On the Adversarial Robustness of Vision Transformers

Following the success in advancing natural language processing and understanding , transformers are expected to bring revolutionary changes to computer vision . This work provides a comprehensive study on the robustness of vision transformers ( ViTs ) against adversarial perturbations . Tested on various white-box and transfer attack settings , we find that ViTs possess better adversarial robustness when compared with convolutional neural networks ( CNNs ) . This observation also holds for certified robustness . We summarize the following main observations contributing to the improved robustness of ViTs : 1 ) Features learned by ViTs contain less low-level information and are more generalizable , which contributes to superior robustness against adversarial perturbations . 2 ) Introducing convolutional or tokens-to-token blocks for learning low-level features in ViTs can improve classification accuracy but at the cost of adversarial robustness . 3 ) Increasing the proportion of transformers in the model structure ( when the model consists of both transformer and CNN blocks ) leads to better robustness . But for a pure transformer model , simply increasing the size or adding layers can not guarantee a similar effect . 4 ) Pre-training without adversarial training on larger datasets does not significantly improve adversarial robustness though it is critical for training ViTs . 5 ) Adversarial training is also applicable to ViT for training robust models . Furthermore , feature visualization and frequency analysis are conducted for explanation . The results show that ViTs are less sensitive to high-frequency perturbations than CNNs and there is a high correlation between how well the model learns low-level features and its robustness against different frequency-based perturbations . 1 INTRODUCTION . Transformers are originally applied in natural language processing ( NLP ) tasks as a type of deep neural network ( DNN ) mainly based on the self-attention mechanism ( Vaswani et al . ( 2017 ) ; Devlin et al . ( 2018 ) ; Brown et al . ( 2020 ) ) , and transformers with large-scale pre-training have achieved state-of-the-art results on many NLP tasks ( Devlin et al . ( 2018 ) ; Liu et al . ( 2019 ) ; Yang et al . ( 2019 ) ; Sun et al . ( 2019 ) ) . Recently , Dosovitskiy et al . ( 2020 ) applied a pure transformer directly to sequences of image patches ( i.e. , a vision transformer , ViT ) and showed that the Transformer itself can be competitive with convolutional neural networks ( CNN ) on image classification tasks . Since then transformers have been extended to various vision tasks and show competitive or even better performance compared to CNNs and recurrent neural networks ( RNNs ) ( Carion et al . ( 2020 ) ; Chen et al . ( 2020 ) ; Zhu et al . ( 2020 ) ) . While ViT and its variants hold promise toward a unified machine learning paradigm and architecture applicable to different data modalities , it remains unclear on the robustness of ViT against adversarial perturbations , which is critical for safe and reliable deployment of many real-world applications . In this work , we examine the adversarial robustness of ViTs on image classification tasks and make comparisons with CNN baselines . As highlighted in Figure 1 ( a ) , our experimental results illustrate the superior robustness of ViTs than CNNs in both white-box and black-box attack settings , based on which we make the following important findings : • Features learned by ViTs contain less low-level information and benefit adversarial robustness . ViTs achieve a lower attack success rate ( ASR ) of 51.9 % compared with a minimum of 83.3 % by CNNs in Figure 1 ( a ) . They are also less sensitive to high-frequency adversarial perturbations . • Using denoised randomized smoothing ( Salman et al. , 2020 ) , ViTs attain significantly better certified robustness than CNNs . • It takes the cost of adversarial robustness to improve the classification accuracy of ViTs by introducing blocks to help learn low-level features as shown in Figure 1 ( a ) . • Increasing the proportion of transformer blocks in the model leads to better robustness when the model consists of both transformer and CNN blocks . For example , the attack success rate ( ASR ) decreases from 87.1 % to 79.2 % when 10 additional transformer blocks are added to T2T-ViT-14 . However , increasing the size of a pure transformer model can not guarantee a similar effect , e.g. , the robustness of ViT-S/16 is better than that of ViT-B/16 in Figure 1 ( a ) . • Pre-training without adversarial training on larger datasets does not improve adversarial robustness though it is critical for training ViT . • The principle of adversarial training through min-max optimization ( Madry et al . ( 2017 ) ; Zhang et al . ( 2019 ) ) can be applied to train robust ViTs . 2 RELATED WORK . Transformer ( Vaswani et al . ( 2017 ) ) has achieved remarkable performance on many NLP tasks , and its robustness has been studied on those NLP tasks . Hsieh et al . ( 2019 ) ; Jin et al . ( 2020 ) ; Shi & Huang ( 2020 ) ; Li et al . ( 2020 ) ; Garg & Ramakrishnan ( 2020 ) ; Yin et al . ( 2020 ) conducted adversarial attacks on transformers including pre-trained models , and in their experiments transformers usually show better robustness compared to other models based on Long short-term memory ( LSTM ) or CNN , with a theoretical explanation provided in Hsieh et al . ( 2019 ) . However , due to the discrete nature of NLP models , these studies are focusing on discrete perturbations ( e.g. , word or character substitutions ) which are very different from small and continuous perturbations in computer vision tasks . Besides , Wang et al . ( 2020a ) improved the robustness of pre-trained transformers from an information-theoretic perspective , and Shi et al . ( 2020 ) ; Ye et al . ( 2020 ) ; Xu et al . ( 2020 ) studied the robustness certification of transformer-based models . To the best of our knowledge , this work is one of the first studies that investigates the adversarial robustness ( against small perturbations in the input pixel space ) of transformers on computer vision tasks . There are some concurrent works studying the adversarial robustness of ViTs . We supplement their contribution in Appendix G . 3 MODEL ARCHITECTURES . We first review the architecture of models investigated in our experiments including several vision transformers ( ViTs ) and CNN models . A detailed table of comparison is given in Table 5 . 3.1 VISION TRANSFORMERS . We consider the original ViT ( Dosovitskiy et al . ( 2020 ) ) and its four variants shown in Figure 1 ( b ) . Vision transformer ( ViT ) and data-efficient image transformer ( DeiT ) : ViT ( Dosovitskiy et al . ( 2020 ) ) mostly follows the original design of Transformer ( Vaswani et al . ( 2017 ) ; Devlin et al . ( 2018 ) ) on language tasks . For a 2D image x ∈ RH×W×C with resolution H ×W and C channels , it is divided into a sequence ofN = H·WP 2 flattened 2D patches of size P ×P , xi ∈ R N× ( P 2·C ) ( 1 ≤ i ≤ N ) . The patches are first encoded into patch embeddings with a simple convolutional layer , where the kernel size and stride of the convolution is exactly P × P . In addition , there are also position embeddings to preserve positional information . Similar to BERT ( Devlin et al . ( 2018 ) ) , a large-scale pre-trained model for NLP , a special [ CLS ] token is added to output features for classification . DeiT ( Touvron et al . ( 2021 ) ) further improves the ViT ’ s performance using data augmentation or distillation from CNN teachers with an additional distillation token . We investigate ViT- { S , B , L } /16 , DeiT-S/16 and Dist-DeiT-B/16 as defined in the corresponding papers in the main text and discuss other structures in Appendix F. Hybrid of CNN and ViT ( CNN-ViT ) : Dosovitskiy et al . ( 2020 ) also proposed a hybrid architecture for ViTs by replacing raw image patches with patches extracted from a CNN feature map . This is equivalent to adding learned CNN blocks to the head of ViT as shown in Figure 1 ( b ) . Following Dosovitskiy et al . ( 2020 ) , we investigate ViT-B/16-Res in our experiments , where the input sequence is obtained by flattening the spatial dimensions of the feature maps from ResNet50 . Hybrid of T2T and ViT ( T2T-ViT ) : Yuan et al . ( 2021 ) proposed to overcome the limitations of the simple tokenization in ViTs , by progressively structurizing an image to tokens with a token-to-token ( T2T ) module , which recursively aggregates neighboring tokens into one token such that low-level structures can be better learned . T2T-ViT was shown to perform better than ViT when trained from scratch on a midsize dataset . We investigate T2T-ViT-14 and T2T-ViT-24 in our experiments . Hybrid of shifted windows and ViT ( Swin-T ) : Liu et al . ( 2021 ) computes the representations with shifted windows scheme , which brings greater efficiency by limiting self-attention computation to non-overlapping local windows while also allowing for cross-window connection . We investigate Swin-S/4 in the main text and discuss other structures in Appendix F . 3.2 CONVOLUTIONAL NEURAL NEWORKS . We study several CNN models for comparison , including ResNet18 ( He et al . ( 2016 ) ) , ResNet5032x4d ( He et al . ( 2016 ) ) , ShuffleNet ( Zhang et al . ( 2018 ) ) , MobileNet ( Howard et al . ( 2017 ) ) and VGG16 ( Simonyan & Zisserman ( 2014 ) ) . We also consider the SEResNet50 model , which uses the Squeeze-and-Excitation ( SE ) block ( Hu et al . ( 2018 ) ) that applies attention to channel dimensions to fuse both spatial and channel-wise information within local receptive fields at each layer . The aforementioned CNNs are all trained on ImageNet from scratch . For a better comparison with pre-trained transformers , we also consider two CNN models pre-trained on larger datasets : ResNeXt-32x4d-ssl ( Yalniz et al . ( 2019 ) ) pre-trained on YFCC100M ( Thomee et al . ( 2015 ) ) , and ResNet50-swsl pre-trained on IG-1B-Targeted ( Mahajan et al . ( 2018 ) ) using semi-weakly supervised methods ( Yalniz et al . ( 2019 ) ) . They are both fine-tuned on ImageNet . 4 ADVERSARIAL ROBUSTNESS EVALUATION METHODS . We consider the commonly used ` ∞-norm bounded adversarial attacks to evaluate the robustness of target models . An ` ∞ attack is usually formulated as solving a constrained optimization problem : max xadv L ( xadv , y ) s.t . ∥∥xadv − x0∥∥∞ ≤ , ( 1 ) where x0 is a clean example with label y , and we aim to find an adversarial example xadv within an ` ∞ ball with radius centered at x0 , such that the loss of the classifier L ( xadv , y ) is maximized . We consider untargeted attack in this paper , so an attack is successful if the perturbation successfully changes the model ’ s prediction . The attacks as well as a randomized smoothing method used in this paper are listed below . White-box attack Four white-box attacks are involved in our experiments . The Projected Gradient Decent ( PGD ) attack ( Madry et al . ( 2017 ) ) solves Eq . 1 by iteratively taking gradient ascent : xadvt+1 = Clipx0 , ( x adv t + α · sgn ( ∇xJ ( xadvt , y ) ) ) , ( 2 ) where xadvt stands for the solution after t iterations , and Clipx0 , ( · ) denotes clipping the values to make each xadvt+1 , i within [ x0 , i − , x0 , i + ] , according to the ` ∞ threat model . As a special case , Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al . ( 2014 ) ) uses a single iteration with t = 1 . AutoAttack ( Croce & Hein ( 2020 ) ) is currently the strongest white-box attack which evaluates adversarial robustness with a parameter-free ensemble of diverse attacks . We also design a frequencybased attack for analysis , which conducts attack under an additional frequency constraint : xadvfreq = IDCT ( DCT ( x adv pgd − x0 ) Mf ) + x0 , ( 3 ) where DCT and IDCT stand for discrete cosine transform and inverse discrete cosine transform respectively , xadvpgd stands for the adversarial example generated by PGD , and Mf stands for the mask metric defined the frequency filter which is illustrated in Appendix B . We found this design similar to Wang et al . ( 2020b ) . Black-box attack We consider the transfer attack which studies whether an adversarial perturbation generated by attacking the source model can successfully fool the target model . This test not only evaluates the robustness of models under the black-box setting , but also becomes a sanity check for detecting the obfuscated gradient phenomenon ( Athalye et al . ( 2018 ) ) . Previous works have demonstrated that single-step attacks like FGSM enjoys better transferability than multi-step attacks ( Kurakin et al . ( 2017 ) ) . We thus use FGSM for transfer attack in our experiments . Denoised Randomized Smoothing We also evaluate the certified robustness of the models using randomized smoothing , where the robustness is evaluated as the certified radius , and the model is certified to be robust with high probability for perturbations within the radius . We follow Salman et al . ( 2020 ) to train a DnCNN ( Zhang et al . ( 2017 ) ) denoiser Dθ for each pre-trained model f with the “ stability ” objective with LCE denoting cross entropy and N denoting Gaussian distribution : LStab = E ( xi , yi ) ∈D , δLCE ( f ( Dθ ( xi + δ ) ) , f ( xi ) ) where δ ∼ N ( 0 , σ 2I ) . ( 4 ) Randomized smoothing is applied on the denoised classifier f ◦ Dθ for robustness certification : g ( x ) = arg max c∈Y P [ f ( Dθ ( x+ δ ) ) = c ] where δ ∼ N ( 0 , σ2I ) . ( 5 ) The certified radius is then calculated for the smoothed classifier as ( Cohen et al. , 2019 ) : R = σ 2 ( Φ−1 ( pA ) − Φ−1 ( pB ) ) , ( 6 ) where Φ−1 is the inverse of the standard Gaussian CDF , pA = P ( f ( x+δ ) = cA ) is the confidence of the top-1 predicted class cA , and pB = maxc6=cA P ( f ( x+ δ ) = c ) is the confidence for the second top class . Accordingly , given a perturbation radius , the certified accuracy under this perturbation radius can be evaluated by comparing the given radius to the certified radius R .

Summary: This paper provides a comprehensive study on the robustness of ViTs against adversarial perturbations. The authors found that 1) ViTs has better adversarial robustness than convolutional neural networks; 2) Introducing convolutional or tokens-to-token blocks can improve the classification accuracy but at the cost of the adversarial robustness; 3) More proportion of transformers has better robustness; 4) Pre-training on larger datasets does not improve adversarial robustness; 5) Adversarial training is applicable to ViTs. In addition, many experiments verify the findings on white-box, transfer attack settings and adversarial training.