PaperlayerView exact revision on arXiv

Source-linked AI summary

On the Adversarial Robustness of Vision Transformers

Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Chen, Cho-Jui Hsieh

arXiv:2103.15670v3cs.CVcs.AIcs.LG

TL;DR

The paper asks whether vision transformers are more robust to adversarial perturbations than competing vision architectures and what explains any difference. It compares ViTs with CNNs and MLP-Mixer across empirical and certified settings, then analyzes frequency content and architectural changes. ViTs show stronger robustness, while adding low-level feature-learning modules can improve clean accuracy at a robustness cost.

  • Problem

    The robustness of vision transformers against small adversarial perturbations, including certified robustness, requires systematic comparison with CNNs and MLP-Mixer.

  • Method

    The study evaluates ViTs and competing architectures under white-box, transfer, and certified robustness settings, using frequency analysis and feature visualization to examine learned features.

  • Results

    ViTs are more robust than CNNs and MLP-Mixer across considered attacks and certified settings, with 59.8% robust accuracy reported for ViTs and significantly better certified robustness than CNNs.

  • Takeaways & Limitations

    ViTs’ reduced high-frequency feature content is associated with improved robustness, whereas convolutional or token-to-token additions can improve classification accuracy while reducing adversarial robustness.

Abstract

from arXiv · show

Following the success in advancing natural language processing and understanding, transformers are expected to bring revolutionary changes to computer vision. This work provides a comprehensive study on the robustness of vision transformers (ViTs) against adversarial perturbations. Tested on various white-box and transfer attack settings, we find that ViTs possess better adversarial robustness when compared with MLP-Mixer and convolutional neural networks (CNNs) including ConvNeXt, and this observation also holds for certified robustness. Through frequency analysis and feature visualization, we summarize the following main observations contributing to the improved robustness of ViTs: 1) Features learned by ViTs contain less high-frequency patterns that have spurious correlation, which helps explain why ViTs are less sensitive to high-frequency perturbations than CNNs and MLP-Mixer, and there is a high correlation between how much the model learns high-frequency features and its robustness against different frequency-based perturbations. 2) Introducing convolutional or tokens-to-token blocks for learning high-frequency features in ViTs can improve classification accuracy but at the cost of adversarial robustness. 3) Modern CNN designs that borrow techniques from ViTs including activation function, layer norm, larger kernel size to imitate the global attention, and patchify the images as inputs, etc., could help bridge the performance gap between ViTs and CNNs not only in terms of performance, but also certified and empirical adversarial robustness. Moreover, we show adversarial training is also applicable to ViT for training robust models, and sharpness-aware minimization can also help improve robustness, while pre-training with clean images on larger datasets does not significantly improve adversarial robustness.

1 Introduction

This work studies whether vision transformers are robust to adversarial perturbations, comparing them with CNNs and MLP-Mixer across empirical and certified settings. It finds that ViTs generally provide stronger robustness, while some accuracy-oriented architectural additions trade robustness for clean accuracy.

  • Overall findings: ViTs show superior adversarial robustness over CNNs and MLP-Mixer across various evaluation settings.The study evaluates image-classification models under adversarial attacks and compares their robustness with CNN and MLP baselines.
  • Overall findings: 59.8% robust accuracy is achieved by ViTs, compared with a maximum 16.7% improvement for CNNs in Figure 1.The reported robust accuracy is evaluated against adversarial perturbations.
  • Certified robustness: ViTs attain significantly better certified robustness than CNNs under denoised randomized smoothing.This extends the robustness comparison beyond empirical attack accuracy.
  • Architectural trade-offs: Adding convolutional or other low-level feature-learning blocks can improve clean accuracy but reduces adversarial robustness.The reported trade-off is visible for hybrid architectures and is attributed to introducing modules that learn low-level or high-frequency features.
  • Architectural trade-offs: Adding 10 transformer blocks to T2T-ViT-14 raises robust accuracy from 12.9% to 20.8%, whereas scaling pure ViTs does not guarantee greater robustness.The robustness of ViT-S/16 is reported as better than that of ViT-B/16.
  • Training strategies: Adversarial training applies to ViTs, sharpness-aware optimization improves both robustness and clean accuracy, and clean pre-training on larger datasets does not improve adversarial robustness.These findings concern training strategies rather than architectural changes.

2 Related Work

Related work has studied transformer robustness mainly in NLP and, more recently, in vision. This paper distinguishes itself by analyzing the source of ViTs’ robustness through frequency, certified robustness, and broad architectural comparisons.

  • Transformer robustness: NLP studies generally find transformers more robust than LSTM- or CNN-based models under discrete perturbations.Those perturbations include word or character substitutions and differ from small continuous perturbations in computer vision.
  • Vision-transformer studies: Concurrent vision studies examine white-box and black-box attacks, patch-based structures, adversarial training, transferability, and other views of ViT robustness.The cited works also investigate ensemble defenses and augmentation-based training.
  • This paper’s focus: This work focuses on the origin of ViTs’ adversarial robustness through frequency analysis and reports especially strong resistance to high-frequency perturbations.It also applies denoised randomized smoothing to study certified robustness.
  • This paper’s focus: The study claims to be the first to investigate certified adversarial robustness of transformers on computer-vision tasks from a frequency perspective.It evaluates white-box and black-box robustness against small perturbations and includes ConvNeXt and MLP-Mixer.

3 Model Architectures

The experiments compare vanilla and hybrid ViT variants with CNN, MLP-Mixer, and differently pretrained CNN baselines. The architecture set spans pure transformers, CNN- and token-based hybrids, shifted-window models, and varied training schemes.

  • Experimental models: The study uses publicly available, separately tuned checkpoints for the investigated architectures.This differs from evaluating all models under one shared training setting.
  • Vision transformers: Vanilla ViT variants include ViT, DeiT, and ViT-SAM, with image patches encoded into patch embeddings.The study evaluates ViT-{S,B,L}/16, DeiT-S/16, Dist-DeiT-B/16, and other variants.
  • Hybrid architectures: CNN-ViT replaces raw image patches with patches extracted from a CNN feature map.The experiments use ViT-B/16-Res with spatial features from ResNet50 as the input sequence.
  • Hybrid architectures: T2T-ViT progressively aggregates neighboring tokens to learn low-level structures, while Swin-T limits attention to shifted local windows with cross-window connections.The experiments include T2T-ViT-14, T2T-ViT-24, and Swin-S/4.
  • Comparison baselines: CNN baselines include ResNet, ShuffleNet, MobileNet, VGG, and SEResNet, alongside MLP-Mixer and ConvNeXt.The CNN comparisons include models with channel attention through squeeze-and-excitation.
  • Comparison baselines: Additional CNN baselines are pre-trained on YFCC100M or IG-1B-Targeted before ImageNet fine-tuning.These models support comparisons with pretrained transformers.

4 Adversarial Robustness Evaluation Methods

The paper evaluates adversarial robustness using norm-bounded white-box, transfer, and frequency-filtered attacks, and assesses certified robustness through denoised randomized smoothing.

  • White-box attacks: ℓ∞-bounded attacks search for adversarial examples within a radius-ϵ ball around a clean input by maximizing classifier loss.The paper considers untargeted attacks, where success means changing the model’s prediction.
  • White-box attacks: PGD iteratively performs gradient ascent and clips each updated input back into the permitted ℓ∞ region; FGSM is its single-step special case.The clipping operation keeps each coordinate within [x0,i − ϵ, x0,i + ϵ].
  • White-box attacks: AutoAttack evaluates robustness with a parameter-free ensemble combining gradient-based, optimization-based, and query-based black-box attacks.Its components include APGD-CE, APGD-DLR, FAB, and Square Attack.
  • Transfer attacks: Transfer attacks test whether perturbations generated on a source model fool a target model, providing a black-box robustness evaluation and a check for obfuscated gradients.The experiments use FGSM because single-step attacks have better transferability than multi-step attacks.
  • Frequency analysis: Frequency-filtered attacks apply DCT-based masks to PGD perturbations so they occupy full-, low-, or high-frequency domains.The filters preserve all frequencies, only low frequencies, or only high frequencies, respectively.
  • Certified robustness: Certified robustness is evaluated with denoised randomized smoothing, which trains a denoiser and certifies the smoothed classifier within a perturbation radius.Certified accuracy compares a specified radius with the calculated certified radius using class-confidence bounds.

5 Experiments

Experiments show that ViTs are more robust than CNNs and MLP-Mixer across empirical, transfer, and certified settings, while high-frequency feature learning and hybrid architectural additions expose robustness trade-offs.

  • Frequency study: ViTs learn fewer high-frequency features and are less sensitive to high-frequency perturbations than CNNs.For ResNet50-32x4d, high-pass robust accuracy drops 43.7 percentage points as the radius increases, versus 32.9 points for ViT-B/16.
  • Robustness comparisons: ViTs outperform CNNs and MLP-Mixer in diverse adversarial settings, including white-box, transfer, and certified robustness evaluations.The study compares frequency-filtered, PGD, AutoAttack, transfer, and denoised randomized-smoothing robustness.
  • Architectural trade-offs: Adding ResNet or T2T blocks improves clean classification but decreases ViT adversarial robustness.At ε = 0.001, ViT-B/16 robust accuracy falls from 48.9% to 45.5% under PGD and from 39.8% to 27.7% under AutoAttack after adding ResNet features.
  • Training strategies: Clean-image pre-training on larger datasets does not improve adversarial robustness, whereas adversarial training and sharpness-aware optimization can help.Sharpness-aware optimization also improves clean accuracy, and adversarial training is directly applicable to ViTs.
  • CNN design: Modern CNN designs borrowing transformer techniques can narrow the gap in clean, empirical, and certified robustness.Examples include larger kernels, patchified inputs, layer normalization, GELU activations, and invertible bottlenecks.

6 Conclusion

The paper finds that ViTs are more robust than CNNs under considered empirical and certified attacks because they learn less low-level information, while CNNs borrowing transformer techniques can improve robustness.

  • Conclusion: ViTs are more robust than CNNs across the considered adversarial attacks and certified robustness settings.The conclusion covers both empirical and certified robustness.
  • Conclusion: ViT features contain less low-level information, contributing to improved resistance against perturbations that often contain high-frequency components.Introducing convolutional blocks increases low-level feature learning but harms adversarial robustness.
  • Conclusion: Modern CNN designs that imitate transformer global-attention behavior improve both standard performance and certified and empirical adversarial robustness.The conclusion presents these designs as a way to inform robust vision-model architecture.
  • Conclusion: Adversarial training can be applied to ViTs for robust-model training.The conclusion explicitly reports this demonstration without claiming universal effectiveness.

A The Source of Adversarial Robustness

Additional analyses rule out insufficient attack optimization as the source of ViT robustness and connect the observed advantage to attention-related robustness perspectives.

  • Attack optimization: ViT robustness is not caused by insufficient attack optimization in white-box evaluation.The authors examine loss landscapes with sufficient PGD steps.
  • Attack optimization: ViT loss curves converge to lower values than ResNet18 as PGD steps increase, supporting the robustness comparison.The corresponding robust-accuracy curves are also evaluated across attack steps.
  • PGD comparison: Across attack radii and steps, darker PGD blocks indicate that vision transformers are more robust than CNNs.The figure encodes robustness through adversarial accuracy, with darker blocks representing more robust models.
  • Interpretation: The paper relates transformer attention to Hopfield networks as a possible explanation for improved adversarial robustness.This connection is presented as an explanatory perspective rather than as the main experimental finding.

B Experiments on SOTA ViT Structures

Experiments on contemporary ViT structures compare shifted-window, distillation, and sharpness-aware variants, finding that shifted windows can harm robustness while sharpness-aware training improves it.

  • Swin Transformer: Swin Transformers use shifted local windows, which limit self-attention computation and can harm robustness relative to the reported alternatives.The text compares this effect with the Tokens-to-Token scheme.
  • DeiT: DeiT improves ViT performance through data augmentation or CNN-teacher distillation with an additional distillation token.This passage describes the model design rather than a separate robustness result.
  • SAM-ViT: SAM-ViT trains ViTs from scratch with sharpness-aware minimization without large-scale pretraining or strong data augmentation.Sharpness-aware minimization is also reported to improve ViT certified robustness.
  • Experimental setup: The SOTA ViT experiments evaluate models summarized in Table 6 using clean and 40-step PGD robust accuracy at different radii.AutoAttack results are also reported separately for these models.

C Experiments on Cifar-10

The CIFAR-10 experiments adapt ViT-B/16 to smaller images and compare its robustness with WideResNet under varying attack radii. The reported results show ViT-B/4 outperforming WideResNet in robust accuracy in this setting.

  • Table 8 reports clean and robust accuracy for ViTs under AutoAttack at different attack radii.Higher robust accuracy indicates greater robustness.

D Robustness Against Adversarial Deformation

The paper evaluates robustness against adversarial deformations that iteratively apply small changes to clean images. These results are reported as consistent with the paper’s PGD and AutoAttack findings.

  • Robust accuracy against iterative adversarial deformations agrees with the results obtained using PGD and AutoAttack.The deformation results are reported in Table 10.
  • Adversarial deformation attacks iteratively apply small deformations to clean data rather than only adding perturbations.The evaluation concerns correctly classified images.
  • Table 10 reports robust accuracy (%) against AFef under Alaifari et al.’s default setting.

E Transfer Attack Results

The paper reports transfer-attack results across additional attack radii. Figure 8 organizes these results by surrogate and target models to assess transferability and vulnerability.

  • Transfer-attack results using more attack radii are provided in Figure 8.

F Adversarial Training

The adversarial-training experiments adapt ViT-B/16 for CIFAR-10 and compare it with CNN baselines under PGD and TRADES. ViT achieves higher robust accuracy than ResNet18, comparable robust accuracy to WideResNet-34-10, and much better clean accuracy, while fast FGSM training can catastrophically overfit.

  • Settings: The experiment adapts ViT-B/16 to CIFAR-10 by resizing its patch embeddings and using 4 × 4 patches.The resulting model is named ViT-B/4 and retains 8 × 8 patches.
  • Settings: The ViT experiment uses CIFAR-10 with ϵ = 8/255 and evaluates models using PGD-10 and AutoAttack.Models are trained for 20 epochs in the reported table.
  • Results: ViT achieves higher robust accuracy than ResNet18 and comparable robust accuracy to WideResNet-34-10 after adversarial training.The comparison uses CIFAR-10 results evaluated with PGD-10 and AutoAttack.
  • Results: ViT achieves much better clean accuracy than ResNet18 and WideResNet-34-10 in the reported adversarial-training experiment.
  • Results: PGD- and TRADES-based adversarial training are applicable to vision transformers, whereas fast FGSM training causes catastrophic overfitting for ViT.Under PGD attacks, test accuracy remains almost 0 for the fast-training attempt.
Loading 2103.15670v3…