queries and candidates, generative retrieval surpasses dual-tower models in both speed and accuracy on large-scale corpora, providing new insights for cross-modal retrieval. However, constructing identifiers for multimodal data remains an untapped problem, and the modality gap between natural language queries and multimodal candidates hinders retrieval performance due to the absence of additional encoders. To this end, we propose a pioneering generAtive Cross-modal rEtrieval framework (ACE), which is a comprehensive framework for end-to-end cross-modal retrieval based on coarse-to-fine semantic modeling. We propose combining K-Means and RQ-VAE to construct coarse and fine tokens, serving as identifiers for multimodal data. Correspondingly, we design the coarse-to-fine feature fusion strategy to efficiently align natural language queries and candidate identifiers. ACE is the first work to comprehensively demonstrate the feasibility of generative approach on text-to-image/audio/video retrieval, challenging the dominance of the embedding-based dual-tower architecture. Extensive experiments show that ACE achieves state-of-the-art performance in cross-modal retrieval and outperforms the strong baselines on Recall@1 by 15.27% on average.

Many machine learning models are susceptible to adversarial attacks, with decision-based black-box attacks representing the most critical threat in real-world applications. These attacks are extremely stealthy, generating adversarial examples using hard labels obtained from the target machine learning model. This is typically realized by optimizing perturbation directions, guided by decision boundaries identified through query-intensive exact search, significantly limiting the attack success rate. This paper introduces a novel approach using the Approximation Decision Boundary (ADB) to efficiently and accurately compare perturbation directions without precisely determining decision boundaries. The effectiveness of our ADB approach (ADBA) hinges on promptly identifying suitable ADB, ensuring reliable differentiation of all perturbation directions. For this purpose, we analyze the probability distribution of decision boundaries, confirming that using the distribution's median value as ADB can effectively distinguish different perturbation directions, giving rise to the development of the ADBA-md algorithm. ADBA-md only requires four queries on average to differentiate any pair of perturbation directions, which is highly query-efficient. Extensive experiments on six well-known image classifiers clearly demonstrate the superiority of ADBA and ADBA-md over multiple state-of-the-art black-box attacks. The source code is available at https://github.com/BUPTAIOC/ADBA., Comment: 10 pages, 5 figures, conference

In this paper, we present ControlSpeech, a text-to-speech (TTS) system capable of fully cloning the speaker's voice and enabling arbitrary control and adjustment of speaking style, merely based on a few seconds of audio prompt and a simple textual style description prompt. Prior zero-shot TTS models and controllable TTS models either could only mimic the speaker's voice without further control and adjustment capabilities or were unrelated to speaker-specific voice generation. Therefore, ControlSpeech focuses on a more challenging new task-a TTS system with controllable timbre, content, and style at the same time. ControlSpeech takes speech prompts, content prompts, and style prompts as inputs and utilizes bidirectional attention and mask-based parallel decoding to capture corresponding codec representations in a discrete decoupling codec space. Moreover, we discovered the issue of text style controllability in a many-to-many mapping fashion and proposed the Style Mixture Semantic Density (SMSD) model to resolve this problem. SMSD module which is based on Gaussian mixture density networks, is designed to enhance the fine-grained partitioning and sampling capabilities of style semantic information and generate speech with more diverse styles. In terms of experiments, we make available a controllable model toolkit called ControlToolkit with a new style controllable dataset, some replicated baseline models and propose new metrics to evaluate both the control capability and the quality of generated audio in ControlSpeech. The relevant ablation studies validate the necessity of each component in ControlSpeech is necessary. We hope that ControlSpeech can establish the next foundation paradigm of controllable speech synthesis. The relevant code and demo are available at https://github.com/jishengpeng/ControlSpeech .

Diffusion-based text-to-image generation models trained on extensive text-image pairs have shown the capacity to generate photorealistic images consistent with textual descriptions. However, a significant limitation of these models is their slow sample generation, which requires iterative refinement through the same network. In this paper, we enhance Score identity Distillation (SiD) by developing long and short classifier-free guidance (LSG) to efficiently distill pretrained Stable Diffusion models without using real training data. SiD aims to optimize a model-based explicit score matching loss, utilizing a score-identity-based approximation alongside the proposed LSG for practical computation. By training exclusively with fake images synthesized with its one-step generator, SiD equipped with LSG rapidly improves FID and CLIP scores, achieving state-of-the-art FID performance while maintaining a competitive CLIP score. Specifically, its data-free distillation of Stable Diffusion 1.5 achieves a record low FID of 8.15 on the COCO-2014 validation set, with a CLIP score of 0.304 at an LSG scale of 1.5, and an FID of 9.56 with a CLIP score of 0.313 at an LSG scale of 2. Our code and distilled one-step text-to-image generators are available at https://github.com/mingyuanzhou/SiD-LSG., Comment: Code and model checkpoints available at https://github.com/mingyuanzhou/SiD-LSG

Graph Transformer, due to its global attention mechanism, has emerged as a new tool in dealing with graph-structured data. It is well recognized that the global attention mechanism considers a wider receptive field in a fully connected graph, leading many to believe that useful information can be extracted from all the nodes. In this paper, we challenge this belief: does the globalizing property always benefit Graph Transformers? We reveal the over-globalizing problem in Graph Transformer by presenting both empirical evidence and theoretical analysis, i.e., the current attention mechanism overly focuses on those distant nodes, while the near nodes, which actually contain most of the useful information, are relatively weakened. Then we propose a novel Bi-Level Global Graph Transformer with Collaborative Training (CoBFormer), including the inter-cluster and intra-cluster Transformers, to prevent the over-globalizing problem while keeping the ability to extract valuable information from distant nodes. Moreover, the collaborative training is proposed to improve the model's generalization ability with a theoretical guarantee. Extensive experiments on various graphs well validate the effectiveness of our proposed CoBFormer., Comment: Accepted by ICML 2024 (Camera-Ready)

Deep clustering as an important branch of unsupervised representation learning focuses on embedding semantically similar samples into the identical feature space. This core demand inspires the exploration of contrastive learning and subspace clustering. However, these solutions always rely on the basic assumption that there are sufficient and category-balanced samples for generating valid high-level representation. This hypothesis actually is too strict to be satisfied for real-world applications. To overcome such a challenge, the natural strategy is utilizing generative models to augment considerable instances. How to use these novel samples to effectively fulfill clustering performance improvement is still difficult and under-explored. In this paper, we propose a novel Generative Calibration Clustering (GCC) method to delicately incorporate feature learning and augmentation into clustering procedure. First, we develop a discriminative feature alignment mechanism to discover intrinsic relationship across real and generated samples. Second, we design a self-supervised metric learning to generate more reliable cluster assignment to boost the conditional diffusion generation. Extensive experimental results on three benchmarks validate the effectiveness and advantage of our proposed method over the state-of-the-art methods.

We introduce Score identity Distillation (SiD), an innovative data-free method that distills the generative capabilities of pretrained diffusion models into a single-step generator. SiD not only facilitates an exponentially fast reduction in Fr\'echet inception distance (FID) during distillation but also approaches or even exceeds the FID performance of the original teacher diffusion models. By reformulating forward diffusion processes as semi-implicit distributions, we leverage three score-related identities to create an innovative loss mechanism. This mechanism achieves rapid FID reduction by training the generator using its own synthesized images, eliminating the need for real data or reverse-diffusion-based generation, all accomplished within significantly shortened generation time. Upon evaluation across four benchmark datasets, the SiD algorithm demonstrates high iteration efficiency during distillation and surpasses competing distillation approaches, whether they are one-step or few-step, data-free, or dependent on training data, in terms of generation quality. This achievement not only redefines the benchmarks for efficiency and effectiveness in diffusion distillation but also in the broader field of diffusion-based generation. The PyTorch implementation is available at https://github.com/mingyuanzhou/SiD, Comment: ICML 2024, PyTorch implementation: https://github.com/mingyuanzhou/SiD

The coalescence of stellar-mass primordial black holes (PBHs) might explain some of the gravitation waves (GWs) events detected by LIGO-Virgo-KAGRA. On the other hand, observational hints for supermassive PBHs (SMPBHs) have been accumulated. Thus it can be expected that stellar-mass PBHs might be gravitationally bounded to SMPBHs ($\sim10^{6}-10^9M_\odot$) in the early Universe, and both constituted primordial extreme mass-ratio inspirals (EMRIs). In this work, we initiate the study of the merger rate for primordial EMRIs. The corresponding intrinsic EMRI rate at low redshift may be comparable to that of astrophysical model, $10-10^4$yr$^{-1}$, which the space-based detector LISA has the capability to detect, but significantly raises with redshift. Though equal mass binaries also inevitably form, we find that under certain conditions the primordial EMRIs can be the most prevalent GW sources, and thus potentially a new probe to PBH., Comment: 23 pages, 6 figures

Recent advances in representation learning have demonstrated the significance of multimodal alignment. The Dual Cross-modal Information Disentanglement (DCID) model, utilizing a unified codebook, shows promising results in achieving fine-grained representation and cross-modal generalization. However, it is still hindered by equal treatment of all channels and neglect of minor event information, resulting in interference from irrelevant channels and limited performance in fine-grained tasks. Thus, in this work, We propose a Training-free Optimization of Codebook (TOC) method to enhance model performance by selecting important channels in the unified space without retraining. Additionally, we introduce the Hierarchical Dual Cross-modal Information Disentanglement (H-DCID) approach to extend information separation and alignment to two levels, capturing more cross-modal details. The experiment results demonstrate significant improvements across various downstream tasks, with TOC contributing to an average improvement of 1.70% for DCID on four tasks, and H-DCID surpassing DCID by an average of 3.64%. The combination of TOC and H-DCID further enhances performance, exceeding DCID by 4.43%. These findings highlight the effectiveness of our methods in facilitating robust and nuanced cross-modal learning, opening avenues for future enhancements. The source code and pre-trained models can be accessed at https://github.com/haihuangcode/TOC_H-DCID.

In the field of large language models (LLMs), aligning models with the diverse preferences of users is a critical challenge. Direct Preference Optimization (DPO) has played a key role in this area. It works by using pairs of preferences derived from the same prompts, and it functions without needing an additional reward model. However, DPO does not fully reflect the complex nature of human learning, which often involves understanding contrasting responses to not only identical but also similar questions. To overcome this shortfall, we propose Relative Preference Optimization (RPO). RPO is designed to discern between more and less preferred responses derived from both identical and related prompts. It introduces a contrastive weighting mechanism, enabling the tuning of LLMs using a broader range of preference data, including both paired and unpaired sets. This approach expands the learning capabilities of the model, allowing it to leverage insights from a more varied set of prompts. Through empirical tests, including dialogue and summarization tasks, and evaluations using the AlpacaEval2.0 leaderboard, RPO has demonstrated a superior ability to align LLMs with user preferences and to improve their adaptability during the training process. Our code can be viewed at https://github.com/yinyueqin/relative-preference-optimization

The bubbles that nucleated during slow-roll inflation can be supercritical, i.e. their radii are larger than the Hubble horizon of de Sitter spacetime inside the bubble (an inflating baby universe inside it), and thus naturally develop to the supermassive primordial black holes (SMPBHs) with a multi-peaks mass function. In this paper, we further investigate relevant phenomenology. After slow-roll inflation ended, the bubbles may be not only supercritical, but also subcritical. It is showed that it seems unlikely for the subcritical bubbles to collapse to SMPBHs. Theoretically, however, before they collapsed such bubbles might have a probability of up-tunnelling to the supercritical ones and thus contribute to SMPBHs. We present a mechanism for the origin of initial clustering of SMPBHs, which can significantly magnify the merger rate of SMPBH binaries, and show the possibility that the merging of such SMPBH binaries explains recent NANOGrav signal., Comment: 39 pages, 11 figures

The probability that the primordial black hole (PBH) binaries formed in the early Universe can be affected by the Hubble expansion of background, which is non-negligible when the number density of PBHs is very low (it is actually this case for supermassive PBHs). In this paper, taking into account the effect of cosmic expansion on the comoving distance of PBH pairs, we worked out the merger rate of PBHs with any extended mass function. The torques by all PBHs and linear density perturbations are also considered. It is found that the merger rate of PBH, $M\gtrsim 10^6M_\odot$, binaries is significantly lower for $f_\text{pbh}\lesssim 0.01$ than expected., Comment: 16 pages, 5 figures

In the dynamic landscape of Artificial Intelligence (AI), two notable phenomena are becoming predominant: the exponential growth of large AI model sizes and the explosion of massive amount of data. Meanwhile, scientific research such as quantum computing and protein synthesis increasingly demand higher computing capacities. Neuromorphic computing, inspired by the mechanism and functionality of human brains, uses physical artificial neurons to do computations and is drawing widespread attention. Conventional electronic computing has experienced certain difficulties, particularly concerning the latency, crosstalk, and energy consumption of digital processors. As the Moore's law approaches its terminus, there is a urgent need for alternative computing architectures that can satisfy this growing computing demand and break through the von Neumann model. Recently, the expansion of optoelectronic devices on photonic integration platforms has led to significant growth in photonic computing, where photonic integrated circuits (PICs) have enabled ultrafast artificial neural networks (ANN) with sub-nanosecond latencies, low heat dissipation, and high parallelism. Such non-von Neumann photonic computing systems hold the promise to cater to the escalating requirements of AI and scientific computing. In this review, we study recent advancements in integrated photonic neuromorphic systems, and from the perspective of materials and device engineering, we lay out the scientific and technological breakthroughs necessary to advance the state-of-the-art. In particular, we examine various technologies and devices employed in neuromorphic photonic AI accelerators, spanning from traditional optics to PICs. We evaluate the performances of different designs by energy efficiency in operations per joule (OP/J) and compute density in operations per squared millimeter per ..., Comment: Advanced Materials Accepted

In this paper, we highlight a problem of evaluation metrics adopted in the open-vocabulary segmentation. That is, the evaluation process still heavily relies on closed-set metrics on zero-shot or cross-dataset pipelines without considering the similarity between predicted and ground truth categories. To tackle this issue, we first survey eleven similarity measurements between two categorical words using WordNet linguistics statistics, text embedding, and language models by comprehensive quantitative analysis and user study. Built upon those explored measurements, we designed novel evaluation metrics, namely Open mIoU, Open AP, and Open PQ, tailored for three open-vocabulary segmentation tasks. We benchmarked the proposed evaluation metrics on 12 open-vocabulary methods of three segmentation tasks. Even though the relative subjectivity of similarity distance, we demonstrate that our metrics can still well evaluate the open ability of the existing open-vocabulary segmentation methods. We hope that our work can bring with the community new thinking about how to evaluate the open ability of models. The evaluation code is released in github.

Humans watch more than a billion hours of video per day. Most of this video was edited manually, which is a tedious process. However, AI-enabled video-generation and video-editing is on the rise. Building on text-to-image models like Stable Diffusion and Imagen, generative AI has improved dramatically on video tasks. But it's hard to evaluate progress in these video tasks because there is no standard benchmark. So, we propose a new dataset for text-guided video editing (TGVE), and we run a competition at CVPR to evaluate models on our TGVE dataset. In this paper we present a retrospective on the competition and describe the winning method. The competition dataset is available at https://sites.google.com/view/loveucvpr23/track4., Comment: Project page: https://sites.google.com/view/loveucvpr23/track4

Large language models (LLMs) have demonstrated superior performance compared to previous methods on various tasks, and often serve as the foundation models for many researches and services. However, the untrustworthy third-party LLMs may covertly introduce vulnerabilities for downstream tasks. In this paper, we explore the vulnerability of LLMs through the lens of backdoor attacks. Different from existing backdoor attacks against LLMs, ours scatters multiple trigger keys in different prompt components. Such a Composite Backdoor Attack (CBA) is shown to be stealthier than implanting the same multiple trigger keys in only a single component. CBA ensures that the backdoor is activated only when all trigger keys appear. Our experiments demonstrate that CBA is effective in both natural language processing (NLP) and multimodal tasks. For instance, with $3\%$ poisoning samples against the LLaMA-7B model on the Emotion dataset, our attack achieves a $100\%$ Attack Success Rate (ASR) with a False Triggered Rate (FTR) below $2.06\%$ and negligible model accuracy degradation. Our work highlights the necessity of increased security research on the trustworthiness of foundation LLMs., Comment: To Appear in Findings of the Association for Computational Linguistics: NAACL 2024, June 2024

Fine-tuning large pre-trained computer vision models is infeasible for resource-limited users. Visual prompt learning (VPL) has thus emerged to provide an efficient and flexible alternative to model fine-tuning through Visual Prompt as a Service (VPPTaaS). Specifically, the VPPTaaS provider optimizes a visual prompt given downstream data, and downstream users can use this prompt together with the large pre-trained model for prediction. However, this new learning paradigm may also pose security risks when the VPPTaaS provider instead provides a malicious visual prompt. In this paper, we take the first step to explore such risks through the lens of backdoor attacks. Specifically, we propose BadVisualPrompt, a simple yet effective backdoor attack against VPL. For example, poisoning $5\%$ CIFAR10 training data leads to above $99\%$ attack success rates with only negligible model accuracy drop by $1.5\%$. In particular, we identify and then address a new technical challenge related to interactions between the backdoor trigger and visual prompt, which does not exist in conventional, model-level backdoors. Moreover, we provide in-depth analyses of seven backdoor defenses from model, prompt, and input levels. Overall, all these defenses are either ineffective or impractical to mitigate our BadVisualPrompt, implying the critical vulnerability of VPL.