PaperlayerView exact revision on arXiv

Source-linked AI summary

Understanding Robustness of Transformers for Image Classification

Srinadh Bhojanapalli, Ayan Chakrabarti, Daniel Glasner, Daliang Li, Thomas Unterthiner, Andreas Veit

arXiv:2103.14586v2cs.CVcs.AIcs.LG

TL;DR

The paper addresses whether Vision Transformers remain robust despite their attention-based architecture and non-overlapping image patches. It compares ViTs and ResNets across input and model perturbations using varied model sizes, patch sizes, and pre-training datasets. ViTs trained with sufficient data are at least as robust across broad perturbations, while individual-layer removal is usually tolerated and later layers remain important for classification.

  • Problem

    Because ViTs process images with pure attention rather than convolutional inductive biases, their robustness relative to ResNets requires broader evaluation.

  • Method

    The paper evaluates varied ViT and ResNet models using input-perturbation benchmarks, texture and shape bias, representation correlations, lesion studies, and spatially local attention.

  • Results

    ViTs pre-trained on sufficiently large datasets are at least as robust as ResNets across broad input perturbations and tolerate removal of almost any single layer.

  • Takeaways & Limitations

    The findings support using ViTs as robust vision architectures and show that later layers consolidate CLS-token information despite correlated activations.

  • Takeaways & Limitations

    For ImageNet-21k pre-training, ViT robustness does not scale better than ResNet robustness.

Abstract

from arXiv · show

Deep Convolutional Neural Networks (CNNs) have long been the architecture of choice for computer vision tasks. Recently, Transformer-based architectures like Vision Transformer (ViT) have matched or even surpassed ResNets for image classification. However, details of the Transformer architecture -- such as the use of non-overlapping patches -- lead one to wonder whether these networks are as robust. In this paper, we perform an extensive study of a variety of different measures of robustness of ViT models and compare the findings to ResNet baselines. We investigate robustness to input perturbations as well as robustness to model perturbations. We find that when pre-trained with a sufficient amount of data, ViT models are at least as robust as the ResNet counterparts on a broad range of perturbations. We also find that Transformers are robust to the removal of almost any single layer, and that while activations from later layers are highly correlated with each other, they nevertheless play an important role in classification.

1. Introduction

This paper studies whether Vision Transformers are robust despite processing images with pure attention and non-overlapping patches. It compares ViTs with ResNets across input and model perturbations, finding broad robustness and layer-level resilience.

  • Motivation: The study asks how ViTs behave under input and model perturbations, extending robustness understanding beyond conventional convolutional networks.The motivation is ViT’s pure attention-based processing and departure from convolutional architectures.
  • Experimental scope: The experiments compare ViT variants with similarly sized and trained ResNets across natural, adversarial, and spatial input perturbations.The evaluation also measures texture and shape bias.
  • Model analysis: The paper investigates internal information evolution through correlation analysis, lesion studies, and spatial-locality constraints in self-attention.These analyses examine representation redundancy and whether attention can be made more convolution-like.
  • Input robustness: ViTs pre-trained on sufficiently large datasets tend to be at least as robust as corresponding ResNets to input perturbations.This conclusion is reported across models of different sizes and pre-training datasets.
  • Model robustness: ViTs are robust to removing almost any single layer, while later layers produce highly correlated representations.Later layers make limited updates to individual patch representations while consolidating information in the CLS token.

2. Preliminaries

Transformers process sequences of vectors through stacked attention and feed-forward blocks, while ViT adapts this architecture to images by patchifying them. The paper evaluates varied ViT and ResNet configurations across scale, patch size, and pre-training data.

  • Background: Transformers were introduced for sequence modeling and later applied successfully across natural-language-processing tasks.The cited work emphasizes strong performance when combined with pre-training.
  • Transformers: Transformer models process sequences of vectors through stacked blocks containing multi-head self-attention and tokenwise feed-forward layers.Layer normalization and residual connections are used in both components.
  • Vision Transformer: ViT partitions an image into non-overlapping patches, linearly projects them into a sequence, and appends a CLS token for classification.A 384×384 image with 16 × 16 patches produces sequence length 162.
  • Model variants: The evaluation varies model parameters, ViT input patch size, and pre-training datasets, with all models fine-tuned on ILSVRC-2012.Pre-training uses ILSVRC-2012, ImageNet-21k, or JFT-300M.

3. Robustness to Input Perturbations

ViT robustness depends strongly on pre-training scale: with sufficiently large datasets, ViTs match or exceed ResNets across natural, adversarial, and spatial perturbations, with favorable scaling as models grow. Smaller patches improve spatial robustness, while adversarial perturbations generally do not transfer between architectures.

  • Natural Corruptions: Pre-training data fundamentally determines ViT robustness: ViTs underperform ResNets with small datasets but outperform them on most corruptions after JFT-300M pre-training.The same pattern appears on ImageNet-C and ImageNet-R, with gains also arising from larger models or smaller patches in the large-data regime.
  • Natural Adversarial Examples: On ImageNet-A, ViTs begin outperforming ResNets when both are pre-trained on JFT-300M, although the benchmark’s ResNet-50-based selection favors difficulty for ResNets.This makes the ImageNet-A comparison less definitive than the other natural-shift results.
  • Adversarial Perturbations: PGD attacks are more successful than FGSM; ViT robustness varies with training data, while larger models generally withstand perturbations better.For large-data models, PGD robustness shows diminishing returns beyond 300 million parameters.
  • Adversarial Perturbations: ViT and ResNet PGD perturbations differ qualitatively: ViT patterns align with patch boundaries, while ResNet patterns are more spatially incoherent.The perturbations concentrate most strongly around foreground objects for both model families.
  • Adversarial Perturbations: Adversarial patterns computed for ViTs rarely degrade ResNet performance, and ResNet-derived patterns similarly fail to transfer well to ViTs.The paper reports this non-transferability specifically for adversarial patterns across the two architectures.
  • Adversarial Spatial Perturbations: 16 × 16 ViTs are as robust as comparable ResNets to rotations and translations, whereas 32 × 32 ViTs are more susceptible.Both architecture families remain susceptible to spatial attacks overall.

4. Robustness to Model Perturbations

The paper probes ViT model robustness through layer correlations, lesion studies, and spatially restricted attention. Later layers are highly redundant in patch representations yet remain important for consolidating CLS information, while single-layer removal and local attention often degrade performance only modestly.

  • Representation Correlation: Layer correlations reveal highly redundant groups, including a large correlated group among later Transformer layers.This organization resembles stage structure observed in ResNets despite ViTs lacking explicit downsampling-based groups.
  • Representation Correlation: Later layers mainly consolidate CLS-token information while providing limited updates to individual patch representations.Patch representations become increasingly correlated toward the network’s end, whereas CLS representations change more rapidly in later layers.
  • Lesion Study: Except for the first block, removing any single ViT block, self-attention component, or MLP block does not substantially degrade performance.The lesion study removes blocks after training, allowing information to pass through skip connections; this parallels redundancy reported for ResNets.
  • Lesion Study: Removing more layers causes gradual performance deterioration, while larger models are more robust to layer removal.Training-data scale also affects this robustness: models pretrained on large datasets are less robust to layer removal, suggesting higher model utilization.
  • Restricted Attention: Local inter-patch attention causes graceful degradation, whereas randomly masking the same amount usually degrades accuracy significantly more.Removing inter-patch attention late in the network has relatively little effect, but disrupting it in initial blocks causes significant degradation; CLS-to-patch attention remains unrestricted.
  • Implications: The observed redundancy indicates that ViT models could be heavily pruned during inference.This conclusion follows from the combination of correlated later representations and the limited impact of removing individual blocks.

5. Takeaways

The paper’s takeaways compare ViTs and ResNets across data scales, perturbations, patch sizes, and internal representations. ViT robustness depends on training data and patch size, while internal redundancy coexists with continued CLS-token processing in later layers.

  • Overall Robustness: With sufficient training data, ViTs outperform ResNets, scale better with model size, and show the same advantage for robustness.Relative accuracy on the standard ILSVRC-2012 validation set predicts performance across diverse perturbations.
  • Adversarial Perturbations: FGSM is more effective against ViTs than ResNets, but both architectures are equally vulnerable to PGD perturbations.The optimal perturbations differ substantially between architectures and do not transfer between them.
  • Patch Size: Smaller ViT patches improve robustness to adversarial spatial transformations but increase texture bias.Patch size therefore affects distinct robustness properties in different directions.
  • Internal Representations: ViTs form correlated representation groups like ResNets, while later layers primarily update CLS representations rather than individual patches.This redundancy supports potential inference-time pruning, but later layers still contribute to classification through CLS-token consolidation.

A. Experimental Setup

The experiments evaluate adversarial, spatial, and preprocessing perturbations using standardized image inputs and attention masks. The setup also defines a fixed spatial attack grid and patch-distance restrictions for Transformer attention.

  • Image Preprocessing: Images are directly resized to each network’s expected input dimensions, without cropping or preserving aspect ratio, then intensity-normalized.Most models use 384 × 384 inputs.
  • Adversarial Perturbations: FGSM and PGD update image pixels using the sign of cross-entropy gradients and clip intensities to the valid range after each update.Step sizes and the overall L∞ norm are converted to each model’s intensity normalization.
  • Spatial Adversarial Attacks: The spatial adversarial attack tests whether any of 2511 fixed grid transformations causes an incorrect classification.The transformations cover the vertices of a discrete spatial-transformation grid shared across images and models.
  • Restricted Attention: Restricted attention masks remove patch pairs whose patch-grid distance exceeds a chosen horizontal or vertical threshold.The mask is applied after patch embedding to the flattened patch sequence and CLS token.

B. Raw Accuracy Values

Table 3 reports the raw accuracy values corresponding to the results presented in Figures 2 and 6.

  • Raw Accuracy Values: Table 3 contains the raw accuracy values underlying the results shown in Figures 2 and 6.It provides the numerical accuracy values associated with those figure results.

C. ImageNet-C Detailed Results

This section details ImageNet-C evaluations across corruption groups, individual corruption types, and severity levels. Results are reported as accuracies for ViT and ResNet models on clean and corrupted images.

  • Corruption benchmark: ImageNet-C contains 15 synthetic corruption types across noise, blur, weather, and digital groups, plus an extra group.Five severity levels produce 75 grouped corruptions, while the full evaluation averages across 95 distinct corruptions including 20 extra corruptions.
  • Corruption groups: Corruption-group accuracies average across all corruption types in each group and all severity levels.The reported groups are noise, blur, weather, and digital.

D. Robustness Scaling on ImageNet-21k

The study examines robustness scaling when models are pretrained on ImageNet-21k. Under this smaller pretraining set, larger ViTs generally do not gain more robustness than larger ResNets, except on ImageNet-C.

  • Robustness scaling: With ImageNet-21k pretraining, scaling ViT models generally provides no better robustness gains than scaling ResNets.ImageNet-C is identified as an exception to this pattern.
  • Pretraining data: ImageNet-21k is not large enough for ViT models to exhibit better robustness scaling.The comparison covers robustness on various benchmarks as a function of model size.

E. Adversarial Perturbations: Accuracies with Self and Cross-Over Attacks

The paper evaluates adversarial robustness using attacks computed on ViT or ResNet models and then tests the perturbations on the same or the other model type. Cross-model attacks fail to cause incorrect outputs in the reported evaluations.

  • Cross-model attacks: Adversarial perturbations computed with ViTs fail to cause incorrect outputs on ResNets, and perturbations computed with ResNets fail on ViTs.The evaluation uses PGD and FGSM across model variants trained on different amounts of data.
  • Evaluation protocol: Tables 4 and 5 report accuracies on original images and under PGD- or FGSM-based perturbations.Results use a subset of 1,000 ILSVRC-2012 validation images and compare self-attack with cross-model evaluation.

F. Layer Correlation Analysis

The layer-correlation study compares representations across Transformer blocks and residual-network blocks using correlation-based similarity measures. It spans multiple ViT architectures, ResNet models, and pretraining datasets.

  • Transformer representations: Figures 31 and 32 measure representation similarity across Transformer blocks using absolute Pearson correlation.Figure 32 restricts the comparison to CLS-token representations.
  • Transformer models: The Transformer analysis covers ViT-B/32, ViT-B/16, ViT-L/32, and ViT-L/16 pretrained on three datasets.The datasets are ILSVRC-2012, ImageNet 21k, and JFT-300M, with all models fine-tuned on ILSVRC-2012.
  • ResNet comparison: Figure 33 provides a comparative analysis of representations across residual-network blocks using Linear Centered Kernel Analysis.CKA enables comparisons across residual-network stages with different representation shapes.

G. Lesion Study

The lesion study evaluates how ViT models respond when individual architectural components are removed after training. It spans four model variants and three pre-training datasets, with all models fine-tuned on ILSVRC-2012.

  • The study removes individual ViT blocks, MLP layers, or Self-Attention layers after training to evaluate model behavior.
  • Four ViT variants are compared: ViT-B/32, ViT-B/16, ViT-L/32, and ViT-L/16.
  • The models use three pre-training datasets—ILSVRC-2012, ImageNet 21k, and JFT-300M—and are all fine-tuned on ILSVRC-2012.
Loading 2103.14586v2…