PaperlayerView exact revision on arXiv

Source-linked AI summary

Intriguing Properties of Vision Transformers

Muzammal Naseer, Kanchana Ranasinghe, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, Ming-Hsuan Yang

arXiv:2105.10497v3cs.CVcs.AIcs.LG

TL;DR

The paper asks how ViTs’ flexible image-wide attention affects robustness and generalization under visual nuisances. Through systematic experiments across three ViT families and comparisons with CNNs, it finds broad robustness, reduced texture bias, shape-based segmentation without pixel supervision, and strong transfer from a single model.

  • Problem

    The paper investigates how ViT self-attention handles severe occlusions, domain shifts, spatial permutations, adversarial perturbations, and natural corruptions while producing robust, generalizable representations.

  • Method

    The authors conduct systematic experiments across three ViT families and fifteen vision datasets, introduce shape-focused architectural design choices, and ensemble off-the-shelf tokens from one ViT.

  • Results

    ViTs show favorable robustness and generalization versus CNNs, including up to ∼60% top-1 accuracy after 80% random occlusion, shape recognition comparable to humans, unsupervised foreground segmentation, and strong feature transfer.

  • Takeaways & Limitations

    Flexible, content-dependent receptive fields from self-attention support ViT robustness, shape-sensitive representations, segmentation without pixel labels, and transferable feature ensembles.

  • Takeaways & Limitations

    The experiments use ImageNet-pretrained ViTs, whose representations may reflect Western, gender, and ethnicity biases and whose data includes privacy risks from unblurred faces.

Abstract

from arXiv · show

Vision transformers (ViT) have demonstrated impressive performance across various machine vision problems. These models are based on multi-head self-attention mechanisms that can flexibly attend to a sequence of image patches to encode contextual cues. An important question is how such flexibility in attending image-wide context conditioned on a given patch can facilitate handling nuisances in natural images e.g., severe occlusions, domain shifts, spatial permutations, adversarial and natural perturbations. We systematically study this question via an extensive set of experiments encompassing three ViT families and comparisons with a high-performing convolutional neural network (CNN). We show and analyze the following intriguing properties of ViT: (a) Transformers are highly robust to severe occlusions, perturbations and domain shifts, e.g., retain as high as 60% top-1 accuracy on ImageNet even after randomly occluding 80% of the image content. (b) The robust performance to occlusions is not due to a bias towards local textures, and ViTs are significantly less biased towards textures compared to CNNs. When properly trained to encode shape-based features, ViTs demonstrate shape recognition capability comparable to that of human visual system, previously unmatched in the literature. (c) Using ViTs to encode shape representation leads to an interesting consequence of accurate semantic segmentation without pixel-level supervision. (d) Off-the-shelf features from a single ViT model can be combined to create a feature ensemble, leading to high accuracy rates across a range of classification datasets in both traditional and few-shot learning paradigms. We show effective features of ViTs are due to flexible and dynamic receptive fields possible via the self-attention mechanism.

1 Introduction

The paper systematically compares ViT families with CNNs to characterize robustness and generalization under visual nuisances. It attributes ViTs’ advantages to content-dependent, long-range interactions and demonstrates robustness, shape-sensitive representations, segmentation without pixel supervision, and transferable feature ensembles.

  • Motivation: The study evaluates three transformer families across fifteen vision datasets, comparing ViTs and CNNs under occlusions, distributional shifts, adversarial and natural perturbations, and cross-domain generalization.The analysis targets learned representations relevant to robustness and generalizability.
  • Mechanism: Self-attention enables content-dependent long-range interactions, allowing ViTs to flexibly adjust receptive fields and enhance representation expressivity under data nuisances.Unlike fixed convolutional filters, self-attention conditions interactions on the query content while modeling global relationships.
  • Findings: ViTs maintain strong robustness to severe occlusions, spatial patch permutations, adversarial perturbations, and common image corruptions compared with state-of-the-art CNNs.The reported nuisances include noise, blur, contrast, and pixelation artefacts.
  • Findings: ViTs are less texture-biased than CNNs and can achieve human-comparable shape recognition when trained to focus on shape cues.The paper uses shape-focused training and a dedicated shape token to model shape and texture features separately.
  • Findings: Shape-focused ViTs can segment foreground objects without pixel-level supervision by concentrating on foregrounds and ignoring backgrounds.The paper presents this as automated semantic segmentation arising from shape-related representations.
  • Findings: Off-the-shelf features from a single ViT architecture can be combined into an ensemble that achieves strong generalization across downstream classification tasks.The proposed transfer approach combines representations from a single pretrained ViT model.

2 Related Work

Related work contrasts CNNs’ sensitivity to distributional shifts and texture reliance with ViTs’ global-context modeling. Prior findings motivate examining ViT robustness, shape bias, segmentation, and transferable features through flexible receptive fields.

  • Robustness and generalization: Prior studies report that CNNs are sensitive to adversarial noise, common corruptions, and domain shifts, motivating comparisons with self-attention-based ViTs.Examples include shifts from RGB images to sketches and high-frequency adversarial changes.
  • Shape and texture bias: CNNs often rely on local texture rather than global shape, whereas large ViTs show less texture bias and relatively greater emphasis on shape information.ViT shape bias approaches human-level performance when models are trained on stylized ImageNet.
  • Receptive fields and features: Transformer receptive fields cover the entire input space, supporting global context and structural information while retaining higher representational capacity than handcrafted features.This work studies flexible receptive fields and content-based context modeling as routes to robust, generalizable features.
  • Transferable features: Prior work on visualizing CNN features and evaluating off-the-shelf representations provides a precedent for studying ViT feature generalization against CNNs.The paper adopts a similar focus on transferable intermediate representations.

3 Intriguing Properties of Vision Transformers

Experiments show that ViTs remain robust under severe occlusion and perturbation, while their self-attention enables dynamic receptive fields and shape-sensitive representations. These properties also support unsupervised segmentation and transferable off-the-shelf features.

  • Robustness to occlusions: 70% top-1 accuracy remains for DeiT-S when 50% of image content is removed, versus 0.1% for similarly sized ResNet50.The comparison uses ImageNet validation models with 22-million-parameter DeiT-S and 23-million-parameter ResNet50.
  • Robustness to occlusions: 37% accuracy remains for DeiT-B when 90% of image information is randomly masked, with the finding consistent across ViT architectures.Occlusion is evaluated through Random, Salient, and Non-Salient PatchDrop settings.
  • Dynamic receptive fields: Later transformer layers attend to non-occluded regions, while class tokens retain more information from original images than ResNet50 features.This behavior is attributed to content-dependent receptive fields that adjust attention to remaining image evidence.
  • Shape and texture: DeiT-S reaches human-level shape-bias performance on stylized ImageNet, and shape-focused training enables semantic segmentation without pixel-level labels.A dedicated shape token also lets the architecture model shape and texture features separately while balancing accuracy and shape-bias.
  • Adversarial and natural perturbations: ViTs are more robust than an augmented ResNet50 to common image corruptions, although models trained without augmentations are more vulnerable.The evaluated corruptions include rain, fog, snow, and noise; higher shape-bias alone does not guarantee corruption robustness.
  • Off-the-shelf transfer: ViT features improve over CNN baselines across classification datasets, and a single-model feature ensemble achieves the best results across all datasets.The transfer experiments use linear classifiers on fine-grained, species, and other out-of-domain datasets.

4 Discussion and Conclusions

The paper concludes that ViTs offer robustness and generalizability advantages across diverse vision challenges, while acknowledging bias and privacy risks in the ImageNet-based experiments.

  • ViTs are evaluated across fifteen vision datasets for robustness, generalizability, transferability, and automatic segmentation without pixel supervision.The experiments compare multiple ViT models and demonstrate robustness to occlusions, distributional shifts, patch permutations, adversarial attacks, and common corruptions.
  • ImageNet-pretrained ViTs may reflect biases in their learned representations because the data is mostly Western and under-represents certain groups.The cited ImageNet version also contains gender and ethnicity stereotypes.
  • The experiments also raise privacy concerns because this ImageNet version contains unblurred human faces.The authors plan to use a newer ImageNet version addressing these issues.

A Random PatchDrop: Effect of Patch Size

Varying the PatchDrop grid shows that ViT robustness depends partly on occluded patch sizes matching the model’s patch size, but the broader occlusion trends persist beyond matching grids.

  • PatchDrop experiments vary the masking grid size and report accuracy on the ImageNet validation set.The main-paper setup uses a 14×14 grid containing 196 patches of 16×16 pixels, while the appendix evaluates different grid sizes.
  • ViTs are significantly more robust when occluded patch dimensions are multiples of the model patch size.The 7×7 grid performs better because it divides the original 14×14 grid into matching factors.
  • The varying-grid experiments reconfirm the occlusion trends observed in Section 3.1.These trends remain visible even for grid sizes such as 8×8 that do not match the original ViT grid pattern.

A.1 Random PatchDrop with Offset

Offsetting PatchDrop masks removes alignment with ViT grid patterns while preserving the overall robustness trends. ViT-L is an exception, showing a relative accuracy drop that may reflect its scale and training differences.

  • Offset masks remove alignment between occlusion patches and ViT grid patterns to reduce evaluation bias toward ViT models.The experiments replicate the earlier PatchDrop setting with a small spatial offset.
  • Similar robustness trends remain between ViT models and ResNet50 under offset PatchDrop.
  • ViT-L shows a significant relative accuracy drop under offset masking compared with the no-offset setting.
  • ViT-L’s anomalous behavior may reflect its over 300 million parameters and different training regime, including less extensive augmentation than DeiT-family models.A similar relative drop appears in the 16×16 grid-size experiment.

B Random PixelDrop

PixelDrop tests occlusion independently of ViT’s intrinsic patch grid by masking individual pixels and varying grid sizes. ViTs and CNNs show similar qualitative trends, while performance generally declines as occlusion becomes more fine-grained.

  • PixelDrop masks individual pixels at varying occlusion levels, decoupling occlusion evaluation from ViT input-grid operations.PixelDrop is equivalent to PatchDrop with a 1×1 grid.
  • ViTs and ResNet50 exhibit similar performance trends under random PixelDrop on ImageNet validation data.
  • At fixed 50% occlusion, overall model performance decreases as PatchDrop grid size approaches PixelDrop.
  • ViT-L performs substantially better than the other models but shows an anomalous drop at the 16×16 grid size.The drop resembles the offset-mask behavior reported elsewhere.

C Robustness to Feature Drop

Feature-drop experiments test robustness by removing intermediate representations inside models rather than masking input images. ViT-L remains robust to substantial feature loss, while ResNet50 is more sensitive in earlier layers.

  • Feature-drop experiments randomly set selected percentages of intermediate ViT input features to zero across transformer blocks.
  • ViT-L retains significant robustness even with up to 25% feature drop, suggesting information redundancy within the model.
  • ResNet50 shows significant performance losses when feature drop affects earlier residual layers.Its feature-drop values are not directly comparable to ViT values because the architectures differ substantially.
  • Feature drop in ResNet50’s last layer causes almost negligible performance loss, potentially because of average pooling.

D Robustness to Occlusions: More Analysis

Additional occlusion experiments show that robustness extends beyond class-token ViTs. Swin Transformers, which aggregate tokens without an explicit class token, are more robust to object occlusion than ResNet50.

  • Swin Transformer variants are evaluated against object occlusion because they average all tokens instead of using an explicit class token.
  • Swin models exhibit superior robustness to object occlusion compared with ResNet50 across three PatchDrop settings.
  • These results indicate that robustness to information loss is not limited to ViT architectures using an explicit class token.

D.2 RegNetY [50]

RegNetY is more robust than ResNet50 under the studied occlusions but behaves similarly to other CNNs overall, while DeiT-T performs significantly better than RegNetY variants.

  • RegNetY shows relatively higher robustness than ResNet50 under the proposed occlusions but behaves similarly to other CNN models overall.
  • DeiT-T performs significantly better than all considered RegNetY variants under object occlusion.
  • Shape-biased ViTs show favorable PatchDrop robustness compared with a shape-biased CNN, with ResNet50 and DeiT-S offering a closer parameter-count comparison.The cited passage notes similar trainable parameter counts: 25 million for ResNet50 and 22 million for DeiT-S.

F Dynamic Receptive field

ViTs can exploit discriminative image information across spatial positions, and their attention changes across layers to focus on non-occluded regions, reflecting dynamic receptive fields.

  • 62.9% top-1 average accuracy for DeiT-S versus 5.4% for ResNet50 shows position-robust recognition when images move within a background.DeiT-S accuracy is reported as 62.9±0.05, while ResNet50 achieves 5.4% average accuracy.
  • The position comparison reports ResNet50 values of 5.59, 5.71, 4.86, and 5.30, versus 51.21–69.37 for the three DeiT variants.The rows list DeiT-T, DeiT-S, and DeiT-B values for the same four positions.
  • ViTs exploit discriminative information regardless of image position, as evaluated across upper-right, upper-left, bottom-right, and bottom-left placements.The comparison reports Top-1 (%) accuracy on the ImageNet validation set.
  • Later attention layers attend to non-occluded image regions as the image moves, providing evidence of a highly dynamic receptive field.The visualization averages attention maps across the ImageNet validation set for each head across all 12 layers of DeiT-T.

G Additional Qualitative Results

Additional visualizations examine PatchDrop, attention-based segmentation, adversarial patches, and salient-region variation across ViT models and training conditions.

  • 81.7%, 75.5%, 68.1%, and 71.3% are DeiT-B accuracies for original, random, non-salient, and salient PatchDrop conditions, respectively.These values are reported across the ImageNet validation set for the illustrated occlusion levels.
  • Class-token attention produces automatic image segmentations for DeiT-S models trained originally, with SIN, and with SIN distillation.
  • The qualitative results include varying levels of Salient PatchDrop across different images.
  • The visualizations include original images and adversarial patches at 5%, 15%, and 25% levels.
  • Adversarial patch visualizations compare DeiT-S trained on ImageNet with DeiT-S-SIN, while also contrasting their performance and shape bias.The passage states that DeiT-S performs significantly better, whereas DeiT-SIN has higher shape bias.
  • Adversarial patches optimized for DeiT-T, DeiT-B, and T2T-24 illustrate that these ViTs are more robust to such patterns than CNNs such as ResNet50.
Loading 2105.10497v3…