Skip to content

Stealthy Multi-task Adversarial Attacks

Conference: ECCV2026
Paper: ECCV Proceedings
Area: AI Safety
Keywords: multi-task learning / adversarial attack / stealthy selective attack / constrained multi-objective optimization / adversarial robustness

TL;DR

The paper proposes SMTA2, which casts "degrade one task of a multi-task model while leaving the other tasks intact" as a constrained multi-objective optimization problem, relaxes it into an ordinary first-order iterative attack via a weighted loss with positive weights on the targeted task and negative weights on the non-targeted tasks, and resolves the remaining weight-selection difficulty with an per-iteration automated weight search; on NYUv2 and Cityscapes it degrades the targeted task heavily while holding non-targeted tasks at their clean baselines, on both undefended and adversarially trained models.

Background & Motivation

Deep networks are extremely vulnerable to adversarial perturbations: a perturbation that is nearly invisible to the human eye can send predictions completely off, which is a concrete hazard for safety-critical systems. Multi-task learning (MTL) is normally a remedy rather than a risk โ€” one shared backbone learns several related tasks jointly, improving data efficiency and generalization. But the shared representation also creates coupled vulnerabilities: a perturbation crafted for one task propagates through the shared features into the others. Existing multi-task attacks, such as Guo et al.'s Multi-Task Adversarial Attack and Zhang et al.'s gradient-balancing attack, all aim to bring every task down together; they are non-stealthy by construction. Real attackers, however, rarely want the whole system to collapse. Making lane detection fail while depth estimation still works, or breaking pedestrian segmentation while traffic-sign recognition stays accurate, produces dangerous misbehavior that does not trigger an obvious system-wide alarm. This selective and stealthy regime had not been studied systematically before.

The real obstacle is feasibility. Multi-task objectives are coupled through shared parameters, so gradients that raise the loss of one task inevitably damage the others. "Maximize the targeted task's loss" and "no non-targeted task may exceed its clean-input loss" are therefore nearly incompatible under strong perturbations: the feasible region satisfying all preservation constraints is extremely narrow, direct optimization is intractable, and naive loss reweighting typically fails to keep the non-targeted tasks at their baselines.

This paper's angle is to put the preservation constraints explicitly into the optimization problem and then apply a lossy but tractable relaxation: positive weights on the targeted task and negative weights on the non-targeted ones, so that a negative-weight term pulls a non-targeted task back whenever it starts to degrade. "Attack" and "preserve" then live inside a single gradient ascent, and the entire remaining difficulty reduces to choosing the per-task weights. Two weight-search strategies are designed for this โ€” manual trial-and-error escalation, and per-iteration automated online updating. Core idea: model the selective attack as a constrained multi-objective problem, then use signed weights plus online weight adaptation to reduce the constrained optimization to a first-order iterative attack of the same complexity as a conventional one.

Method

Overall Architecture

SMTA2 assumes an already-trained multi-task model whose tasks share a representation. An input sample \(x\) carries labels \(y=(y_1,\dots,y_m)\) for all tasks, the loss of task \(i\) is written \(L_i(x,y_i)\), and the attacker designates one task \(i_t\) as the target. The threat model is fully white-box: the attacker has access to the model gradients, to every task's loss and labels, and can first evaluate all task losses on the clean input to obtain the preservation baselines; the perturbation only has to satisfy an \(L_p\) ball and a pixel box constraint. The problem to solve is

\[ \max_{\delta}\ L_{i_t}(x+\delta,\,y_{i_t})\quad \text{s.t.}\ \ \|\delta\|_p\le\epsilon,\ \ x+\delta\in\mathcal{B},\ \ L_i(x+\delta,y_i)\le L_i(x,y_i)\ \ (\forall i\ne i_t) \]

The last group of constraints is the preservation constraint: no non-targeted task may have a higher adversarial loss than its clean loss. Dropping it degenerates the problem into a non-stealthy multi-task attack that damages the targeted and the non-targeted tasks alike. Because the feasible region is extremely narrow under a shared backbone, the paper relaxes it into a signed weighted objective:

\[ \max_{\|\delta\|_p\le\epsilon,\ x+\delta\in\mathcal{B}}\ L(x+\delta,y)=\sum_{i=1}^{m}w_iL_i(x+\delta,\,y_i),\qquad w_{i_t}>0,\ \ w_i<0\ (i\ne i_t) \]

The signs are the whole mechanism. A positive weight makes gradient ascent raise the targeted task's loss, while negative weights make the very same ascent lower the non-targeted losses, so compensation appears automatically once a non-targeted task starts to degrade. The paper argues that with a correctly adjusted weight combination a solution feasible for Eq. (1) can be recovered from Eq. (2); the difficulty therefore migrates entirely to how the weights are searched, which is what the two designs below address.

One point deserves emphasis: "stealth" here is functional, not perceptual. The paper defines it as "the non-targeted task metrics do not degrade," and the visualizations (Figs. 2 and 3) show the perturbation is essentially invisible at \(\epsilon=4/255\); however, no perceptual distance such as LPIPS or SSIM is reported anywhere, and neither are black-box or transfer-based settings โ€” every attack requires gradients of the target model.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["clean input + pretrained multi-task model"] --> B["signed weight construction<br/>positive for target, negative for others"]
    B --> C["automated weight search<br/>online update from per-task loss diff"]
    B --> D["manual weight search<br/>enlarge negative magnitude on violation"]
    C --> E["single first-order step<br/>PGD / APGD / IFGSM on the weighted loss"]
    D --> E
    E --> F{"non-targeted loss above its clean baseline?"}
    F -->|yes, update weights and continue| C
    F -->|no, all satisfied| G["adversarial sample x + ฮด"]

Key Designs

1. Signed weight construction: one signed weighted loss carries both "attack" and "protect"

Hard constraints cannot be optimized directly under a shared backbone, so the paper moves them inside the loss through a sign convention: the targeted task gets a positive weight and every non-targeted task gets a negative one. This is not an incidental trick. While maximizing \(\sum_i w_iL_i\), the positive term pushes gradients toward raising the targeted loss, whereas the negative terms are equivalent to minimizing the corresponding losses, so a single backward pass already injects the compensating component that pulls non-targeted tasks back to their baselines. This is exactly where SMTA2 parts ways with non-stealthy multi-task attacks: those sum all tasks with the same sign, so the perturbation can only move in the direction where everything gets worse, while the negative signs here require the net gradient effect to be "collapse one thing while steadying the rest."

Once the signs are fixed, the attack strength is decided entirely by the weight magnitudes, and the paper is explicit about both failure modes. If the negative magnitudes are too small, non-targeted tasks degrade anyway and the preservation constraint is violated. If they are too large, non-targeted tasks are pushed above their clean performance โ€” the constraints hold, but the gradient budget spent on them dilutes the attack and the targeted task suffers less. Weights are therefore not a "more conservative is better" hyper-parameter but a balance point that must be found per input and per iteration; this turns a constrained optimization problem into an online parameter-tuning problem, which directly motivates the two search strategies below.

2. Automated weight search: driving the weights online from per-task loss differences

Since the hard part is finding the weights, the most direct solution is to let the algorithm find them during the attack. The automated strategy (Algorithm 1) embeds the weight search into the attack loop: each step first performs one first-order attack step (PGD, APGD or IFGSM, all interchangeable) with the current weights to obtain an updated \(\delta\), then inspects the loss change of every non-targeted task and updates its own negative weight by that loss difference:

\[w_i\leftarrow w_i-\lambda_i\big(L_i(x+\delta,y_i)-L_i(x,y_i)\big)\]

When a loss rises โ€” meaning the task has been collateral damage โ€” \(w_i\) moves further negative, so in the next round it contributes a stronger gradient toward repairing that task; when the loss is already below the clean baseline the update naturally stops or recedes. To suppress oscillation, each non-targeted task carries its own step size \(\lambda_i\), initialized uniformly and attenuated as \(\lambda_i\leftarrow\alpha\lambda_i\) (\(\alpha\in(0,1)\)) as soon as that task satisfies the preservation constraint. This cools down the tasks that are already "settled" and redirects the weight-update budget to those still violating their constraints. The whole procedure is pure online feedback control: the error signal is the per-task loss difference, \(\lambda_i\) is the step size and \(\alpha\) the damping; no second-order information and no extra attack reruns are needed. Complexity is therefore essentially unchanged โ€” each step adds only \(m-1\) scalar comparisons and updates, i.e. \(O(m)\), negligible against back-propagation, keeping the overall cost at \(O(S\cdot\text{Backprop})\).

3. Manual weight search: a feasibility anchor and a controlled baseline via incremental escalation

The paper also keeps a cruder but more trustworthy strategy as a reference: fix the targeted task's weight, start the non-targeted tasks with a very small negative magnitude, run one complete attack, check which tasks fell below their baselines, enlarge the negative magnitude only for those tasks, and rerun from scratch until every non-targeted task satisfies its constraint. Its value is twofold. Existence-wise, repeated escalation always finds a feasible solution, which corroborates that the relaxation in Eq. (2) does approach the feasible region of Eq. (1). Engineering-wise, the search space grows rapidly with the number of tasks and every weight change costs a full attack rerun, which is expensive and hard to scale โ€” precisely what makes the automated strategy's "update online every step, run once" attractive. In the experiments the two search schemes achieve comparable attack and preservation quality (with the automated one slightly better in a few settings), and the difference shows up mainly in efficiency and scalability; this controlled comparison is itself one of the paper's most convincing pieces of evidence.

A Worked Example

Take NYUv2 under PGD \(L_\infty\) with \(\epsilon=4/255\) and semantic segmentation as the targeted task. In the first iterations the negative magnitudes for depth and surface normals are near zero, so the first few steps are almost a plain multi-task attack: segmentation mIoU drops quickly, but depth aErr climbs as well โ€” the paper's "negative weights too small means non-targeted tasks still degrade" regime. As segmentation gradients keep spilling over, the adversarial losses of depth and normals rise above their clean baselines, the loss differences become positive, and both negative weights are pushed further negative; the next steps therefore carry an additional component that presses depth aErr back down and pulls normal mDist toward the baseline. Once a task's loss difference turns negative (constraint satisfied), its step size is attenuated by \(\alpha\), the update shrinks, and it stops competing with the targeted task for gradient. At convergence the weights settle at some intermediate values: segmentation mIoU falls from the clean 46.56 to 18.33, while depth 37.45 and normals 23.31 are in fact better than or close to the clean baselines (40.57 / 23.41) โ€” all these numbers are the SMTA2 automated row at \(\epsilon=4/255\) in Table 1. Switching the target to depth, the same procedure diverts the negative weights to protect segmentation and normals: depth aErr is raised from 40.57 to 168.69 while segmentation 47.67 and normals 23.36 barely move.

Note that the paper reports only the converged end state, not the per-iteration weight trajectory; the description above therefore concerns the direction the weights move and why, and any intermediate magnitudes are illustrative rather than source data โš ๏ธ refer to the original paper.

Loss & Training

The attack objective is exactly the weighted loss of Eq. (2), \(L(x+\delta,y)=\sum_i w_iL_i(x+\delta,y_i)\), and the attacker itself is a pluggable first-order method: PGD (\(L_2\) / \(L_\infty\)), IFGSM (\(L_\infty\)) and APGD (\(L_1\) / \(L_2\)); the contribution does not depend on the optimizer. As for hyper-parameters, \(\lambda\) is initialized uniformly for all non-targeted tasks, the attenuation coefficient is \(\alpha\in(0,1)\), and the total number of attack steps \(S\) follows each attack algorithm's default. Perturbation budgets are \(2/255\), \(4/255\) and \(8/255\) under \(L_\infty\), \(5\) and \(10\) under \(L_2\), and \(10\) and \(20\) under \(L_1\) for APGD. Images are resized to \(288\times384\) for NYUv2 and \(256\times512\) for Cityscapes. Metrics follow the Auto-ฮป setup: NYUv2 uses mIoU for semantic segmentation, aErr for depth and mDist for surface normals, while Cityscapes uses mIoU for semantic and part segmentation and aErr for disparity estimation. Each task is treated as the targeted task in turn, with the others as the protected ones. The defended setting uses PGD adversarially trained (AT) models.

Key Experimental Results

Because segmentation and regression tasks have no classification-style "attack success rate," attack strength is measured by how far each task metric degrades relative to its clean baseline, and stealthiness by whether the non-targeted metrics hold that baseline; the \(\epsilon=0\) row is the clean baseline.

Main Results

PGD \(L_\infty\) attacks on NYUv2 (Table 1; the underline marks the targeted task, blue indicates a value dragged down by the attack and red a preserved one):

Setting Target task Segment mIoU(โ†‘) Depth aErr(โ†“) Normal mDist(โ†“)
Clean baseline (\(\epsilon=0\)) โ€” 46.56 40.57 23.41
Non-stealthy (\(8/255\)) Segment 10.11 78.36 36.23
Non-stealthy (\(8/255\)) Depth 14.58 240.52 41.16
Non-stealthy (\(8/255\)) Normal 18.91 93.36 68.05
SMTA2 automated (\(2/255\)) Segment 26.46 40.28 23.12
SMTA2 automated (\(2/255\)) Depth 47.63 106.45 23.40
SMTA2 automated (\(2/255\)) Normal 46.76 34.76 39.99
SMTA2 automated (\(8/255\)) Segment 12.32 39.56 23.21
SMTA2 automated (\(8/255\)) Depth 52.83 225.11 22.36
SMTA2 automated (\(8/255\)) Normal 46.93 38.03 63.29

PGD \(L_\infty\) attacks on Cityscapes (Table 2); the contrast between non-stealthy attacks and the SMTA2 automated strategy is what makes "collateral damage" visible:

Setting Target task Seg mIoU(โ†‘) Part Seg mIoU(โ†‘) Disp aErr(โ†“)
Clean baseline (\(\epsilon=0\)) โ€” 54.20 51.82 81.51
Non-stealthy (\(8/255\)) Segment 11.31 19.24 164.19
Non-stealthy (\(8/255\)) Part Seg 25.77 14.65 153.10
Non-stealthy (\(8/255\)) Disparity 16.05 14.18 824.75
SMTA2 automated (\(8/255\)) Segment 10.02 52.07 81.50
SMTA2 automated (\(8/255\)) Part Seg 54.27 12.22 80.97
SMTA2 automated (\(8/255\)) Disparity 57.36 52.10 1008.44

Ablation Study

Manual vs. automated weight search (NYUv2, PGD \(L_\infty\), \(\epsilon=4/255\), same settings as Table 1):

Target task Weight search Segment mIoU(โ†‘) Depth aErr(โ†“) Normal mDist(โ†“)
Segment Manual 18.30 37.30 23.22
Segment Automated 18.33 37.45 23.31
Depth Manual 47.08 165.27 22.83
Depth Automated 47.67 168.69 23.36
Normal Manual 47.86 37.26 53.47
Normal Automated 46.98 39.58 53.87

Does it still hold on adversarially trained models? (NYUv2, PGD \(L_\infty\), \(\epsilon=8/255\); non-stealthy attacks vs. SMTA2 automated):

Target task Method Segment mIoU(โ†‘) Depth aErr(โ†“) Normal mDist(โ†“)
Segment Non-stealthy 23.33 61.37 30.97
Segment SMTA2 automated 26.83 38.67 23.17
Depth Non-stealthy 28.68 76.32 31.15
Depth SMTA2 automated 46.78 73.72 23.01
Normal Non-stealthy 28.90 61.44 35.85
Normal SMTA2 automated 47.38 39.76 34.42

Key Findings

  • Collateral damage under non-stealthy attacks is the rule, not an exception. On NYUv2 at \(\epsilon=8/255\), attacking only segmentation still pushes depth aErr from 40.57 to 78.36 and normals from 23.41 to 36.23. Cityscapes is more extreme: targeting disparity alone collapses the other two mIoU values from 54.20 / 51.82 to 16.05 / 14.18, whereas SMTA2 holds them at 57.36 / 52.10 โ€” above the clean baseline rather than merely at it.
  • Selectivity does not come at the cost of attack strength. At \(\epsilon=8/255\) on NYUv2 the targeted segmentation drops to 12.32 (non-stealthy: 10.11), targeted depth rises to 225.11 (240.52) and targeted normals to 63.29 (68.05) โ€” essentially the same tier, and on Cityscapes the targeted disparity is hit even harder (1008.44 vs. 824.75). Adding "do not damage the other tasks" costs almost nothing in attack power.
  • Non-targeted tasks frequently improve rather than merely hold, a by-product of the negative weights. Since the preservation constraint is one-sided (only "no worse than the clean baseline"), negative weights not only offset collateral damage but also push the shared representation in a direction favorable to the other tasks: with normals targeted on NYUv2, depth aErr falls from 40.57 to 34.76 (automated, \(\epsilon=2/255\)), and with disparity targeted on Cityscapes both segmentation mIoU values are 57.36 / 52.10, above the 54.20 / 51.82 baseline.
  • Automated and manual search are on par in accuracy, with the automated one ahead in a few settings. At \(\epsilon=4/255\) with depth targeted: automated 168.69 vs. manual 165.27; with segmentation targeted they are nearly tied (18.33 vs. 18.30). The paper argues the automated strategy's value lies in not having to rerun the whole attack chain, hence better scalability as the task count grows.
  • The conclusions survive a change of attack paradigm. On Cityscapes, APGD \(L_1\) at \(\epsilon=20\) drives the targeted part segmentation to 13.58 while the other two stay at 55.28 / 80.23; APGD \(L_2\) at \(\epsilon=10\) drives the targeted disparity to 690.18 while the two segmentation tasks stay at 55.99 / 52.08. SMTA2 does not depend on PGD; a stronger optimizer only damages the target further without breaking preservation.
  • Adversarial training reduces the attack magnitude but not the selectivity. On the AT NYUv2 model, targeting normals raises mDist only from 23.41 to 34.42 (63.29 when undefended), and on Cityscapes AT cuts the disparity attack from 1008.44 to 122.42, the strongest defensive effect in the whole study. Even so, non-stealthy attacks on AT models still degrade every task together (e.g. depth 61.37 and normals 30.97 when segmentation is targeted), whereas SMTA2 still collapses only the target and keeps the rest near their baselines โ€” existing adversarial training is not designed for this task-asymmetric threat.
  • The radar plots in Fig. 4 compress the story into one view: non-stealthy attacks pull all three task axes toward the center at every \(\epsilon\), while SMTA2 pulls only the targeted axis and leaves the others hugging the clean ratio of 1.

Highlights & Insights

  • Encoding "selectivity" in the sign of the weights: the positive/negative signs carry both "attack" and "protect," so a single gradient ascent performs the attack and the constraint compensation together, with no bi-level optimization and no external constraint solver. The trick transfers to any multi-objective setting where "change A but do not touch B" is required, such as multi-task model editing or anti-forgetting constraints in continual learning.
  • Turning hyper-parameter search into online feedback control: the per-task loss difference serves as the error signal, \(\lambda_i\) as the step size and \(\alpha\) as damping, adjusting the weights into the feasible region while the attack proceeds, at an extra cost of only \(O(m)\) per step and the same overall complexity as a conventional attack (\(O(S\cdot\text{Backprop})\)). "Do not search separately โ€” fold the search into the main loop" is portable to any setting that needs per-sample weight tuning, such as multi-task loss balancing or reward weighting in multi-objective RLHF.
  • The one-sidedness of the preservation constraint exposes a positive signal: negative-weight terms do more than cancel damage; they push the shared representation in a direction favorable to that task, which is why non-targeted tasks often end up better than on the clean model. Read backwards, this suggests a defensive lead โ€” applying analogous "protection weights" to critical tasks at training or inference time might improve the local robustness of multi-task models. The paper does not pursue this, and it looks worth a try.
  • The evaluation contribution may outlast the method: the paper defines stealthiness functionally, as non-degradation of task metrics, and proposes preservation-aware attack assessment. For MTL security this means a globally robust model is not locally robust โ€” one must check task by task whether a point attack on one task drags the others down with it.

Limitations & Future Work

  • A fully white-box assumption: the attacker needs gradients of the target model, every task head's losses and labels, and a clean-input pass to establish the constraint baselines. None of this is guaranteed in deployment, and the paper reports no black-box or transfer-based attacks, so the practical value of the stealth claim is only verified under first-order white-box access.
  • No quantification of perceptual stealthiness: visualizations are used to argue the perturbation is subtle, but there is no LPIPS / SSIM / perceptual distance, nor any comparison of whether SMTA2's perturbation is less noticeable than a conventional attack at the same \(\epsilon\). Strictly speaking, "stealthy" here means functionally stealthy, not perceptually invisible.
  • Only three tasks and three branches: the automated strategy is claimed to scale to more tasks, but there is no experiment with \(m>3\); manual search grows rapidly with the task count, which the paper acknowledges without giving a quantitative curve (e.g. how many attack reruns are needed as a function of \(m\)).
  • The constraint is defined on losses rather than metrics: preservation is written as \(L_i(x+\delta,y_i)\le L_i(x,y_i)\), but losses and final metrics (mIoU / aErr / mDist) are not one-to-one, and the experiments already show cases where a metric beats the baseline while the loss relation need not hold strictly.
  • No fair comparison against hidden-task attacks: the authors note that Zhe et al. (2024) use a different setting, but no side-by-side numbers under a common protocol are given, leaving the relative strength of the two lines unclear.
  • Only PGD-AT is evaluated on the defense side: stronger or mechanistically different defenses (TRADES, input transforms, diffusion purification) are not tested. AT is clearly effective against the disparity attack on Cityscapes (1008.44 โ†’ 122.42), so it remains open whether another defense could break the selectivity itself.
  • Improvement directions: replace the online weight update with a version that works from a few queries (e.g. zero-order estimates of the loss differences) to move toward black box; replace the simple exponential attenuation of \(\lambda\) with a control law closer to a PID to further damp oscillation; and define the preservation constraint directly on task metrics (via differentiable surrogates) so that metrics, rather than losses, are guaranteed not to degrade.
  • vs. non-stealthy multi-task attacks (Guo et al. 2020, MTA; Zhang et al. 2025, gradient balancing): they sum the task losses with the same sign and maximize them jointly, aiming at an overall collapse and exploiting shared representations to beat single-task baselines. SMTA2 assigns negative weights to non-targeted tasks and aims at "precision strike with zero collateral damage." The price is a narrower feasible region and a weight-search problem that must be solved; the payoff is an attack that is far harder to notice in a real system โ€” measured attack strength is in the same tier, while the observable system behavior is completely different.
  • vs. hidden-task attacks (Zhe et al. 2024): they predefine "hidden tasks" and compromise them stealthily through shared representations without explicitly modeling task relationships. SMTA2 leaves the architecture and task relationships untouched, lets any task be designated as the target, and writes "which tasks must be protected" explicitly into the optimization, giving better controllability and interpretability at the cost of requiring complete task labels and losses.
  • vs. single-task adversarial attacks (PGD / APGD / IFGSM): these are SMTA2's underlying optimizers, not its competitors. The paper effectively swaps in a multi-task weighted objective, a pluggable modification of the attack target that leaves convergence properties and the order of time complexity unchanged.
  • vs. adversarial training (Madry et al.'s min-max): AT formulates defense as a min-max problem, and SMTA2 can be read as a "selective" version of the inner max โ€” the outer minimization of the worst-case loss stays, but the inner problem no longer damages all tasks uniformly. Experiments show AT reduces the absolute degradation of the targeted task yet cannot remove the "only one task collapses" property, suggesting MTL defenses need to account explicitly for asymmetric inter-task threats.
  • vs. multi-task multi-objective optimization (e.g. Sener & Koltun): that line treats multi-task training as multi-objective optimization to ease task conflict. This paper moves the same "tasks are in tension" language to the attack side with the sign flipped โ€” training seeks a win-win across tasks, whereas the attack seeks an asymmetric solution that hits one task hard and leaves the rest undisturbed.

Rating

  • Novelty: โญโญโญโญ First work to systematize "selective plus strictly preserving" as a constrained multi-objective attack; the problem definition and evaluation protocol have value in themselves, while the method (signed weights plus online weight adaptation) is a natural but effective modification of existing weighted attack objectives.
  • Experimental Thoroughness: โญโญโญ Two datasets ร— three attack algorithms ร— two norms ร— undefended and adversarially trained models is broad enough; but there are only three tasks, no black-box or transfer experiments, no quantification of perceptual stealthiness, and no sensitivity ablation on \(\alpha\) or the initial \(\lambda\).
  • Writing Quality: โญโญโญโญ The problem formalization and the analysis of both failure modes are clear, and the manual-vs-automated comparison is well designed; the weaknesses are dense tables (three rows per \(\epsilon\), with color semantics carried by cell borders), Eq. (1) being corrupted in the cached text, and some arguments (e.g. the strategies' motivation) repeated across sections.
  • Value: โญโญโญโญ Directly relevant to safety evaluation: a globally robust multi-task model is not locally robust, and evaluation must check the cross-task effect of a point attack on each task individually; preservation-aware attack assessment can become a new dimension of MTL robustness benchmarking.