The two distinct characteristics or risks specifically associated with Transfer Learning attacks are Backdoor Persistence and Adversarial Transferability.

B. Backdoor Persistence: This attack involves poisoning the pre-trained (teacher) model. An attacker embeds a hidden trigger (the backdoor) into the model, which causes specific malicious behavior when activated. When a downstream user fine-tunes this compromised model for their own task, the backdoor functionality often persists in the resulting (student) model. This is a direct risk of using pre-trained weights from an untrusted source, a core tenet of the transfer learning supply chain.

C. Adversarial Transferability: This is the phenomenon where an adversarial example (a carefully perturbed input) designed to fool one model is also effective at fooling a different model, especially if the second model was fine-tuned from the first. The student model inherits a significant portion of the teacher model's feature representation, making it vulnerable to the same adversarial inputs. This risk is magnified in transfer learning scenarios where an attacker may have access to the original teacher model.

A. Gradient Vanishing: This is a fundamental problem related to the training of very deep neural networks, where gradients shrink exponentially as they are backpropagated, making it difficult for lower layers to learn. It is a training optimization challenge, not a security attack vector specifically introduced by the process of transfer learning.

D. Prompt Injection: This is a type of attack that targets the input-processing logic of a deployed LLM at inference time. While a fine-tuned model is susceptible to prompt injection, the vulnerability is in how the model handles prompts, not a risk that is inherited through the model weights from the teacher model during the transfer learning process itself. Backdoors and transferable adversarial examples are properties embedded within or enabled by the learned parameters being transferred.

1. Gu, T., Dolan-Gavitt, B., & Garg, S. (2017). BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain. arXiv preprint arXiv:1708.06733. This is the foundational paper on backdoor attacks (termed "BadNets"), which explicitly frames the attack in the context of a compromised model supply chain, such as transfer learning.

2. Papernot, N., McDaniel, P., & Goodfellow, I. (2016). Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples. arXiv preprint arXiv:1605.07277. This research extensively studies the property of adversarial transferability and demonstrates how it can be used to mount black-box attacks, a risk directly applicable when a student model is derived from a publicly known teacher model.

3. Shafahi, A., et al. (2018). Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. In Advances in Neural Information Processing Systems 31 (NeurIPS 2018). This paper discusses advanced poisoning attacks, including those that can be injected into models that are later used for transfer learning, demonstrating the persistence of such vulnerabilities.