Adversarial Robustness in Zero-Shot Learning: An Empirical Study on Class and Concept-Level Vulnerabilities

Area of Science:

• Computer Vision
• Machine Learning
• Artificial Intelligence

Background:

• Zero-shot Learning (ZSL) enables image classifiers to recognize unseen classes without prior training data.
• ZSL models map visual features to human-understandable class concepts, promising improved generalization and interpretability.
• The robustness of ZSL models against systematic input perturbations remains largely unexplored.

Purpose of the Study:

• To empirically analyze the robustness of existing ZSL methods at both class-level and concept-level.
• To identify vulnerabilities in ZSL models that could be exploited by adversarial attacks.
• To propose novel attack strategies and evaluate their effectiveness against current ZSL architectures.

Main Methods:

• Investigated the effectiveness of a non-target class attack (clsA) on ZSL and Generalized Zero-shot Learning (GZSL) settings.
• Introduced a Class-Bias Enhanced Attack (CBEA) to disrupt GZSL accuracy across all calibration points.
• Developed two novel concept-level attacks: Class-Preserving Concept Attack (CPconA) and Non-Class-Preserving Concept Attack (NCPconA).

Main Results:

• clsA was found to disrupt ZSL predictions, but its success in GZSL was limited to specific calibration points, indicating spurious attack success.
• CBEA effectively eliminated GZSL accuracy by exacerbating the probability gap between seen and unseen classes.
• CPconA and NCPconA demonstrated that ZSL models are vulnerable to concept manipulation, allowing malicious actors to alter class predictions by introducing or removing concepts.
• Extensive experiments on recent ZSL models confirmed their susceptibility to both class and concept-based attacks.

Conclusions:

• Existing ZSL models exhibit significant vulnerabilities to both class-level and concept-level adversarial attacks.
• The findings underscore a critical performance gap and the urgent need for enhanced adversarial robustness in ZSL.
• The developed attack methods provide valuable insights for improving the security and reliability of ZSL systems.