On the Adversarial Robustness of Vision Transformers

Following the success in advancing natural language processing and understanding , transformers are expected to bring revolutionary changes to computer vision . This work provides a comprehensive study on the robustness of vision transformers ( ViTs ) against adversarial perturbations . Tested on various white-box and transfer attack settings , we find that ViTs possess better adversarial robustness when compared with convolutional neural networks ( CNNs ) . This observation also holds for certified robustness . We summarize the following main observations contributing to the improved robustness of ViTs : 1 ) Features learned by ViTs contain less low-level information and are more generalizable , which contributes to superior robustness against adversarial perturbations . 2 ) Introducing convolutional or tokens-to-token blocks for learning low-level features in ViTs can improve classification accuracy but at the cost of adversarial robustness . 3 ) Increasing the proportion of transformers in the model structure ( when the model consists of both transformer and CNN blocks ) leads to better robustness . But for a pure transformer model , simply increasing the size or adding layers can not guarantee a similar effect . 4 ) Pre-training without adversarial training on larger datasets does not significantly improve adversarial robustness though it is critical for training ViTs . 5 ) Adversarial training is also applicable to ViT for training robust models . Furthermore , feature visualization and frequency analysis are conducted for explanation . The results show that ViTs are less sensitive to high-frequency perturbations than CNNs and there is a high correlation between how well the model learns low-level features and its robustness against different frequency-based perturbations . 1 INTRODUCTION . Transformers are originally applied in natural language processing ( NLP ) tasks as a type of deep neural network ( DNN ) mainly based on the self-attention mechanism ( Vaswani et al . ( 2017 ) ; Devlin et al . ( 2018 ) ; Brown et al . ( 2020 ) ) , and transformers with large-scale pre-training have achieved state-of-the-art results on many NLP tasks ( Devlin et al . ( 2018 ) ; Liu et al . ( 2019 ) ; Yang et al . ( 2019 ) ; Sun et al . ( 2019 ) ) . Recently , Dosovitskiy et al . ( 2020 ) applied a pure transformer directly to sequences of image patches ( i.e. , a vision transformer , ViT ) and showed that the Transformer itself can be competitive with convolutional neural networks ( CNN ) on image classification tasks . Since then transformers have been extended to various vision tasks and show competitive or even better performance compared to CNNs and recurrent neural networks ( RNNs ) ( Carion et al . ( 2020 ) ; Chen et al . ( 2020 ) ; Zhu et al . ( 2020 ) ) . While ViT and its variants hold promise toward a unified machine learning paradigm and architecture applicable to different data modalities , it remains unclear on the robustness of ViT against adversarial perturbations , which is critical for safe and reliable deployment of many real-world applications . In this work , we examine the adversarial robustness of ViTs on image classification tasks and make comparisons with CNN baselines . As highlighted in Figure 1 ( a ) , our experimental results illustrate the superior robustness of ViTs than CNNs in both white-box and black-box attack settings , based on which we make the following important findings : • Features learned by ViTs contain less low-level information and benefit adversarial robustness . ViTs achieve a lower attack success rate ( ASR ) of 51.9 % compared with a minimum of 83.3 % by CNNs in Figure 1 ( a ) . They are also less sensitive to high-frequency adversarial perturbations . • Using denoised randomized smoothing ( Salman et al. , 2020 ) , ViTs attain significantly better certified robustness than CNNs . • It takes the cost of adversarial robustness to improve the classification accuracy of ViTs by introducing blocks to help learn low-level features as shown in Figure 1 ( a ) . • Increasing the proportion of transformer blocks in the model leads to better robustness when the model consists of both transformer and CNN blocks . For example , the attack success rate ( ASR ) decreases from 87.1 % to 79.2 % when 10 additional transformer blocks are added to T2T-ViT-14 . However , increasing the size of a pure transformer model can not guarantee a similar effect , e.g. , the robustness of ViT-S/16 is better than that of ViT-B/16 in Figure 1 ( a ) . • Pre-training without adversarial training on larger datasets does not improve adversarial robustness though it is critical for training ViT . • The principle of adversarial training through min-max optimization ( Madry et al . ( 2017 ) ; Zhang et al . ( 2019 ) ) can be applied to train robust ViTs . 2 RELATED WORK . Transformer ( Vaswani et al . ( 2017 ) ) has achieved remarkable performance on many NLP tasks , and its robustness has been studied on those NLP tasks . Hsieh et al . ( 2019 ) ; Jin et al . ( 2020 ) ; Shi & Huang ( 2020 ) ; Li et al . ( 2020 ) ; Garg & Ramakrishnan ( 2020 ) ; Yin et al . ( 2020 ) conducted adversarial attacks on transformers including pre-trained models , and in their experiments transformers usually show better robustness compared to other models based on Long short-term memory ( LSTM ) or CNN , with a theoretical explanation provided in Hsieh et al . ( 2019 ) . However , due to the discrete nature of NLP models , these studies are focusing on discrete perturbations ( e.g. , word or character substitutions ) which are very different from small and continuous perturbations in computer vision tasks . Besides , Wang et al . ( 2020a ) improved the robustness of pre-trained transformers from an information-theoretic perspective , and Shi et al . ( 2020 ) ; Ye et al . ( 2020 ) ; Xu et al . ( 2020 ) studied the robustness certification of transformer-based models . To the best of our knowledge , this work is one of the first studies that investigates the adversarial robustness ( against small perturbations in the input pixel space ) of transformers on computer vision tasks . There are some concurrent works studying the adversarial robustness of ViTs . We supplement their contribution in Appendix G . 3 MODEL ARCHITECTURES . We first review the architecture of models investigated in our experiments including several vision transformers ( ViTs ) and CNN models . A detailed table of comparison is given in Table 5 . 3.1 VISION TRANSFORMERS . We consider the original ViT ( Dosovitskiy et al . ( 2020 ) ) and its four variants shown in Figure 1 ( b ) . Vision transformer ( ViT ) and data-efficient image transformer ( DeiT ) : ViT ( Dosovitskiy et al . ( 2020 ) ) mostly follows the original design of Transformer ( Vaswani et al . ( 2017 ) ; Devlin et al . ( 2018 ) ) on language tasks . For a 2D image x ∈ RH×W×C with resolution H ×W and C channels , it is divided into a sequence ofN = H·WP 2 flattened 2D patches of size P ×P , xi ∈ R N× ( P 2·C ) ( 1 ≤ i ≤ N ) . The patches are first encoded into patch embeddings with a simple convolutional layer , where the kernel size and stride of the convolution is exactly P × P . In addition , there are also position embeddings to preserve positional information . Similar to BERT ( Devlin et al . ( 2018 ) ) , a large-scale pre-trained model for NLP , a special [ CLS ] token is added to output features for classification . DeiT ( Touvron et al . ( 2021 ) ) further improves the ViT ’ s performance using data augmentation or distillation from CNN teachers with an additional distillation token . We investigate ViT- { S , B , L } /16 , DeiT-S/16 and Dist-DeiT-B/16 as defined in the corresponding papers in the main text and discuss other structures in Appendix F. Hybrid of CNN and ViT ( CNN-ViT ) : Dosovitskiy et al . ( 2020 ) also proposed a hybrid architecture for ViTs by replacing raw image patches with patches extracted from a CNN feature map . This is equivalent to adding learned CNN blocks to the head of ViT as shown in Figure 1 ( b ) . Following Dosovitskiy et al . ( 2020 ) , we investigate ViT-B/16-Res in our experiments , where the input sequence is obtained by flattening the spatial dimensions of the feature maps from ResNet50 . Hybrid of T2T and ViT ( T2T-ViT ) : Yuan et al . ( 2021 ) proposed to overcome the limitations of the simple tokenization in ViTs , by progressively structurizing an image to tokens with a token-to-token ( T2T ) module , which recursively aggregates neighboring tokens into one token such that low-level structures can be better learned . T2T-ViT was shown to perform better than ViT when trained from scratch on a midsize dataset . We investigate T2T-ViT-14 and T2T-ViT-24 in our experiments . Hybrid of shifted windows and ViT ( Swin-T ) : Liu et al . ( 2021 ) computes the representations with shifted windows scheme , which brings greater efficiency by limiting self-attention computation to non-overlapping local windows while also allowing for cross-window connection . We investigate Swin-S/4 in the main text and discuss other structures in Appendix F . 3.2 CONVOLUTIONAL NEURAL NEWORKS . We study several CNN models for comparison , including ResNet18 ( He et al . ( 2016 ) ) , ResNet5032x4d ( He et al . ( 2016 ) ) , ShuffleNet ( Zhang et al . ( 2018 ) ) , MobileNet ( Howard et al . ( 2017 ) ) and VGG16 ( Simonyan & Zisserman ( 2014 ) ) . We also consider the SEResNet50 model , which uses the Squeeze-and-Excitation ( SE ) block ( Hu et al . ( 2018 ) ) that applies attention to channel dimensions to fuse both spatial and channel-wise information within local receptive fields at each layer . The aforementioned CNNs are all trained on ImageNet from scratch . For a better comparison with pre-trained transformers , we also consider two CNN models pre-trained on larger datasets : ResNeXt-32x4d-ssl ( Yalniz et al . ( 2019 ) ) pre-trained on YFCC100M ( Thomee et al . ( 2015 ) ) , and ResNet50-swsl pre-trained on IG-1B-Targeted ( Mahajan et al . ( 2018 ) ) using semi-weakly supervised methods ( Yalniz et al . ( 2019 ) ) . They are both fine-tuned on ImageNet . 4 ADVERSARIAL ROBUSTNESS EVALUATION METHODS . We consider the commonly used ` ∞-norm bounded adversarial attacks to evaluate the robustness of target models . An ` ∞ attack is usually formulated as solving a constrained optimization problem : max xadv L ( xadv , y ) s.t . ∥∥xadv − x0∥∥∞ ≤ , ( 1 ) where x0 is a clean example with label y , and we aim to find an adversarial example xadv within an ` ∞ ball with radius centered at x0 , such that the loss of the classifier L ( xadv , y ) is maximized . We consider untargeted attack in this paper , so an attack is successful if the perturbation successfully changes the model ’ s prediction . The attacks as well as a randomized smoothing method used in this paper are listed below . White-box attack Four white-box attacks are involved in our experiments . The Projected Gradient Decent ( PGD ) attack ( Madry et al . ( 2017 ) ) solves Eq . 1 by iteratively taking gradient ascent : xadvt+1 = Clipx0 , ( x adv t + α · sgn ( ∇xJ ( xadvt , y ) ) ) , ( 2 ) where xadvt stands for the solution after t iterations , and Clipx0 , ( · ) denotes clipping the values to make each xadvt+1 , i within [ x0 , i − , x0 , i + ] , according to the ` ∞ threat model . As a special case , Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al . ( 2014 ) ) uses a single iteration with t = 1 . AutoAttack ( Croce & Hein ( 2020 ) ) is currently the strongest white-box attack which evaluates adversarial robustness with a parameter-free ensemble of diverse attacks . We also design a frequencybased attack for analysis , which conducts attack under an additional frequency constraint : xadvfreq = IDCT ( DCT ( x adv pgd − x0 ) Mf ) + x0 , ( 3 ) where DCT and IDCT stand for discrete cosine transform and inverse discrete cosine transform respectively , xadvpgd stands for the adversarial example generated by PGD , and Mf stands for the mask metric defined the frequency filter which is illustrated in Appendix B . We found this design similar to Wang et al . ( 2020b ) . Black-box attack We consider the transfer attack which studies whether an adversarial perturbation generated by attacking the source model can successfully fool the target model . This test not only evaluates the robustness of models under the black-box setting , but also becomes a sanity check for detecting the obfuscated gradient phenomenon ( Athalye et al . ( 2018 ) ) . Previous works have demonstrated that single-step attacks like FGSM enjoys better transferability than multi-step attacks ( Kurakin et al . ( 2017 ) ) . We thus use FGSM for transfer attack in our experiments . Denoised Randomized Smoothing We also evaluate the certified robustness of the models using randomized smoothing , where the robustness is evaluated as the certified radius , and the model is certified to be robust with high probability for perturbations within the radius . We follow Salman et al . ( 2020 ) to train a DnCNN ( Zhang et al . ( 2017 ) ) denoiser Dθ for each pre-trained model f with the “ stability ” objective with LCE denoting cross entropy and N denoting Gaussian distribution : LStab = E ( xi , yi ) ∈D , δLCE ( f ( Dθ ( xi + δ ) ) , f ( xi ) ) where δ ∼ N ( 0 , σ 2I ) . ( 4 ) Randomized smoothing is applied on the denoised classifier f ◦ Dθ for robustness certification : g ( x ) = arg max c∈Y P [ f ( Dθ ( x+ δ ) ) = c ] where δ ∼ N ( 0 , σ2I ) . ( 5 ) The certified radius is then calculated for the smoothed classifier as ( Cohen et al. , 2019 ) : R = σ 2 ( Φ−1 ( pA ) − Φ−1 ( pB ) ) , ( 6 ) where Φ−1 is the inverse of the standard Gaussian CDF , pA = P ( f ( x+δ ) = cA ) is the confidence of the top-1 predicted class cA , and pB = maxc6=cA P ( f ( x+ δ ) = c ) is the confidence for the second top class . Accordingly , given a perturbation radius , the certified accuracy under this perturbation radius can be evaluated by comparing the given radius to the certified radius R .

Summary: This work studies the adversarial robustness of vision transformers comprehensively. The author first presents their finding via empirical experiments. Concretely, they show the robustness of vision transformers from the perspective of adversarial attack, transferability, and certified robustness, adversarial training defense. Then, they analyze the reason behind the observation.