Research map / Adversarial robustness and security / Backdoor and poisoning
TrojViT: Trojan Insertion in Vision Transformers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| patch-wise trigger instead of area-wise trigger (ablation) | TrojViT on Deit-small · ImageNet | ASR (%): +2.15 (94.69 to 96.84) | Helped |
| adding attention-target loss to trigger generation (ablation) | patch-wise trigger TrojViT · ImageNet, Deit-small | CDA (%): 77.49 to 79.23 | Helped |
| tuned parameter distillation (e=0.0005) (ablation) | TrojViT Trojan insertion · ImageNet, Deit-small | TBN: 1650 to 880 bits (about 46.67% reduction) | Helped |
| larger tuned parameter threshold e=0.003 (ablation) | tuned parameter distillation · ImageNet, Deit-small | ASR (%): 99.98 to 99.64 | Hurt |
| tuned parameter distillation threshold e from 0 to 0.003 (ablation) | TrojViT · ImageNet, Deit-small | TBN: 1650 to 345 | Helped |
| single-patch trigger vs more patches (ablation) | TrojViT trigger area · ImageNet, Deit-small | CDA (%): 78.61 (1 patch) to 79.23 (9 patches) | Mixed |
| defense: decomposing last classification head critical matrix | TrojViT · ImageNet | ASR (%): ASR drops ~21-30 points (e.g., 99.96 to 75.31 on Deit-s) | Hurt |
| attention loss weight lambda=0 vs lambda=1 (ablation) | Attention-Target Loss · ImageNet, Deit-small | ASR (%): 96.84 to 99.98 | Helped |
| number of ViT layers summed in attention loss (1 to 12) (ablation) | Attention-Target Loss · ImageNet, Deit-small | ASR (%): 67.97 (1 layer) to 99.96 (12 layers) | Helped |
Closest papers by meaning
- Attention-Imperceptible Backdoor Attacks on Vision Transformers (AAAI 2025 · similarity 0.88)
- Deep-TROJ: An Inference Stage Trojan Insertion Algorithm through Efficient Weight Replacement Attack (CVPR 2024 · similarity 0.87)
- Your Scale Factors are My Weapon: Targeted Bit-Flip Attacks on Vision Transformers via Scale Factor Manipulation (CVPR 2025 · similarity 0.87)
- Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · similarity 0.86)
- Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transfomers (CVPR 2024 · similarity 0.85)
- Attacking Transformers with Feature Diversity Adversarial Perturbation (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.