PaperlayerView exact revision on arXiv

Source-linked AI summary

On Improving Adversarial Transferability of Vision Transformers

Muzammal Naseer, Kanchana Ranasinghe, Salman Khan, Fahad Shahbaz Khan, Fatih Porikli

arXiv:2106.04169v3cs.CVcs.AIcs.LG

TL;DR

Earlier studies reported low black-box transferability for ViT attacks, raising the question of whether the issue lies in ViT features or attack procedures. The paper combines a within-model self-ensemble with token refinement; it reports improved transfer across model families and vision tasks.

  • Problem

    Prior work reported low black-box transferability for ViTs, leaving open whether it reflected weak features or suboptimal attacks.

    Source: §1 · p. 2

  • Method

    The approach uses class tokens from multiple ViT blocks as a self-ensemble and refines intermediate tokens with patch-token structure.

    Source: §1 · p. 2

  • Results

    The paper reports favorable transfer rates across convolutional and transformer models and across classification, detection, and segmentation.

    Source: §1 · p. 3

  • Takeaways & Limitations

    The authors conclude that architectural characteristics of ViTs can be used with existing attacks to improve adversarial transferability.

    Source: §5 · p. 9

    The evaluations use an ImageNet version containing biases that portray unreasonable social stereotypes.

    Source: §5 · p. 10

Abstract

from arXiv · show

Vision transformers (ViTs) process input images as sequences of patches via self-attention; a radically different architecture than convolutional neural networks (CNNs). This makes it interesting to study the adversarial feature space of ViT models and their transferability. In particular, we observe that adversarial patterns found via conventional adversarial attacks show very \emph{low} black-box transferability even for large ViT models. We show that this phenomenon is only due to the sub-optimal attack procedures that do not leverage the true representation potential of ViTs. A deep ViT is composed of multiple blocks, with a consistent architecture comprising of self-attention and feed-forward layers, where each block is capable of independently producing a class token. Formulating an attack using only the last class token (conventional approach) does not directly leverage the discriminative information stored in the earlier tokens, leading to poor adversarial transferability of ViTs. Using the compositional nature of ViT models, we enhance transferability of existing attacks by introducing two novel strategies specific to the architecture of ViT models. (i) Self-Ensemble: We propose a method to find multiple discriminative pathways by dissecting a single ViT model into an ensemble of networks. This allows explicitly utilizing class-specific information at each ViT block. (ii) Token Refinement: We then propose to refine the tokens to further enhance the discriminative capacity at each block of ViT. Our token refinement systematically combines the class tokens with structural information preserved within the patch tokens.

1 INTRODUCTION

ViTs process images as patch sequences through self-attention, and prior work reported low black-box transferability for larger models. The paper proposes using class information from multiple blocks and refining intermediate tokens, with favorable transfer across model families and vision tasks.

1 INTRODUCTION

  • Prior work reported lower black-box transferability for large ViTs, prompting investigation of whether weak transfer reflects weak features or suboptimal attacks.Source: §1 · p. 2
  • Self-ensemble extracts class tokens from each ViT block and applies the pretrained final classifier to obtain block-specific logits.This uses discriminative information from multiple pathways within one transformer.Source: §1 · p. 2
  • Token refinement fuses patch-token structure with intermediate class tokens and aligns them with the final classifier to strengthen their discriminative capacity.Source: §1 · p. 2
  • For ViT designs without an explicit class token, the method can use the average of patch tokens as a class token.Source: §1 · p. 2
  • The paper reports favorable adversarial transfer rates across convolutional and transformer models and across classification, detection, and segmentation.Source: §1 · p. 3

2 BACKGROUND AND RELATED WORK

The section reviews black-box transfer attacks and prior work on network architectures and ViT robustness. It positions the paper's approach as using a single ViT's internal blocks, rather than an ensemble of CNN and ViT models, to improve attack transferability.

2 BACKGROUND AND RELATED WORK

  • Black-box transfer attacks craft adversarial signals on a source model for target models, while target-gradient estimation methods require multiple queries.Source: §2 · p. 3
  • The paper characterizes its work as the first to address limited transferability of ViT models.Source: §2 · p. 3
  • Prior work exploits architectural features such as skip connections or model linearity to improve attack transferability.Source: §2 · p. 3
  • Figure 2 describes MIM transferability as decreasing from DeiT-T (5M parameters) to DeiT-B (86M parameters), while MIME and MIMRE improve attack performance.Source: Figure 2 · p. 4
  • Unlike prior CNN–ViT ensembles, the proposed self-ensemble turns one ViT into multiple classifiers and can be integrated with existing attack approaches.Source: §2 · p. 4

3 ENHANCING ADVERSARIAL TRANSFERABILITY OF VITS

This section builds attacks from multiple ViT block classifiers rather than only the final class token, then refines tokens to strengthen intermediate pathways and improve transferability.

3.1 SELF-ENSEMBLE: DISCRIMINATIVE PATHWAYS OF VISION TRANSFORMER

  • The self-ensemble shares a classification head across block outputs, forming n classifiers from one ViT and exposing intermediate class-token pathways to attack optimization.The attack uses a joint loss over the outputs of each block.Source: §3.1 · pp. 4–5, §3.3 · p. 6
  • Multiple intermediate classifiers, especially later blocks, achieve meaningful ImageNet top-1 accuracy, indicating discriminative information before the final block.Figure 3 measures each block classifier on the ImageNet validation set.Source: §3.1 · p. 5, Figure 3 · p. 5

3.2 TOKEN REFINEMENT

  • Token refinement restores patch-token spatial layout for convolution and pooling, linearly refines the class token, then sums both features for the shared head.The pretrained model weights are frozen while the refinement modules are trained for one epoch on ImageNet training data.Source: §3.2 · p. 6
  • Fine-tuning the refinement modules boosts discriminative power, especially in earlier blocks, by aligning intermediate tokens with the final classifier.The paper reports increased classification performance for refined tokens in Figure 5.Source: §3.2 · p. 6, Figure 5 · p. 6

3.3 ADVERSARIAL TRANSFER

  • The self-ensemble attack seeks misclassification across block classifiers under a perturbation budget; targeted attacks optimize toward a specified class.The untargeted objective applies across the ViT blocks, subject to the norm constraint.Source: §3.3 · pp. 6–7
  • On 5k ImageNet validation adversarial samples at ε≤16, self-ensemble perturbations with refined tokens have significantly higher fool rates.The passage reports the comparison without giving individual table values.Source: Table 1 · p. 7

4 EXPERIMENTS

The experiments evaluate attacks generated from DeiT source models across black-box classification, detection, and segmentation, using established attacks and transferability metrics. The proposed self-ensemble with refined tokens improves classification transfer and cross-task results, while also making intermediate blocks more effective attack targets.

4 EXPERIMENTS

  • The evaluation uses DeiT-T, DeiT-S, and DeiT-B sources, black-box targets across vision tasks, and ImageNet, COCO, and PASCAL-VOC12 samples.Attacks are ℓ∞ with ϵ ≤16; classification uses fooling rate, detection uses mAP decrease, and segmentation uses the Jaccard Index.Source: §4 · pp. 7–8
  • The method consistently improves transfer for FGSM, PGD, MIM, and DIM; iterative attacks use 10 iterations and DIM uses transformation probability 0.7.Table 2 covers fooling rates on 5k ImageNet validation adversarial samples at ϵ ≤16.Source: §4 · p. 8, Table 2 · p. 8

4.1 CLASSIFICATION; 4.2 CROSS-TASK TRANSFERABILITY

  • The self-ensemble with refined tokens improves black-box transfer across classification models and increases transfer to detection and segmentation targets.The detection and segmentation evaluations use classification-generated adversaries; the reported cross-task outcomes are summarized in Tables 3 and 4.Source: §4.1 · p. 8, Table 3 · p. 9, Table 4

4.1 CLASSIFICATION

  • Conventional attacks show only moderate transfer from ViTs to CNNs, whereas the proposed approach improves transfer to convolutional and transformer models.Transfer is higher among models with architectural similarities, while smaller models in shared model families are reported as more vulnerable.Source: §4.1 · p. 8
  • Under MIM, the proposed approach makes intermediate blocks as attack-effective as the last class token, unlike MIM alone, which fails to fool initial blocks.The blockwise comparison is shown in Figure 6 and is presented as a mechanism for exploiting ViT adversarial space.Source: §4.1 · p. 9, Figure 6 · p. 9

4.2 CROSS-TASK TRANSFERABILITY

  • For cross-task transfer, attacks originate from classification predictions; images are processed in parts for large-input settings such as DETR, with clear DETR gains and capacity-related increases for DINO.The DINO comparison is against the baseline and is reported for the more robust model.Source: §4.2 · p. 9

5 CONCLUSION

The conclusion presents self-ensemble and token refinement as a way to address limitations in existing ViT transfer attacks, with performance boosts across attack methods. The appendices extend evaluation across datasets, attack settings, model designs, and tasks, while the ethics statement notes potential misuse and ImageNet-related concerns.

5 CONCLUSION

  • Self-ensemble with token refinement improves transferability when applied to a range of state-of-the-art attack methods.The authors characterize the approach as addressing a shortcoming in current ViT adversarial-transfer methods.Source: §5 · p. 9
  • The reproducibility statement describes open-source attack implementations, token fine-tuning, cross-task procedures, and release plans for models and sample indices.Attack parameters and reproduction steps are referenced in the main text and appendices.Source: §5 · p. 10
  • The authors state that attacks may assist malicious disruption of deployed ViT systems in the short term, while supporting robustness research in the long term.They also note ImageNet biases, Western-world data limitations, stereotypes, and privacy risks from unblurred faces.Source: §5 · p. 10

Appendix

  • Appendix experiments report extensions across CIFAR10 and Flowers, the full 50k ImageNet validation set, diverse ViT designs, and CNNs.The paper also discusses different input sizes, computational cost, and refined-token latent-space visualization.Source: Appendix · p. 14

A SELF-ENSEMBLE WITHIN ENSEMBLE

The authors extend self-ensembling across an ensemble of DeiT models and report improved adversarial transfer. Their self-ensemble adds only minimal attack-complexity increase compared with using multiple models.

A SELF-ENSEMBLE WITHIN ENSEMBLE

  • Self-ensemble with refined tokens further improves transfer for adversarial perturbations generated from an ensemble of DeiT-T, DeiT-S, and DeiT-B models.The models each have 12 blocks; the self-ensemble extends the three-classifier ensemble to 36 classifiers.Source: A SELF-ENSEMBLE WITHIN ENSEMBLE · p. 14, Table 5 · p. 14
  • Unlike multiple-model ensemble approaches, self-ensemble improves transfer with minimal added attack complexity from a single ViT.The authors report clear additional transfer improvements when combining the multi-model and self-ensemble approaches.Source: A SELF-ENSEMBLE WITHIN ENSEMBLE · p. 14

B SELF-ENSEMBLE FOR MORE ATTACKS: PATCHWISE AND AUTO-ATTACK

The authors test whether self-ensemble with refined tokens extends to additional attack methods and stronger attack settings. They report increased transfer for Patchwise and Auto-Attack, and consistent black-box gains at larger iteration counts and perturbation budgets.

B SELF-ENSEMBLE FOR MORE ATTACKS: PATCHWISE AND AUTO-ATTACK

C SELF-ENSEMBLE FOR DIFFERENT ϵ: 4, 8, 16

  • At ϵ values 4, 8, and 16, the approach consistently improves black-box transfer for 100-iteration PGD and Auto-Attack.Auto-Attack includes multiple random restarts and thousands of queries; results are presented in Table 7.Source: C SELF-ENSEMBLE FOR DIFFERENT ϵ: 4, 8,… · p. 15

D SELF-ENSEMBLE FOR MORE DATASETS: CIFAR10 AND FLOWERS

The approach improves adversarial transferability on CIFAR10 and Flowers, increases black-box attack strength against Swin Transformer, and remains effective on the full ImageNet validation set.

D SELF-ENSEMBLE FOR MORE DATASETS: CIFAR10 AND FLOWERS

E VULNERABILITY OF SWIN TRANSFORMER

  • The passage reports that our approach increases the black-box vulnerability of a ViT architecture without an explicit class token, identifying Swin Transformer as the example.Source: E VULNERABILITY OF SWIN TRANSFORMER · p. 16

F FULL IMAGENET VALIDATION SET

  • On the full 50k ImageNet validation set, the approach significantly increases adversarial transferability and remains effective as dataset size grows.The experiments use MIM and DIM; the 5k ImageNet subset is balanced, with five samples per class.Source: F FULL IMAGENET VALIDATION SET · p. 16

G CROSS-TASK TRANSFERABILITY WITH LARGER IMAGES (>224)

For cross-task attacks, the source model supplies labels from its predictions; for larger images, the attack is run on smaller portions and the resulting adversarial signals are combined.

G CROSS-TASK TRANSFERABILITY WITH LARGER IMAGES (>224)

  • For cross-task attacks without a single image-level label, the source model’s original prediction becomes the target for the white-box attack, whose signal is applied to the target task.The algorithm uses the source model’s prediction on the clean input as the label.Source: G CROSS-TASK TRANSFERABILITY WITH… · p. 18
  • For images larger than the ViT input size, the method attacks smaller portions separately and combines their signals into an image-sized adversary.For a 896 x 896 image, the example splits it into 16 portions of size 224x224.Source: G CROSS-TASK TRANSFERABILITY WITH… · pp. 17–19

H COMPUTATION COST AND INFERENCE SPEED ANALYSIS

Token refinement adds learnable parameters and compute, while self-ensemble without refinement has only marginal added computational cost. Refinement improves intermediate-token recognition and yields more clustered, separated representations.

H COMPUTATION COST AND INFERENCE SPEED ANALYSIS

  • Fine-tuning with additional parameters raises average self-ensemble top-1 accuracy by 12.43 for DeiT-T, 15.21 for DeiT-S, and 16.70 for DeiT-B.Similar trends are reported for CvT and MLP-Mixer.Source: H COMPUTATION COST AND INFERENCE SPEED… · p. 20, Figure 10 · p. 22
  • Self-ensemble without refinement adds only marginal computational cost, while refinement is slightly more expensive, especially for very large models such as DeiT-B.The added refinement cost depends on the pretrained ViT’s complexity and token dimensions; DeiT-B has 86 million parameters and produces R784 tokens.Source: H COMPUTATION COST AND INFERENCE SPEED… · p. 20, Table 14

H.1 LATENT SPACE OF REFINED TOKENS

  • Refined tokens have lower within-class variation and better between-class separation, which the authors link to reduced misalignment with the final classifier.The visualization uses class tokens from intermediate blocks 5–8 of DeiT-T, DeiT-S, and DeiT-B, with 10 ImageNet classes.Source: §H.1 · p. 20, Figure 9 · p. 21
  • For CvT and MLP-Mixer, fine-tuning aligns intermediate-block tokens with the final classifier; MLP-Mixer’s early blocks are more discriminative than CvT’s despite lower final accuracy.The authors report that this early-block discriminability allows a self-ensemble that boosts adversarial transferability.Source: Figure 10 · p. 22

I SELF-ENSEMBLE FOR HYBRID VIT AND MLP-MIXER

The approach extends to hybrid CvT models and MLP-Mixer, with refined tokens improving ImageNet recognition accuracy and self-ensemble attacks boosting transferability.

I SELF-ENSEMBLE FOR HYBRID VIT AND MLP-MIXER

  • Across CvT-Tiny, CvT-Small, and MLP-Mixer-Base, refined tokens improve ImageNet top-1 accuracy, and self-ensemble attacks with refinement boost transferability.The ensembles contain 10, 16, and 12 models, respectively; MLP-Mixer uses averaged patch tokens in place of a class token.Source: I SELF-ENSEMBLE FOR HYBRID VIT AND… · p. 22, Table 15 · p. 23

J CAN SELF-ENSEMBLE IMPROVE TRANSFERABILITY FROM CNN?

Feature refinement improves adversarial transfer from ResNet50, but its self-ensemble gains are considerably smaller than ViT gains; CNN feature dimensions constrain the basic shared-classifier approach.

J CAN SELF-ENSEMBLE IMPROVE TRANSFERABILITY FROM CNN?

  • ResNet50’s varying channel dimensions prevent basic AttackE from sharing the final classifier across its intermediate blocks.Its four intermediate feature maps range from 256×56×56 to 2048×7×7, while the final classifier processes pooled features from the last block.Source: J CAN SELF-ENSEMBLE IMPROVE… · p. 23
  • Feature refinement improves ResNet50 transfer, but self-ensemble with token refinement improves ViT transfer considerably more.The comparison uses ResNet50 and DeiT-S models with similar computational complexity; the figure reports relative improvement after refinement.Source: J CAN SELF-ENSEMBLE IMPROVE… · p. 24, Figure 11 · p. 24
  • The refined-embedding variant finetunes ResNet50 features and uses an intermediate layer to project intermediate vectors to the final feature dimension.The paper concludes that the approach is well suited to improving ViT adversarial transferability.Source: J CAN SELF-ENSEMBLE IMPROVE… · pp. 23–24

Related papers

Loading 2106.04169v3…