Source-linked AI summary
Towards Transferable Adversarial Attacks on Vision Transformers
Zhipeng Wei, Jingjing Chen, Micah Goldblum, Zuxuan Wu, Tom Goldstein, Yu-Gang Jiang
TL;DR
Adversarial transferability for ViTs is less established than for CNNs, and standard attacks do not account for transformer patches and self-attention. The paper introduces PNA and PatchOut to tailor attacks to these components. The dual attack improves transfer across ViTs and from ViTs to normally and robustly trained CNNs, with reported average ASR gains over MI and SGM.
Problem
Transferability of adversarial examples crafted on ViTs is relatively underexplored, while standard CNN-oriented attacks may overlook patches and self-attention.
Method
The dual attack combines PNA, which bypasses attention gradients, with PatchOut, which randomly updates patch subsets during attack crafting.
Results
The dual attack improves average ASR over MI and SGM by 15.86% for ViTs, 27.68% for normally trained CNNs, and 23.52% for robustly trained CNNs.
Takeaways & Limitations
White-box ViTs can generate transferable adversarial examples for black-box ViTs, normally trained CNNs, and robustly trained CNNs.
Abstract
from arXiv · showhide
Vision transformers (ViTs) have demonstrated impressive performance on a series of computer vision tasks, yet they still suffer from adversarial examples. % crafted in a similar fashion as CNNs. In this paper, we posit that adversarial attacks on transformers should be specially tailored for their architecture, jointly considering both patches and self-attention, in order to achieve high transferability. More specifically, we introduce a dual attack framework, which contains a Pay No Attention (PNA) attack and a PatchOut attack, to improve the transferability of adversarial samples across different ViTs. We show that skipping the gradients of attention during backpropagation can generate adversarial examples with high transferability. In addition, adversarial perturbations generated by optimizing randomly sampled subsets of patches at each iteration achieve higher attack success rates than attacks using all patches. We evaluate the transferability of attacks on state-of-the-art ViTs, CNNs and robustly trained CNNs. The results of these experiments demonstrate that the proposed dual attack can greatly boost transferability between ViTs and from ViTs to CNNs. In addition, the proposed method can easily be combined with existing transfer methods to boost performance. Code is available at https://github.com/zhipeng-wei/PNA-PatchOut.
Introduction
The paper develops a ViT-specific dual attack that bypasses attention gradients and updates random patch subsets to improve adversarial transferability. Experiments show stronger transfer across ViTs and from ViTs to CNNs, including robustly trained CNNs.
- Motivation: ViT transferability is less understood than CNN transferability because patches and multi-headed self-attention create distinct architectural considerations.The authors argue that standard attacks can produce suboptimal results and misrepresent transformer vulnerability.
- Proposed approach: The dual attack combines Pay No Attention, which treats forward-pass attention weights as constants, with PatchOut, which randomly updates a subset of patches each iteration.PNA bypasses the computation-graph branch producing attention weights, while PatchOut uses different patches as input during attack crafting.
- Toy experiments: 42.47% ASR versus 29.92% results when all attention gradients are bypassed rather than propagated during BIM on ViT-B/16.This toy experiment uses ImageNet validation images and shows ASR decreasing as more attention gradients are used.
- Toy experiments: Stacking multiple ten-patch perturbations achieves higher ASR than optimizing the whole image at once.The experiment averages attack success across DeiT-B, LeViT-256, CaiT-S-24, PiT-B, ConViT-B, TNT-S and Visformer-S.
- Results: 15.86%, 27.68%, and 23.52% average ASR improvements are reported over MI and SGM for ViTs, normally trained CNNs, and robustly trained CNNs, respectively.The experiments evaluate transfer from white-box ViTs to black-box ViTs, CNNs, and robustly trained CNNs.
Related Work
The related work frames transfer attacks as a way to attack black-box models using surrogate models, then reviews foundational attacks and methods designed to improve transferability. Prior ViT-specific work includes ensemble-based optimization using class tokens.
- Threat models: Black-box attacks expose only victim outputs, so transfer-based attacks craft examples on white-box surrogates for use against unknown models.The black-box setting is described as substantially more challenging than the white-box setting.
- Foundational attacks: FGSM performs one gradient-sign update, whereas BIM applies repeated small-step updates and often produces stronger white-box adversarial examples.Both methods are commonly used as foundations for transfer-based attacks.
- Transfer methods: Momentum and Nesterov-based gradient calculations stabilize update directions or add loss terms to improve perturbation optimization and reduce overfitting.MI integrates momentum to stabilize updates and escape poor local maxima.
- Vision Transformers: Vision Transformers process raw image patches and use transformer-specific training and architecture developments such as DeiT's teacher-student strategy and T2T-ViT.These works address ViT accuracy, efficiency, or reduced dependence on massive pre-training datasets.
- ViT transfer attacks: Self-Ensemble improves adversarial transferability by optimizing perturbations over an ensemble built from class tokens at each layer.Its effectiveness depends on the availability and number of class tokens, which varies across ViT architectures.
Methodology
The dual attack adapts transfer-based adversarial-example generation to ViT structure by bypassing attention gradients and optimizing randomly selected patch subsets. PNA focuses gradients on patch features, while PatchOut varies the attacked patches across iterations under a constrained iterative procedure.
- Pay No Attention (PNA): PNA uses patch embeddings, attention weights, and value projections to define the attention output before decomposing its gradient with respect to the input.The attention formulation uses query, key, and value weights; its output is then differentiated with respect to Z.
- Pay No Attention (PNA): PNA treats attention weights as constants by stopping gradients through attention, reducing reliance on model-specific patch interactions.The method sets ∂A/∂Z = 0 and approximates the gradient using the non-attention branch.
- Optimization procedure: The dual attack iteratively samples patches, computes PNA gradients, updates the perturbation with step size α, and clips entries to the budget interval [−ϵ, ϵ].Algorithm 1 initializes δ_0 = 0, uses α = ϵ/I, and returns x_adv = x + δ_I.
- PatchOut: PatchOut randomly selects T patches at each iteration and applies an attack mask so perturbation updates use varying image subsets.The selected patches form x_s, and the mask M identifies the retained patch locations.
- PatchOut: PatchOut adds a regularization term whose coefficient λ balances the loss objective against encouraging perturbations with a large L2 norm.The formulation uses element-wise masking through ⊙ and favors a larger distance from x.
Experiments
The experiments evaluate transferability from white-box ViTs to ViTs, normally trained CNNs, and robustly trained CNNs using multiple models and attack baselines. Results show that the dual attack improves transferability, including when combined with existing methods, while component and parameter studies examine why it works.
- Experimental setup: Experiments use ImageNet validation images correctly classified by all evaluated models and assess transferability across multiple ViT and CNN architectures.The CNN evaluation includes normally trained and robustly trained models.
- Performance on ViTs: 58.67% average MASR is achieved against black-box ViTs, outperforming baseline attacks across ViT structures.MASR averages ASR across different white-box surrogate models for each black-box victim.
- Performance on CNNs: 42.61% average MASR on normally trained CNNs and 22.38% on robustly trained CNNs demonstrate transfer from white-box ViTs across CNN architectures.The paper notes that transfer success decreases across the structural gap between ViTs and CNNs, while the dual attack remains effective.
- Combining with existing methods: Combining the dual attack with MI and SGM significantly improves transferability across ViTs, normally trained CNNs, and robustly trained CNNs.For robustly trained CNNs, average MASR increases by 28.54% for MI and 102.49% for SGM.
- Ablation studies: PNA provides the largest component-level transferability improvement, while combining PatchOut, L2, and PNA achieves the best overall performance.The results suggest that the three components contribute in complementary ways on both ViTs and CNNs.
- Ablation studies: PatchOut performance depends on the number of sampled patches T, with T = N reducing PatchOut to BIM; Figure 4 also varies λ.The ablation uses ViT-B/16 as the white-box model and attacks other black-box models.
Conclusion
The paper identifies ViT properties that enable more transferable adversarial examples and validates the dual attack across broad architectural gaps. Its experiments show transferability between transformers and CNNs despite their architectural differences.
- Ignoring attention gradients and perturbing only patch subsets prevents overfitting and creates diverse input patterns that increase transferability.
- The proposed dual attack combines Pay No Attention and PatchOut to craft highly transferable adversarial examples.
- Experiments with 8 ViTs, 4 normally trained CNNs, and 3 robustly trained CNNs show improved adversarial transferability.
- Combining the attack with existing methods consistently enhances adversarial transferability.
- The observed transferability spans wide architectural gaps between transformers and CNNs, suggesting their feature extractors and implicit biases are not entirely different.