Research map / Adversarial robustness and security / Attacks on text and graphs
Understanding and Defending Patched-based Adversarial Attacks for Vision Transformer
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add ARMRO layer-wise detect-and-mask defense | ViT-B/16, ViT-B/32, ViT-L/32, DeiT-B/16 · 1-patch Token-Attack, Patch-Fool, GMYA on ImageNet 384x384 | robustness accuracy: e.g. ViT-B/16 Patch-Fool 1-patch 33.5% to 82.8% | Helped |
| Add ARMRO defense | ViT models · clean ImageNet accuracy | clean accuracy: about 1% drop (ViT-B/16 85.0% to 84.1%) | Hurt |
| Replace ARMRO with Attention-Mask (Nd=5) (ablation) | ViT-B/32 · 1-patch Patch-Fool ImageNet | robustness accuracy: 66.4% vs 78.7% for ARMRO | Hurt |
| Add ARMRO detection (Nd=5) vs Attention-Mask on false positives (ablation) | ViT-B/32 · 1-patch Patch-Fool | false positive ratio: Attention-Mask false positive >90% vs ARMRO ~7-10% | Helped |
| Adaptive attack: reduce patch size or perturbation radius (weaker attacks) (ablation) | ARMRO on ViT-B/32 · Patch-Fool adaptive attack | defense success rate: defense drops to 58% for 16-pixel or 0.4-radius attacks while attack success below 50% | Mixed |
| Adaptive attack with strict column-score restriction (ablation) | ARMRO on ViT-B/32 · Patch-Fool adaptive attack | robustness: robustness falls to 55% (only 55% of attacks detected) | Hurt |
| Compare ARMRO to CNN-based patch defenses adapted to ViT | ViT-B/16 etc. · 1-patch Patch-Fool | robustness accuracy: ARMRO 83% vs Patch Guard 64% and Saliency Map 55% on ViT-B/16 | Helped |
Closest papers by meaning
- Attacking Transformers with Feature Diversity Adversarial Perturbation (AAAI 2024 · similarity 0.90)
- Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · similarity 0.90)
- Towards Understanding and Improving Adversarial Robustness of Vision Transformers (CVPR 2024 · similarity 0.89)
- Improving the Adversarial Transferability of Vision Transformers with Virtual Dense Connection (AAAI 2024 · similarity 0.89)
- Attention-Imperceptible Backdoor Attacks on Vision Transformers (AAAI 2025 · similarity 0.88)
- SlowFormer: Adversarial Attack on Compute and Energy Consumption of Efficient Vision Transformers (CVPR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.