Research map / Adversarial robustness and security / Attacks on text and graphs
DeSparsify: Adversarial Attack Against Token Sparsification Mechanisms
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DeSparsify, a PGD-based adversarial attack that makes token-sparsification vision transformers (ATS, AdaViT, A-ViT) keep all tokens while preserving the original classification, degrading availability via higher GFLOPS, memory, and energy.
Problem
Token sparsification mechanisms make vision transformers input-dependent and efficient on average, but this dynamism opens a worst-case availability attack surface where crafted inputs force full computation.
Approach
Craft imperceptible adversarial perturbations with a custom mechanism-specific loss (KL divergence toward uniform scores for ATS, MSE toward keep decisions for AdaViT, cumulative halting score toward zero for A-ViT) plus a classification-preservation term, so sparsification is disabled while predictions remain unchanged.
Key results
- Single-image DeSparsify increases ATS GFLOPS by 74% (3.09 to 4.20) and A-ViT TUR from 72% to 100% while keeping accuracy near 88%.
- Against ATS on DeiT-s, the single-image attack raises GPU memory by 37%, energy by 72%, and throughput cost by 8% relative to clean images.
- Ensemble perturbations trained on all three TS mechanisms reach close to single-mechanism performance (e.g., 50% GFLOPS increase on ATS), while cross-mechanism transfer is limited.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply the DeSparsify single-image perturbation | DeiT-s + ATS · ImageNet-1K validation | GFLOPS: 3.09 -> 4.20 (74%) | Helped |
| Apply the DeSparsify single-image perturbation | DeiT-s + AdaViT · ImageNet-1K validation | GFLOPS: 2.25 -> 3.27 (44%) | Helped |
| Apply the DeSparsify single-image perturbation | DeiT-s + A-ViT · ImageNet-1K validation | GFLOPS: 3.57 -> 4.6 (100%) | Helped |
| Use a class-universal perturbation | DeiT-s + ATS · ImageNet-1K validation | GFLOPS: 3.09 -> 3.40 (21%) | Helped |
| Use a class-universal perturbation | DeiT-s + AdaViT · ImageNet-1K validation | GFLOPS: 2.25 -> 2.94 (30%) | Helped |
| Use a class-universal perturbation | DeiT-s + A-ViT · ImageNet-1K validation | GFLOPS: 3.57 -> 4.07 (49%) | Helped |
| Apply the DeSparsify single-image perturbation | DeiT-s + ATS · ImageNet-1K validation | memory: 240 -> 329 (1.37×) | Helped |
| Apply the DeSparsify single-image perturbation | DeiT-s + ATS · ImageNet-1K validation | energy: 2663 -> 4595 (1.72×) | Helped |
| Apply the DeSparsify single-image perturbation | DeiT-s + ATS · ImageNet-1K validation | accuracy: 88.5% -> 88.2% | No clear effect |
| Train the perturbation on all three token-sparsification mechanisms | DeiT-s with ATS, AdaViT, and A-ViT · ImageNet-1K validation | GFLOPS | Helped |
| Set λ to 0 rather than the accuracy-preserving value (ablation) | DeSparsify on DeiT-s + ATS · ImageNet-1K validation | accuracy: ∼20% | Hurt |
| Increase λ from 0 toward 8 · 10−4 (ablation) | DeSparsify on DeiT-s + ATS · ImageNet-1K validation | accuracy: a marginal 1% change | Helped |
Surprising findings
- Sponge examples actually reduce GFLOPS for AdaViT and A-ViT (e.g., -18% and -26%), i.e., they sparsify more tokens.
- Universal patch achieves strongest slowdown but severely degrades accuracy (e.g., 20% on AdaViT), reducing stealthiness.
Limitations
- Limited transferability of perturbations across TS mechanisms and backbones.
- AdaViT attack is weaker because some blocks already use no tokens on clean images.
- Hardware metrics only reported for ATS since AdaViT and A-ViT only zero out tokens without reducing computation.
Experimental setup
Datasets: ImageNet CIFAR-10
Benchmarks: ImageNet validation CIFAR-10 validation
Metrics: accuracy GFLOPS token utilization ratio GPU memory energy consumption throughput
Baselines: Random perturbation Standard PGD Sponge Examples Clean w/o
Builds on: PGD sponge examples ATS AdaViT A-ViT
Closest papers by meaning
- Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · similarity 0.86)
- Attention! Your Vision Language Model Could Be Maliciously Manipulated (NeurIPS 2025 · similarity 0.86)
- Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferability (NeurIPS 2025 · similarity 0.85)
- SlowFormer: Adversarial Attack on Compute and Energy Consumption of Efficient Vision Transformers (CVPR 2024 · similarity 0.85)
- Towards Understanding and Improving Adversarial Robustness of Vision Transformers (CVPR 2024 · similarity 0.85)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.