Understanding Sensitivity of Differential Attention through the Lens of Adversarial Robustness
Authors: Tsubasa Takahashi
Shojiro Yamabe
Futa Kai Waseda
Kento Sasaki
Venue: ICLR 2026 Poster (2026)
Keywords: Adversarial Robustness
Differential Attention
Lipschitz Continuity
Adversarial Attack
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Differential Attention (DA) has been proposed as a refinement to standard attention, suppressing redundant or noisy context through a subtractive structure and thereby reducing contextual hallucination. While this design sharpens task-relevant focus, we show that it also introduces a structural fragility under adversarial perturbations. Our theoretical analysis identifies negative gradient alignment—a configuration encouraged by DA’s subtraction—as the key driver of sensitivity amplification, leading to increased gradient norms and elevated local Lipschitz constants. We empirically validate this Fragile Principle through systematic experiments on ViT/DiffViT and evaluations of pretrained CLIP/DiffCLIP, spanning five datasets in total. These results demonstrate higher attack success rates, frequent gradient opposition, and stronger local sensitivity compared to standard attention. Furthermore, depth-dependent experiments reveal a robustness crossover: stacking DA layers attenuates small perturbations via depth-dependent noise cancellation, though this protection fades under larger attack budgets. Overall, our findings uncover a fundamental trade-off: DA improves discriminative focus on clean inputs but increases adversarial vulnerability, underscoring the need to jointly design for selectivity and robustness in future attention mechanisms.

Published as a conference paper at ICLR 2026
UNDERSTANDING SENSITIVITY OF DIFFERENTIAL AT- TENTION THROUGH THE LENS OF ADVERSARIAL Ro- BUSTNESS
Tsubasa Takahashi
Shojiro Yamabe
Futa Waseda
Kento Sasaki
Turing Inc. PInstitute of Science Tokyo
The University of Tokyo UUniversity of Tsukuba
toooass.takaaashieeee org, kento. sasaki@turing com
ABSTRACT
Differential Attention (DA) has been proposed as refinement to standard atten- tion, suppressing redundant noisy context through a subtractive structure and thereby reducing contextual hallucination. While this design sharpens task-relevant focus, show that it also introduces structural fragiliity under adversarial per- turbations, Our theoretical analysis identifies negative gradient alignment-a configuration encouraged by DA's subtraction- as the key driver of sensitivity amplification, leading to increased gradient norms and elevated local Lipschitz constants. We empirically validate this Fragile Principle through systematic experi- ments on ViT/DiffViT and evaluations of pretrained CLIPP/DffCLIIP spanning five datasets in total. These results demonstrate higher attack success rates, frequent gradient opposition, and stronger local sensitivity compared to standard attention. Furthermore, depth-dependent experiments reveal robustness crossover: stacking DA layers attenuates small perturbations via depth reethdddeendent noise cancellation, though this protection fades under larger attack budgets. Overall, our findings uncover fundamental trade-off: DA improves discriminative focus clean inputs but increases adversarial vulnerability, underscoring the need to jointly design for selectivity and robustness in future attention mechanisms.
INTRODUCTION
Recent advances in attention mechanisms have significantly enhanced the representational capacity of deep learning models, driving breakthroughs across vision, language, and multimodal domains. However, these mechanisms can sometimes lead to contextual hallucinations due to the misallocation
of attention scores (Huang et al.) 2024 Maynez et al. 2020).
The Differential Transformer eY al. 2025), introduced alongside the Differential Attention (DA) mechanism, offers promising refinement to address such misallocation issues. DA employs two distinct attention maps, A₁ and A2, and introduces a subtraction operation, A XA2, inspired by noise-cancellation techniques in signal processing. This formulation suppresses irrelevant noisy information while enhancing focus on task-relevant features. The subtraction structure encourages higher attention weights in A₁ for informative regions and lower weights in Ag for the same regions, yielding sharper and more selective outputs (Figure I(a)..
Thanks to these advantages, the Differential Transformer effectively mitigates contextual hallucina- tions in summarization and question answering tasks (Ye et al. 2025). This improvement likely stems from DA's increased selectivity for task-relevant content, aligning with prior findings (Huang et al.) 2024) that identify attention misallocation as a key cause of hallucination in standard Transformers.
These properties make DA particularly attractive for safety-critical applications, such autonomous driving, medical diagnostics, and legal document analysis, where minimizing spurious or incoher- ent model behavior essential. These advantages have already inspired a number of follow-up
studies (Abid et al. 2025 Hammoud & Ghanem 2025 Schneider et al. 2025).
"Currently with Acompany Co., Ltd. Work done while the author intern Turing Inc.

---

Published as a conference paper at ICLR 2026
Clcan Image
-
Attandion Molse
Attandion Nolae
(a) Behavior Differential Attention under Clean Samples
Clean
Adv. Noise
-
image
(b) Behavior of Differential Attention under Adversarial Samples
Figure 1: Illustration of the Fragile Principle of Differential Attention. (a) On clean inputs. well-
aligned attention maps cancel redundant focus, producing sharp and stable responses. (b) With adversarial perturbations, the gradients (red arrows) of the two attention branches may become negatively aligned, amplifying small input changes and leading to conflicting responses.
At first glance, the subtractive structure of DA may appear inherently beneficial for robustness by attenuating noisy signals, one might expect it to improve stability against adversarial perturbations well. However, does this intuition hold? In this work, rigorously challenge this assumption and show that the same structure designed to suppress noise can introduce a latent vulnerability. We formalize this phenomenon as the Fragile Principle of DA, revealing how subtractive mechanisms amplify input perturbation sensitivity and expose the model to adversarial fragility (Figure ((b)..
We theoretically show that when the gradients of the two branches are aligned in opposite direc- tions-that is, they point against each other with cos 0 < O, condition we call negative gradient alignment the subtraction amplifies the overall gradient norm and increases the local Lipschitz constant. This phenomenon, inherent to DA's subtractive design, not only reduces attention misallo- cation but also increases sensitivity to adversarial perturbations. Beyond this single-layer fragility, uncover depth-dependent robustness effeett stacking DA layers enhances robustness small perturbations via cumulative noise cancellation, though fragility re-emerges at larger budgets.
To validate this, conduct extensive experiments DA-based models trained diverse datasets, evaluating their robustness against adversarial perturbations. The results support our theoretical predictions: DA exhibits higher attack success rates, frequent negative gradient alignment, and larger local Lipschitz estimates than models with standard attention.
Contributions. Our work makes the following key contributions:
We present the first theoretical investigation of Differential Attention (DA) from the perspec- tive of adversarial robustness.
We show that DA's subtraction, while mitigating attention misallocation, structurally induces negative gradient alignment, amplifying sensitivity compared to standard attention and revealing unique adversarial vulnerability (Section
We develop a deeendeee analysis, theoretically and empirically demonstrating how cumulative noise cancellation yields partial robustness under small perturbations (Section 4
We evaluate DiffCLIP and DiffViT across multiple datasets, showing increased attack success rates, stronger negative gradient alignment, and higher local Lipschitz estimates relative standard attention (Section
RELATED WORK
Attention Robustness and Vulnerability. Transformers Vaswani et al. 2017) achieve state-of-ft oooe--of-tue the- art results across domains, yet more vulnerable to adversarial inputs than CNNs (Bai al. 2021b) Mo et al.] 2022; Jain Duttal 2024). ViTs (Dosovitskiy et al. (02T) are especially susceptible patch attacks due global receptive fields (Fu et al. 2022 Liu al. 2023). Transfer-hased
2

---

Published as a conference paper at ICLR 2026
attacks (Naseer et al. 2022; Ming al. 2024) and robustness-oriented training (Qin et al. 2022 Wang et al. 2021 show that robustness must be engineered. Differential Attention (DA) suppresses redundant signals through subtraction, but its robustness remains unexplored. While prior works aim to improve attention robustness through architectural modifications or robustness-enhancing training. work takes different perspective: analyze the intrinsic sensitivity of DA fixed mechanism, rather than proposing or comparing robustness orrentte variants.
Interpretability in Attention. The explanatory role of attention contested: some argue it fails to reflect reasoning (Jain & Wallace 2019; |eerrao & Smith 2019) Bai et al. 2021a), while others
promote sparsity or concept alignment (Martins et al. 22000; Pan al. 2021
Rigotti al. 2022).
Structured mechanisms such as Structured Attention (Niculae & Blondel 2017 aim for transparency.
but their robustness implications remain unclear.
Certified robustness often relies on Lipschitz con- straints, which bound worst-case changes. Prior work constrains attention layers (Kim al. [02T]] Dasoulas et al. 2021), stabilizes entropy (Zhai et al. 2023), or shows weight decay modulates sensi- tivity (Kobayashi et al. 2024). Other analyses examine sequence length and normalization (Castin)
Lipschitz Behavior and Gradient Sensitivity.
et al. 2024). These works suggest Lipschitz properties strongly shape robustness.
Structural Fragility and OOD Sensitivity, Beyond input perturbations, structural vulnerabilities also emerge: CNNs exhibit
sensitivity (Tsuzuku & Sato (019), and flows assign high likelihood to trivial OODs (Osada et al., (2024). These lindings underscore that architecture itself amplify dampen robustness. To our knowledge, prior work studies DA's subtractive design, which we show suppresses redundancy yet paradoxically increases adversarial fragility.
3 PRELIMINARY
In this section, briefly review the standard attention mechanism and introduce the structure of Differential Attention (DA) eYe al. 2025), which forms the basis for our theoretical analysis.
3.1 ATTENTION MECHANISM
Given an input sequence represented as matrix X E R&xxd, where N is the sequence length and d the embedding dimension, the self-attention mechanism computes the output follows:
QK VTk
Attention X) = Softmax
V.
where the query, key, and value matrices are linear projections: Q X= XW V XWV, with Wº,, WK WV E BRdx being learned parameters, and d, denoting the head dimension. The softmax operation normalizes the attention scores across the key dimension, assigning higher weights to tokens that are more relevant to each query.
3.2 DIFFERENTIAL ATTENTION
Differential Attention (DA) Ye et al. 2025) modifies the standard attention structure by introducing two parallel branches of attention maps, whose outputs are combined in a subtractive manner to suppress redundant or noisy signals. Specifically, DA computes two separate sets of query and key projections:
Q x Ki XW
Q2 =X K₂ XW
and single shared value projection V X as well as standard attention. Each branch independently computes its own attention map as
QUKI Vdle
Q2Kg Vily
A Softmax
A₂ Softmax
The output of DA is then given by:
DA(X) (A1 XA2)V,
3

---

Published as a conference paper at ICLR 2026
where À is learned fixed scalar parameter that controls the contribution of the subtractive branch. When À is trainable, its initial value is set by Anit- The default value of Aini is set to 0.8 through intensive study in (Ye et al. 2025). This structure aims to enhance semantic focus by amplifying meaningful patterns captured by A while suppressing redundant or noisy patterns captured by A2.
THEORETICAL ANALYSIS: STRUCTURAL SENSITIVITY AND ROBUSTNESS
We now provide a theoretical analysis of the sensitivity of Differential Attention (DA) to input perturbations. While DA is motivated by the goal of suppressing redundant focus through subtraction, we show that the same structure can, under specific conditions, amplify sensitivity and thereby introduce fragility.
We first examine how gradient amplification arises when the two attention branches are negatively aligned configuration that DA naturally encourages (Section[4.]) We then extend the analysis to multiple layers, where stacking can yield a depth-dependent cancellation effect (Section 4.2) Finally, discuss the scope and limitations of these results.
Notation. Let x be a clean input and x' = x + & perturbed input with small perturbation &. We analyze the sensitivity of the differential attention map ADA (x) with respect We denote by Abase the standard (non-differentiaa) attention map.
All proofs of Lemmas and Theorems are provided in Appendix A
4.1 FRAGILE PRINCIPLE: SENSITIVITY AMPLIFICATION VIA THE SUBTRACTIVE STRUCTURE
A core feature of DA is its subtractive formulation: ADA = A XA2, designed to suppress redundant or noisy attention patterns. For this subtraction be effective, the two attention maps A₁ and A2 cannot act independently; they must focus on overlapping regions but with opposing intensities (see Figure D In practice, this means that during training the model implicitly encouraged to assign gradients pointing in opposite directions to A and A2 within those regions.
Such opposite alignment is not merely a byproduct but a functional necessity: without it, the subtraction would fail to sharpen focus or remove noise. The cancellation mechanism therefore builds structural bias toward negative gradient alignment. While this property enables DA to highlight informative regions more clearly than standard attention, it also raises the possibility that the same mechanism could amplify sensitivity to perturbations. Our analysis begins from this structural observation and investigates its consequences for robustness.
Lemma 1. Let 0 be the angle between the input gradients of A and A2. Then,
A A211 2 V cos
The cross-term becomes positive whenever cos < 0, causing gradient amplification. Theorem (Sensitivity Amplification by Alignment). Let p / VgAil.. Then,
IV = |V (1 x 2os
Asymptotically,
if cos 0 +1, 1((111 Ap) Ai||
(1 Xp)
| A1
(2)
if cos = -.
Thus, under negative alignment (cos 0 < 0), DA inherently amplifies perturbation sensitivity. This fragility arises not by accident but as a structural byproduct of DA's cancellation goal.
We now compare DA'S sensitivity to that of standard attention maps.
Theorem 2 (Relative Sensitivity to Standard Attention). Let ApA = Ai - XAg and Abaso be standard attention. Define 7 [
VeAill
Then,
V ADAl
TV 1 X2 2Ap
(3)
V Anase
with maximum attained when cos 0 -1 and minimum when cos 0 +1.
4

---

Published as a conference paper at ICLR 2026
Theorem (Existence of Amplifying Perturbations).
There exists perturbation & such that
IV ADAll
1 + x2 -
if and only if cos A
V Abase
2Xp
This condition delineates the (p, ()) region where DA exhibits strictly higher sensitivity than standard attention. Since and 0 can be adversarially controlled, DA's subtractive design exposes a structural vulnerability.
Implication for Lipschitz constants. To assess how the above gradient amplification affects robustness, we consider the local Lipschitz constant. which captures the worst-case sensitivity of the attention map to small perturbations. Relating DA's gradient behavior to Lipschitz continuity reveals that subtraction structurally shifts sensitivity upward, often increasing local Lipschitz values and weakening robustness.
Building on the definition of the local Lipschitz constant,
|A(x + A
L(x)
sup E
1151
we derive the following bound:
Lemma 2. Let LDA (2) and Lowe (z) be the local Lipschitz constants of ADA and A Then,
LDA(Z)) (2) Liaas (x)
57V1+ X2p² 2Apcos
This inequality shows explicitly how the subtraction weight À and the gradient alignment angle together govern DA's local sensitivity. We further analyze the certifiable robustness radius in Appendix B extending this discussion.
4.2 DEPTH-DEPENDENT ROBUSTNESS VIA NOISE CANCELLATION
Noise cancellation as structural property of DA. DA is designed with a subtractive form, ADA A1-XAg which suppresses components common to both A₁ and A2. This noise cancellation effect is independent of gradient alignment: it does not rely whether VA₁ and VA2 are aligned or anti-aligned, but rather on the structural subtraction that systematically reduces shared activations or perturbations. The strength of this effect is governed primarily by the coefficient X.
Accumulation across depth. When DA layers are stacked, this cancellation compounds: shared noise that survives one layer is more likely to be attenuated again in subsequent layers. In contrast, standard attention lacks such a subtractive mechanism, so its effective perturbation propagation is closer simple accumulation across depth. Formally, if f(d) denotes the d-th DA layer with local Lipschitz constant - and (d)) E (0, 1] denotes the average reduction factor from noise cancellation at layer d, then
| ( S (d)
L 1A A (d-1)
A (0)
Consequence (upper bound). By recursion, let F o...... (1) denote the D-layer composition. Then,
D III
[Fxx + - F(x)l &
a Lod
|Ell = (ā LDA) |[[]|
(5)
where & and LDA denote the geometric means across layers. If aLDA 1, small perturbations attenuated with depth, yielding robustness gains that are specific to DA.
We note that is not an independent hyperparameter but rather an emergent factor that is influenced by as well as the distribution activations across layers. Intuitively, larger À magnifies the subtractive partially cancelled across layers, and
effect, making it statistically more likely that perturbations thus biases a downward. However, the exact value of a is also shaped by training dynamics, and cannot be reduced to deterministic function of X.
5

---

Published as a conference paper at ICLR 2026
Theorem 4 "Depth-eppnnde Sensitivity of Standard Attention vs. DA), For standard attention, perturbations propagate as
|| S (L
with no cancellation effect (a 1), unlike DA's structural differentiation. For DA, the bound becomes
|| S (a TDA)
where ä < reflects structural noise cancellation.
Corollary (Crossover in Robustness). If LDA Lrase (DA locally more sensitive) but < 1 (nontrivial cancellation), then there exists depth threshold D such that
(a LDA) (Loase) D"
For D D*, DA is more fragile than standard attention; for > D" DA becomes asymptotically more robust.
Interpretation. This analysis highlights two independent mechanisms in DA: (i) negative gradient alignment, which locally amplifies fragility, and (ii) noise cancellation, which systematically attenu- ates shared perturbations and strengthens with depth. The coexistence of these forces explains why DA can appear fragile at shallow depths yet exhibit improved robustness when scaled deeper. In particular, perturbations amplified in early layers do not propagate unchanged: each subsequent DA layer introduces its own cancellation step. the perturbation energy progressively reduced as depth increases. This cumulative attenuation provides a simple explanation for the empirical trend we observe- strong fragility in shallow models and partial robustness in deeper stacks without requiring additional architectural assumptions.
4.3 LIMITATIONS OF THE THEORETICAL ANALYSIS
While our analysis offers structural understanding of the sensitivity amplification in DA, it is based on few simplifying assumptions that may not always hold in practice:
Local linear approximation via input gradients. Our derivation relies on local gradient- based sensitivity-i.e.. assuming that local behavior of ADA can be well- apel-aaprox by its gradient. This is valid under small perturbations, but may not fully capture global nonlinear effects in deep networks. This local first-order assumption follows the standard practice in prior analyses attention robustness (e.g., Kim et al.] (2021); Dasoulas et al. (2021)) which similarly characterize sensitivity through gradients under small perturbations. This regime matches typical adversarial settings (e.g., PGD or CW with < 8/255), where first-order effects dominate the model's response. Our theoretical results should therefore be interpreted as local sensitivity characterizations rather than global guarantees.
Layer isolation. We analyze DA in isolation, holding other network layers fixed. In practice, interactions with downstream modules may either mitigate or exacerbate sensitivity.
These assumptions common in robustness analyses. They clarify how DA's design induces fragility, but also underscore the need for empirical validation (Section
5 EXPERIMENTS
We conduct extensive experiments to validate our theoretical analysis of the Fragile Principle in DA. Specifically, we evaluate: (i) adversarial vulnerability measured by attack success rate (ASR), (ii) the frequency of negative gradient alignment (cos( ( Ve A2) < 0), and (iii) empirical estimates of the local Lipschitz constant. We also examine how these effects vary with model depth.
Scope of our evaluation. Our experiments are designed to isolate the architectural effect of DA's subtractive structure. For this reason, we train and evaluate each model on the same dataset and do not incorporate robustness- saanttess-eehancingg training schemes, which would change many other aspects of the representation and thus confound the analysis of DA itself. Similarly, we focus on well-established and broadly used attack baselines (PGD (Madry al. 2018), AutoAttack (Croce & Hein 2020b), Carlini Wagner (CW) (Carlini & Wagner (017)) rather than task- or model speciifcc adversarial methods, since the latter may introduce additional factors unrelated to the mechanism study.

---

Published as a conference paper at ICLR 2026
1.0
1.0
DMCC IP imageewe
neiir in noco CLI.. coco
Imageret
0.3
DITMIT CIFARIO
0.8
0.8-
CINARRO
VIT CIFARLOD
0.7
0.5
opollon be 1/255)
epellon Ix 1/255)
(a) DifIViT and ViT under Adversarial Examples
(b) DifICLIP and CLIP under Adversarial Examples
1.0
Rete
0.9
0.9
0.5-
DHIWIT (CIFAR-100)
0.8
DITICLIP
0.4
(CIFAR1100]
CUP COCO
DITICPP, imaganet
0.2
VIT (CIFAR-10)
0.7
CUP Imagenet
Adverseria Patch
Adversaria Patch
(c) DiffViT and ViT under Adversarial Patches
(d) DifICLIP and CLIP under Adversarial Patches
Figure 2: ASR under Adversarial Examples and Patches crafted with PGD. DiffVIT and DiffCLIP generally exhibit higher or comparable ASR compared to standard attention, with the gap most pro- nounced in small-class datasets (CIFAR and COCO), while narrowing on large-scale ones (Imagenet).
5.1 EXPERIMENTAL SETUP
Models. We evaluate two classes of models: (1) ViT and DiffViT trained from for controlled studies, and (2) pre-trained CLIP (VIT-B/16) (Radford et al. 202T) and its DA-based variant DiffCLIP (Ham- moud & Ghanem 2025). The ViT/DifIVIT models are lightweight transformers with a D-layer Attention or Differential Attention (DA) module, where D E {1, 2, 4,8, 12). Unless otherwise stated, we use D = 1. The subtraction coefficient X is initialized at Aunit = 0.8 and updated during training, following YYe al. 2025). DiffCLIP extends CLIP by replacing standard attention with DA, while preserving CL.IP's contrastive training objective between image and text. This substitution allows DifICLIP to suppress redundant activations and sharpen focus on discriminative regions. In addition, (Hammoud & Ghanem 2025) introduce DifIVIT, ViT variant that employs DA.
Datasets. For ViT and DifIViT, we train on CIFAR-10 10 and CIFAR- (Krizhevsky) 2009), consisting of 10 and 100 classes of 32 x 32 natural images. We also include Tiny ImageNet (Le & Yang 2015)
for ViT and Dif with depth 4, with results reported in Appendix. For CLIP and DifíCLIP, we use the MSCOCO 2014 validation set (Lin et al. (014) (40k images annotated by 80 categories) and the ImageNet- 1k validation set (Deng et al. 2009) (50k images across 1,000 categories).
Adversarial Attacks. We consider PGD (Madry et al. 2018), Carlini-Wagner (CW) (Carlini & Wagner 2017), and AutoAttack (AA) (Croce & Hein 2020b). PGD is applied both as an adversarial example attack and an adversarial patch attack. For CLIP and DiffCLIP, perturbations minimize the cosine similarity between the perturbed image encoding @visual (x + o) and its text prompt embedding (hest()) where / is class description (e.g.. "a photo of <class>"). For ViT and DiffViT, perturbations instead minimize cross cros--yy loss to induce misclassification. PGD and AutoAttack are constrained under foo norm, while CW applied under Ez. Patch attacks restrict 8 to square of size w x w at random image location.
All experiments are run on single NVIDIA H100 GPU. Implementation details and hyperparameters are provided in Appendix C
5.2 ATTACK SUCCESS RATE
To assess adversarial vulnerability, we compute the attack success rate (ASR):
ASR
#successful attacks
Itrials
Since we focus on untargeted attacks, a perturbation successful it changes the prediction relative to the clean input.
7

---

Published as a conference paper at ICLR 2026
Table Attack success rates and clean accuracy of DiffViT on CIFAR-10 when varying Ainit ASR
increases with Ainit up to 0.8, Beyond that point, ASR drops, suggesting over-cancellation.
Ainit
0.5
0.7
0.8 (default)
0.85
0.9
0.95
Accuracy
0.8605
0.8697
0.8700
0.8567
0.8524
0.8468
ASR (c 1/255)
0.4074
0.6772
0.8498
0.7531
0.4956
0.4164
1.2
1.0
0.9-
0.5
VIT 472--
IMMV 1/34
1225511255
0.5
DIIVIT 4eppm425555
47L595542255
DIMVI 1/2-1/25
0.7-
0.7
0.6
2
10
Model Depth
Model Depth
(a) ASR under PGD
(b) ASR under AutoAttack
0.55
Hessnn Local Liprttt
0.:0
DRIVIT CINARIO
DIIVIT CIPARIGO
DIVIIT, CIFAR10
DIPVIT, CIFAR100
CIFAR1O
CIFAR100O
2
10
2
0
10
12
Mode Depth
Model Depth
(c) 1.2 Norm of Perturbation under CW
(d) Mean Local Lipschitz
Figure 3: Depth-dependent effects of DA. (a) (b) Under PGD and AutoAttack, DA is fragile at
depth 1-2, but ASR drops with depth for e=1 /255 4=//555 both converge high ASR. (c) Under CW-L2, deeper models require larger perturbations to reach 100% ASR. (d) Mean local Lipschitz estimates over all layers rise with depth, indicating higher local sensitivity.
Controlled Study on VIT/DifVVIT (Single Layer), Figure ((a) and ( show ASR under adversarial examples and patch attacks, respectively. Across all cases, DiffViT exhibits higher ASR than ViT, consistent with the Fragile Principle. We also vary Ainit. which controls the subtraction strength in DA. Table shows ASR on CIFAR-10 increases steadily up to Ainit = 0.8, after which declines, suggesting over-subtraction reduces vulnerability.
Controlled Study on VIT/DITVVI (Multiple Layers). Our theory predicts that although a single DA layer embodies the Fragile Principle by amplifying sensitivity, stacking layers reverses this trend through a cancellation effect, producing depth-dependent robustness. Figures support this: under CW, deeper DiffVITs require larger perturbations to reach ASR=100% (Fig. B(.). Under PGD and AutoAttack, those ASRs are highest at depth but decreases with depth for c=1 /255, surpassing VIT's robustness (Fig. ((a);: 4/255, both saturate at high ASR. We report additional experiments on Tiny ImageNet in Appendix D.I which show the same trend.
Pretrained Models (CLIP/DiFCC.IP), Figure 2(b) and [ddrrepon ASR for CLIP and DiffCLIP evaluated on COCO and ImageNet. On COCO, DiffCLIP consistently shows higher vulnerability across perturbation budgets and patch sizes, supporting the Fragile Principle. On ImageNet, results are more nuanced: under adversarial examples, DiffCLIP remains slightly more vulnerable, whereas under patch attacks CLIP marginally outperforms DiffCLIP, though the difference is small. This suggests that dataset scale and diversity can modulate the manifestation of DA's fragility.
5.3 SENSITIVITY AMPLIFICATION UNDER PERTURBATIONS
We next test whether DA amplifies local sensitivity. We estimate the local Lipschitz constant 4 sampling & uniformly from l- bounded noise with ||E|| < 8/255.
Figure 3(d) reports the mean local Lipschitz estimate, computed by averaging the local Lipschitz constants across all layers of each model. We observe that deeper DiffViT models consistently yield
8

---

Published as a conference paper at ICLR 2026
Upschitz Ee:
0.15
0.10
DIFCLIP
CLIP
CIMMT
VIT
DETVIT
0.05
0.5
0.00
5 6
9
10
11
12
1-h Attention Layer
(a) DifiCLIP and CLIP
(b) CIFAR-10
CIFAR-100
Figure 4: Mean Lipschitz estimates of attention layers under imput perturbations. Models incorporat- ing DA exhibit the highest values among all attention layers, particularly at layers with larger
1.0
Ratlo of 0058
Rabio
1
3
6
9
10
11
12
Layer
DA
1th DA Layer
(a) DiffCLIP
(b) CIFAR-10
(c) CIFAR-100
Figure 5: Frequency of negative gradient alignment (cos( V A1, V
<
0) at each layer.
higher pay-layer Lipschitz values, indicating that local sensitivity increases with depth. Figure44further compares ViT/DiffViT and CLIP/DifiCLIP. In settings, DA-equipped models exhibit significantly higher Lipschitz estimates than baselines, with maxima at layers using larger A. Interestingly, later layers often display lower sensitivity than earlier ones, suggesting that the cumulative dynamics of DA distribute perturbation effects unevenly across depth rather than simply compounding them. The wider spread of values in DA models highlights their more variable sensitivity across layers.
These results confirm that DA's subtractive design can both amplify and reduce sensitivity, aligning with our theoretical claims. The amplified sensitivity facilitates adversarial perturbations, underscor- ing risks in safety-critical critical domains.
5.4 NEGATIVE GRADIENT ALIGNMENT DIFFERENTIAL ATTENTION
Finally, we examine whether DA structurally induces negative gradient alignment. For perturbations & bounded by || < 8/255, we compute cosine similarity between gradients Aç and Vę and record the frequency of cos < O.
summarizes results. In DifICLIP, negative alignment is strongest in the first layer but still present deeper. For CIFAR-traine ViT/DiffViT, even the simplest single-layer variants show dominant negative alignment.
Figure 5
Thus, negative gradient alignment is not rare anomaly but structural property of DA, providing direct empirical evidence for the Fragile Principle.
DISCUSSION AND LIMITATION
Summary of findings. Our study reveals structural trade-off at the heart of Differential Attention (DA). While its subtractive design sharpens task-relevant focus and reduces contextual hallucination, also inherently amplifies sensitivity when the two branches exhibit negative gradient alignment. This Fragile Principle manifests increased local Lipschitz constants, higher attack success rates, and frequent opposing gradient flows. At the same time, our depth-dependent analysis shows that DA models gain robustness small perturbation budgets when stacking layers, owing to the cumulative effect of noise cancellation across depth. However, this protection diminishes as perturbation strength grows.
Limitations. Our theoretical analysis relies on local linearization and isolates the attention mechanism from other layers. These assumptions clarify the structural role of subtraction but may not capture

---

Published as a conference paper at ICLR 2026
full nonlinear interactions. Moreover, exploration of the subtraction weight À was limited to initialization; a fuller study of its training dynamics remains open. Another limitation lies in the controlled nature of our experiments. Since our aim is to isolate the srechanism-speciffe behavior of DA, we focus on small, gradient-based perturbations and do not evaluate robustness under natural semantic adversarial examples (e.g., distribution shifts, physical noise, natural-adversarill image curation). These factors introduce complex, task- and dataset-dependent effects that can obscure the structural phenomena we analyze. Extending DA's sensitivity analysis such real-world perturbations is an important direction for future work, but is deliberately outside the scope of our mechanism-leve study.
Future directions for robustness. Several avenues could mitigate DA's fragility. First, careful tuning of \ offers trade-off between noise suppression and adversarial robustness, as suggested in Table [ Second, our results suggest that increasing DA depth itself can serve as a lightweight mitigation: deeper models required larger perturbations under CW and exhibited lower ASR under PGD/AA at small budgets, though this advantage disappears under stronger attacks (Fig. 3). Third, adversarial training with small perturbations reduced ASR (Appendix D.2). showing compatibility with standard defenses. Finally, view DA natural candidate for integration with certified defenses, where its selective subtraction could complement Lipschitz- based guarantees.
Overall, this work highlights both the promise and the fragility of subtractive attention mechanisms, and we hope it inspires future designs that preserve DA's discriminative focus while mitigating its structural vulnerability.
7 CONCLUSION
We analyzed Differential Attention (DA) and revealed a structural fragility that arises under adversarial perturbations. While DA sharpens focus and suppresses contextual hallucination on clean inputs, its subtractive design can amplify local sensitivity via negative gradient alignment, This fragility reflects fundamental trade-off: DA's discriminative benefits may come at the cost of adversarial vulnerability. We validated this trade-off through gradient alignment analysis, local Lipschitz estimation, and experiments. Importantly, our results show that increasing DA depth can naturally mitigate small perturbations via cumulative noise cancellation, although this effect diminishes under stronger attacks. These insights highlight the need to jointly consider clean performance, adversarial robustness, and architectural depth when designing future attention mechanisms.
Ethics Statement. This work focuses the theoretical and empirical analysis of Differential Attention (DA) under adversarial perturbations. Our study does not involve human subjects, personal sensitive data, any identifiable information. All datasets used in this paper publicly available benchmarks (CIFAR- 12-10/1000 Tiny ImageNet, MSCOCO, ImageNee--le Ik) that are widely adopted in the research community and collected under ethical and legal guidelines. While our analysis reveals structural vulnerabilities in DA, the goal is to advance understanding of robustness in attention mechanisms and inspire more resilient designs. We do not foresee direct harmful applications of these findings, rather, highlighting DA's fragility is a necessary step toward safer deployment in safety-critical domains such as autonomous driving or medical AI.
Reproducibility Statement. We have taken care ensure the reproducibility of our results. All model architectures, training setups, and hyperparameters are described in the main text and Appendix C For theoretical contributions, assumptions are explicitly stated, and proofs of lemmas and theorems are provided in Appendix [ For empirical evaluation, we detail dataset specifications (CIFAR-10/100, Tiny ImageNet, MSCOCO, ImageNet- 1k) and attack configurations (PGD, CW, AutoAttack), including perturbation budgets and norm constraints. Results are consistently reported across multiple datasets and model configurations (e.g., depth, À initialization) support robustness of conclusions. Figures and tables in the main text and Appendix provide complete experimental outcomes, ensuring transparency and replicability.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Mian Muhammad Naeem Abid, Nancy Mehta, Zongwei Wu, and Radu Timofte. Dataformer: Differential additive transformer for lightweight semantic segmentation. In IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, CVPR Workshops 2025, Nashville, TN, USA, June 11-15, 2025, pp. 820-831, 2025.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: A query-efficient black-box adversarial attack via random search. In Computer Vision ECCV 2020 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXIII, pp. 484-501, 2020.
Bing Bai, Jian Liang, Guanhua Zhang, Hao Li, Kun Bai, and Fei Wang. Why attentions may not be interpretable? KDD '11 The 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Virtual Event, Singapore, August 14-18, 2021. pp. 25-34, 2021a.
Yutong Bai, Jieru Mei, Alan L. Yuille, and Cihang Xie. Are transformers more robust than cnns? In Advances in Neural Information Processing Systems 34: Annual Conference Neural Information Processing Systems 2021, NeurlPS 2021, December 6-14, 2021, virtual, pp. 26831-268443 202
Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privucy, SP 2017, San Juse, CA, USA, May 22-26, 2017, pp. 39-339--55 2017.
Valérie Castin, Pierre Ablin, and Gabriel Peyré. How smooth attention? In Forty-firs International Conference Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024, pp. 5817-5840, 2024.
Soravit Changpinyo, Piyush Sharma, Nan Ding, and Radu Soricut. Conceptual 12m: Pushing web-scale image-text pre-training to recognize long-tail visual concepts. IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, pp. 3558-3563 2021.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, pp.
2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, pp. 2206-2216 2020b.
George Dasoulas, Kevin Scaman, and Aladin Virmaux. Lipschitz normalization for self-attention layers with application to graph neural networks. In Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, pp. 2456-2466. 2021.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR 2009), 20-25 June 2009, Miami, Florida, USA, pp. 248,2555,100 2009.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021, 2021.
Yonggan Fu, Shunyao Zhang, Shang Wu, Cheng Wan, and Yingyan Lin. Patch-fool: Are vision trans- formers always robust against adversarial perturbations? In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022, 2022.
Hasan Abed Al Kader Hammoud and Bernard Ghanem. Diffelip: Differrntial attention meets CLIP.
Trans. Mach. Learn. Res., 2025, 2025.
11

---

Published as a conference paper at ICLR 2026
Qidong Huang, Xiaoyi Dong. Pan Zhang, Bin Wang, Conghui He, Jiaqi Wang, Dahua Lin, Weiming Zhang, and Nenghai Yu. OPERA: alleviating hallucination in multi-modal large language models via over-trust penalty and eetroppctiionaalloattie and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024, pp. 13418-13427, 2024.
In IEEE/CVF Conference Computer Vision
Samyak Jain and Tanima Dutta. Towards understanding and improving adversarial robustness of vision transformers. In JEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024, pp. 14736-247443 2024.
Sarthak Jain and Byron C. Wallace. Attention is not explanation. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. NAACL-HLT 2019, Minneapolis, MN, USA, June 2-7, 2019, Volume 1 (Long and Short Papers), pp.
2019.
Hyunjik Kim, George Papamakarios, and Andriy Mnih. The lipschitz constant of self-attention. In Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, 2021.
Seijin Kobayashi, Yassir Akram, and Johannes von Oswald. Weight decay induces low-rank attention layers. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 15, 2024, 2024.
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009.
Yann Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3, 2015.
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. Microsoft COCO: common objects in context. In Computer Vision ECCV 2014 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V. pp. 740-755, 2014.
Liang Liu, Yanan Guo, Youtao Zhang, and Jun Yang. Understanding and defending patched-based adversarial attacks for vision transformer. In International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, pp. 21631-21652 2023.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver. BC, Canada, April 30 May 3. 2018, Conference Track Proceedings, 2018
André T. Martins, António Farinhas, Marcos V. Treviso, Vlad Niculae, Pedro M. Q. Aguiar, and Mário A. T. Figueiredo. Sparse and continuous attention mechanisms. In Advances in Neural Information Processing Systems 33; Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020.
Joshua Maynez, Shashi Narayan, Bernd Bohnet, and Ryan T. McDonald. On faithfulness and factual- ity in abstractive summarization. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, ACL 2020, Online, July 5-10, 2020, pp. 1906-1919, 2020.
Di Ming, Peng Ren, Yunlong Wang, and Xin Feng. Boosting the transferability of adversarial attack on vision transformer with adaptive token tuning. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 -0-17 15, 2024, 2024.
Yichuan Mo, Dongxian WU, Yifei Wang, Yiwen Guo, and Yisen Wang. When adversarial training meets vision transformers: Recipes from training to architecture. In Advances in Neural Information Processing Systems 35: Anmual Conference on Neural Information Processing Systems 2022,
NeurlPS 2022, New Orleans, LA, USA, November 28 December 9, 2022, 2022.
12

---

Published as a conference paper at ICLR 2026
Muzammal Naseer, Kanchana Ranasinghe, Salman Khan, Fahad Shahbaz Khan, and Fatih Porikli. On improving adversarial transferability of vision transformers. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022, 2022.
Vlad Niculae and Mathieu Blondel. A regularized framework for sparse and structured neural attention. In Advances in Neural Information Processing Systems 30: Annual Conference Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, pp- 3338-3348, 2017.
Genki Osada, Tsubasa Takahashi, and Takashi Nishide. Understanding likelihood of normalizing flow and image complexity through the lens of out-of-distribution detection. In Thirty Thirty-Eighth AAAI Conference on Artificial Intelligence, AAAI 2024, Thirty-Sixthe Conference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2014, February 20-27, 2024, Vancouver, Canada, pp. 21492-21500, 2024.
Bowen Pan, Rameswar Panda, Yifan Jiang, Zhangyang Wang, Rogério Feris, and Aude Oliva. Ia- red$ Interpretability-wwarr redundancy reduction for vision transformers. In Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurlPS 2021, December 6-14, 2021, virtual, pp. 24898-24444 2,911, 2021.
Yao Qin, Chiyuan Zhang. Ting Chen, Balaji Lakshminarayanan, Alex Beutel, and Xuezhi Wang- Understanding and improving robustness of vision transformers through patch-based negative augmentation. In Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA, November 28 December 2022, 2022.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, pp. 8748-872 8763, 2021.
Mattia Rigotti, Christoph Miksovic, Ioana Giurgiu, Thomas Gschwind, and Paolo Scotton. Attention- based interpretability with concept transformers. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022, 2022.
Nadav Schneider, Itamar Zimerman, and Eliya Nachmani. Differential mamba. In Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics, IJCNLP-AACL 2025, Mumbai, India, December 20-24, 2025, pp. 2561-2575, 2025.
Sofia Serrano and Noah A. Smith. Is attention interpretable? In Proceedings of the 57th Conference of the Association for Computational Linguistics, ACL 2019, Florence, Italy, July 28- August 2, 2019, Volume 1: Long Papers, pp.
2019.
Yusuke Tsuzuku and Issei Sato. On the structural sensitivity of deep convolutional networks to the directions of fourier basis functions. In IEEE Conference Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA. USA, June 16-20, 2019, pp. 51-60, 2019.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz. Kaiser, and Illia Polosukhin. Attention all you need. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, pp. 3998-6008 2017.
Boxin Wang, Shuohang Wang, Yu Cheng, Zhe Gan, Ruoxi Jia Bo Li, and Jingjing Liu. Infobert: Improving robustness of language models from an information theoretic perspective. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021, 2021.
Ross Wightman. Pytorch image models.
https: com/ www/rwiggtman.
pytorch- mage- modemoodelg 1 2019.
13

---

Published as a conference paper at ICLR 2026
Tianzhu Ye, Li Dong, Yuqing Xia, Yutao Sun, Yi Zhu, Gao Huang, and Furu Wei. Differential transformer. The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025, 2025.
Shuangfei Zhai, Tatiana Likhomanenko, Etai Littwin, Dan Busbridge, Jason Ramapuram, Yizhe Zhang, Jiatao Gu, and Joshua M. Susskind. Stabilizing transformer training by preventing attention entropy collapse. In International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, pp. 40770- 2023.
14

---

Published as a conference paper at ICLR 2026
A PROOF OF THEORETICAL CLAIMS
This section provides complete proofs of the lemmas and theorems presented in Section
4
A. PROOF OF LEMMA
Proof. Let 0 be the angle between the input gradients of A₁ and A2, i.c., cos From the definition of DA, ADA A AA2. we compute its gradient with respect to input perturbation & ADA VęAi AV Taking the squared norm:
(V. A.
A
ADAl2 \V V
22 A1, VgA2)
AV 2| + A2 Alll cos
A.2 PROOF OF THEOREM 1
Proof. By substituting p= Ve into the result of Lemma 1, we obtain:
Vę == [| (1 2²p² 2Apcos
Case 1: If cos 0 +1 (aligned gradients), then:
V ADA 2 / (1 + X²p² 2 2Ap) 1V 11
Case 2: If cos 0 = -1 (oppositely aligned gradients), then:
| ADeAAxll /V + x²p² 2Xp) = |V || A
A.3 PROOF OF THEBREM 2
Proof. Now define Y = /VAAil///V Abwell- Substituting this into the expression derived in Theorem 1, we get:
IV - > Absse 2| (1+ + x²p² - cos 8).
Taking square roots on both sides gives the desired result (3. Finally, note that this expression is minimized when cos 0 = +1 (fully aligned), and maximized when cos 0 = - (fully opposed), as the cross term- - 2Xp cos f becomes most negative or positive, respectively.
A.4 PROOF OF THEBORM 3
Proof. Let consider the set of perturbations & with ||E|| S c. Since the gradients VçA1 and 4 vary continuously with direction, there exists a direction of within this c-ball such that the angle f satisfies the required condition. Thus, if the inequality cos 1+ is satisfied for some 2Ap
value of 0 (i.e., some {), then such a direction & with |g| S exists, as the set of possible angles 0 spans continuous range this ball. Since varies continuously with &, and cos 0 spans continuous range, the intermediate value theorem ensures the existence of such a E.
A.5 PROOF OF LEMMA 2
Proof. Recall that the local Lipschitz constant of function f at input x is defined as: Ly(x) ((a+))-f(xl)) If is differeentablee at x, then: Ly(x) < [+))f( We apply this to the attention maps. Since Apa is differentiable almost everywhere, we have: (xr( (Dx)Dx())] Similarly, Loase (2) < V Abase
Su #u [[E||
Now. from Theorem 2, we already have the following relationship:
Ve [
7V1 + X22 2Ap cos O. Using the fact that the Lipschitz constant is upper-bounded by the gradient [m)(a)
norm: Zaw (z)
< [[))
Vedum
= X2p² cos
15

---

Published as a conference paper at ICLR 2026
A.6
PROOF OF THEOREM 4
For standard attention, the layerwise deviation satisfies
- base
(d)
A (d
which unrolls to
|A S
II d=1
||E|| (Lraase PIEE--
buse
For DA, the subtractive form introduces an additional contraction factor ( (0, 1] per layer, giving
| | S a
(d)
A (1-
Thus
D (II d=1
|A
|k = (ā LDA) IEll,
DA
where ā and TDA denote geometric means. Since DA's subtractive structure systematically biases (d) 1, this establishes the stated bound.
B ROBUSTNESS CERTIFIABLE RADIUS
Robustness Certifiable Radius. Further, Lipschitz continuity is central to robustness certification. For classifier f, the certified radius around input æ is Lower-bounder as:
R(x) Fx(x) maxisy Fi(x)
Lx(xx)
where Fi(x)) are the class logits, y is the true label, Fy is the logit for the correct class, and (x) the local Lipschitz constant. The numerator the classification margin, and the denominator reflects input sensitivity.
The Lipschitz constant of the entire model can be upper-boundee by the product of the per-layer (f) (ar). Since we compare models that differ only in the attention layer, constants (x) < <II'= 4
treat all other (x) fixed, isolating the contribution of the attention mechanism to the overall sensitivity. Thereby yielding the following theorem about the certified radius.
Theorem S. Let (x) and (x) be the certified radius for classifier f incorporating DA and standard attention, respectively. Assume that all per-layer Lipschitz constants (.(3)(x) (xx) except for the attention layer identical between the two models, isolating the effect of the attention mechanism. Then, the ratio of certified radii satisfies:
RDA (x)
Am
66
R (x)
7V1 X2p - 2op 0
where MIDA is the classification margin under DA, and Am
In particular, under the opposite
Mas
alignment cos 0 = 1,, the bound admits the asymptotic form O
Am 7(++Xp)
Proof. Now, using the definition of certified radius and margin ratio Am =
we compute:
RDA(I' MDAA LIDAZZ) Am Lbase (2) TDbasee Lruse (x)
Rhose (x)
LDA (x)
Then applying the Lipschitz ratio bound derived in Lemma 2, we finally have the claim 6
This formulation illustrates a key trade-off in DA: while the subtractive mechanism can sharpen focus and modestly inerease classification margins (i.e., Am 1), it also amplifies local sensitivity through the 7 7 X2p² 2Ap cos 0 factor particlaalll under negative gradient alignment. Since
16

---

Published as a conference paper at ICLR 2026
this amplification often outweighs the margin gain, the certified robustness deteriorates, as reflected in shrinking certified radius.
Here, while r and À are fixed constants, both Am, p and & depend the perturbation direction & and can thus be influenced by an adversary. This implics that an attacker may reduce the certified radius by manipulating p (e.g., increasing gradient asymmetry) suppressing the margin MDA through targeted perturbations.
C IMPLEMENTATION DETAILS
This section describes the implementation details of our experiments to ensure reproducibility.
C.I TARGET MODELS
DIfICLIP (Hammoud & Ghanem 2025)
extends CLIP (Radford al. 2021 by replacing standard self-attention with Differential Attention (DA). It retains CLIP's s original contrastive training objective between images and text, while using DA to suppress redundant activations and enhance focus on discriminative regions. Additionally, (Hammoud & Ghanem (025) introduces DifIViT, vision transformer variant that incorporates DA into ViT architectures.
DiffCLIP and CLIP. We use the pre- preitrrined weights of DiffCLIP VITB16. VVTB16_CC12M released by (Ham moud & Ghanem 2025), which are trained on CC12M (Changpinyo al.) 2021) datasets. The authors have also publicly released the corresponding CLIP models via their HuggingFace repository
DiffVIT and ViT. For ViT, we adopt the architecture provided in the s mm library (Wightman] 2019)
and train it on CIFAR- 10 and CIFAR-100. We implement DifVIT following the design in (Hammoud
Ghanem 2025) and train on the same datasets. We train the models for 100 epochs on CIFAR-I0
and 300 epochs CIFAR- 1-00 using the Adam optimizer with a learning rate of 5 x 10-4 and batch size B 128.
C.2 ADVERSARIAL ATTACKS
C.2.1 PGD
We evaluate adversarial robustness using both adversarial patch attacks and adversarial examples, optimized via Projected Gradient Descent (PGD) (Madry et al. 2018) under Loo norm constraints.
For CLIP and DifPCLIP, the attack objective is to break the semantic alignment between visual and textual representations. We minimize the cosine similarity between the perturbed visual embedding and its associated text prompt:
min cos (Avisual (x 8), Prexi
where æ the input image, t the class prompt (c.g., "a photo of <class>"), and @ Heex denote the visual and text encoders, respectively.
For ViT and DiffVIT on CIFAR- 10/100, the attack instead minimizes the (negative) cross-entropy loss induce misclassification.
In the adversarial patch setting, the perturbation constrained to a fixed-size square patch of dimension x inserted random location in æ. We set 1.0 and vary the patch size w.
C.2.2 AUTOATTACK
AutoAttack is an ensemble adversarial evaluation framework that combines four complementary attacks: APGD-CE, APGD-DLR, FAB (Croce & Hein 2020a), and Square Attack (Andriushchenko al. 2020). This combination provides a strong and diverse set of adversarial perturbations for robustness evaluation. We employ the official AutoAttack implementation available at GitHut?
httras///uuggingfcccccooo
otwp:ffffllppocpcfooooooooo 67cd8d33776666 Sea ( cc26:d993
https:://gfthbb..om///331//
17

---

Published as a conference paper at ICLR 2026
C.2.3 BELLINI-WAGNER (CW) ATTACK
The Carlini-Wagner attack (Carlini & Wagner 2017) is a strong optimization-base adversarial method that searches for minimal perturbations capable of inducing misclassification. Unlike iterative gradient-based methods such as PGD, CW directly formulates the attack as a constrained optimization problem under &g norm. We use PyTorch implementation based on the open-source repository
D ADDITIONAL EXPERIMENTAL RESULTS
D.1 ASR ON TINYIMAGENET
On Tiny ImageNet (Table 2). we observe a consistent pattern: DiffVIT shows higher ASR than VIT across patch sizes and small & budgets. The gap is most pronounced at e-1/255. At larger budgets (e=4/255), the two models converge, echoing the cancellation-ffagiliy tradeoff seen in CIFAR experiments.
Table 2: ASR on TinylmageNet under PGD) Attacks
Model
patch=8
patch=4
patch=2
4/255
2/255
1/255
0.5/255
DifTViT
0.6465
0.4556 0.4072
0.1834 0.1498
0.6318
0.3866 0.3857
0.2822 0.2309
0.2364
VIT
0.6139
0.6490
0.1866
D.2 ADVERSARIAL TRAINING
In addition to balancing the structural trade-off inherent DA, complementary robustness strategies can be applied. Adversarial training offers a complementary strategy that orthogonal to DA's subtractive structure.
Table report the result. The adversarial training with small perturbations successfully reduced ASR without harming classification accuracy. However, beyond 0.5/255, it drastically drops the clean accuracy. Therefore, adversarial training is a candidate technique to increase the adversary robustness, but is not bulver-bullet.
Table 3: Attack success rates and clean accuracy of vanilla DiffViT and DiffViT with adversarial training when varying on CIFAR-10.
Accuracy
ASR (c=0.25/255)
ASR (c=0.5/255)
ASR (c=1/255)
DifVVIT (CIFAR-10)
0,8700
0.3310
0.6367
0,8498
+ Ady. Train c=0.25/2555)
0.9518
0.2537
0.6434
0.8824
Adv. Train (c=0.5/2555
0.8931
0.1787
0.4440
0.7676
+ Adv. Train (e=1 12555)
0.7384
0.0982
0.2089
0.4302
D.3 PGD WITH RANDOM RESTART
To verify the stability of our PGD evaluations, we additionally performed PGD attacks with random restarts on all ViT/DifIViT and CLIP/DiffCLIP models. The original results in the main paper reported the average ASR over multiple runs, whereas the new experiments explicitly re-run PGD with three random initializations per input.
Figure 6 shows the result. Across all datasets (CIFAR- ImageNet, and COCO), random restart increases absolute ASR values-as expected from a stronger optimization procedure- the relative behavior between DA and standard attention remains unchanged. In all settings. DA exhibits higher sensitivity for small perturbations, and the depth- depth-dependent trends observed in the main paper are fully preserved.
18

---

Published as a conference paper at ICLR 2026
1.0
1.0
0.9
0.8
DITMI CIFARIO CIPARIO
0.8
CLIP Imagaret
CLIP COCD
VIT CIFARLOD
0.5
0.7
opollon be 17255)
epollons 37255)
(a) ASR under PGD for DiftCLIP CLIP
(b) ASR under PGD for DifIVIT VIT
Figure 6: ASR under PGD with Random Restart.
For ViT/DiffViT, random restart yields consistent increases in ASR as grows, with DiffVIT remain- ing uniformly more vulnerable than ViT. For CLIP/DifiCLIP, evaluations on both ImageNet and COCO also show the same pattern: DiffCLIP maintains equal or higher ASR compared to CLIP across all perturbation budgets.
Overall, the random-restart results confirm that our conclusions are not an artifact of single-run PGD) but remain robust under stronger multi-start attacks.
E
LLM USAGE
used large language models (LLMs) as writing assistants to improve clarity and readability, They were not involved in generating ideas, conducting experiments, or producing results, All technical content and contributions are solely by the authors.
19


Reviews:
[{"review_id": "D4MC693Yef", "reviewer": "Reviewer_kz14", "summary": "The paper studies the robustness properties of Differential Attention (DA), a variant of standard attention that subtracts two attention maps. It provides a theoretical analysis linking DA’s subtractive operation to gradient alignment and local Lipschitz bounds that govern adversarial sensitivity. The authors derive formal expressions showing that negative gradient alignment amplifies perturbations while increased network depth can attenuate this effect. Experiments on ViT and DiffViT models trained on CIFAR-100 and Tiny-ImageNet evaluate attack success rates under PGD, CW, and AutoAttack. Further experiments on CLIP and DiffCLIP with ViT-B/16 backbones test sensitivity on ImageNet and COCO using cosine-similarity-based adversarial losses. Results show that DA-based models are generally more sensitive to small perturbations, with the difference diminishing as network depth increases.", "questions": "-   For the PGD experiments, were the attacks performed with **random restarts** to avoid local minima and confirm consistency across runs?\n    \n-   For **DiffCLIP**, how might **prompt-based or contrastive multi-prompt attacks** affect the observed robustness trends?\n    \n-   Beyond **classification**, are there other tasks (e.g., retrieval, captioning, grounding) where demonstrating the Differential Attention sensitivity effect might be more informative or representative?\n    \n-   Have the authors considered evaluating on **natural adversarial benchmarks** such as _NaturalBench: Evaluating Vision-Language Models on Natural Adversarial Samples_ [1] to complement synthetic PGD or patch attacks?\n\n1.NaturalBench: Evaluating Vision-Language Models on Natural Adversarial Samples, NeurIPS 2024 (DnB Track)", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "-   Provides a clear theoretical analysis of Differential Attention and its connection to adversarial sensitivity.\n    \n-   Conducts a well-controlled experimental study across multiple depths, datasets, and attack types, systematically isolating the role of model depth.\n    \n-   Demonstrates consistent empirical evidence that sensitivity effects are most pronounced in shallow models and diminish with increasing depth.", "weaknesses": "-   **Shallow-depth focus limits practical impact.** The paper’s main vulnerability appears in 1–4 layer ViTs, which are not used in practice. By D = 12 the effect largely disappears, so the controlled finding is interesting but of limited relevance to standard transformer deployments.\n    \n-   **Vision-only experiments are low-resolution / small-scale.** The ViT / DiffViT results are reported on CIFAR and Tiny-ImageNet. These datasets use lower-resolution images and limited context. Full ImageNet-1k experiments on realistic ViT-B/16 (or comparable) models are necessary to validate transfer to real-world settings.\n    \n-   **Adversarial attack suite for transformers is incomplete.** The evaluation relies on PGD / CW but omits transformer-aware attacks. Stronger image-side attacks such as TI-FGSM [1],  token-level attacks (Token Gradient Regularization) [3], and patch-focused (P-IFGSM) [2] attacks should be included. Also test higher budgets (e.g., ε = 16/255 as an upper bound) for ImageNet-scale robustness checks.\n    \n-   **VLM attack protocol is weak relative to prior work.** For CLIP/DiffCLIP the paper minimizes cosine similarity to a single prompt. Robust evaluation should use contrastive, multi-prompt, and multimodal attack frameworks (e.g., VL-Attack [4] / PromptAttack–style contrastive attacks and adapted AutoAttack variants) to provide a stronger, field-standard baseline.\n\n\n1.  **Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu.** _Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks._ In **CVPR**, 2019.  \n    \n2.  **Lianli Gao, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen.** _Patch-wise Attack for Fooling Deep Neural Networks._ In **ECCV**, 2020.  \n    \n3.   **Jianping Zhang, Yizhan Huang, Weibin Wu, and Michael R. Lyu.** _Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularization._ In **CVPR**, 2023.  \n    \n4.  **VL-Attack: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Models.** In **NeurIPS**, 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CrNxoolTUR", "reviewer": "Reviewer_NCE2", "summary": "This paper investigates the adversarial robustness of the Differential Attention (DA) mechanism. It concludes that while DA improves discriminative focus on clean inputs, it inherently amplifies adversarial sensitivity, and that stacking DA layers can partially mitigate this effect through depth-dependent noise cancellation.", "questions": "See Weaknesses", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "[1] The authors hypothesize and theoretically analyze that while DA helps suppress redundant context and enhances task-relevant selectivity, it may amplify sensitivity to input perturbations due to negative gradient alignment between its branches. The biggest problem with this paper is the lack of sufficient comparative methods, failing to demonstrate the advantages of this method compared to others.\n\n[2] The paper formalizes this effect as the Fragile Principle and connects it to increased gradient norms and local Lipschitz constants.\nTheoretical derivations are provided, along with extensive experiments using ViT/DiffViT and CLIP/DiffCLIP models on multiple datasets (CIFAR-10/100, Tiny ImageNet, COCO, ImageNet).", "weaknesses": "[1]The literature review section and comparative baselines did not adequately discuss other studies on attention robustness.  The paper does not benchmark DA against attention variants designed for robustness. The biggest problem with this paper is the lack of sufficient comparative methods, failing to demonstrate the advantages of this method compared to others.\n\n[2] The text repeatedly mentions \"gradient opposition\" and \"perturbation amplification.\" Providing visualizations of gradient fields or attention maps (e.g., adversarial heatmap comparisons) would significantly enhance its persuasiveness. \n\n[3] Similar analyses on gradient sensitivity and Lipschitz bounds for attention already exist (e.g., Kim et al., 2021; Dasoulas et al., 2021).\n\n[4] Quantitative examples are lacking (e.g., attention map visualization, perturbation trajectory, or gradient heatmap could be more informative).\n\n[5] Is the proposed differential attention mechanism applicable to existing large language models?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "OOi6OIOtZa", "reviewer": "Reviewer_da2g", "summary": "This paper systematically investigates the robustness of the Differential Attention (DA) mechanism under adversarial perturbations. The authors find that although DA effectively suppresses redundant information and enhances the model’s focus on critical features through the subtraction of two attention maps, this subtractive structure leads to negative gradient alignment. As a result, it amplifies input perturbations and increases the local Lipschitz constant, making the model more vulnerable to adversarial attacks. To address this, the paper proposes the “Fragile Principle,” which theoretically reveals the structural cause of DA’s amplified sensitivity. Extensive experiments on ViT, DiffViT, CLIP, and DiffCLIP models further validate this phenomenon. In addition, the authors observe a “depth-dependent robustness crossover” property of DA: shallow models tend to be more sensitive, whereas deeper stacks can exhibit partial robustness under small perturbations. Overall, this work uncovers a structural trade-off between selective enhancement and robustness degradation in DA, providing both theoretical insights and practical guidance for designing future attention mechanisms that balance focus and robustness.", "questions": "1.Theoretical analysis is primarily based on local linear approximations and single-layer isolation assumptions.These assumptions may not hold under deep networks with nonlinear coupling, and the paper provides insufficient discussion of their impact and applicability. It is recommended to explicitly clarify the conditions under which the local linear assumption remains valid.\n2.The observed phenomenon of “shallow fragility and deeper robustness to small perturbations” lacks mechanistic explanation.The paper is encouraged to provide a more detailed interpretation or theoretical reasoning for this behavior.\n3.More ablation studies are needed to pinpoint the source of the fragility issue.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "1.The first systematic study on the robustness of Differential Attention (DA).\nPrevious research has primarily focused on the advantages of DA in reducing attention hallucinations and enhancing focus. In contrast, this work is the first to introduce the “Fragile Principle” from the perspective of adversarial robustness, revealing that the subtractive structure of DA theoretically amplifies sensitivity to input perturbations.\n2.Rigorous theoretical derivation and comprehensive experimental design.\nThe paper presents a series of formal results (Lemmas and Theorems 1–5) that systematically derive the gradient amplification mechanism and Lipschitz bounds of DA, providing solid mathematical foundations for the Fragile Principle. The authors conduct extensive comparative experiments on ViT, DiffViT, CLIP, and DiffCLIP models across multiple datasets (CIFAR-10/100, Tiny ImageNet, MSCOCO, ImageNet-1k), covering various adversarial attack methods including PGD, CW, and AutoAttack.\n3.Consistent and well-validated results.\nTheoretical predictions—such as negative gradient alignment, increased Lipschitz constants, and depth-dependent robustness trends—are consistently supported by empirical evidence.", "weaknesses": "1.Overreliance on local linear assumptions in theoretical analysis.The paper primarily analyzes the sensitivity of DA through gradients and local Lipschitz constants. While such local linear approximations are common, they do not always accurately capture the global behavior of deep nonlinear networks.\n2.Limited robustness evaluation.The current experiments mainly assess robustness under conventional ℓ∞ and ℓ₂ attacks. However, in real-world applications, more complex perturbations—such as natural distortions, semantic attacks, and physical noise—are often more representative and challenging.\n3.Lack of mechanistic interpretation.The experiments observe a “depth-dependent robustness crossover” phenomenon, but the paper only describes it empirically without explaining its underlying causes in terms of gradient propagation or feature space dynamics.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "94dnRyI9G4", "reviewer": "Reviewer_Jyme", "summary": "This paper provides a theoretical and empirical study of Differential Attention (DA) — a variant of self-attention that combines two attention maps through subtraction (A₁ − λA₂). The authors reveal that while DA improves task-relevant selectivity, its subtractive structure may amplify adversarial sensitivity due to negative gradient alignment between branches. The results show that DA often yields higher attack success rates and larger local Lipschitz estimates, confirming the theoretical fragility. Interestingly, stacking DA layers can partly cancel noise and improve robustness under small perturbations, though this advantage diminishes under stronger attacks.", "questions": "1. See in W1.\n\n2. The paper theorizes depth-dependent robustness (ᾱ L̄DA < 1), but empirically, only ASR and per-layer Lipschitz values are shown. How is ᾱ estimated or validated?\n\n3. The adversarial settings focus on small ϵ, would the observed depth advantage persist under larger perturbations or different norms.\n\n4. It would be valuable to include comparisons with adversarially trained or robustly pretrained baselines.\n\n5. Whether adversarial examples transfer between DA-based and standard-attention models more effectively than vice versa?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper firstly provides a systematic theoretical treatment of how DA’s subtractive structure influences robustness.\n\n2. Empirically, the work is thorough and reproducible, covering multiple model families (ViT, CLIP) and three attack methods, with reasonable ablations on λ and model depth.\n\n3. The paper is well-written with a clear logical flow. The mathematical analysis is clear and connects gradient alignment, Lipschitz continuity, and adversarial fragility in a consistent framework.", "weaknesses": "1. The experimental design does not fully satisfy the standard of transfer-based robustness evaluation. The authors describe results on five datasets, but each model is trained and tested on the same dataset, without evaluating cross-dataset or transfer performance.\n\n2. The “depth-dependent robustness” claims also remain partially qualitative.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)