Research map / Adversarial robustness and security / Black-box and transfer attacks
Towards Transferable Adversarial Attacks on Vision Transformers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Skip attention gradients during backpropagation (PNA) (ablation) | BIM on ViT-B/16 · ImageNet validation, black-box models | ASR: 29.92% to 42.47% | Helped |
| Optimize random subsets of patches and accumulate the perturbations (ablation) | BIM on ViT-B/16 · ImageNet validation, black-box models | ASR | Helped |
| Add PatchOut (ablation) | Dual attack · ViTs | Average ASR (%): 26.97 -> 34.92 | Helped |
| Add L2 regularization (ablation) | Dual attack · ViTs | Average ASR (%): 26.97 -> 37.79 | Helped |
| Add PNA (ablation) | Dual attack · ViTs | Average ASR (%): 26.97 -> 42.47 | Helped |
| Add PatchOut, L2 regularization, and PNA together (ablation) | Dual attack · ViTs | Average ASR (%): 26.97 -> 59.15 | Helped |
| Add PatchOut (ablation) | Dual attack · Normally trained CNNs | Average ASR (%): 10.63 -> 12.55 | Helped |
| Add L2 regularization (ablation) | Dual attack · Normally trained CNNs | Average ASR (%): 10.63 -> 16.55 | Helped |
| Add PNA (ablation) | Dual attack · Normally trained CNNs | Average ASR (%): 10.63 -> 18.75 | Helped |
| Set patch count to 130 rather than all patches or a smaller subset (ablation) | PatchOut · ViTs | Average ASR (%) | Helped |
| Set the L2 balance parameter to 0.1 (ablation) | PatchOut · ViTs | Average ASR (%) | Helped |
| Combine the dual attack with MI | MI attack · Robust CNNs | Average ASR (%): 21.53 -> 30.13 | Helped |
Closest papers by meaning
- Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · similarity 0.94)
- Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferability (NeurIPS 2025 · similarity 0.93)
- Improving the Adversarial Transferability of Vision Transformers with Virtual Dense Connection (AAAI 2024 · similarity 0.91)
- Attacking Transformers with Feature Diversity Adversarial Perturbation (AAAI 2024 · similarity 0.91)
- Towards Understanding and Improving Adversarial Robustness of Vision Transformers (CVPR 2024 · similarity 0.90)
- Learning to Transform Dynamically for Better Adversarial Transferability (CVPR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.