Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: 
This paper enhances transferability of vision transformers (ViT) by introducing two strategies specific to the architecture of ViT models, i.e. Self-Ensemble and Token refinement. Specifically,  Self-Ensemble finds multiple discriminative pathways by dissecting a single ViT model into an ensemble of networks, leading to an explicit utilization of class-specific information at each ViT block. In addition, the proposed Token Refinement can potentially enhance the discriminative capacity at each block of ViT. 

The high-level motivation of this paper is that the adversarial patterns found via conventional adversarial attacks show very low black-box transferability for ViT models. The authors claim that this phenomenon is due to the sub-optimal attack procedures that do not leverage the true representation potential of the ViTs. Thus, this paper introduces a highly transferable attack approach that augments the current adversarial attacks and increases their transferability from ViTs to the unknown models. 

The paper conduct experiments on a range of standard attack methods to establish the performance boost obtained through the proposed transferablility approach by using the Source (white-box) models, Target (black-box) models. The experiments conducted on ImageNet/COCO dataset, and PASCAL demonstrate that the proposed method can outperform the baselines on some of the experimental settings. The paper also provides a detailed analysis of the model and experimental results. 

main_review: 

###Summary###

This paper enhances transferability of vision transformers (ViT) by introducing two strategies specific to the architecture of ViT models, i.e. Self-Ensemble and Token refinement. Specifically,  Self-Ensemble finds multiple discriminative pathways by dissecting a single ViT model into an ensemble of networks, leading to an explicit utilization of class-specific information at each ViT block. In addition, the proposed Token Refinement can potentially enhance the discriminative capacity at each block of ViT. 

The high-level motivation of this paper is that the adversarial patterns found via conventional adversarial attacks show very low black-box transferability for ViT models. The authors claim that this phenomenon is due to the sub-optimal attack procedures that do not leverage the true representation potential of the ViTs. Thus, this paper introduces a highly transferable attack approach that augments the current adversarial attacks and increases their transferability from ViTs to the unknown models. 

The paper conduct experiments on a range of standard attack methods to establish the performance boost obtained through the proposed transferablility approach by using the Source (white-box) models, Target (black-box) models. The experiments conducted on ImageNet/COCO dataset, and PASCAL demonstrate that the proposed method can outperform the baselines on some of the experimental settings. The paper also provides a detailed analysis of the model and experimental results. 

### Novelty ###

The paper proposes two novel strategies about how to enhance the transferability of ViT models, i.e. refined tokens and self-ensemble. When those ideas are combined to an adversarial attack, it significantly boosts the transferability of adversarial examples, thereby bringing out the true generalization of ViTs’ adversarial space. These two ideas are interesting and should be heuristic for the research community, especially for those who have a strong interest in designing ViT models. 


###Clarity###

The paper is overall logically clear and easy to follow. The tables and figures are well illustrated by the captions. The writing and presentation of this paper are good enough to convey the ideas.

###Pros###

1) The paper proposes two interesting ideas to enhance the generalization ability of the ViT models, i.e. refined tokens and self-ensemble. These two methods are well-motivated. For self-ensemble, it creates an ensemble of classifiers by learning a shared classification head at each block along the ViT hierarchy, leading to an explicit utilization of class-specific information at each ViT block. For refined tokens, the paper proposes both patch token refinement and class token refinement to tackle the misalignment between the features with the classifier. 

2) The paper provides extensive experiments on multiple datasets, settings, and vision tasks. The results show that both proposed techniques can boost the performance, compared with many SOTA baselines.  Through the experiments, this paper empirically demonstrates favorable transfer rates across different model families (convolutional and transformer) as well as different vision tasks (classification, detection, and segmentation).

3) The paper provides a detailed empirical analysis to demonstrate the effectiveness of the proposed methods. 

###Cons###

1) While self-ensembling is useful to enhance the transferability of the ViT models, it also makes the models more complex. Thus, some computational costs and inference speed analysis are desired. 

2) One of the main assumptions of proposing the patch token refinement and class token refinement is there exists misalignment between the feature and classifier in ViT models. It will be helpful to provide some empirical evidence to validate this assumption (even some material in the appendix). 

Based on the summary, cons, and pros, the current rating I am giving now is "weak accept". I would like to discuss the final rating with other reviewers, ACs.

summary_of_the_review: Thia paper proposes two strategies specific to the architecture of ViT models, i.e. Self-Ensemble and Token refinement to enhance the transferability of the ViT models.  The experiments conducted on ImageNet/COCO dataset, and PASCAL demonstrate that the proposed method can outperform the baselines on some of the experimental settings.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper looks at Vision Transforms (ViTs) models and transferability of adversarial examples, which is previously known to be challenging between ViTs to CNNs and vice versa. The paper leverages the discriminative information stored in the lower layers' tokens and proposes two methods that modify and fine-tune the ViTs in order to extract the adversarial samples. The paper conducts extensive experiments to show the effectiveness in adversarial transferability across different models, including CNN's and ViT's variants, and tasks.
main_review: In general, I find the paper presents an interesting and important work w.r.t the adversarial security of ViTs. The main strengths of the paper are:

- The paper is well organized and well-written. 
- The proposed approaches are well-motivated by empirical findings.
- The paper has several experiments that the effectiveness of these approaches.

I also have some concerns/questions about the discussions in the paper:

- In my view, the addition of the ensemble module and refined tokens is similar to an approach that combines both CNN and ViT. In Figure 6, it is also evidence that the addition of the refined tokens is important. This begs the question of whether adversarial samples of hybrid CNN/ViT models have similar transferability performance as of the proposed methods in the paper? Currently, it seems like the paper only studies one particular type of ViTs, and the generality of the proposed methods, as well as the generality of the motivation, can be limited.
- Does the same trend follow w.r.t adversarial transferability to other large CNN models such as BiT?


summary_of_the_review: I find that the paper presents an interesting study on the transferability of adversarial samples of ViTs. In general, I think it is a good paper, but also have some concerns about the generality of the work.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: By incorporating self-ensemble and token refinement methods, the authors have devised a method that takes use of the modularity of ViT models to improve their adversarial transferability. Their experiments have demonstrated adversarial transferability across different convolution and transformer model families for different vision tasks.
main_review: The problem approached by the paper is interesting and the proposed approach is novel to the best of my knowledge. The work is well-structured and written in a clear and concise manner with sufficient experimental verification. 

Strengths:
- well written
- sufficient experimental validation including different vision tasks and datasets
- a good overview of previous black-box and white box attacks

Weaknesses:
- will the method work on images with lower dimensions
-  it would have been interesting to include a Future Works section
- a more thorough discussion as why the approach works
- what effect do surrogate model and black-box target model topological differences have on adversarial transferability?
- enhance the quality of images
- 
summary_of_the_review: Overall, I vote for marginal accept. I like the idea of mining the relation between blocks and handle it by the proposed self-ensemble and token refinement method. My major concern is about the clarity of the paper and discussion as when and why the method works. Hopefully the authors can address my concern in the rebuttal period.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: In this paper,  authors improve adversarial transferability of ViT by Self-Ensemble and Token Refinement method.
'Self-Ensemble' implies it treats each transformer block of ViT as the 'last block' and apply a shared classifier to it. So that the trivial discriminative path can be attacked.
'Token Refinement' tries to improve the classification ablity of shallow blocks by using extra non-shared module on each block's output tokens.
This paper successfully improved the adversarial ability of ViT attacks. Sufficient experimental results and detailed description ensure its reproducibility.
main_review: Strength
1. This is a novel study on ViT adversarial attack modeling, and the self-ensemble method seems to make sense.
2. This work conducts sufficient experiments, and shows good transferablity in a variety of situations.
3. The method of this paper is a general framework. It is not limited to specific calculation method (such as saliency maps and gradients), but is augmented calculation object. So I hope this paper will have a broader impact.

Weekness
1. The author claims that the design of this attack method comes from the different inductive biases between Transformer and CNN style models. However, this paper dosen‘t mention why this inductive bias would cause the previous attack method to fail, nor dose it mention why that difference would make the method more effective.
2. In addition, this method seems to be able to improve the transferablity of models with other paradigms. If this method can improve CNNs' adversarial tranferablity better, it is difficult to say that this is a method of "improving adversarial transferability of ViT model". This paper lacks relevant ablation studys.
summary_of_the_review: In summary, this paper proposes novel methods and shows good reproducibility. Proposed self-ensemble and token reinforcement gets good results in many situations. But I still have doubts about whether this method is for Transformer’s inductive bias.
I am inclined to accept this paper, but I would like to see a more detailed discussion.
review_title: null

Meta-review: In this paper, the authors enhance the adversarial transferability of vision transformers by introducing two novel strategies specific to the architecture of ViT models: Self-Ensemble and Token Refinement method. Comprehensive experiments on various models (including CNN's and ViT's variants) and tasks (classification, detection, and segmentation) successfully verify the effectiveness of the proposed method.

In general, the problem studied is relevant and important. The paper is well-written and well-motivated with empirical findings. The proposed two strategies are novel, simple to implement, and effective in practice. Following the author's response and discussion, the average score increases from 6 to 7.5, with most concerns well addressed. AC believes that the paper should be highlighted at the ICLR conference.
Decision: Accept (Spotlight)