Research map / Adversarial robustness and security / Certified and empirical robustness
Towards Practical Certifiable Patch Defense With Vision Transformer
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| introduce ECViT with progressive smoothed image modeling and isolated band unit self-attention | ViT-B in derandomized smoothing · ILSVRC2012 validation, 2% pixels | certified accuracy: 26.00 -> 41.70 | Helped |
| introduce ECViT-B | ViT-B · ILSVRC2012 validation | clean accuracy: 54.60 -> 78.58 | Helped |
| use ECViT-B instead of BagCert | CIFAR10 validation · CIFAR10 validation, 2×2 patch | certified accuracy: 73.33 -> 82.80 | Helped |
| add progressive training stages, from one stage to three (ablation) | ECViT-B with VAE tokenizer, b=37 · ILSVRC2012 validation, 2% pixels | certified accuracy: 38.78 -> 41.70 | Helped |
| add the third progressive training stage after two stages (ablation) | ECViT-B with VAE tokenizer, b=37 · ILSVRC2012 validation, 2% pixels | certified accuracy: 40.73 -> 41.70 | Helped |
| add the third progressive training stage after two stages (ablation) | ECViT-B, b=4 · CIFAR10 validation, 2×2 patch | certified accuracy: 82.40 -> 82.80 | Helped |
| add the third progressive training stage after two stages (ablation) | ECViT-B, b=4 · CIFAR10 validation | clean accuracy: 93.14 -> 93.48 | Helped |
| use a VAE tokenizer instead of a distilled tokenizer (ablation) | ECViT-B, b=37, three stages · ILSVRC2012 validation, 2% pixels | certified accuracy: 40.84 -> 41.70 | Helped |
| use a VAE tokenizer instead of a distilled tokenizer (ablation) | ECViT-B, b=25, three stages · ILSVRC2012 validation, 2% pixels | certified accuracy: 40.93 -> 40.79 | Hurt |
| increase band size from b=19 to b=37 (ablation) | ECViT-B, three stages, VAE tokenizer · ILSVRC2012 validation, 2% pixels | certified accuracy: 40.72 -> 41.70 | Mixed |
| increase adversarial patch size (ablation) | ECViT-B · ILSVRC2012 | certified accuracy: 47.39 -> 41.70 -> 37.26 | Hurt |
Closest papers by meaning
- Understanding and Defending Patched-based Adversarial Attacks for Vision Transformer (ICML 2023 · similarity 0.92)
- Certified Defenses for Adversarial Patches (ICLR 2020 · similarity 0.90)
- Certified Patch Robustness via Smoothed Vision Transformers (CVPR 2022 · similarity 0.90)
- A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.88)
- PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies (CVPR 2025 · similarity 0.87)
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.