Research map / Adversarial robustness and security / Certified and empirical robustness
Improving Interpretation Faithfulness for Vision Transformers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Faithful ViTs (FViTs) and Denoised Diffusion Smoothing (DDS), which combines Gaussian randomized smoothing with diffusion-based denoising to certify stable top-k attention and robust predictions under adversarial perturbations.
Problem
Vision Transformer attention-based explanations are fragile: small adversarial input perturbations change top-k attention indices and predictions, so explanations are unfaithful.
Approach
Apply randomized smoothing with Gaussian noise followed by a pretrained diffusion denoiser before the ViT's self-attention, and prove this yields a faithful attention module with certified top-k overlap and Rényi-divergence-bounded prediction robustness; Gaussian noise is argued to be near-optimal.
Key results
- On ImageNet with ViT, the method reports classification accuracy 0.85 and pixel accuracy 0.76 versus best baseline VTA at 0.82 and 0.73 under the default PGD attack (8/255).
- Ablation on the full method: robust classification accuracy 99.5 vs 92.1 when both smoothing and denoising are removed.
- Computational cost: about 0.32 s per 256x256 image on ImageNet at noise level 8/255 (t*=45 denoising steps).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply DDS instead of VTA | ViT · ImageNet | classification accuracy: 0.82 -> 0.85 | Helped |
| Apply DDS instead of VTA | ViT · ImageNet | pixel accuracy: 0.73 -> 0.76 | Helped |
| Apply DDS instead of VTA | ViT · Cityscape | mIoU: 0.7 -> 0.73 | Helped |
| Apply DDS instead of VTA | ViT · COCO | mIoU: 0.78 -> 0.81 | Helped |
| Add randomized smoothing (ablation) | DDS · Adversarial evaluation | Rob.Acc: 98.2 -> 99.5 | Helped |
| Add diffusion denoising (ablation) | DDS · Adversarial evaluation | Rob.Acc: 96.4 -> 99.5 | Helped |
| Add randomized smoothing (ablation) | DDS · Adversarial evaluation | segmentation Rob.Acc: 96.3 -> 97.8 | Helped |
| Add diffusion denoising (ablation) | DDS · Adversarial evaluation | segmentation Rob.Acc: 94.7 -> 97.8 | Helped |
| Add randomized smoothing (ablation) | DDS · Adversarial evaluation | mIOU: 0.977 -> 0.985 | Helped |
| Add diffusion denoising (ablation) | DDS · Adversarial evaluation | mIOU: 0.965 -> 0.985 | Helped |
| Add randomized smoothing (ablation) | DDS · Perturbation tests | Pos. AUC: 18.51 -> 15.29 | Helped |
| Add diffusion denoising (ablation) | DDS · Perturbation tests | Pos. AUC: 21.36 -> 15.29 | Helped |
Surprising findings
- Verification experiment found adversarial examples within 1.5R for the smoothed classifier in only 23% of cases and within 2R in 64% of cases, which the authors present as evidence of bound tightness.
Limitations
- Robustness certificates rely on Gaussian noise and Rényi-divergence bounds, which are conservative; empirical verification shows attacks succeed within 2R in 64% of cases.
- Requires many Monte Carlo denoising samples (e.g., 100,000 repetitions) and per-image denoising cost.
- Evaluation of explanations uses segmentation labels as ground truth, and the explanation method (Trans. Att.) is fixed.
Experimental setup
Datasets: ImageNet Cityscapes COCO ImageNet-segmentation
Benchmarks: ImageNet Cityscapes COCO ImageNet-segmentation
Metrics: classification accuracy pixel accuracy mIoU mAP P-AUC (positive perturbation) negative perturbation AUC
Baselines: Raw Attention Rollout GradCAM LRP Vanilla Transformer Attribution (VTA)
Builds on: randomized smoothing denoised diffusion probabilistic model (DDPM) Transformer Attribution (Trans. Att.) PGD
Closest papers by meaning
- On the Faithfulness of Vision Transformer Explanations (CVPR 2024 · similarity 0.89)
- Alias-Free ViT: Fractional Shift Invariance via Linear Attention (NeurIPS 2025 · similarity 0.87)
- Unveil Benign Overfitting for Transformer in Vision: Training Dynamics, Convergence, and Generalization (NeurIPS 2024 · similarity 0.87)
- Random Entangled Tokens for Adversarially Robust Vision Transformer (CVPR 2024 · similarity 0.87)
- Probabilistic Conceptual Explainers: Trustworthy Conceptual Explanations for Vision Foundation Models (ICML 2024 · similarity 0.87)
- Improving Adversarial Transferability on Vision Transformers via Forward Propagation Refinement (CVPR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.