Research on the adversarial robustness of Vision Transformers

1. 01What problem does this paper attempt to solve?

   Systematically study the robustness of ViT to adversarial perturbations, compare with CNN and MLP-Mixer, and explain its sources.

   Core question: How robust is the vision Transformer (ViT) to adversarial perturbations, who is more robust compared with CNN and MLP-Mixer, and what is the source of the robustness difference.

   • Setting and motivation: After Transformer's success in NLP, it was introduced to vision tasks; the authors believe that before safe and reliable real-world deployment, the robustness of ViT to adversarial perturbations must be studied.
   • Existing gaps: The authors state that Transformer robustness research in NLP targets discrete perturbations, which differ from the continuous small perturbations in vision; the concurrent work Alamri et al. (2020) used hybrid CNN-Transformer models and weaker attacks, and lacked an explanation of the source of robustness.
   • Core hypothesis: The authors hypothesize that ViT is more robust because the features it learns contain fewer high-frequency patterns spuriously correlated with labels, and they test this with frequency-filtered attacks and feature visualization.
   • Paper contributions: The authors conduct a systematic comparison of white-box, transfer, and certified robustness, and state that ViT is better in all; they also examine the effects of adversarial training, SAM, and pretraining on ViT robustness.
   • Threat model:
     • Goal: untargeted attacks, where a perturbation succeeds if it changes the model prediction.
     • Knowledge and capability: ℓ∞ norm-bounded perturbations; two settings: white-box (PGD, AutoAttack) and black-box transfer (FGSM generated on the source model).
     • Victim systems: ImageNet image classification models, including ViT variants, CNN, and MLP-Mixer.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into three groups: NLP Transformer robustness, concurrent work on ViT robustness, and comparison baselines.

   Robustness of Transformers in NLP

   • Hsieh et al. (2019), Jin et al. (2020), Garg & Ramakrishnan (2020), etc.—adversarial attacks on pretrained Transformers, where in experiments Transformers are usually more robust than LSTM and CNN, with Hsieh et al. (2019) giving a theoretical explanation; the authors point out that these works target discrete perturbations (word or character substitutions), which differ from continuous visual perturbations.
   • Wang et al. (2020a)—improving the robustness of pretrained Transformers from an information-theoretic perspective; Shi et al. (2020), Ye et al. (2020), Xu et al. (2020)—studying robustness certification of Transformer models.

   Concurrent and subsequent work on ViT adversarial robustness

   • Alamri et al. (2020)—using Transformer encoders in object detection and reporting better robustness; the authors point out that their model is a hybrid of CNN and Transformer, the attacks are weaker, and there is no explanation of the source.
   • Mahmood et al. (2021)—measuring ViT robustness under white-box and black-box settings and analyzing CNN+Transformer ensemble defenses; Qin et al. (2021), Salman et al. (2021)—studying from the perspective of patch structure; Herrmann et al. (2022)—designing pyramid adversarial training.
   • Naseer et al. (2021b)—examining whether the weak transferability of ViT adversarial examples reported in this paper stems from weak features or weak attacks; Aldahdooh et al. (2021), Paul & Chen (2021), Mao et al. (2022), etc.—studying from perspectives such as preprocessing defenses, natural adversarial examples, and robust components.

   Comparison baselines and benchmarks

   • Baseline models: ResNet18, ResNet50-32x4d, ShuffleNet, MobileNet, VGG16, SEResNet50, MLP-Mixer, ConvNeXt, as well as ResNeXt-32x4d-ssl (YFCC100M) and ResNet50-swsl (IG-1B-Targeted) pretrained on large datasets.
   • Benchmarks: ImageNet-1k (main experiments), CIFAR-10 (adversarial training, Appendix F).

   Authors' positioning: this paper focuses more on the sources of ViT robustness, explains them from a frequency perspective, and states that it is the first work to study certified adversarial robustness of Transformers on vision tasks and to explain the sources of ViT robustness from a frequency perspective.

   Collapse this answer

3. 03How does the paper address this problem?

   Using frequency-filtered PGD, feature visualization, multiple attacks, and randomized smoothing certification, systematically compare and explain ViT robustness.

   Overall approach: on ImageNet, compare the empirical and certified robustness of ViT with CNN and MLP-Mixer using multiple attacks, then use frequency-filtered PGD attacks and feature visualization to test the hypothesis that "ViT learns fewer high-frequency features and is therefore more robust."

   Problem formulation

   • Use ℓ∞ norm-bounded attacks: max_x^adv L(x^adv, y) s.t. |x^adv − x₀|_∞ ≤ ϵ, i.e., maximize the classification loss within the ℓ∞ ball centered at x0 with radius ε; untargeted setting, where the attack succeeds if the prediction is changed.

   Attacks and evaluation methods

   • PGD: solved by iterative gradient ascent, x^adv_t+1 = Clip_x0,ϵ(x^adv_t + α · sgn(∇_x J(x^adv_t, y))); FGSM is its t=1 special case. Main experiments fix 40 steps, ε ∈ {0.001, 0.003, 0.005, 0.01}, Foolbox default parameters.
   • AutoAttack: a parameter-free ensemble attack (APGD-CE, APGD-DLR, FAB, Square Attack), requiring no tuning.
   • Transfer attack: use FGSM to generate perturbations on the source model to attack the target model, evaluating black-box robustness and serving as a sanity check for obfuscated gradients; the authors state that single-step attacks transfer better, hence FGSM.

   Frequency analysis

   • Frequency-filtered PGD: apply DCT to the PGD perturbation, filter with mask Mf, then IDCT back to the spatial domain, i.e., x^{adv}_{freq} = \mathrm{IDCT}(\mathrm{DCT}(x^{adv}_{pgd} - x_0) \odot M_f) + x_0, so that the perturbation contains only high-frequency or low-frequency components.
   • Filter design (Figure 2): low-pass keeps the 32×32 low-frequency region of 224×224, high-pass keeps the 192×192 high-frequency region, full-pass is equivalent to ordinary PGD.
   • Feature visualization: following Yuan et al. (2021), visualize the feature maps of the first block of each model, with CNN inputs scaled to 224×224 and ViT to 1792×1792, so that feature maps are all 112×112.

   Certified robustness

   • Use denoised randomized smoothing (Salman et al., 2020): train a DnCNN denoiser for each pretrained model with stability objective LStab, then apply randomized smoothing to the denoised classifier, computing the certified radius R = σ/2·(Φ⁻¹(pA) − Φ⁻¹(pB)) according to the formula of Cohen et al. (2019).
   • Training settings: σ = 0.25, 25 epoch, learning rate 10⁻⁵, batch size 64.

   Model selection principle

   • All models use public checkpoints, each tuned to its best by its original authors; the authors follow Paul & Chen (2021) in believing that a unified training setting may be biased against some models.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Comparison of PGD, AutoAttack, transfer, and certified robustness on ImageNet, plus frequency analysis, feature visualization, and CIFAR-10 adversarial training.

   Experimental setup

   • Models evaluated: ViT-S/B/L/16, ViT-SAM-B/16, ViT-B/16-Res, T2T-ViT-14/24, DeiT-S/16, Dist-DeiT-B/16, Swin-S/4, MLP-Mixer-B/16, ConvNeXt-S, SEResNet50, ResNeXt-32x4d-ssl, ResNet50-swsl, ResNet18, ResNet50-32x4d, ShuffleNet, MobileNet, VGG16 (the appendix additionally has DeiT-T/B, Swin-T/B/L and other variants).
   • Datasets: ImageNet-1k; CA is evaluated on the entire test set, RA on adversarial examples generated from 1000 test samples; CIFAR-10 is used for adversarial training (Appendix F).
   • Attacks: PGD (40 steps) and AutoAttack, ε ∈ {0.001, 0.003, 0.005, 0.01}; transfer attacks use FGSM, ε ≤ 0.1; certification uses denoised randomized smoothing (σ = 0.25).
   • Metrics: CA, RA (higher is more robust), certified accuracy/radius, RER of transfer attacks (target model error rate).
   • Number of repetitions: not reported in the paper.

   Main results

   According to Table 3 (PGD) and Table 4 (AutoAttack), RA (%) at ε=0.001:

   Swipe horizontally to read the table

   Model	CA	PGD RA	AutoAttack RA
   ViT-S/16	77.6	55.4	48.1
   ViT-B/16	75.7	48.9	39.8
   ViT-L/16	79.2	55.1	46.6
   ViT-SAM-B/16	76.7	63.4	59.8
   ViT-B/16-Res	84.0	45.5	27.7
   T2T-ViT-14	80.1	37.1	12.9
   T2T-ViT-24	82.2	47.7	20.8
   Swin-S/4	81.8	40.0	7.9
   MLP-Mixer-B/16	73.8	41.9	34.5
   ConvNeXt-S	82.7	42.4	15.9
   SEResNet50	75.7	35.4	21.6
   ResNet50-swsl	81.2	24.7	8.1
   ResNet18	70.0	24.9	14.3
   ResNet50-32x4d	77.6	28.2	13.2
   ShuffleNet	69.4	15.0	6.1
   MobileNet	71.9	16.7	7.8
   VGG16	71.6	26.3	16.7

   (Three rows—DeiT-S/16, Dist-DeiT-B/16, ResNeXt-32x4d-ssl—are omitted; at ε=0.01, RA is about 0.0% for all models.)

   • The authors state that at small radii ViT's RA is higher than CNN's: at ε=0.001, ViT-S/16's PGD RA is 55.4%, and the highest for CNN is 30.0% (main text 5.2.1).
   • Introducing ResNet or T2T modules reduces RA: at ε=0.001, ViT-B/16-Res drops from 48.9% to 45.5% under PGD and from 39.8% to 27.7% under AutoAttack compared with ViT-B/16; T2T-ViT-14 is 18.3 percentage points lower than ViT-S/16 under PGD and 35.2 percentage points lower under AutoAttack.
   • Larger models are not necessarily more robust: ViT-S/16 outperforms ViT-B/16 under both PGD and AutoAttack; but in hybrid architectures, increasing the proportion of Transformer blocks helps, with T2T-ViT-24 having higher RA than T2T-ViT-14.

   Frequency study and feature visualization

   • What was measured: Table 2 reports RA under low-pass, high-pass, and full-pass filtered PGD (40 steps).
   • Results: As ε increases from 0.001 to 0.01, ResNet50-32x4d's RA drops from 75.0% to 59.0% under low-pass and from 47.7% to 3.3% under high-pass; ViT-B/16 drops from 71.9% to 55.8% under low-pass and from 66.3% to 33.4% under high-pass. T2T-ViT-14/24 and ViT-B/16-Res are lower than vanilla ViT in the high-pass column and higher in the low-pass column.
   • Authors' interpretation: CNN is more sensitive to high-frequency perturbations, and high-frequency perturbations are the main cause of CNN's low RA; introducing CNN/T2T modules makes ViT more sensitive to high frequencies. In the feature visualization (Figure 3), the first layer of CNN learns obvious edge/line features, which are difficult to observe in ViT-B/16's feature maps; the authors believe that model vulnerability is related to the tendency to learn high-frequency low-level features.

   Transfer attacks

   • What was measured: FGSM transfer attacks; Figure 4 gives the RER heatmap of source model × target model (ε ≤ 0.1).
   • Results: When CNN is the source and ViT is the target, RER is very low; adversarial examples generated with ViT as the source transfer to other models with higher RER; transfer is better between structurally similar models (ViT-S/B/L transfer well to each other, similarly between T2T-ViT and between CNNs).
   • Authors' interpretation: ViT relies less on model-specific high-frequency patterns, and its adversarial perturbations are forced to rely less on model-specific features, hence they transfer more easily; the authors believe that at large radii ViT adversarial examples are even stronger, possibly because transferable perturbations require larger radii, leaving this for further exploration.

   Certified robustness

   • What was measured: certified accuracy at different radii under denoised randomized smoothing (σ=0.25) (Table 5).
   • Results: At radius 0.1, DeiT-S/16 is 0.6352, SAM-ViT is 0.6320, ViT-S/16 is 0.5944, higher than ResNet50's 0.4584 and VGG16's 0.3772; T2T-ViT-14 is 0.4044, lower than ConvNeXt-S (0.5160) and SEResNet50 (0.4880) at radii less than 0.5. With the denoiser added, under σ=0.25 noise, ViT-S/16 accuracy is 64.84%, ResNet50 is 47.782%, ResNet18 is 5.966% (the original source gives two bases as such: ViT-S/16 without denoiser 4.996%, ResNet50 without denoiser 5.966%).
   • Authors' interpretation: Pure ViT has better certified robustness than CNN; the T2T module makes certified robustness even worse than CNN; SAM further improves it; modern CNN designs that borrow ViT techniques, such as ConvNeXt, narrow the gap with ViT in clean accuracy, empirical and certified robustness.

   Other ablations and analyses

   • Sanity check (Appendix A): In Figure 5, ViT-S/16's loss curve converges at a value far lower than ResNet18's; the authors state that ViT's robustness improvement is not caused by insufficient attack optimization.
   • CIFAR-10 (Appendix C): Under PGD-10, ViT-B/4's RA is higher than WideResNet's (e.g., at ε=0.001, 0.9202 vs. 0.7744, Table 9).
   • ADef deformation attack (Appendix D): ViT-S/16 RA 12.4%, higher than VGG16 10.8%, ResNet18 11.8%, etc. (Table 10).
   • Adversarial training (Appendix F, CIFAR-10, 20 epoch): Under TRADES, ViT-B/4's PGD-10 RA is 53.9% and AutoAttack 49.2%, higher than PreActResNet18 (49.4/44.9), comparable to WideResNet-34-10 (53.4/49.3), with higher clean accuracy of 85.0%; the authors state that after adversarial training ViT does not surpass WideResNet-34-10.
   • Pretraining: ResNet50-swsl and ResNeXt-32x4d-ssl have RA similar to or lower than non-pretrained ResNet18 and ResNet50-32x4d; the authors state that pure pretraining cannot improve adversarial robustness.
   • FGSM fast adversarial training: The authors report that the method of Wong et al. (2020) still causes catastrophic overfitting for ViT, with test accuracy under PGD almost 0.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors point out limitations such as ViT adversarial training not surpassing large CNNs and FGSM fast training overfitting, and leave several open questions.

   Limitations and future directions noted by the authors

   • After adversarial training, the robust accuracy of ViT did not exceed that of large CNNs such as WideResNet-34-10; the authors speculate that ViT may require more data or more training epochs (Appendix F).
   • The FGSM fast adversarial training of Wong et al. (2020) still caused catastrophic overfitting in ViT; the authors speculate that this method may not be suitable for pretrained models or may require further adjustment (Appendix F).
   • Under large attack radii, ViT adversarial examples are stronger than CNN ones; the authors believe that transferable perturbations may require larger radii, "could be further explored" (Section 5.2.2).
   • To save cost, the adversarial training experiments trained each model for only 20 epochs, whereas prior work used about several hundred epochs; the authors state that they provide baseline results for future exploration and improvement (Appendix F).
   • The authors state that a trade-off between CA and RA remains (Section 5.1.2).

   Experimental coverage

   • There are 20 main models tested (Table 3/4), and Appendix B additionally includes 12 variants such as DeiT-T/B, Dist-DeiT-T, ViT-SAM-B/32, and Swin-T/B/L (Table 7/8).
   • Attacks cover PGD, AutoAttack, FGSM transfer, ADef deformation (Appendix D), and frequency-filtered PGD; certification covers denoised randomized smoothing (σ=0.25).
   • The main experiments are on ImageNet-1k, with RA using 1000 test samples; adversarial training is on CIFAR-10, ε=8/255, 20 epochs.
   • The paper does not report the number of experimental repetitions or variance.
   • The paper does not report the specific sample size for transfer attacks; Figure 4/8 only give RER heatmaps.

   Collapse this answer

6. 06Summarize the main content of the paper

   ViT is better than CNN and MLP-Mixer in white-box, transfer, and certified robustness, which the authors attribute to it learning fewer high-frequency features.

   A systematic analysis paper on the adversarial robustness of vision Transformers, comparing ViT with CNN and MLP-Mixer and explaining the source of robustness.

   • Problem: After ViT entered vision tasks, its robustness to ℓ∞ adversarial perturbations lacked systematic study, and existing work lacked an explanation of the source.
   • Method: On ImageNet, compare about 20 models using PGD (40 steps), AutoAttack, FGSM transfer attacks, and denoised randomized smoothing; design frequency-filtered PGD (DCT + high/low-pass masks) and first-layer feature visualization to test the hypothesis that "ViT learns fewer high-frequency features."
   • Main results: At ε=0.001, ViT-S/16 has PGD RA 55.4% and AutoAttack RA 48.1%, while CNN's PGD RA is at most 30.0% (Table 3/4); ViT-SAM-B/16 reaches AutoAttack RA 59.8%.
   • Frequency evidence: As ε goes from 0.001 to 0.01, ResNet50-32x4d's RA under high-pass attack drops from 47.7% to 3.3%, while ViT-B/16 only drops from 66.3% to 33.4% (Table 2); in feature visualization, CNN learns obvious edge lines, which are hard to observe in ViT feature maps (Figure 3).
   • Architecture effects: Introducing ResNet/T2T modules improves clean accuracy but reduces robustness (ViT-B/16-Res has AutoAttack RA 27.7% vs. ViT-B/16's 39.8%); in hybrid architectures, increasing the proportion of Transformer blocks improves robustness (T2T-ViT-24 is better than T2T-ViT-14).
   • Conclusions and implications (in the authors' voice): The authors state that ViT is better than CNN in both empirical and certified robustness, and that modern CNNs borrowing ViT designs (large convolution kernels, LN, Patchify, etc.) can narrow the gap; adversarial training and SAM are effective for ViT, while pure pretraining is not; after adversarial training, ViT did not exceed WideResNet-34-10, which is left for future work.

   Collapse this answer

Related papers