PaperlayerView exact revision on arXiv

Source-linked AI summary

On the Robustness of Vision Transformers to Adversarial Examples

Kaleel Mahmood, Rigel Mahmood, Marten van Dijk

arXiv:2104.02610v2cs.CVcs.LG

TL;DR

Vision Transformers were less studied adversarially than CNNs despite their strong image-classification performance. The paper evaluates their white-box and black-box robustness, transferability, and ensemble defenses, finding low cross-family transferability, no white-box ensemble security, and substantial black-box robustness without clean-accuracy loss.

  • Problem

    Vision Transformers lacked an in-depth adversarial analysis despite CNNs having an expansive attack-and-defense literature.

  • Method

    The paper evaluates multiple Vision Transformers, Big Transfer Models, and CNNs using white-box and black-box attacks, transferability studies, and ensemble defenses.

  • Results

    Adversarial examples transfer remarkably little across model families; SAGA breaks white-box ensemble security, while a two-model ensemble improves robust accuracy by as much as 60% under black-box attacks.

  • Takeaways & Limitations

    Transferability can support black-box robustness while preserving near state-of-the-art clean accuracy, but it does not provide white-box security.

  • Takeaways & Limitations

    The low-transferability pattern is not absolute and varies across model pairs, including Big Transfer models on ImageNet.

Abstract

from arXiv · show

Recent advances in attention-based networks have shown that Vision Transformers can achieve state-of-the-art or near state-of-the-art results on many image classification tasks. This puts transformers in the unique position of being a promising alternative to traditional convolutional neural networks (CNNs). While CNNs have been carefully studied with respect to adversarial attacks, the same cannot be said of Vision Transformers. In this paper, we study the robustness of Vision Transformers to adversarial examples. Our analyses of transformer security is divided into three parts. First, we test the transformer under standard white-box and black-box attacks. Second, we study the transferability of adversarial examples between CNNs and transformers. We show that adversarial examples do not readily transfer between CNNs and transformers. Based on this finding, we analyze the security of a simple ensemble defense of CNNs and transformers. By creating a new attack, the self-attention blended gradient attack, we show that such an ensemble is not secure under a white-box adversary. However, under a black-box adversary, we show that an ensemble can achieve unprecedented robustness without sacrificing clean accuracy. Our analysis for this work is done using six types of white-box attacks and two types of black-box attacks. Our study encompasses multiple Vision Transformers, Big Transfer Models and CNN architectures trained on CIFAR-10, CIFAR-100 and ImageNet.

1. Introduction

Vision Transformers emerged as attention-based alternatives to CNNs, whose adversarial weaknesses are well documented. This paper investigates ViT security through white-box and black-box attacks, transferability, and ensemble defenses.

  • Vision Transformers: Vision Transformers apply self-attention to image patches and achieve near state-of-the-art results after large-scale pretraining.The described training regime pretrains on ImageNet-21K or JFT before fine-tuning on smaller datasets.
  • Adversarial Threats: CNNs are vulnerable to adversarial examples, where small input perturbations cause high-confidence misclassification.White-box attackers access model parameters and gradients, while black-box attackers query the model or use a synthetic model.
  • Research Gap: Vision Transformers had received less adversarial study than CNNs despite their growing role in image classification.The paper focuses on image-based adversarial attacks and analyzes transformers alongside Big Transfer Models and ResNets.
  • Research Questions: The paper tests whether Vision Transformers improve security over CNNs and examines adversarial-example transferability between model families.The study uses six standard white-box attacks and extends the analysis to ensemble defenses under white-box and black-box threats.
  • Main Findings: A simple transformer–CNN ensemble is insecure against the new SAGA white-box attack but achieves unprecedented robustness under a black-box adversary without sacrificing clean accuracy.The paper uses transfer-style and query-based black-box attacks to evaluate the ensemble.

2. Related Work

Prior work extensively studied adversarial robustness for NLP transformers, while vision transformers remained comparatively unexplored. The paper positions its analysis as an in-depth adversarial study of transformers for vision.

  • NLP Transformer Robustness: Adversarial research on NLP transformers includes natural adversarial-example generation and theoretical analyses of self-attention robustness.Existing work studies translation, BERT-based classification, cross-non-linearity, and cross-position interactions.
  • NLP Transformer Robustness: Verification work on NLP transformers avoided large-scale pretrained models such as BERT because they were too challenging to verify tightly.This marks a practical boundary in the cited verification approach.
  • Vision Transformer Gap: The paper claims to be the first in-depth analysis of a transformer’s adversarial properties from a vision perspective.Its contribution addresses the contrast between substantial NLP-focused work and limited vision-focused analysis.

3. White-Box Attacks on Vision Transformers

The white-box study evaluates Vision Transformers against strong gradient-based attacks under an adversary with full model knowledge. Across datasets, Vision Transformers are no more secure than Big Transfer Models or conventional CNNs.

  • Adversarial Model: The white-box adversary knows the model architecture and trained parameters and creates bounded untargeted perturbations satisfying ∥x−xadv∥∞≤ϵ.The perturbation bounds are ϵ = 0.031 for CIFAR-10/CIFAR-100 and ϵ = 0.062 for ImageNet.
  • Evaluation: The evaluation measures robust accuracy on clean test examples that the classifier initially labels correctly.Adversarial examples are generated from this correctly classified set using the selected attacks.
  • Attack Suite: Six white-box attacks include FGSM, MIM, PGD, APGD, and BPDA-based testing to address possible gradient masking.BPDA is used because attack failure can reflect poor gradient estimation rather than genuine classifier security.
  • Models and Datasets: The study attacks multiple ViT, Big Transfer, and ResNet variants across CIFAR-10, CIFAR-100, and ImageNet.It varies transformer patch size and model complexity, using eight models for CIFAR datasets and seven for ImageNet.
  • Results: 0% robustness occurs for Vision Transformers under C&W and APGD attacks, while PGD and MIM robustness remains below 6% across datasets.The paper concludes that Vision Transformers provide no additional security over Big Transfer Models or conventional CNNs.

4. Vision Transformers Transferability Study

The study measures adversarial-example transferability across Vision Transformers, Big Transfer Models, and CNNs on CIFAR-10, CIFAR-100, and ImageNet. Transferability is generally low across model genera but higher within genera, with implications for security that are trends rather than absolute rules.

  • Security implication: Low transferability may provide a security avenue because the same adversarial examples are not misclassified by both classifiers.High transferability instead indicates a shared vulnerability to the same adversarial examples.
  • Study design: The study evaluates transferability across eight CIFAR models and seven ImageNet models using all classifier pairs and 1,000 jointly correctly classified examples.Transferability is measured with Equation 3 after generating adversarial examples for one classifier and evaluating them on another.
  • Cross-genus transferability: Low transferability occurs between Vision Transformers and Big Transfer Models across CIFAR-10, CIFAR-100, and ImageNet.BiT-M-50x1-generated examples fool ViT-L-16 5.7%, 15.5%, and 11.8% of the time, respectively.
  • Cross-genus transferability: ViT-L-16-generated examples fool BiT-M-50x1 in 42.5%, 47.6%, and 34.3% of cases on CIFAR-10, CIFAR-100, and ImageNet.These rates are below half across all three datasets.
  • Within- and cross-genus patterns: Adversarial examples generally transfer within ViT, BiT, or ResNet genera but not reliably across different genera.The figure encodes cross-genus transferability with green, blue, and light-blue bars, and within-genus transferability with pink, red, and orange bars.
  • Study boundary: The low-transferability pattern is observed across multiple datasets and model pairs but is not an absolute rule.For ImageNet, transferability between BiT-M-R50x1 and BiT-M-152x4 is 28% and 24.9%.

5. White-Box Security and Transferability

Low transferability between different model genera motivates a ViT–BiT ensemble, but the proposed SAGA attack shows that this ensemble is not secure against a white-box adversary.

  • Transferability and Ensemble Design: Adversarial examples transfer poorly between different model genera, motivating an ensemble combining Vision Transformers and Big Transfer Models.The base ensembles use ViT-L-16 with BiT-M-101x3 for CIFAR-10/CIFAR-100 and BiT-M-152x4 for ImageNet.
  • Transferability and Ensemble Design: The ensemble defense uses random selection because majority voting weakens evaluation and absolute consensus can reduce clean accuracy.Absolute consensus marks a sample adversarial when classifiers disagree, but many clean samples may then be marked adversarial.
  • White-Box Attack: 26.3% of adversarial examples generated from ViT-L-16 fool BiT-M-152x4, illustrating low cross-model transferability.The paper uses this observation to motivate an attack that simultaneously targets both models rather than relying on transfer from one model.
  • White-Box Attack: SAGA blends gradients from CNNs and Vision Transformers with transformer self-attention to craft examples misclassified by multiple ensemble members.The attack operates within perturbation bounds and weights model-gradient terms with attacker-selected coefficients.
  • White-Box Results: 74.0%, 84.4% and 91.8% are SAGA’s attack success rates on the ensembles for CIFAR-10, CIFAR-100 and ImageNet, respectively.SAGA outperforms the Basic and Single MIM white-box multi-model attacks across all three datasets.

6. Black-Box Security and Transferability

Because SAGA requires knowledge of ensemble models and parameters, the paper evaluates query-based and transfer-based black-box attacks. A ViT–BiT ensemble substantially improves robust accuracy without reducing clean accuracy.

  • Black-Box Threat Model: Black-box attacks are considered because SAGA depends heavily on access to ensemble models and trained parameters.The evaluation includes query-based RayS and transfer-based Adaptive Black-Box attacks.
  • Experimental Setup: The black-box evaluation compares a ViT–BiT ensemble with single ViT and CNN configurations under RayS and Adaptive attacks.The ensemble uses ViT-L-16 with BiT-M-101x3 on CIFAR-10/CIFAR-100 and BiT-M-152x4 on ImageNet.
  • Black-Box Results: 66.5%, 73% and 32.1% are the robust-accuracy increases for the ViT–BiT ensemble under RayS on CIFAR-10, CIFAR-100 and ImageNet, respectively.Robust accuracy is the percentage of adversarial samples correctly identified by the defense.
  • Black-Box Results: 57% robust accuracy remains under the CIFAR-10 Adaptive attack despite 100% training-data access, query access and a synthetic model pretrained on ImageNet-21K.This represents a 26.2% improvement over a single model.
  • Clean Accuracy: 98.2%, 92.83% and 85.37% are the ensemble’s average clean accuracies on CIFAR-10, CIFAR-100 and ImageNet, respectively.The paper reports that the robustness improvement does not come at the cost of clean accuracy.

7. Conclusion

The paper finds that Vision Transformers are as vulnerable as CNNs under white-box attacks, while low cross-architecture transferability can support black-box ensemble robustness.

  • Six attacks show individual Vision Transformers are just as vulnerable as CNN counterparts to white-box adversaries.
  • Transferability between Vision Transformers and other model genera is generally remarkably low across CIFAR-10, CIFAR-100, and ImageNet.
  • SAGA shows that low transferability does not yield white-box security for CNN–transformer ensembles.
  • Two-model ensembles improved robust accuracy by as much as 60% in some cases while maintaining near-state-of-the-art clean accuracy under black-box attacks.

MATERIAL

The supplementary material expands the paper’s attack evaluations, formalizes the white-box threat model, and describes six white-box attack methods and their constraints.

  • Supplementary material: The supplement adds white-box and black-box experiments, adversarial training results, and further transferability analyses.
  • White-box adversarial model: Adversarial samples must be misclassified while remaining within an l_p distance bound and valid pixel range.
  • White-box adversarial model: The white-box model gives the adversary access to the classifier, trained parameters, clean input, and corresponding label.
  • White-box attacks: The evaluation covers FGSM, PGD, MIM, C&W, APGD, and BPDA, including attacks designed to address gradient masking.
  • White-box attacks: FGSM uses one gradient step, whereas PGD iteratively updates and projects perturbations into an ϵ-ball.

C. Self-Attention Gradient Attack (SAGA)

SAGA targets ensembles by blending model gradients, demonstrating that CNN–transformer defenses can be attacked in white-box settings despite low transferability.

  • Attack design: SAGA is introduced as a white-box attack against ensembles containing Vision Transformers and CNN-like Big Transfer Models.
  • Adversarial images: SAGA-generated adversarial images use l∞ bounds of ϵ = 0.031 on CIFAR-10 and ϵ = 0.062 on ImageNet, with little perceivable visual difference.
  • Hyperparameters: Simple gradient averaging produces low attack success, so SAGA requires carefully chosen model-specific scaling factors.
  • Hyperparameters: For CIFAR-10, SAGA uses α1 = 0.998 for ViT-L-16 and α2 = 2e −4 for BiT-M-R101x3, yet both gradients remain critical.
  • ResNet results: A ViT-L-16/ResNet-164 ensemble reaches only 15% robust accuracy under SAGA, indicating that this combination is not secure.

D.2. Transfer Based Adversarial Model

The transfer-based threat model trains a synthetic classifier from available data, then transfers its white-box adversarial examples to the unknown target model. Experiments show that successful transfer depends strongly on the synthetic architecture, especially for Vision Transformers.

  • Threat model: A transfer-based adversary lacks the target architecture and parameters but may access training and pre-training data without a query limit.
  • Threat model: The attacker trains a synthetic model on target-labeled data, crafts examples with a white-box attack, and applies them to the target classifier.
  • Transfer results: For ViT-L-16, a pre-trained ViT-B-32 synthetic model using 10% of the data leaves 53% robust accuracy, versus 92.4% without pre-training.
  • Transfer results: With 100% attack strength, VGG-16 leaves ViT-L-16 at 46.8% robust accuracy, while ResNet-56 leaves it at 4.8%.
  • Implications: Unlike CNN transfer attacks, Vision Transformer attacks require careful synthetic-model selection, creating a new challenge for black-box attack designers.
  • Vision Transformer architecture: The Vision Transformer architecture uses patch embeddings, positional encoding, and multi-headed self-attention before classification.
  • Transformer–CNN relation: Self-attention can be mathematically equivalent to a k×k convolution when an attention head uses an appropriate value matrix, but learning that matrix is empirical.

E.2. Decision Region Graphs

Decision region graphs visualize how model predictions change as adversarial and random perturbations vary. Across CIFAR-10, CIFAR-100, and ImageNet, Vision Transformers, ResNets, and Big Transfer Models exhibit different decision-region landscapes and robustness patterns.

  • Graph construction: Decision region graphs color-code classification regions in a two-dimensional perturbation space for a single image.The origin is the unperturbed image; each point corresponds to a class label.
  • Graph construction: I′ = I + x · g + y · r generates perturbed images by combining model-loss gradient noise with random noise orthogonal to that gradient.x and y control the magnitudes of the adversarial and random-noise components.
  • Graph interpretation: Increasing x strengthens adversarial noise, analogous to increasing the FGSM step size, while movement along y represents increasing random-noise magnitude.The graph therefore separates sensitivity to gradient-aligned and orthogonal perturbations.
  • Cross-dataset results: Vision Transformers and Big Transfer Models tolerate more noise than ResNets in the decision-region graphs, including random noise across the evaluated datasets.Figures 8 and 9 show the same general trend for CIFAR-100 and ImageNet.
  • Interpretation: Different decision-region landscapes support the reported low transferability between Vision Transformers, ResNets, and Big Transfer Models.The authors caution that visualizations alone cannot establish the conjecture that differing decision boundaries explain this pattern.

F. Friendly Adversarial Training Defense for Vision Transformers

Friendly Adversarial Training applies early-stopped PGD to Vision Transformers and compares their robustness with ResNet-based defenses. The reported Transformer robustness is similar to that of ResNet architectures under this defense.

  • Defense method: Friendly Adversarial Training uses less-strong adversarial examples by stopping the PGD algorithm early.Its PGD-K-τ formulation introduces τ to control how far adversarial examples cross the decision boundary.
  • Defense method: When K = τ, PGD-K-τ is equivalent to the standard PGD k-step algorithm.The method is evaluated across different τ values for Transformer-based networks.
  • Results: Friendly Adversarial Training produces similar adversarial robustness for Vision Transformers and ResNet-based architectures.The comparison covers ViT and ResNet models on CIFAR-10 and CIFAR-100.
  • Results: 47% adversarial robustness accompanies ViT-L-16 with τ = 1, while clean accuracy drops from 99.1% to 94.2%.The cited result is reported for the evaluated adversarial-robustness setting.
  • Evaluation: Table 9 reports FAT defense accuracy across ViT-B-32, ViT-B-16, ViT-L-16, and ResNet-164 for τ = 0, 1, 2, and 10.The table lists attacks from FGSM to APGD and includes clean accuracy.
  • Additional evaluation: The appendix provides full transferability tables for CIFAR-10, CIFAR-100, and ImageNet, using robust accuracy under FGSM, PGD, or MIM.PGD and MIM use 10 steps to avoid overfitting examples to a particular model.
Loading 2104.02610v2…