Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning
Authors: Di Ming
Peng Ren
Yunlong Wang
Xin Feng
Venue: NeurIPS 2024 poster (2024)
Keywords: Adversarial Attack
Adversarial Transferability
Black-box Attack
Primary area: safety_in_machine_learning

Abstract: Vision transformers (ViTs) perform exceptionally well in various computer vision tasks but remain vulnerable to adversarial attacks. Recent studies have shown that the transferability of adversarial examples exists for CNNs, and the same holds true for ViTs. However, existing ViT attacks aggressively regularize the largest token gradients to exact zero within each layer of the surrogate model, overlooking the interactions between layers, which limits their transferability in attacking black-box models. Therefore, in this paper, we focus on boosting the transferability of adversarial attacks on ViTs through adaptive token tuning (ATT). Specifically, we propose three optimization strategies: an adaptive gradient re-scaling strategy to reduce the overall variance of token gradients, a self-paced patch out strategy to enhance the diversity of input tokens, and a hybrid token gradient truncation strategy to weaken the effectiveness of attention mechanism. We demonstrate that scaling correction of gradient changes using gradient variance across different layers can produce highly transferable adversarial examples. In addition, introducing attentional truncation can mitigate the overfitting over complex interactions between tokens in deep ViT layers to further improve the transferability. On the other hand, using feature importance as a guidance to discard a subset of perturbation patches in each iteration, along with combining self-paced learning and progressively more sampled attacks, significantly enhances the transferability over attacks that use all perturbation patches. Extensive experiments conducted on ViTs, undefended CNNs, and defended CNNs validate the superiority of our proposed ATT attack method. On average, our approach improves the attack performance by 10.1% compared to state-of-the-art transfer-based attacks. Notably, we achieve the best attack performance with an average of 58.3% on three defended CNNs. Code is available at https://github.com/MisterRpeng/ATT.

Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning
Di Ming, Peng Ren, Yunlong Wang, Xin Feng" School of Computer Science and Engineering, Chongqing University of Technology Chongqing, China
diming@cqut.eet edu. cn, misterr cesterr_2019e63.. com, {ylwang, xfeng) edu.c
Abstract
Vision transformers (ViTs) perform exceptionally well in various computer vision tasks but remain vulnerable adversarial attacks. Recent studies have shown that the transferability of adversarial examples exists for CNNs, and the same holds true for ViTs. However, existing ViT attacks aggressively regularize the largest token gradients exact zero within each layer of the surrogate model, overlooking the interactions between layers, which limits their transferability in attacking black- box models. Therefore. in this paper, focus boosting the transferability of adversarial attacks on VITs through adaptive token tuning (ATT). Specifically, we propose three optimization strategies: adaptive gradient re-scaling strategy reduce the overall variance of token gradients, a self-paced patch out strategy to en- hance the diversity of input tokens, and hybrid token gradient truncation strategy to weaken the effectiveness of attention mechanism. We demonstrate that scaling correction of gradient changes using gradient variance across different layers produce highly transferable adversarial examples. In addition, introducing atten- tional truncation can mitigate the overfitting over complex interactions between tokens in deep ViT layers to further improve the transferability. On the other hand, using feature importance as a guidance to discard a subset of perturbation patches in each iteration, along with combining self-paced learning and progressively more sampled attacks, significantly enhances the transferability over attacks that use all perturbation patches. Extensive experiments conducted on ViTs, undefended CNNs, and defended CNNs validate the superiority of our proposed ATT attack method. On average, our approach improves the attack performance by 10.1% compared to state-of-the-are transfer-based attacks. Notably, we achieve the best attack performance with an average of 58.3% on three defended CNNs. Code is available lhtps:::.. //gi tigt....bb... com com/MistteRppeng/AT
Introduction
The Vision Transformer (ViT) was the first to apply the transformer architecture to computer vision models, demonstrating excellent performance image classification tasks. Since then, various ViT-based transformer structures have shown comparable success in a range of computer vision tasks, including object detection 2 3 semantic segmentation [4]5], and human pose estimation [6]. However, similar to convolutional neural networks (CNNs), VIT models also vulnerable to adversarial attacks g 10) For ViT to be widely adopted in real-world applications, particularly in secure systems, it is crucial to identify model weaknesses [I]] 12 [3] and develop more robust ViT models. Specifically, adversarial attacks generate perturbations that can cause incorrect model classifications, which are often too subtle for humans notice. The transferability of the adversarial
"Corresponding Author: Xin Feng
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

perturbations leads to the fact that the perturbations can directly deceive the unknown target model. Therefore, it is imperative to study transferable ViT attacks to further uncover the vulnerabilities of ViT models, thereby providing valuable insights for adversarial defense or building robust ViTs.
Gradient regularization-base adversarial attack adjusts the gradient after back- prcck-popagation to update the perturbation more stably and effectively. However, attack methods designed specifically for CNNs are less effective when directly applied to ViTs. Token gradient regularization (TGR) [4] addresses the shortcomings of existing gradient regularization methods and designs technique that regularizes the gradient of intermediate ViT layers, leading to significant improvement of the transferability of adversarial attacks on ViTs. However, we observe that TGR simply sets the largest part of token gradients in each module to zero, thereby losing feature information to a certain extent. To solve this problem, we propose an adaptive variance reduction method, not only correcting the gradient variance but also preserving the feature information (see the bottom-right of Fig. D. Thus, the perturbation can learn more features while reducing overfitting and improving the transferability of adversarial examples across ViT models with various network structures.
Another ViT attack approach, proposed by Wei et al. [15], inspired us to incorporate input diversity with gradient regularization to enhance the transferability further. This transfer-based VIT method proposes the PatchOut Attack to exploit the input diversity [16]. PatchOut is a straightforward and effective way to address the overfitting. However, this approach does not account for update efficiency and difficulty, leading to potential over wverddisarrinng of updates. As result, the finite number of iterations may end with perturbation that has not reached its optimal state. To address this, we propose a discard strategy that combines feature importance- based sampling and self- self-paced learning. As shown on the left side of Fig. [ this approach allows for a more rational implementation of patch out strategy and improves the update efficiency.
Influenced by 15 we found out that the attention mechanism specific ViTs tends to cause the perturbation overfitting in surrogate models. To resolve this, we propose an attention weakening strategy further adaptively tune the token gradients both within and across ViT layers. Specifically, as indicated in the top-right of Fig. [ we truncate the gradient back- proppagationn in the attention module of deep ViT layers while preserving the token gradients of QKV and MLP modules, to reduce the overfitting caused by excessive global attention. In addition, for purpose of balancing the interactions between different modules in the remaining shallow ViT layers, we also adjust the token gradients of the attention, QKV and MLP modules accordingly.
In summary, the main contributions of our paper include:
We propose an adaptive token gradient re-scaling method improve the transferability of adversar- ial attacks. This method aims to reduce the overall variance of token gradients in each ViT layer and smooth token gradient variance changes throughout all the ViT layers. Mcanwhile, we introduce a hybrid token gradient truncation method to weaken the effectiveness of attention mechanism. In order to achieve balance between different modules, we further adjust the truncation factors of each module accordingly.
We propose self-paced patch out strategy for learning the input diversity. During the perturbation training, a sparse mask is constructed under the semantic guidance of patch-level feature importance. As the iterations increase, sampled mask. These sparse masks are then superimposed with perturbations as input samples, and the perturbation updates are incrementally enhanced through this self-pacee training process, which not only mitigates the overfitting issue but also enhances the attack efficiency.
learning strategy is employed to generate a progressively more d
Extensive experiments are conducted to verify the effectiveness of our proposed adaptive token tuning attack method, which improves the attack success rate by an average of 10.1% over state-of- the-art methods under black-box attack setting, including an average of 4.9% for attacking ViTs and 12.8% for attacking CNNs. Additionally, we achieves the highest average attack rate of 58.3% on defended CNNs, further demonstrating the superior transferability of our ATT attack approach in both undefended and defended black-box models.
2 Related Work
Current adversarial attacks can be broadly divided into two main categories: white-box and black- box attacks. White-box attack refers to adversarial attack under the condition that all the model information is known. On the contrary, black-box attacks do not have unrestricted access to all

---

Grndien
Backproaggation
Truncated Attention I Layers
Transforner Block,
Trinsformer Block,
Trinformer Blockqu
Transfrmer Block,
Self-Paced Patch
Adastive Variance Reduced Token Giadieet Gradizet Rafacton (Anzetir)
Transformer Block
Atention
-75
W
x
MLP
Goaterr Recuationn (OKY Y MI
MLP
25
Hleneett-w wase
Element-wiie additiion
W
QRV
mulliphicaiin
Figure I: The overall framework of our Adaptive Token Tuning (ATT) attack method.
model's information. Specifically, black-box attacks consist of two types: query-based black-box attacks, which could access the output of the target model, and transfer-based black-box attacks, where no knowledge of the target model is available. In practice, it is often impossible to obtain any information about the target model, making transfer-based black-box attacks more serious security threat. Therefore, this paper focuses on transferable black-box attacks on ViT models.
Adversarial Attacks on CNNs. Adversarial attacks on CNNs can be categorized into gradient optimization- baaeiiaattti---adddddde and feature information-bast attacks. In gradient optimization-base based adversarial attacks, 18 19, 20) incorporated momentum term into the existing iterative attack update process 21 to stabilize the update direction and avoid the local optima. Towards improving the backpropaga- tion path, Skipping Gradient Method (SGM) 22 allowed gradients to backpropagate more through skip connections, while Backward Propagation Attack (BPA) (23) mitigated the negative impact of gradient truncation in ReLU and max-pooling to improve the relevance between the gradient and the input. Besides, [24, 25 introduced variance adjustment methods that modify the current gradient based the variance of gradients from the previous iteration and from ensemble surrogate models respectively, resulting in more stable gradient updates. In comparison, feature information- based adversarial attacks, such FIA 26) and FDA (27). aim to degrade model performance by disrupting important features that play a critical role in the model's ' decisions. Since inaccurate feature importance guidance could lead to decrease in transferability,
proposed the neuron attribution-basee attack methods that utilized more accurate neuron importance for feature-level 31 32) that utilized feature importance create masks that guide perturbation updates, enhancing transferability by focusing on more critical features during attacks. addition that, [33 34 specifically targeted feature information from shallow layers to craft more transferable perturbation against the fine-tuned models.
(28 29
attacks. Furthermore, there also other approaches 330
Adversarial Attacks on ViTs. However, attack methods designed for CNNs have very low transfer- ability to ViT models. To improve the attack performance against ViTs, Nasser et al. (35 proposed the self- self-integration (SE) method and token refinement module (TR). Specifically, SE leverages the classification header at each layer of the ViT model to produce adversarial perturbations, while TR further refines the classification token based on SE to enhance the attack transferability. Wei el al. 15 approached the problem from the perspective of attention, proposing method to skip the attention module, which significantly improves the transferability of adversarial examples. Addi- tionally, they proposed a random extraction of perturbation patch strategy from the perspective of image transformation to further enhance the transferability. Zhang et al. (36) introduced virtual dense connectivity approach, enabling the backpropagation of gradients through jump connections in deep network. Gao al. (37) developed a feature diversity-based attack that uses adversarial perturbations to accelerate feature collapse due to the VIT attention module. Zhang et al. [14] pro- posed token gradient regularization approach to reduce gradient variance during backpropagation in token-wise manner, based on the structural features of ViTs, to improve the transferability of adversarial perturbations. By contrast, our adaptive token tuning method not only considers the token gradient variance but also aims to reduce the destruction of feature diversity to preserve the original feature information. Additionally, we design self- self-paced patch out strategy to enhance both the transferability and efficiency of adversarial attacks.
3

---

3 Methodology
3.1 Preliminary
Notations and Definitions. benign sample is defined the original clean image æ E R x along with its corresponding ground-truth label E {1, 2, .., K where C, H, W, and K represent the number of channels, height, width of the image, and the number of label categories, respectively. In VIT networks, the image x is evenly partitioned into a set of patches 22 = { m.. zp HW/P2 denotes the number of patches. The
where x RCXx" denotes the i-th patch and set of ViT modules is defined as M (QKV, MLP, Attention). and the total number of ViT layers is L. Given a surrogate VIT model f. the predicted label for the input a is represented by 8 = f(x). where ÿ = y for benign sample Consistent with previous works, we focus on fooling ViT models in the untargeted attack setting. To guarantee the effectiveness and imperceptibility of adversarial example aado + 6, adversarial attack maximizes the following optimization problem:
arg max L(f(2 + 6), v), s.t. |001 S 8
(1)
where is the loss function, e.g., cross-entropy, and e constant to constrain the adversarial perturbation 8 in the -nomm bound, thereby resulting in change of label that f(( +
Patch Out. Motivated by previous work [16), Wei al. [5 proposed the PatchOut attack to alleviate the overfitting phenomenon by creating diverse input patterns, Specifically, portion of patches in the adversarial perturbation are randomly discarded using a binarized attack mask w, where the values of selected/unselected patches are set to ones/zeros respectively. During the feed-forward process, the input to surrogate model f becomes as x + ô @ w. thus enhancing the input diversity.
Token Gradient Regularization. As compared to gradient variance tuning [24] applied directly to the input, Zhang el al. (14) regularized the gradient variance of tokens in the intermediate ViT blocks. Through the back-propagation in ViT layers, token gradients are multiplied by a scaling factor and & extreme values are further reset to zeros. As a result, adversarial perturbation is updated by a regularized input gradient, i.e., TGR(V&&C &C, s, k), resulting in a more stable optimization process.
3.2 Adaptive Variance Reduced Token Gradient
During the training, large gradient variance tends to overfit the surrogate model and causes the update of the perturbations to fall into local optimal solution, which lowers the transferability of adversarial attack. Wang et al. (24] propose variance tuning method to reduce the gradient variance in the input perturbation space, but ignoring the gradient variance in intermediate layers. Thus, we aim to reduce the overall gradient variance across all VIT layers to improve training effectiveness.
Variance Reduction in Single VIT Layer. Given the module m M in an intermediate I-th ViT
layer, the latent representation i-th token is defined as z (1.m) and its corresponding gradient w.t.t. the
loss function L in Eq. 1 is defined as g (1.m) ac/Oz 00 (1.().m)) During the back poockproppggtion, TGR [14] searches the largest gradient (t.m) out of n token gradients via j = arg max (l,..sn 9
(1.m) for
each module m. and simply sets g; (1.m) = 0 to reduce the variance of token gradients in I-th ViT layer. However, this largest gradient could be highly correlated with important features. As consequence, iterative optimization updates may overlook this portion of semantic information, undermining the quality of the perturbations.
To simultancously reduce the token gradient variance and preserve the feature information from the largest token gradient, we decrease the largest token gradient mildly by gradient penalty factor
7 E (0, 1). For m = QKV or m MLP, g (f.m) = 7 g (I.m)) Following the TGR [14 method, for = Attention, we also search for the set S of extreme token gradients located in the same row or column as the largest token gradient. Thus, all the token gradients in S are re-scaled by
g (t.m) 7 g (l.m) for E S, since they are highly correlated with the largest token gradient. As can be seen, this mild re-scaling strategy allows some important feature information in the largest or extreme token gradients (i.e., nonzero gradient values) to back-propagate between consecutive ViT layers in certain degree. The detailed analysis of the change in the token gradient variance (before and after mild re-scaling by 7) is provided in Appendix A

---

Adaptive Variance Reduction Throughout VIT Layers. If re-saling the token gradient of each intermediate ViT layer independently. after propaaaop,,,,,n, the gradient w.E.f the input perturbation could be deviated from the original updating direction. Inspired by 38 39,, we utilize the gradient information across ViT layers to adaptively re-scale the token gradients in each ViT layer. To be specific, the last VIT layer is selected as the anchor, since it is most relevant to the classification task. Then, the largest token gradient (or the set of extreme token gradients) in each VIT layer is adaptively re-scaled to ensure its gradient variance remains consistent with previous VIT layer. Thus, for t-th iteration, we define the adaptive variance reduce token gradient method as follows:
(1.m)
(l.m) gitt
(7+2(1- 1 (1.m)
(1+1.m)
9i.t
(2)
where $ (4)m) and $ (.m)) denote the variance of token gradients for module m in 1-th and (1+ 1)
layers respectively, i.e., D (l.TT)) Var(g(l.m) and $ ([(+1,,m) Var(g (f)L)))) and À is the adaptive factor balancing the relative importance between the gradient penalty factor and the ratio of gradient variances. With this adaptive updating strategy, the variances of token gradients between consecutive ViT layers become smoother compared to using a fixed constant value for re-scaling token gradients. Appendix B provides further details regarding the analysis of adaptive variance reduced token gradient throughout ViT layers with different parameter settings.
3.3 Self-Paced Patch Out under Semantic Guidance
Undoubtedly, random discarding [15 is a simple and effective method to alleviate the overfitting and improve the transferability. However, discarding patches inappropriately raised by randomness could lead to the difficulty in updating the perturbation, especially when limiting the total number of iterations to small value, e.g., only 10 iterations are commonly used in the literature of ViT attack. Thus, within limited training budget, we propose self-paced patch out strategy under semantic guidance to prevent the improper discarding of important patches to a certain degree. In addition to that, the number of discarded patches are dynamically controlled by a scheduled pace further stabilize the perturbation training.
Generating Semantic Guided Sparse Mask. Instead of generating a completely random mask, we leverage the rich semantic information to mitigate the optimization instability caused by discarding perturbation patches. Based on Grad-CAM 40), we construct the feature importance matrix W
# by fusing gradients and features from intermediate ViT layer, Le., W = = c O!! where (l)) is the number of channels in 1-th layer and / (0, I.). According to the partition of T.p- we further define the patch version of W W, (W,). p ..,, ,,,,,, where W PxP. Thus, the
feature importance of i-th patch xpp (i) be measured by the Frobenius norm [[Wlle.
Furthermore, patch-level feature importance can combined with random sampling to discard a portion of patches under semantic guidance. First, we define 1, as a C' x P x P tensor with all ones and the scaled patch-level feature importance as E [0, Cxx where dy. = (I min, (II W [lx)) (m)x))/mmxx)))) (le) - min, [W 1p for i.j f1....,n). To control the
n).
number of discarded patches, we further introduce a 2 0 and 3 2 0 as scaling and offset coefficients to shift the distribution of Then, the semantic guided sparse mask w can be generated by:
w = (q < c
(3)
where q [0, C is random variable sampled from the patch-level uniform distribution (0, 1). In detail, for i-th patch of q, we have of = c Ip where c ~ 20(0, 1). As can be seen, the elements within patch will be discarded Additionally, patches with lower feature importance are more likely to be discarded, while those with higher feature importance less likely to be discarded.
preserved altogether with the same probability.
Self-Paced Patch Out via Progressive Sparse Mask. To further improve both the efficiency and the effectiveness of training adversarial perturbations, self-paces patch out strategy is introduced to control the number of discarded patches for each iteration at a dynamic pace. For f-th itcration, we define the progressive sparse mask w, based on feature importance e, follows:
w; = wwlw (g: < a - B), qe ~ (,,,, a 1 - (1-c))
(r(w)) < Ny(w2) < ... (WT).
5

---

where T is the number of iterations, qi is the random variable sampled from U, (0, 1), and N2(w)) is the number of discarded patches in wi; approximately equal to E - a c + B)]/(C P2).
To be specific, as the iteration & increases, C₁ becomes gradually, and more perturbation patches are discarded such as N,(w;) < No((++1) to prevent the overfitting. In the meanwhile, training samples with varying patterns are fed into the surrogate ViT model for purpose of enhancing the diversity of inputs. On the other hand, the coefficients a and 3 can be adjusted correspondingly to guarantee that the strength (i.e., the magnitude) of adversarial perturbations increases step by step, e.g., w @ 6.11 S | @ 0++1l11. For a fair comparison, we also set appropriate values for a and / generate progressive sparse masks, ensuring that the total number of discarded patches throughout the training process is greater than or at least equal to that of other methods such as PNA [5]. Thus, we have Σ E
C₁ + (C P2) 2 T Nipathh; where T is the number of iterations and Ndpatch the fixed number of patches discarded by comparison methods per iteration. To summarize, our proposed self-paced patch out effectively integrates self- eef-paaed learning into training process and maximizes the adaptive loss function L. = C(S(x @ w)); y) at each iteration, which can further improve the transferability of crafted adversarial perturbations across various models.
3.4 Weakening the Effectiveness of Attention Mechanism
Feature-based adversarial attacks 226 29 33 34 have shown that not all the features in DNNs contribute positively to the generation of adversarial perturbations. despite their significances in classification tasks. On the other hand, is demonstrated in previous ViT studies [13 17 that attention modules in certain ViT layers are redundant for image classification and adversarial perturbation generation, which could cause the overfitting phenomenon. Building upon this, we propose to reduce the impact of some attention modules during the training of adversarial perturbations.
Truncated Attention Layers. According 41 (3),
shallow layers exploit generic properties of attention. whereas deep layers exploit highly model-specifie properties of attention. To mitigate the overfitting caused by excessive global attention, we introduce a hard truncation strategy for deep ViT layers. During back-
(I.m) with a truncation we multiply the token gradient g;
factor T for module m = Attention. To be specific, we set 7(.m)) to 0 for I E {I' + 1, L}, value for I E {1.....,')) 1'}. As a result, intermediate gradients can be back- pooc-propagated to each token individually via skipping attention mechanism, thereby reducing the adversarial perturbation's dependence on complex interactions between tokens in deep ViT layers.
while setting 7(1.m) to
Hybrid Token Gradient Truncation. For purpose of effectively balancing the influence of different modules on the perturbation training, we further introduce a hybrid token gradient truncation method to constrain the token gradient in each module throughout all VIT layers using the predefined
set mm of T. truncation factors. For m = Attention, we set S = (7(..) ... -(" .m) O, ... ,,),
,.,, where deep ViT layers are processed via the hard truncation (i.e., -(l.m) = >> 1'), and shallow ViT layers are processed via the soft truncation (i.e,, p(l.m) 0, 1"). For either m QKV or m = MLP, we set s! = (f(1.m),.... ..., ..., ((',m) (('++.m), ..., (......................... (L,m)) }. where all the intermediate ViT layers are processed via the soft truncation (i.e., f(lim) > 0, 1 E (1.....AI L)). In addition to that, for any [-th ViT layer (1 S ("), by setting ((I.Attentoo) < max(7 -((MMPP) between different ViT modules, the perturbation training process.
continue to weaken the effectiveness of attention mechanism during
In sections 3.2 3.4 we introduced the details of our proposed adaptive token tuning (ATT) attack method from three perspectives. On the one hand, both variance reduction and hybrid truncation aim to adaptively tune the token gradient throughout the paok-propagation path. On the other hand, self-paced patch out focuses on adaptively tuning the token diversity in the input perturbation space. The overall optimization algorithm for training adversarial example is provided in Appendix C
4 Experiments
We utilized different surrogate models for comparison, demonstrating versatility and effectiveness of our ATT attack. Ablation experiments were conducted to verify the effectiveness of each component of our approach. Additionally, we analyzed experimental results by examining gradient variance and feature information, providing a statistical explanation for the effectiveness of our method.

---

4.1 Experiment Setup
Dataset. We followed the baseline approach [4] by selecting 1,000 random images from different categories in the ILSVRC2012 [42] validation set. All surrogate models can classify the images in our chosen dataset with near hear-perfect accuracy.
Models. We chose four representative VIT models as surrogate models to produce adversarial samples: ViT-B/16 [. PÎT-B [43), CaiTSS/24 [44], and Visformer-S 45 Considering structural differences between ViTs and CNNs, we divided attack scenarios into two categories: attacking ViTs and attacking CNNs. For ViT attack, we used four ViT models as target models to test the transferability of adversarial samples: DeïT-B [46), TNT-S [47], LeViT-256 48). and ConVVT-B [49). Similarly, we selected four CNN models as target models to verify the transferability of adversarial samples: Inception-v3 (Inc-v3) [50], Inception-v4 (Inc-v4) [5T), InceptiionRRsNet--eee (IncRes-v2) [5]] and ResNet-v2-152 (Res-v2) [52] [53] To validate the effectiveness against defense models, we further selected three ad adversarially trained defense models: inception-v3-ent (Ine-v3ens3), Inception-v4-ens/ (Inc-v4ens4), and Inception-Resie ResNet-v2 (IncRes-v2adv) [54] [55].
Baseline Methods. Since our approach takes into account the optimization of the gradient, we selected several methods closely related to ours as baselines, including MI-FGSM (MIM) [18], VMI-FGSM (VMI) (24), and SGM [22] To demonstrate the superiority of our approach over state- of-the-art ViT attacks, we used PNA 15 and TGR [1] for comparison. Our approach also proposes superior self-paced input diversity method; therefore, we used PatchOut
[15] the baseline.
Evaluation Metrics. Consistent with the bascline methodology [1]], we used the attack success rate (ASR) as the evaluation metric in all transfcrability comparison experiments. Additionally, we defined the number of iterations that led to the first-time misclassification by the model as t, which used as a metric for efficiency comparison within limited training budget T. For ASR, higher values (f) indicate better transferability, while for t, lower values (4) indicate better efficiency.
Parameters. We kept all known parameter settings consistent with [14.. The maximum perturbation amplitude was set to = 16, and the number of training iterations was set to T 10, resulting in a step size of f 1.6 for each perturbation update. All comparison methods used momentum as the stabilization update strategy with decay factor μ = 1.0. Hyperparameters specifie to each method were kept the same those set by original methods. The penultimate VIT layer (i.e., = L 1) is selected to generate patch-level feature importance. We set appropriate values for a and 3 to ensure the expected value of the number of discards in our method was greater than or equal to the number of PatchOut discards, where its optimal N Ndpatch is 130. We adjusted the images of the whole dataset to 224 224 and set the patch size to 16 16. For the adaptive gradient variance reduction strategy, we set the gradient penalty factor to 7 = 0.5 and the adaptive factor to À = 0.01. Truncation factor т is finetuned with appropriate values to balance different modules for each surrogate model.
4.2 Evaluating the Transferability
In this section, verified the transfcrability of adversarial perturbations four ViTs, four unde- fended CNNs, and three defended CNN models. Specifically, we produced adversarial samples using the four VIT surrogate models, tested the attack success rate all black-box models, calculated the average attack success rate across all black-box models (abbreviated as Avgss)
Firstly, we focus solely on the ViT attack using "Token Boadient-Basedd Optimization". Here, all comparison methods and "Ours" indicate the pure gradient- attack "Without Input Diversity Enhancements". In Table we verified the transferability of our method on ViTs. The experimental results indicated that our method achieved nearly 100% attack success rate under white-box settings. In addition, the transfcrability of our method performed significantly better than all other baseline methods, with an average increase of 6.4% in the attack success rate of black-box models. All baseline methods optimized the gradient and achieved good attack performance, especially TGR, improving the transferability by a large margin. However, TGR directly set the token with the maximum gradient to zero, preventing the perturbation from learning potentially important feature information. In contrast, our method greatly preserved the original feature information while avoiding the overfitting phenomenon caused by excessively large gradients.
Furthermore, we validated the transferability of our method from VIT models to undefended and defended CNN models. Experimental results on CNN models are shown in Table 2 where the
7

---

Table The attack success rate (%) of various transfer- attacks against eight VIT models and
the average attack success rate (%) of all black-box models. The best results are highlighted in bold.
Modell
Attack
VIT-R166
PTT-B
CarT-S/24
Visformer-S S
DeiT-B
TNT-S
LeViT-256
ConViT-B
Avgs.
100.0
34.5
64.1
36.3
64.3
33.8
66.0
49.9
VMI
99.6*
48.8
74.4
49,5
73.0
64.8
50.3
75.9
62.4
SGM
100.0
36.9
77.1
40.1
77.9
61.6
40.2
78.4
58.9
VIT-B/16
100.0*
78.6
47.7
78.6
62.8
47.1
79.5
TGR
100.0*
49.5
85.0
53.8
85.6
73.1
56.5
85.4
69.8
Ours
99.9*
$7.5
90.3
63.9
90.8
82.0
66.8
90.8
77.41
24.7
100.0"
44.5
43.0
38.3
37.8
36.7
VMI
38.9
99,7*
51.0
56.6
50.1
57.0
52.6
51.7
51.1
SGM
418
100.0"
$7.3
73.9
$7.9
72.6
68.
59.9
61.6
PYT-B
PNA
47.9
100.0*
62.6
74.6
62.4
70.6
67.3
TGR
60.3
100.0*
S0.2
87.3
78.0
87.1
81.
76.5
78.7
Ours
69.6
100.0"
86.1
91.9
85.5
93.5
W9,0
K5.5
85.9
MIM
70.9
33.1
90.2
76.4
S4.8
VMI
76.3
63.6
98.8*
67.3
88.5
82.3
67.0
88.1
76.2
CaiT-S/24
86.0
100.0*
68.2
91.1
74.9
96.7
81.5
PNA
82.4
99,7
67.7
86.9
67.1
79.2
TGR
88.2
66.1
100.0*
75.4
98.8
92.8
74.7
97.9
84.8
93.6
99,4
87.4
98.8
91.21
MIM
28.1
50.4
41.0
99.9*
36.9
51.9
49.4
39.6
42.5
VMI
39.2
60.0
56.6
100.0
54.1
62.8
59.1
54.4
55.2
SGM
Visforme-SS
PNA
35.4
61.5
54.7
100.0
51.0
66.3
64.5
50.7
54.9
TGR
41.2
70.3
62.0
100.0*
59.5
74.7
74.8
56.2
62.7
Ours
44.7
70.9
68.7
100.0
78.8
80.9
58.4
67.01
Table 2: The attack success rate (%) of various transfer-based attacks against four undefended CNN models and three defended CNN models and the average attack success rate (%) of all black-box models. The best results are highlighted in bold.
Model
Attack
Inc-v3
Inc-v4
IncRes-v2
Res-v2
Inc-v3ens3
Ine-y3ens4
IncRes-v2ady
Avg
MIM
31.7
28.6
26.1
29.4
22.3
19.8
16.5
24.9
VMI
43.1
41.6
37.9
42.6
31.4
30.6
25.0
36.0
SGM
31.5
27.7
23.8
28.2
20.8
18.0
14.3
23.5
VIT-B/16
PNA
42.7
37.5
35.3
39.5
29.0
27.3
22.6
33.4
TGR
47.5
42.3
37.6
43.3
31.5
30.8
25.6
36.9
Ours
53.3
49.0
45.4
51.5
38.1
43.91
MIM
36.3
34.88
27.4
29.6
19.0
25.6
VMI
47.3
45.4
40.7
43.4
35,9
34,4
29.7
39.5
SGM
50.6
45.4
38.4
41.9
25.6
20.8
16.7
34.2
PIT-B
PNA
59.3
56.3
49.8
53.0
33.3
32.0
25.5
44.2
TGR
72.1
69.8
65.1
64.8
43.6
41.5
32,8
$5.7
Ours
80.4
75.3
72.7
72.9
52.5
50.6
63.6*
MIM
48.4
42.9
39.5
43.8
30.8
27.6
23.3
36.6
58.5
50.9
48.2
$2.0
44.8
SGM
53.5
45.9
40.2
45.9
30.8
28.5
38.0
CaiT-S/24
PNA
57.2
51.8
47.7
$1.6
38.4
36.2
30.1
44.7
TGR
60.3
52.9
49.3
53.4
39.6
37.0
31.8
46.3
Ours
73.9
66.0
66.3
66.4
54.6
52.1
43.9
60.51
MIM
44.5
42.5
36.6
39.6
24.4
20.5
16.6
32.1
VMI
54.6
53.2
48.5
$2.2
33.0
32.0
22.2
42.2
Visformer-S
SGM
43.2
41.1
29.6
35.7
16.1
26.7
PNA
55.9
54.6
46.0
51.7
40.7
TGR 65.9
66.8
55.3
60.9
36.0
32.5
23.3
48.7
Ours
80.9
81.2
70.5
75.7
50.1
41.3
32.0
61.71
transferability of all other methods on CNNs was low, but our method significantly outperformed all baselines. The black-box attack success rate increased by an average 10.5%, which was higher than the transferability improvement the VIT model, indicating that method is more ad advantagcous for cross-model attacks. We analyzed that our method, in addition to avoiding overlitting surrogate models, allowed the perturbation to learn many features possible, thus enabling the perturbation to better attack both ViTs and CNN models. Our method achieved the average attack success rate of three surrogate models CNNs exceed 60%, with the highest average attack success rate the defended CNNs reaching 50.2%, which poses serious security threat. Additional attack results against robust ViTs [56] 57 58 are provided in Appendix D.9
Lastly, we further investigated the VIT attack strategy that combined "Token Gradient-basee Opti- mization" with "Input Diversity Enhancement", where Patch Out (PO) and the proposed Self-Paced

---

Table 3: The average attack success rate (%) against ViTs, CNNs, and defended CNNs by various transfer-based attacks with input diversity enhancement strategy. The best results are highlighted in
bold. "PO" denotes PatchOut and "SPPO" denotes self-paced patch out under semantic guidance.
Model
Attack
ViTs
CNNs
Del-CNNs
Model
Attack
ViTs
CNNs
Def-CNNs
MIM+PO
61.3
31.3
21.7
MIM+PO
70.3
44,0
29.3
VMI+PO
69.1
42.8
30.9
VMI+PO
76.8
57.8
38.4
SGM-PO
64.8
29.2
18.9
SGM+PO
85.1
49.2
29.3
VIT-B/16
PNA+PO
70.8
42.6
29.9
CaIT-S/24
PNA+PO
81.6
56.6
39.3
TGR+PO
76.0
46.7
33.3
TGR-PO
88.8
60.5
40.5
Ours+PO
77.1
51.7
37.1
Ours+PO
91.1
71,9
$4.3
Ours+SPPO
80.31
54.11
38.71
Ours+SPPO
92.6f
75.41
58,31
Model
Attack
VITs
CNNs
Def-CNNs
Model
Attack
VITs
CNNS
DeF-CNNN
MIM+PO
47.3
32.5
17.5
MIM+PO
54.9
45.7
23.4
VMI+PO
59.5
46.2
35.8
VMI+PO
64.8
56.6
32.6
SGM-PO
70.0
45.6
21.3
SGM+PO
51.6
44.3
15.0
PTE
PNA+PO
73.1
57.8
32.7
Visformer-S
PNA+PO
68.8
61.8
32.3
TGR+PO
82.3
TGR-PO
70.4
64.3
33.5
Ours+PO 84.2
75.2
48.4
Ours+PO
70.5
79.3
44.5
Ours+SPPO
87.71
78.07
52.01
Ours+SPPO
76.41
84.47
50.31
Patch Out (SPPO) used the input diversity enhancement strategy. As result, denoted these methods with "+PO" or "+SPPO" to indicate that gradient-basee attacks were combined "With PO-based SPPO-based Input Diversity Enhancement". As shown in Table 3 the experimental results indicated that our method demonstrated an average improvement of 6.6% in the black-box average attack success rate against ViTs, CNNs, and defended CNNs (Def-CNNs). When combined with the proposed self-paced patch out, our method exhibited superior attack abilities. Our strategy. which discards perturbation patches under semantic guidance in self self-paced way, proved to be more effective than PatchOut's 's random discarding. The success rate of our method's black-box attacks was further enhanced by 3.5% when compared to direct utilization of the PatchOut strategy.
In addition to that, we further conducted cross-task transferability experiments on object detec- tions [59 600 [1]00000000 62 [3 and semantic segmentations [64] 65 666 in black-box attack scenarios.
Adversarial samples crafted by our approach demonstrated greater aggressiveness than baselines, see Appendix D.6 and D.7
4.3
Ablation Study
In this section, we performed three sets of ablation studies on the proposed ATT attack. In the subsequent experiments, all methods were compared based on their complete attack strategies.
Adaptive Factor. explored the role of the adaptive factor smoothing the gradient variance across different layers of ViT-B. The attention's gradient is used as demonstration that similar results can be obtained for other modules. We found that the larger the X, the more effective the gradient variance smoothing was. However, the results of the transferability experiments showed that smoother gradient variance did not always result in higher transferability. We analyzed that this might be due to excessive gradient variance smoothing leading to changes and loss of feature information. Therefore, to balance performance, we chose À = 0.01. More results are given in Appendix B
Attentional Truncation. Considering the differ- ences between models, we conducted experiments on varying the number of truncated ViT layers. In Fig Appendix D.2 three models required trun- cation to achieve better transferability. Visformer-S achieved the best result without truncation, since it shallow model, where scaling alone suffi- cient to mitigate overfitting in attention mechanism.
Table 4: against ViTs, CNNs, and defended CNNS by our method with different module settings.
The average attack success rate (%
Attention
QKV
MLP
ViTs
CNNs
Del-CNNs
49.9
29.1
19.3
70.4
43.3
29.7
/
68.8
40.7
27.7
67.8
39.5
28.0
Attacks with Different Module Settings. We con- ducted ablation experiments using four surrogate models to compute the average attack success rate for ViTs, undefended CNNs, and defended CNNs in black-box setting. Table E shows experimental results on the surrogate model ViT-B, where attacking the attention module greatly improved the transferability, and attacking all three modules
72.1
45.5
31.0
79.3
51.7
37.5
77.8
48.7
35.5
80.3
54.1
38.7
achieves the best ASR. The rest of the experimental results shown in the Appendices D.5 and D.8

---

4.4 The Analysis of Attack's Effectiveness and Efficiency
We utilized ViT-B/16 generate adversarial examples and retained intermediate results for 10 iterations. Fig. 2 shows the process of discarding perturbation patches for "Ours+SPPO" versus "TGR+PO", and the classification results (label and probability). For each iteration, class activation map of adversarial example was generated by GradCAM on CaiT-S/24 with an unlabeled setup. The results showed that our method required only iterations for the model to determine the error, while TGR required 9 iterations. Class activation maps also reflected this change. After 10 iterations, the confidence level of wrong label due to our attack was higher, indicating that our attack was not only more efficient but also stronger. Additionally, considering that each iteration increases fixed perturbation magnitude, our method required a smaller perturbation to mislead the model. More efficiency results tested in different surrogate models are provided in Appendix D.I and D.3
Great
(91.54%%)
(90.90%)
(8S.35%%
(81,88%)
(79.12%)
(70,80%)
(54,519)
(38.42%)
(51.12%)
(64.62%)
TGGR-PO
Ounse RPPO
(92.63%)
(30.13%)
(36.13%)
(45,49%)
(73 8999
78%
(85,27%)
(87 (0.00%)
(87.28%)
Figure/ 2: The attack efficiency of "Ours+SPPO" versus "TGR+PO". Our ATT attack makes the
model predict wrong faster and ends up generating error labels with a higher level of confidence.
5
Conclusion
In this paper, propose adaptive token tuning attack method to enhance the transferability of ViT attacks. Unlike previous gradient-baser based attacks, our method puts more emphasis on smoothing the token gradient variance between different layers and preserving important features along with the back- proeppprppgttion.. Guided by patch-level feature importance, we introduce a self- self-paced discarding strategy from the perspective of input diversity, where the number of discarded perturbation patches is gradually increased. To further improve transferability, we propose a hybrid truncation strategy to reduce overfitting in the attention mechanism. Extensive experiments show that adaptive token tuning attack method has superior transfcrability and efficiency.
Limitations and Broader Impacts
Although our experimental results verified the effectiveness of the proposed adaptive token tuning strategy in enhancing the transferability ViT attacks, the relationship between gradient variance reduction and transferability still lacked theoretical support. Existing research suggested that more generalized feature information could improve perturbation's 's transfcrability, and our work focused on leveraging this by reducing token gradient variance. In future work, will continue exploring from a theoretical perspective to provide valuable insights into adversarial attacks.
If the proposed ATT attack method is maliciously used in soal-world applications, it could lead to security concerns, representing one of its potential negative social impacts. Due the superior perfor- mance of pretrained models and the significant time cost associated with training from scratch, many applications opt to fine-tune pretrained models. As result, this undoubtedly exposes applications to risky environment vulnerable to attacks. Our research aims to encourage deep learning practitioners to further explore security concerns related to model vulnerabilities, and in return, offering constructive guidance for adversarial defense.
10

---

Acknowledgements
This work is partially supported by the National Natural Science Foundation of China (Grant No. 62441607), the Natural Science Foundation of Chongqing, China (Grant No. CSTB2024NSCQ- MSX0341), the Science and Technology Research Program of Chongqing Municipal Education Commission (Grant No. KJQN202301 142), the Scientific Research Foundation of Chongging University of Technology (Grant No. 2022ZD7026), the Chongqing Education Ministry's Key Research Base Project for Humanities and Social Sciences (Grant No. 24SKJD134).
References
[1] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021.
[2] Josh Beal, Eric Kim, Eric Tzeng, Dong Huk Park, Andrew Zhai, and Dmitry Kislyuk. Toward transformer-based object detection. ArXiv, abs/2012.09955 2020.
[3] Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to-end object detection with transformers. In European Conference Computer Vision, volume 16, pages 213-229, 2020.
[4] Robin Strudel, Ricardo Garcia, Ivan Laptev, and Cordelia Schmid. Segmenter: Transformer for semantic segmentation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7262-7272, 2021.
[5] Fangrui Zhu, Yi Zhu, Li Zhang, Chongruo Wu, Yanwei Fu, and Mu Li. A unified efficient pyramid transformer for semantic segmentation. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 2667-2677, 2021.
[6] Yufei Xu, Jing Zhang, Qiming Zhang, and Dacheng Tao. Vitpose: Simple vision transformer baselines for human pose estimation. In Advances in Neural Information Processing Systems, volume 35, pages 38571-38584, 2022.
[7] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. In International Conference on Learning Representations, 2015.
[8] Jiaaa Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021.
[9] Kai Chen, Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Attacking video recognition models with bullet-screen comments. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 312-320, 2022.
[10] Zhipeng Wei, Jingjing Chen, Xingxing Wei, Linxi Jiang, Tat-Seng Chua, Fengfeng Zhou, and Yu-Gang Jiang. Heuristic black-box adversarial attacks video recognition models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 12338-12345. 2020.
[11) Zihan Liu, Yun Luo, Lirong Wu, Zicheng Liu, and Stan Li. Towards reasonable budget allocation in untargeted graph structure attacks via gradient debias. In Advances in Neural Information Processing Systems, 2022.
[12] Zihan Liu, Yun Luo, Zelin Zang, and Stan 7. Li. Surrogate representation learning with isometric mapping for gray-box graph adversarial attacks. In Proceedings of the ACM International Conference on Web Search and Data Mining, pages 591-598, 2022.
[13] Weibin Wu, Hui Xu, Sangiang Zhong, Michael R Lyu, and Irwin King. Deep validation: Toward detecting woal-world corner cases for deep neural networks. In Proceedings of the IFFF/FIP International Conference Dependable Systems and Networks, pages 125-137, 2019.
11

---

[14] Jianping Zhang, Yizhan Huang, Weibin Wu, and Michael R Lyu. Transferable adversarial attacks on vision transformers with token gradient regularization. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 16415-16424, 2023.
[15] Zhipeng Wei, Jingjing Chen, Micah Goldblum, Zuxuan Wu, Tom Goldstein, and Yu- Va-G Jiang. Towards transferable adversarial attacks on vision transformers. In Proceedings of the AAAI Conference Artificial Intelligence, volume 36, pages 6676, 2022.
[16] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEF/CVE Conference on Computer Vision and Pattern Recognition, pages 2730-2739, June 2019.
[17] Sihao Lin, Pumeng Lyu, Dongrui Liu, Tao Tang, Xiaodan Liang, Andy Song, and Xiaojun Chang. Mlp can be a good transformer learner. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, 2024.
[18] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pages 9185-9193, 2018.
[19] Xiaosen Wang, Jiadong Lin, Han Hu, Jingdong Wang, and Kun He. Boosting adversarial transferability through enhanced momentum. In British Machine Vision Conference, 2021.
[20] Jiadong Lin, Chuanbiao Song. Kun He, Liwei Wang. and John E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In International Conference on Learning Representations, 2020.
[21] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In International Conference on Learning Representations, 2017.
[22] Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailcy, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In International Conference on Learning Representations, 2020.
[23] Xiaosen Wang. Kangheng Tong, and Kun He. Rethinking the backward propagation for adversarial transferability. In Advances in Neural Information Processing Systems, volume 36, pages 1905-1922, 2023.
[24] Xiaosen Wang and Kun He. Enhancing the transfcrability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages
2021.
[25] Yifeng Xiong, Jiadong Lin, Min Zhang, John E. Hopcroft, and Kun He. Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14983-1499 June 2022.
[26] Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance-aware transferable adversarial attacks. In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision, pages 7639-7648, October 2021.
[27] Aditya Ganeshan, Vivek B.S., and R. Venkatesh Babu. Fda: Feature disruptive attack. In Proceedings of the IEEF/CVF International Conference Computer Vision, pages 8069-8079, October 2019.
[28) Yi Huang and Adams Wai-Kin Kong. Transferable adversarial attack based on integrated gradients. In International Conference Learning Representations, 2022.
[29] Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R Lyu. Improving adversarial transferability via neuron attribution attacks. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 14993-15002, 2022.
12

---

[30] Xiaoyi Dong, Jiangfan Han, Dongdong Chen, Jiayang Liu, Huanyu Bian, Zehua Ma. Hongsheng Li, Xiaogang Wang. Weiming Zhang, and Nenghai Yu. Robust superpixel-guide guided attentional adversarial attack. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, pages 28892-12901, 2020.
[31] Qilong Zhang, Xiaodan Li, Yuefeng Chen, Jingkuan Song, Lianli Gao, Yuan He, and Hui Xue. Beyond imagenet attack: Towards crafting adversarial examples for black-box domains. In International Conference on Learning Representations, 2022.
[32] Di Ming, Ren Peng, Yunlong Wang, and Xin Feng. Transferable structural sparse adversarial attack exact group sparsity training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24696-282 (1995, June 2024.
[33] Yuanhao Ban and Yinpeng Dong. Pre-trained adversarial perturbations. In Advances in Neural Information Processing Systems, volume 35, pages
2022.
[34] Yiran Liu, Xin Feng, Yunlong Wang, Wu Yang, and Di Ming. Trm-uap: Enhancing the transferability of data-free universal adversarial perturbation via truncated ratio maximization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4739-
4748, 2023.
[35] Muzammal Naseer, Kanchana Ranasinghe, Salman Khan, Fahad Shahbaz Khan, and Fatih Porikli. On improving adversarial transferability of vision transformers. International Conference Learning Representations, 2022.
[36] Jianping Zhang, Yizhan Huang, Zhuoer Xu, Weibin Wu, and Michael R. Lyu. Improving the adversarial transferability of vision transformers with virtual dense connection. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 7133-7141, 2024.
[37] Chenxing Gao, Hang Zhou, Junqing Yu, YuTeng Ye, Jiale Cai, Junle Wang, and Wei Yang. Attacking transformers with feature diversity adversarial perturbation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 1788-1796, 2024.
[38] Yang You, Jing Li, Sashank Reddi, Jonathan Hseu, Sanjiv Kumar, Srinadh Bhojanapalli, Xiaodan Song. James Demmel, Kurt Keutzer, and Cho-Jui Hsieh. Large batch optimization for deep learning: Training bert in 76 minutes. In International Conference on Learning Representations, 2020.
[39] Zeyue Xue, Jianming Liang, Guanglu Song, Zhuofan Zong, Liang Chen, Yu Liu, and Ping Luo. I Large-batch optimization for dense visual predictions: Training faster r-cnn in 4.2 minutes. In Advances Neural Information Processing Systems, volume 35, pages 18694-18706, 2022.
[40] Ramprasaath R. Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-basel localization. International Journal of Computer Vision, 128:336-3555 2016.
[41] Jason Yosinski, Jeff Clune, Yoshua Bengio, and Hod Lipson. How transferable are features in deep neural networks? In Advances in Neural Information Processing Systems, volume 27, 2014.
[42] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International Journal of Computer Vision, 115(3):211-252 2015.
[43] Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spatial dimensions of vision transformers. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 11936-11945, 2021.
[44] Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Hervé Jégou. Go- ing deeper with image transformers. Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 32-42, 2021.
13

---

[45] Zhengsu Chen, Lingxi Xie. Jianwei Niu, Xuefeng Liu, Longhui Wei, and Qi Tian. Visformer: The vision-friendly transformer. In Proceedings of the IEEE/CVP International Conference on Computer Vision, pages 589-598, 2021.
[46] Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data- efitccfffi image transformers & distillation through attention. In Proceedings of the International Conference on Machine Learning, pages 10347-10357. PMIR, 2021.
[47] Kai Han, An Xiao, Enhua Wu, Jianyuan Guo, Chunjing Xu, and Yunhe Wang. Transformer in transformer. In Advances in Neural Information Processing Systems, volume 34, pages 15908-15919, 2021.
[48] Benjamin Graham, Alaaeldin El-Nouby, Hugo Touvron, Pierre Stock, Armand Joulin, Hervé Jégou, and Matthijs Douze. Levit: a vision transformer convnet's clothing for faster inference. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 12259- 12269, 2021.
[49] Stéphane d' Ascoli, Hugo Touvron, Matthew L Leavitt, Ari S Morcos, Giulio Biroli, and Levent Sagun. Convit: Improving vision transformers with soft convolutional inductive biases. In Proceedings of the International Conference on Machine Learning, pages 2286-2296. PMLR, 2021.
[50] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 2818 2818-284 2826, 2016.
[51] Christian Szegedy, Sergey loffe, Vincent Vanhoucke, and Alexander A Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In Proceedings of the AAAI conference on Artificial Intelligence, pages 4278-4288 2017.
[52] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for im- age recognition. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, pages 770-778, 2016.
[53] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European Conference on Computer Vision, pages 630-645. Springer, 2016.
[54] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018
[55] Zhuoer Xu, Guanghui Zhu, Changhua Meng, Shiwen Cui, Zhenzhe Ying, Weiqiang Wang, Gu Ming, and Yihua Huang. A2: Efficient automated attacker for boosting adversarial training. In Advances in Neural Information Processing Systems, 2021.
[56] Yutong Bai, Jieru Mei, Alan L Yuille, and Cihang Xie. Are transformers more robust than cnns? In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and Wortman Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 26831-26844 Curran Associates, Inc., 2021.
[57] Yichuan Mo, Dongxian Wu, Yifei Wang, Yiwen Guo, and Yisen Wang. When adversarial training meets vision transformers: Recipes from training to architecture. In Advances in Neural Information Processing Systems, volume 35. pages 15999-18611, 2022.
[58] Edoardo Debenedetti, Vikash Sehwag, and Prateek Mittal. light recipe to train robust vision transformers. In 2023 IEEE Conference Secure and Trustworthy Machine Learning, pages 225-253, 2023.
[59] Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. Advances in Neural Information Processing Systems, volume 28, 2015.
14

---

[60] Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cmn. In Proceedings of the IEEE International Conference on Computer Vision, pages 2980-2988, 2017.
[61] Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, Cheng-Yarr
Fu, and Alexander C Berg. Ssd: Single shot multibox detector. In Europeun Conference Computer Vision, pages 21-37, 2016.
[62] Tsung- Yi Lin, Priya Goyal, Ross B. Girshick, Kaiming He, and Piotr Dollár. Focal loss for dense object detection. In Proceedings of the IEEE International Conference Computer Vision, pages 2999-3007, 2017.
[63] Zhi Tian, Chunhua Shen, Hao Chen, and Tong He. Fcos: Fully convolutional one-stage object detection. Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 9626 90359965,,22 2019.
[64] Evan Shelhamer, Jonathan Long, and Trevor Darrell. Fully convolutional networks for semantic segmentation. IEEE Transactions on Puttern Analysis and Machine Intelligence, 39:640-651 2017.
[65] Liang-Chich Chen, George Papandreou, Florian Schroff, and Hartwig Adam. Rethinking atrous convolution for semantic image segmentation. ArXiv, abs/ 706.05587, 2017.
[66] Andrew Howard, Mark Sandler, Bo Chen, Weijun Wang, Liang-Chieh Chen, Mingxing Tan, Grace Chu, Vijay Vasudevan, Yukun Zhu, Ruoming Pang, Hartwig Adam, and Quoc Le. Searching for mobilenetv3. In Proceedings of the TEEF/CVF International Conference on Computer Vision, pages 1314-1324, 2019.
15

---

Appendix
A The Analysis of the Variance of Token Gradients in ViT Layers
Based on the TGR 14] method's assumption that channels in the ViT module are independent, can analyze the variance of token gradient a single channel, which can then be applied repeatedly to remaining channels within each module. In the following derivations, we replace g gl.mm) [c] in e-th channel (c 1, C) with g for notational simplicity. Without loss of generality, the number of token gradients in each module m is represented by n. Thus, g is defined the IR" space. Since the scales of different token gradients vary significantly, we assume that the largest token gradient (either before or after re-scaling) far beyond the expectation of token gradients, i.e., max(g) > 0, mgx >> E(g], and y max(g) > Elg] with 7 E (0, 1).
Theorem 1. Given the token gradients g [g 9n. and the scaling factor E (0, 1), the variance of token gradients Var(g) is reduced after re-scaling the largest token gradient by 9j = 7 9j. where j arg (1,, 9s-
Proof of Theorem Based on the predefined re-scaling operation on the largest token gradient,
we define an auxiliary variable g 91, -nJ. where 9i = 9i for = j. and fr = di for i # j. After re-scaling the largest token gradient by 9j = 7 gj. rewrite the variance of the auxiliary
gradient variable g equivalently as follows:
Var(g)
Elg¹1 (EE
o0 7 93)
}
-
9j +
Σ
94 -2)
93
1 1 7
(5)
9j
i=1
Big") (E(g))²
(1-7, n2
93)
7)
9j
1- 7
9j 2B
n
On the other hand, we have the following inequalities that gj > E[g] and 7.9 2 E[g] since gj is an
outlier (i.e., largest) value from the original distribution of token gradients. As result, can obtain that 9j 2 L[g], since ğj = 7 9j 2 Egg] 2 ElG]
Then, the third term A in the last row of Eq. 5 can be rewritten equivalently as:
A
9i) (oj E[gl) (7
(1 (1-7) 7)
9j Elgl)
71
(6)
1-7 gi (9) Bigl) + (ō) - -Bg) 2 0,
n
where 9j 2 and 1 - 2 0.
Combining Eq. and Eq. 6 together, we can obtain the following inequality between the original variance and the variance after re-scaling token gradients:
Var (g) = Var(g) - A S Var(g),
which completes the proof.
For QKV and MLP modules, we can re-scale the largest token gradient in each channel to reduce the overall gradient variance according to Theorem [ For Attention module, we found out that the largest token gradient is highly correlated with other extreme token gradients. We define S as the set of extreme token gradients and its size |S| ní' < n, where includes the largest token gradient gj and its correlated extreme token gradients at the same row or the same column. Thus, we can also assume that all the token gradients in S are far beyond the expectation of token gradients, iee, 9j >
gj E[g], and 7 gj E[g] for E S.
16

---

Lemma 2. Given the token gradients 191......hh and the scaling factor E (0, 1), the variance of token gradients Var(g) reduced after re-scaling all the extreme token gradients in the set by Dj - 9j. where E S and [S] = n' <
Proof of Lemma 2 In the following, the token gradients in the are re-scaled one by one w.n.f. their descending order O, i.e., 90, 2 ... 90... For each index Oj, we define an auxiliary gradient variable g() and its corresponding index set St)) {O1,- .,. Oj}. where 9.") 7 for (() and "3- 9i for i g(i), For any two consecutive indices O, and O 1+ the relationships between gradients and their expectations are 3o; 2 _ and Jo,+1 2 Eig J.
According to Theorem | we have the following inequality of variances before and after re-scaling g
g0,+1 = Y 56 g0++ i.e., Var(g(+))) < Var(g ) By setting g(d) g and iteratively re-scaling
token gradients in the set usinn the descending order O, the following inequality can obtained:
Var(g) = Var(ğ(") 2 Var(g
2 ( Var(g(")) = Va)
Var(g (D))
(8)
where 9: 7 9i for i E S and 9i 9: for i & S. As result, have Var(ū) I Var(g) after re-scaling all the n' extreme token gradients in the set S, which completes the proof.
Based on Lemma 2 we can re-scale the set S of extreme token gradients in each channel to reduce the overall gradient variance for Attention module. As a result, by combining Theorem and Lemma 2 theoretically verify the effectiveness of our mild re-scaling strategy that the overall gradient variance can be reduced for all the modules in ViT layers.
B The Analysis of Adaptive Variance Reduced Token Gradient
It is demonstrated in Fig. 3a that the variance of token gradients after re- re-scaling reduced greatly compared to the variance of original token gradients. Additionally, by adaptively re-scaling the token gradient, the variances throughout ViT layers became more smoother with the increase of the value of X, as shown in Fig. 3b Thus, the proposed adaptive variance reduced token gradient method was more effective than the one of re-scaling the token gradient with fixed constant value.
7=0.0001
1-0.5 =40-10011 1-0.5 - 2-0 01 A-0.001 1-0,000
3.D-11
Gradient variance
Gradient variange
6E-13
2.6-11
S.E-13
2.6-11
4.6-33
1.B-11
3.E:13
S.B-12
8.B-14
S.1-14
3
10
11
Layer
Layer
(a) Comparison of original and re-scaled gradients
(b) Comparison of different values A.
Figure 3: The analysis of adaptive variance reduced token gradient with different parameter settings.
C The Overall Framework of Optimization Algorithm
In section we present the details of the proposed adaptive token tuning (ATT) method from three perspectives, towards training transferable adversarial examples on ViT models.
At each iteration, during the feed-forward process, self- -aced patch out method is applied to randomly discard portion of adversarial perturbations via the semantic guided sparse mask. Following this, the adaptive loss function and its gradient are calculated based on the input pair (i.e., the crafted adversarial example and the ground truth label). On the other hand, during the back-propagation process, we first truncate token gradient in hybrid mode to weaken the effectiveness of attention mechanism, and then adaptively re-scale the set of extreme token gradients reduce the overall gradient variance for each module throughout ViT layers.
17

---

The overall optimization algorithm is summarized in Algorithm 1 In line I1 we adaptively re-scale the largest token gradient (i.e., |S| = 1) for MLP or QKV module and the S of extreme token gradients for Attention module respectively.
Algorithm I Adversarial Attack on ViTs with Adaptive Token Tuning (ATT)
Input: clean image with its ground truth label y, surrogate model loss function C, maximum perturbation bound e, maximum iteration number I', total number of network layers L, gradient penalty factor y, adaptive factor X, scaling and offset factors a, P, truncation factor
Output: Eade Initialize 6u
2: Set 1j f
3: Compute the patch-level feature importance C
4: for 6 1 to 7' do
5: Generate the progressive sparse mask wA via Eq.
6: Compute the loss function L, C(f(x + 8 w))
7: Back-propagate the gradient VLG,
8: for = L to do
9:
for m E {Attention, MLP, Q do
10:
Truncate the token gradients g (1.mm) by 7(..m)
11:
Adaptively re-scale the set S of extreme token gradients via Eq
12: end for
13: end for
14: Update adversarial perturbation 6; = -;-1 + 17 sgn V&L1)
15:
end for
16:
Generate adversarial example Fado max(min(e: + 87, 255), 0)
return Fade
D Additional Experiments
D.1 Comparison of Attack Efficiency between Different Methods
Tables 5 demonstrated the attack efficiency of different methods on ViTs, CNNs, and defended CNNs. To effectively evaluate the attack efficiency during the perturbation training, we calculated the average of the number of iterations that lead to the first-time misclassification by the model across the entire dataset, defined as Lavg = (I/ E t, where |J] represents the total number of test data samples in the dataset D. Compared to state-of-the-ar methods, experimental results showed that the attack efficiency of our ATT method is the highest in all black-box settings. In Fig. 4 showed the attack efficiency of different methods in another way, where the subtitle represented the surrogate model and the r-axis represented the target model (total 15 models; are CNNs). It can be clearly seen that all methods were significantly less efficient against CNNs, which was consistent with the above-mentioned experimental results presented by ASR (%).
are ViTs; 8 14
D.2 The Analysis of Truncating Attention Module
Inspired by [7], we considered the possible redundancy of the attention module, which could lead to perturbation overfitting in the surrogate ViT model. Thus, adopted truncation strategy to discard part of the attention layer. The corresponding number truncation layers is chosen based on the best ASR, shown in Fig. where we conducted the analysis on four surrogate VIT models. Due to differences in network structures, the shallow models (e.g., Visformer-S) obtained the best performance without applying truncation, while the deep models (e.g., PYT-B, CaiT--/24, Visformer-S) required truncation at varying levels.
Without loss of generality, set all the non-zero truncation factors of each module to the same value. Additionally, to ensure the effectiveness of hybrid truncation, we first normalized the token gradients of Attention, QKV, and MLP modules to approximately same order of magnitude, i.e., [| (CH)). Then, according to the normalized values, we adjusted the truncation factors to let MIP and QKV V modules dominate the back proo-ppopag token gradients and weaken the impact of Attention module updating the perturbation.
18

---

Table 5: Comparison of attack efficiency of different methods on ViTs.
Model
Attack
ViT-B/16
PiT-B
CarT-S/24
Visfomer-S
DefT-B
TNT-
LeVIT-256
ConVIT-B
PNA+PO
7.8
5.6
1.5
5.8
VIT-B/16
TGR+PO
2.6
7.5
5.8
7.2
5.8
5,4
7.3
5.6
Ours+SPPO
1,31
6.3.
4.1L
6.01
4.1.
4.3
6.1]
3.91
PNA+PO
7.5
1.3
6.9
5.7
7.1
5.5
6,4
6.8
PIT-B
TGR+PO
5.9
1.8
5.7
4.9
5.9
5.7
Ours+SPPO
5.30
0,9.
4.5L
3.7
4.7.
3.2,
4.0.
4.6
PNA+PO
5.9
7.0
2.3
6.5
4.4
5.1
6.6
4,5
CaIT-S/24
TGR+PO
6.3
1.9
5.7
3.8
3.9
3.8
Ours+SPPO
3.5
4.31
2.41.
PNA+PO
8.0
6.5
7.3
0.8
7.6
5.5
6.2
7.6
Visformer-S
TGR+PO
6.8
5.8
6.3
1.1
6.6
5.1
6.7
6.9
Ours+SPPO
6.5g
5.4,
5.81
0.80)
6.2,
3.81
4.6|.
6.41
Table 6: Comparison of attack efficiency of different methods on CNNs and defended CNNs.
Model
Attack
Inc
Inc
IncRes-v2
ResV2
Inc V3ens3
Vnes4e
IncRes22adv
PNA+PO
8.1
8.4
8.6
8.2
8.8
9.0
9.2
ViT-B/16
TGR+PO
7.6
8.0
8.3
7.9
8.4
8.6
8.8
Ours+SPPO
6.9.
7.2%
7.5.
7.1.
7.91
7.91
8,3,
PNA+PO
7.1
7.5
7.9
7.7
8.7
8.9
9.2
PYT-B
TGR+PO
5.9
6.4
6.8
6.5
7.7
7.8
8.4
Ours+SPPO
5.0.
5.4.
5.9.
5.6..
7.1.
7.3,
7,9
PNA+PO
7.4
7.7
8.0
7.6
8.5
8.6
9.0
CaiT-S/24
TGR+PO
6.5
7.0
7.3
6.8
7.7
7.8
8.4
Ours+SPPO
5.3.
5.8
6.1.
5.7%
6.7
6.9L
7.6
PNA+PO
7.0
7.8
7.4
8.7
8.9
9.3
Visformer-S
TGR+PO
5.3
5.4
6.4
S.7
7.4
7.9
8.5
Ours+SPPO
4.7.
4.8.)
5.8
5.2
7.0L
7.5L
8.2
Phie20
TGR+FO
10.0
10.0
Astingad Number of leerttiens (1
7.0
7.0
6.0
Noniee
4.0
3.0
1.0
0.0
Model
Model
(a) ViT-B/16
(b) PiT-B
PHAIIO
--th- P5A100
TOR
10.0
10.0
Averped Numbe (lcraiene
8.0
7.0
Nonber
5.0
4.0
4.0
1.0
0.0
10
12
14
12
14
Model
Model
(c) CaiT-S-24
(d) Visformer-S
Figure 4: Comparison of attack efficiency of different methods on ViTs, CNNs, and defended CNNs.
19

---

2
Nadee medlane
(d) Visformer-S Figure 5: Comparison of ASR (%) of our ATT method with different number truncated layers.
VIT-B/16
PiT-B
(c) CaiT-S/24
D.3 Additional Analysis of Attack's Effectiveness and Efficiency
We illustrated Fig. 2 more specifically, and in Fig. 6 we visualized class activation maps guided by correct and incorrect labels. could be clearly seen that, during iterative training, adversarial perturbations gradually allowed the feature information of the correct label to be corrupted, while generating the feature information of the incorrect label. Compared to other methods, our ATT method successfully disrupted the model more effectively (i.e., higher confidence level) and more efficiently (i.e., fewer iteration number). this figure, it was observed that the correctly labeled class activation map, the important regions were not exactly in the classification target region, which was obviously a distribution problem incurred by the dataset and the model. This also provoked to think that good model should try to avoid classification errors due to background changes, but this did not seem be achievable on this type of image or model. We believed that a more comprehensive dataset should include the case where the classification target remained the same but the background changed, so that the model could recognize the classification target more accurately.
(92.36%))
(91,35%)
(82 55%)
(56.90%))
(20 80%)
(6 95%)
(R.77%)
(3.36%)
(3.64%)
(4.31%)
PNAIPO
Welmaraner
(91 54%)
(90.917%)
(B8 35%6)
(84.885))
(79.12%)
(70.866))
(54.51%)
(3R.425)
CIS. 10%)
(6-49%))
TOR
(92.699)
(900139))
(8) 78%6
13551
(25 25%)
(3.38%
(0.50%)
(0.11%)
(0.04%)
(0.0276)
Ours SPPO
(0.2756)
(0.96%)
(6.2995)
(86.18%)
(S8 7996)
(72.34%)
(71.76%)
(79.91%)
(76-80%)
(T.11%)
Label Great Dante
(0..19%) (99%)
(0.31%)
(0.81%)
(1. (1.8%%
(4 (4.275))
(10,029)
(22.4595)
(32,90%g
(S1.1 (2%)
(64.625))
(0.3%)
(1.18%)
(5.755%)
(19.36%)
(95.19%)
(73.89%)
(82.788%)
(85.27%)
(87 0016)
(87.28%%)
Figure 6: Class activation maps guided by correct label (top) and incorrect label (bottom).
D.4 Comparison of Class Activation Maps in Intermediate Attack Processes
In Figs. 7 we further showed class activation maps of adversarial examples in intermediate attack processes, trained by different surrogate models. We used a pseudo label (i.e., the label of maxi- mum probability) to guide the generation of class activation maps. Compared to "PNA+PO" and "TGR+PO". our ATT method achieves higher attack efficiency and effectiveness.
20

---

(99.577))
ESP Pil
(98, 7.4%)
(60) 12%
(on SPPh))
(83.237))
PSN-RO
Bes
Dse
Boe
Boe (68.8995)
Jacomar (89.4174)
1994 577%)
(9988295)
(995 6offc
199 (M9N)
(89.107)
(94.8%%)
TGR
Boo eneer
Heee catre 74hit
Iooe enter
Heoo coler
Hew enter
Jacamar
Incamant
Jacemtrr (97.40%)
Jacamar
Jaramar
Chas SPPO
(a) DeiT-B
Anoloti
Axolodi (SA
Avcolai
Anoled
Ploze
Drusa
Drum
Apura
Agama
ASaIRa
PNA
(35,62%)
180.3 1991
033 20%)
(72.129)
(39 (906000)
(39,08%))
(209
(64.219))
(690759))
(75.957)
TOR IN
Axoloil (34.0M%)
Asalet
Apciali
(83 835881
(BC (41%
1O (OTEEMS))
(20
(BEC) 1961
(85C557)
Chuss SPPO
(b) Cin
Reika modio
raekky (923222)
Soicer menky
Speder
Spkke maekky (7TA0001
Sendar
Spikes taekky (SC.A%
Spicer zunkyy (2400)))
Spedar
Spkke cakky (2AIN)
(5547%
PSA+PO
102 37h0
(83.2%)
155 Be10
(53
(58.54%))
(0022%)
TGR: PO
Sesder mandery (22 40h
raenkry
Senter
Spedersankey (12.50)))
Spate: 688A77
Sestormadees (36
Louar
Lesee
(50665))
(220/90)
131,2%0
Cuas SPPO
(c) Inception V33
Buckeve
Busleeve
Buckeve
Buckeve
Buckense
Junco
Junco
Junco
Junco
Junco
PNA-PO
(70,51%)
162. 602.60991
(36, 75MG)
(25,75%)
(13.12%)
(12.95%)
(13.38%%)
(15.125)
(10.23%)
(19.81%)
TOR- IN
Hackeyyo (SN.167))
Buckeree
Busckrve 125
Keuckeye (180075)
Junco (19.00%))
Janco (28-459))
(50L 10S
(2.42%
E20. 78%
(3..1%%
Dlus SPPO
(d) Inception CropptionVeemae V3ess4
Figure 7: Comparison results class activation maps in intermediate attack processes under different surrogate models. For each subfigure, the top is the attack results for "PNA+PO". the middle row the attack results for "TGR+PO", and the bottom row is the attack results for "Ours+SPPO".
21

---

D.5 The Analysis of Our ATT Attack with Different Module Settings
The analysis results were shown in Tables 7 where the ASR is calculated on average for ViTs, CNNs. and defended- CNNNs We further conducted analytical experiments on three additional surrogate ViT models assess the impact of different module settings on attack transferability in black-box scenarios.
respectively (which will also be used in subsequent experiments).
In almost all ablation experiments, it obtained that attacking the Attention module gave the best transferabilitty. But unexpectedly, attacking the MLP module of the CaiT-$-24 model resulted in better transferability. We analyzed that it was due deeper ViT models like CaiT-S-24, where the MLP module played greater role in correct classification. Overall, attacking all three modules simultaneously yielded better performance than other module settings in most cases.
Table 7:
The average attack success rate (%) of our ATT method with different module settings trained by the surrogate model "PiT-B". Attention
QKV
MLP
ViTs
CNNs
Det-CNNs
36.8
32.0
17.3
70.1
58.6
33.1
63.9
52.6
29.0
60.1
47.5
26.3
V
V
75.3
62.9
36.4
85.0
72.2
45.1
79.8
68.3
43.8
87.7
78.0
52.0
Table 8: The average attack success rate (%) of ATT method with different module settings trained by the surrogate CaiTs--a"
Attention
QKV
MLP
ViTs
CNNs
Def-CNNs
69.8
43.3
27.2
82.8
61.7
43.4
V
73.2
50.0
33.9
V
85.0
62.0
45,9
V
83.0
62.3
43.6
V
93.0
75.6
58.3
86.1
64.3
47.1
92.6
75.4
58.3
Table 9: The average attack success rate (%) by our ATT method with different module settings trained by the surrogate model "Visformer-S".
Attention QKV
MLP
ViTs
Def-CNNs CNNs
42.5
40.8
20.6
73.5
67.7
35.1
66.5
62.5
31.8
V
62.1
64.4
35.7
V
73.5
69.5
36.1
77.1
82.3
48.5
V
72.3
77.5
44.9
V
76.4
84.4
50.3
D.6 Evaluating the Transferability of Our ATT Attack on Object Detection Models
In the previous experiments, we evaluated the transferability of different attack methods from one classification model another classification model (i.e., the cross-model transferability). Thus, we further explored the versatility of ViT attacks in cross-task scenarios, where adversarial examples crafted by image classification models (i.e., ViT-B) on the ImageNet dataset were directly input into object detection models. For purpose of better visualization of the cross-task attack process, we used all the intermediate states from 10 updates during the perturbation generation. Additionally, only the top three detection boxes with the highest confidence in the prediction results were considered. We
22

---

compared the performance of "Ours+SPPO" with "TGR+PO" on different object detection models,
including Faster-RCNN (59), Mask-RCNN 600, SSD 6T]. RetinaNet [2]. and FCOS 63
As shown in Fig it was clear to see that our ATT attack method allowed the object detection model to produce higher confidence error in detection results.
D.7 Evaluating the Transferability of Our ATT Attack on Semantic Segmentation Models
To further evaluate the cross-task transferability, we directly input adversarial examples crafted by image classification models (i.e., ViT-B) on the ImageNet dataset into semantic segmentation models. Here, the experimental setup was identical to that used in [.6] We compared the performance of "Ours+SPPO" with "TGR+PO" on different semantic segmentation models, including FCN- re (64). Deeplabw.3-resne550 [65], and LRASPP [66]. It could be seen Fig. ( that our ATT attack method corrupted the segmentation results more severely, which generated more incorrect semantic labels.
(a) Faster-RCNN 59
(b) Mask-RCNN 60
eeloome
(c) SSD 61
(d) RetinaNet 62
(c) FCOS 66
Figure 8: Demonstration of results of attacking multiple object detection models using adversarial examples trained by VIT-B. For each subfigure, the lefumost shows the detection results for clean images, the top right shows the attack results for "TGR+PO", and the bottom right shows the attack results for "Ours+SPPO".
23

---

(a) FCN-resnet101 64
(b) Deeplabw.3rrsseet50 6s
(c) LRASPP 66
Figure 9: Demonstration of results of attacking multiple semantic segmentation models using adversarial examples trained by ViT-B, For each subfigure, the leftmost the clean image, the top right is the attack results for "TGR+PO", and the bottom right is the attack results for "Ours+SPPO".
Table 10: Ablation experiments of our ATT method using different attack strategies with the SPPO setup ("AVR": Adaptive Variance Reduced Token Gradient; "ST": Soft Truncation; "HT": Hard Truncation).
AVR
ST
HT
ViTs
CNNs
Dof-CNNN
AVR
ST
HT
ViTs
CNNs
Def-CNNs
49.9
29.1
19.3
36.8
32.0
17.3
70.4
43.3
29.7
70.1
58.6
33.1
68.8
40.7
27.7
63.9
52.6
29.0
67.8
39.5
28.0
60.1
47.5
26.3
V
V
72.1
45.5
31.0
V
75.3
62.9
36.4
79.3
51.7
37.5
85.0
72.2
45.1
77.8
48.7
35.5
79.8
68.3
43.8
80.3
54.1
38.7
87.7
78.0
52.0
(a) ViT-B
(b) PYT-B
AVR
ST
HT
ViTs
CNNs
Def-CNNs
AVR
ST
HT
ViTs
CNNs
Def-CNNs
69.8
43.3
27.2
42.5
40.8
20.6
82.8
61.7
43.4
73.5
67.7
35.1
73.2
50.0
33.9
66.5
62.5
31.8
85.0
62.0
45,9
62.1
64.4
35.7
83.0
62.3
43.6
73.5
69.5
36.1
93.0
75.6
58.3
77.1
82.3
48.5
64.3
72.3
77.5
44.9
92.6
75.1
58.3
76.4
84.4
50.3
(c) CaiT-S/24
(d) Visformer-S
D.8 Additional Ablation Experiments of Our ATT Method using Different Attack Strategies
In Table 10 we performed ablation experiments on three strategies (AVR/ST/HT), where "AVR" denoted Adaptive Variance Reduced Token Gradient, "ST" denoted soft truncation that we utilized the truncation factor to truncate Attention, QKV, and MIP modules, and "HT"" denoted hard truncation that we could truncate the gradient of selected Attention layers to zero. It could be seen in Table I0

---

that "AVR" achieved better attack performances than "ST" and "HT". The hybrid truncation strategy that combined "ST" with "HT" resulted higher ASR than using "ST" or "HT" independently. On the whole, when considering all three different attack strategies, our ATT method obtained the best transferability nearly all of black-box settings.
In Table an additional experiment was conducted to study the variance reduction of token gradients, where both input enhancement and other gradient strategies are considered here. "Only VR" denoted that only the variance reduction strategy was utilized in our ATT method, while "Only AVR" denoted that only the adaptive variance reduction (AVR) was ultized in our ATT method. As shown in Table [I our proposed adaptive variance reduction strategy performs better than the fixed variance reduction strategy, leading better transferability of crafted adversarial examples.
Table 11: Study of the effect of gradient variance reduction on ASR. "Only VR indicates "Variance Reduced" and "Only AVR" indicates "Adaptive Variance Reduced".
VIT-B/16
PiT-B
CaiT-S/24
Visformer-S
VITS
CNNs Dcf-CNNs
VIs
CNNS
DeFCNNN
VITs CNNs DeF-CNNs
VITS
CNNS Dct-CNNs
Oury(Only VR)
72.5
46.2
33.0
81.4
70.1
45.6
87.2
62.7
45.5
67.0
70.2
36.0
Ours(Only AVR)
73,5
47.5
33.6
84.4
72.5
46.3
89.6
66.5
47.2
67.7
72.6
37.2
D.9 Evaluating the Transferability of Different Attack Methods on Robust VIT Models
In Table 12 we added validation experiment for robust ViTs, where "PNA+PO", "TGR+PO", and "Ours+SPPO" use their optimal hyperparameters, "clean" denoted that the model was utilized to classify a clean dataset and the result was the probability the classifier classifying the data incorrectly. The rest of the attack results were presented by all ASRs. Experimental results showed that our ATT attack method still outperforms SOTA methods robust ViT models (i.e., DeiT- S [56). Swin-B (57), Xcit-S [58]). Meanwhile, performed the same test normal ViT models corresponding to these robust VIT models, where the proposed "Ours+SPPO" also achieved the highest ASR.
Table 12: Comparative experiments different attack methods robust ViTs. "clean" indicates that clean images are classified and all results indicate the percentage of classification errors (i.e., ASR).
Robust ViTs
Normal ViTs
Model
Attack
DeiT-S
Swin-B
Xcit-S
DeiT-S
Swin-B
Xcit-S
clean
13.9
5.4
46.8
0.5
0.4
0.2
PNA+PO
19.5
8.8
51.7
75.2
47.5
45.5
VIT-B/16
TGR+PO
27.7
15.8
56.5
85.1
54.4
54.5
Ours+SPPO
28.81
16.9
56.71
93.71
70.41
68.6
PNA+PO
18.4
9.2
51.8
59.3
67
71.2
PiT-B
TGR+PO
28.8
17.9
58.2
83.8
77.3
80.7
Ours+SPPO
29.11
18.7
58.31
91.71
90.41
92.81
PNA+PO
20.3
9.9
52.2
89.5
69.3
67.1
CaiT-S/24
TGR+PO
32.9
20.3
56.9
96.9
76.7
77.2
Ours+SPPO
35.51
21.9
58.11
99.21
90.41
90.61
PNA+PO
17.9
8.1
51.3
48.5
68.8
68.5
Visformer-S
TGR+PO
23.6
12.9
55.8
61.5
70.6
71.8
SPrs+
24.11
13.8
56.11
76.51
86.51
86.71
25

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Please Section and Appendix D.I D.9
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
Justification: We have dedicated the separate section to discussing the limitations of our method. Please refer Section 6
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
26

---

Justification: The full set of assumptions for proving Theorem and Lemma is provided in Appendix A
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: Section 4.1 describes all experimental setup reproduce our main experi- mental results. Additionally, the optimal parameters of our method are also provided in the Supplementary Material.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, a No answer this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing verifying the results.
5. Open access to data and code
27

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
Please see the README.md file in the Supplementary Material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips //iiss.cc/pill wwtpcccpppppppppeeeeeeeeeeeeeeee hotaa//gguudeee/eeeeabiiiisssss /Cc////oddiiisssseeeeeee ssiiiiiisiyyyyyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification: Please see Section and the Supplementary Material.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: All our results are using fixed seeds since the uncertainty in the transferability of adversarial attacks is small.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
28

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
show in tables or
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please see the README.md file the Supplementary Material.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't It make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification:
We have strictly adhered to the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- cration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We have dedicated separate section discussing the broader impacts of our method. Please refer to Section 6
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
29

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our work poses such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Please see Section and the Supplementary Material. Additionally, both the data and model used in our work are open source and can be used for academic research.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
30

---

If assets are released, the license, copyright information, and terms of use in the thcode has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssit
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: Our work do not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our work do not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper dlees not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: Our work do not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
31

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
32


Reviews:
[{"review_id": "Sv8gepVAvN", "reviewer": "Reviewer_9KoY", "summary": "This paper investigates the enhancement of adversarial attack transferability on Vision Transformers (ViTs) through innovative adaptive token tuning techniques. It addresses the vulnerability of ViTs to adversarial attacks by introducing three main optimization strategies: an adaptive gradient re-scaling method to uniformly reduce gradient variance across ViT layers, a self-paced patch out strategy to increase input diversity and mitigate overfitting by dynamically discarding less important perturbation patches, and a hybrid token gradient truncation method designed to attenuate the attention mechanism's effectiveness, adjusting truncation factors across different modules for optimal balance. Extensive experiments demonstrate that these methods not only improve the transferability of adversarial examples across ViTs and CNNs but also significantly enhance attack success rates by an average of 10.1% compared to state-of-the-art transfer-based attacks. Notably, this approach achieves a remarkable average attack performance of 58.3% on defended CNNs, highlighting the ongoing challenges in securing robustly trained defense models against sophisticated adversarial strategies.", "questions": "The authors mention that the mild re-scaling strategy can back-propagate some important feature information in the largest token gradient, which is correlated with important feature information, unlike TGR. However, it is unclear how retaining important feature information contributes to enhanced transferability of adversarial attacks. Could the authors elaborate on the connection between these retained features and the observed improvements in transferability?", "limitations": "The authors suggest that attention modules in certain ViT layers are redundant for image classification and adversarial perturbation generation, potentially leading to overfitting. This assertion raises questions about the underlying mechanisms. Could the authors provide more detailed analysis or empirical evidence on how these redundant attention modules affect the transferability of adversarial attacks?", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. This paper significantly enhances the transferability of adversarial attacks on Vision Transformers (ViTs) by introducing three main optimization strategies: an adaptive gradient re-scaling method, a self-paced patch out strategy, and a hybrid token gradient truncation method. It also provides a comprehensive theoretical analysis of the proposed methods, detailing the mechanisms through which each contributes to improving adversarial robustness and effectiveness.\n\n2. Extensive experimental results substantiate the effectiveness of the proposed methods, demonstrating their efficacy across various settings and models.", "weaknesses": "1. This paper enhances the transferability of adversarial attacks on Vision Transformers (ViTs) through adaptive token tuning, introducing three main optimization strategies: an adaptive gradient re-scaling method, a self-paced patch out strategy, and a hybrid token gradient truncation method. However, it lacks ablation experiments for these three strategies.\n\n2. The authors propose an improvement on the PatchOut method, termed Self-Paced Patch Out, which is an input transformation approach that intuitively could enhance adversarial transferability. However, comparing it in Table 1 alongside methods that do not incorporate input transformation, such as TGR, seems unfair.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "1. **Answer to Weakness 1 -- ablation experiments for these three strategies:** We apologize for any ambiguity in our manuscript regarding the experimental setups described in Tables 1-3, where we did an ablation study of the input enhancement strategy including both Path Out (PO) and Self-Paced Patch Out (SPPO).\nTo clarify, the input enhancement strategy (PO and SPPO) was not included in Tables 1-2, aligning with the setups used for TGR.\nIn Table 3, the input enhancement strategy is combined with our other two attack strategies.\nAdditionally, we provided the ablation experiment of the other two proposed strategies in **Table 2 of our rebuttal PDF**, including the adaptive gradient re-scaling method (see AVR) and the hybrid token gradient truncation method (see ST and HT).\n\n2. **Answer to Weakness 2 -- Table 1-2 were fair:**\nTo align with the setups used for TGR, we did not include any input enhancement strategies in Tables 1-2, ensuring a fair comparison between our ATT method and the state-of-the-art methods.\nOn the other hand, we investigated the effect of SPPO combined with other methods (such as TGR and PNA) on attack transferability in **Table 1 of our rebuttal PDF**, further verifying the effectiveness of our proposed SPPO strategy.\n\n3. **Answer to Questions -- Retention of features to improved transferability:** The retention of important feature information is pivotal for the effectiveness of gradient-based adversarial attacks, which often utilize the gradient direction opposite to these critical features to enhance attack transferability. While completely disregarding these features, as seen with TGR, reduces overfitting, it also diminishes the utility of these features in facilitating the transferability of perturbations. \nOur experiments, detailed in **Table 4 of the rebuttal PDF**, specifically explore the impact of preserving these important features using our methodology—without truncation or input enhancement strategies—demonstrating their significance in improving adversarial attack transferability.\n\n4. **Answer to Limitations -- Redundant attention modules affected the transferability:** To address concerns regarding the redundancy of attention modules, we provide a comprehensive analysis in Section A.5 of our Supplementary Material. \nThis section includes experimental evidence showing how excessive reliance on the attention mechanism can lead to overfitting, thus negatively impacting the transferability of adversarial attacks. \nBy truncating the attention layer, we demonstrate the potential for improved attack transferability without compromising model accuracy. \nFurther, references [15-16] conducted a comprehensive analysis of the attention mechanism, experimentally verified the overfitting phenomenon caused by the attention module. [15-16] strategically bypassed the attention mechanism to  not only maintain but can enhance the model performance.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "D72Xypu3Vn", "reviewer": "Reviewer_zV8Q", "summary": "n this paper, the authors investigate three strategies to boot the transferability of adversarial attacks on Vision Transformers, including an adaptive gradient re-scaling strategy, a self-paced patch out strategy, a hybrid token gradient truncation.", "questions": "In Table 2, the results reveal that the proposed method can better attack the robust CNNs. How about robust ViTs, such as DiT-S in [3], Swin-B in [4], Xcit-S in [5]?", "limitations": "There is no single section to discuss the limitation and the broader Impact of the paper. Can you explain them with more details?\n\n[1] https://github.com/Trustworthy-AI-Group/TransferAttacks\n\n[2] https://robustbench.github.io/\n\n[3] Are Transformers More Robust Than CNNs? in NeurIPS 2021.\n\n[4] When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecture, in NeurIPS 2022.\n\n[5] A Light Recipe to Train Robust Vision Transformers, in SaTML 2023.", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1 The experiments are solid.\n\n2 The soundness of the method is good.\n\n3 This paper is well written.", "weaknesses": "1 The title of the  paper might be imappropriate to conclude the techniques proposed by authors. The overall methods are composed of three partitions:\n\n- An adaptive gradient re-scaling strategy to reduce the overall variance of token gradients. It is related to the back propagation for crafting adversarial samples. \n\n- A self-paced patch out strategy to enhance the diversity of input tokens. It is related to the adaptive forward propagation for calculating the adversarial loss. \n- A hybrid token gradient truncation strategy to weaken the effectiveness of attention mechanism. It is also related to the back propagation for crafting adversarial perturbations. \n\nWe can see that none of these points are related to the token tuning. (Maybe I am wrong, I hope authors can point out my mistakes.) As I understand it, token tuning usually refers to optimizing the token after tokenizing the input images.  Since the designed attacks craft pertubations directly on input images like most of previous attacks. I think it might be imappropriate to conclude the proposed methods with the phrase \"Adaptive Token Tuning\". \n\n2 In line 72, the authors claim that \"robustly trained defense models still fail to meet security requirements\".  The observation contradicts with the findings observed in [1].  I conjecture this is because the authors choose to attack secure models which is published in 6 years ago. Considering the rapid development in the adversarial community, I recommend to attack recent sucure models trained by $l_{\\infty}$ AT provided by robustbench [2].\n\n3 The novelty of this paper is fair. The design principles of the proposed methods originates from previous papers and in this paper, they simply make them adaptive. Higher flexibility often brings better transferability. However, it also brings additional costs: it will increases the difficulty of hyperparameter tuning. In addition, more new insights are needed to guide community better leverage ViT to attack deep models.\n\n4  The conparison with the baseline methods in Table 1 and Table 2 might be unfair. It seems that the proposed methods acquire better transferability than other attacks. However, considering the proposed attack proposed in this paper combines the power of three attacks: TGR, PNA, PatchOut. I think the appropriate baseline is TGR+PNA+PatchOut. It helps us more precisely pinpoint the gains brought by the proposed method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "1. **Answer to Weakness 1 -- Adaptive Token Tuning for our manuscript title:** We appreciate the reviewer's emphasis on the traditional definition of token tuning. In our work, token tuning extends beyond mere feature value processing; it encompasses the modification of feature values, attention weights, gradient information, and layer interaction, all centered around the token as the basic unit.\nOur strategies, whether related to gradient tuning or input enhancement, adhere to this broader definition of token tuning. We will clarify this in our revised manuscript to avoid any misunderstanding.\n\n2. **Answer to Weakness 2 -- Testing on Defended ViTs:** Based on the reviewer's suggestion, we conducted additional experiments on robust ViTs, as detailed in **Table 3 of our rebuttal PDF**. \nTransferable black-box attacks were tested against three robust ViT models and their normal counterparts using our best strategies and those of comparative methods. \nThe results confirm that our approach consistently outperforms others in effectiveness.\n\n3. **Answer to Weakness 3 -- Description of our innovations:** \n**(1)** Our gradient treatment strategy, although inspired by existing methods like PNA and TGR, we proposed a new treatment strategy for the gradient, and that the idea of treating the gradient was completely different from PNA and TGR, see our manuscript Ln146-154. On this basis, introduced a novel adaptive adjustment strategy that aligned gradients from previous layers with those of the deepest layer. This alignment helped smooth out gradient variance and enhanced feature information learning, moving beyond mere adaptivity.\n**(2)** Our self-paced patch out strategy innovates beyond the random discard of patches. Our strategy introduced the concept of self-stepping learning and meanwhile distinguished between significant and non-significant regions when discarding tokens. This strategy is beneficial for learning the transferable attack pattern and also improves the efficiency of the attack, as demonstrated in Figures 2, 4, and Table 5 of our manuscript. \nThe relationship between our method and PatchOut is more like the relationship between dropout and its variants.\n**(3)** Unlike TGR and PNA, our Hybrid Token Gradient Truncation truncates attention modules in deep ViT layers to learn generic feature patterns and adjusts corresponding truncation factors based on the role of different modules. \nThis nuanced approach differs significantly from previous methods and offers a tailored strategy for enhancing attack transferability.\nIn sum, the above-mentioned strategies are different from the existing ViT gradient attacks. Our approach was a **`new`** and **`innovative`** approach to attacks on gradients.\n\n4. **Answer to Weakness 4 -- Tables 1-2 were fair:** We apologize for any ambiguity in our manuscript regarding the experimental setups described in Tables 1-3. \nThe explanation of the experiment’s fairness can be found in our responses to **Weaknesses 1 and 2 from Reviewer 9KoY**.\nRegarding the combination of TGR, PNA, and PatchOut, our experimental design in Table 3 of our manuscript considers the synergistic and antagonistic effects of combining these methods. \nWe found that simply superimposing TGR and PNA could lead to excessive feature information loss, contradicting the suggested \"PNA+TGR\" approach. \nAn additional comparison experiment is provided in **Table 1 of our rebuttal PDF**.\nPatchout could be used as an enhancement input, so in the comparison experiments, we made such a comparison in our manuscript Table 3.\n\n5. **Answer to Questions -- Testing on Defended ViTs:**\nTo address this query, we extended our experiments to include robust ViT models like DiT-S, Swin-B, and Xcit-S. These results are presented in the updated **Table 3 in our rebuttal PDF**.\nOur method shows comparable effectiveness against these robust ViTs, validating the adaptability and efficiency of our strategies across different robust architectures. \nThis inclusion provides a comprehensive view of our method's performance against state-of-the-art robust ViTs, in line with current advancements in adversarial machine learning.\n\n6. **Answer to Limitations:**\nWe thank the reviewer for paying attention to the limitations of our work. We realize that there was an omission in our citation of the sections discussing limitations, which might have led to confusion. To handle this, we will add a dedicated section in our manuscript to clearly outline the limitations of our Adaptive Token Tuning (ATT) method. This new section will discuss potential scalability issues, the dependence on hyperparameters, and any constraints related to the types of adversarial settings where our method may not perform at its best. We will also take into consideration the social implications. We aim to provide a comprehensive and transparent overview of these aspects to better inform future research and application of our findings.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "u0h7v67l5O", "reviewer": "Reviewer_38RD", "summary": "The paper proposes an Adaptive Token Tuning (ATT) method to enhance the transferability of adversarial attacks on Vision Transformers (ViTs). The method introduces three optimization strategies: adaptive gradient re-scaling to reduce token gradient variance, a self-paced patch out strategy to enhance input diversity, and a hybrid token gradient truncation strategy to reduce the effectiveness of the attention mechanism. Extensive experiments demonstrate the superiority of ATT over existing methods in terms of attack success rate and transferability across various models.", "questions": "Refer to Weakness section.", "limitations": "No.", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The combination of adaptive gradient re-scaling, self-paced patch out, and hybrid token gradient truncation is novel and well-motivated, providing a fresh perspective on improving adversarial attack transferability for ViTs.\n2. The experimental results show that ATT significantly outperforms state-of-the-art methods, achieving higher attack success rates and better transferability.", "weaknesses": "1. In the paper's formulation, there are multiple hyperparameters. Do these hyperparameters interact with each other? Why is γ set to 0.5?\n2. In Figure 2, is the model used for prediction the same as the target model for the attack? From the figure, it appears that the proposed method indeed makes the model focus on the classification target more quickly. However, how do you explain that as the number of iterations increases, the attention no longer focuses on the classification target? The targets shown in the figure are all dogs, just different types, so the attention should still focus on the dog.\n3. Have the effects been tested on defended ViTs?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "1.  **Answer to Weakness 1 -- Hyperparameters Interaction:**\nThe hyperparameters in our Adaptive Token Tuning (ATT) method fall into two categories: those related to gradient adjustment and those pertaining to input enhancement. \nTo mitigate the interaction between hyperparameters,\nthese categories are adjusted independently and alternatively.\nFor the gradient adjustment, the gradient penalty factor $\\gamma$ is initially set to 0.5 as a median value to mildly rescale back-propagated token gradients. It will be adaptively adjusted within the ranges of $(0, 0.5]$ and $[0.5, 1)$ based on the gradient variance across consecutive ViT layers.\nBased on our exploratory experiments, this value of $\\gamma$ was not only a practical but also an effective choice.\n\n2.  **Answer to Weakness 2 -- Model Prediction and Target Focus in Figure 2:**\nIn our experiments (see Ln333-336), ViT-B served as the surrogate model, with visualizations in Figure 2 conducted on the black-box model CaiT-S/24 using Grad-CAM. The visualization does not specifically set a label; thus, attention is drawn to the category deemed most probable by the model. The shift in focus observed in the figure illustrates a change in the highest probability category, indicating a successful attack, characterized by a rapid and confident misclassification. This dynamic is further elaborated in Figure 6, where attention visualizations are presented for both correct and incorrect labels, highlighting the mechanism of our attack’s effectiveness.\n\n3.  **Answer to Weakness 3 -- Testing on Defended ViTs:**\nAs addressed in response to **Weaknesses 2 from Review zV8Q**, we have expanded our experimental validation to include defended (robust) ViTs, with findings detailed in **Table 3 of the rebuttal PDF**. \nThis additional testing confirms the effectiveness of our proposed ATT attack against various adversarial defenses, ensuring that our approach is not only theoretically sound but also practically viable against contemporary robust architectures.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uAURgikaHl", "reviewer": "Reviewer_52P8", "summary": "This paper introduces Adaptive Token Tuning (ATT) to improve the transferability of adversarial examples generated from ViTs. ATT is an improvement over traditional gradient-based algorithms, consisting of three independent methods. The first method reduces gradient variance by rescaling the token gradients computed throughout different modules and layers in the ViT. The second method is a scheduled, semantic-guided patch-out approach to increase the diversity of input during the iterative gradient ascent procedure. The third method is a truncation approach for attenuating the model-specific attention occurring at the deeper layers of the ViT. Experimental results on ImageNet show an improvement over existing transfer-based attacks.", "questions": "1. Do we have results showing the benefit of the adaptive strategy in variance reduction in terms of transferability improvement?\n\n2. In (2), is it possible for the scaling factor to be negative? Wouldn't that change the direction of the gradient, resulting in a less optimal argmax of (1), and potentially making the perturbation less transferable?\n\n3. For the Hybrid Token Gradient Truncation Method, many design decisions are made without clear explanation. For example, why do we have two different types of truncations? I appreciate the authors for including the analysis in A.5 on the number of truncated layers. For the experiment in 4.1, how is $\\ell'$ selected for each model? Do we need to run a sweep for each model?\n\n4. For the results in Tables 1 and 2, do all methods, including the baselines and ours, have Patchout?\n\n5. In Ln 271, shouldn't the number of discards be equal between Patchout and SPPO for a fair comparison?", "limitations": "No discussion on limitation of the work. The checklist says the limitation is discussed in Sec 2 4 and Appendix A1, but I could not find any discussion.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "**Originality:**\n\nThe proposed ATT algorithm includes three strategies that work in combination to improve the transferability of perturbations generated from vision transformers. Each method is developed based on insights from previous work and improves upon them. The proposed method is original.\n\n\n**Quality/Clarity:** \n\nThe presentation is clear, and the methods are well-explained. A thorough evaluation of transferability on a variety of target models, including transformers and both undefended and defended CNNs.\n\n\n**Significance:** \n\nThe proposed work is a valuable addition to methods for generating more transferable perturbations from vision transformers.", "weaknesses": "1. Ln76: Blackbox attack also includes those when target model has limited access, i.e., query-based attacks.\n\n2. The statement in ln 294-295 requires further consideration. The analysis itself does not show that the ATT perturbation captured more features than those generated by other algorithms. While the improvement suggests this, there is no analysis proving the statement.\n\n3. Several statements in the paper requires references, for instance, Ln218-219.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "1. **Answer to Weakness 1 -- query-based attacks:** We appreciate your comment on the broader definition of blackbox attacks, including query-based scenarios where the target model has limited accessibility. We will expand our discussion to encompass these types of attacks, providing a more comprehensive overview of blackbox scenarios in the context of adversarial machine learning. This will be incorporated in the introduction and related work sections to clarify the scope and applicability of our Adaptive Token Tuning (ATT) method.\n\n2. **Answer to Weakness 2 -- the ATT perturbation captured more features:** We acknowledge the reviewer's point regarding the need for a more robust analysis to substantiate our claim that ATT perturbations capture more feature information. Referred to our explanation of **Questions in review 9KoY**. This could be interpreted as a further explanatory illustration of our method from the perspective of experimental results, which could retain more feature information to improve the transferability of the adversarial attack. Additionally, in response, we will refine our experimental section to include a comparative feature analysis between ATT and other algorithms. This analysis will aim to quantitatively demonstrate how ATT retains more relevant features, thereby enhancing transferability. This addition will address the gap between our observational claims and the empirical evidence provided.\n\n3. **Answer to Weakness 3 -- References required for Ln218-219:** Thank you for highlighting the need for additional references in our manuscript. We recognize the importance of properly citing existing work to validate our statements. Specifically, for the assertions made in Ln218-219, we will ensure that all relevant literature is cited, providing a solid foundation for our claims and aligning with academic standards.\n\n4. **Answer to Questions 1 -- Adaptive Variance Reduced and transferability:** We appreciate the inquiry into the impact of our adaptive strategy on variance reduction. As detailed in Table 4 of the supplementary PDF, our experiments demonstrate two key aspects: **(1)** variance reduction while preserving feature information, and **(2)** adaptive variance reduction that smooths gradient variance across layers. \nOur analysis in Supplementary A.2 confirms that our strategy effectively reduces gradient variance, optimizing $\\lambda$ to balance the trade-off between fixed and overly penalized scaling, which could hinder the transferability. This optimal setting ensures improved attack efficacy without compromising the adaptive nature of the method.\n\n5. **Answer to Questions 2 -- The scaling factor to be negative?:** In our implementation (referenced in Line 147, as well as the code implementation), we ensure that the scaling factor remains non-negative, thus maintaining the original direction of token gradients. This is crucial for sustaining an effective adversarial attack, as negative values would indeed invert the gradient direction, undermining the attack's efficacy.\n\n6. **Answer to Questions 3 -- Hybrid Token Gradient Truncation Method:** The Hybrid Token Gradient Truncation Method is designed to optimize the utilization of the attention mechanism by adjusting gradients in different Our motivation, grounded in literature and empirical evidence (see references [16] in our submitted manuscript), seeks to understand and enhance the impact of different modules in ViT layers on the perturbation transferability. \nFor each surrogate model tested, we need to sweep them all, but parameters are fixed except for those under examination, facilitating focused analysis as described in Supplementary A.5.\n\n7. **Answer to Questions 4 -- Do Tables 1 and 2 include PatchOut?:** Regarding input enhancement strategies, Tables 1 and 2 deliberately exclude PO/SPPO to isolate the effects of our adaptive gradient and truncation strategies from those of input modifications. This choice was made to clearly demonstrate the independent effectiveness of our proposed methods.\n\n8. **Answer to Questions 5 -- Number of PatchOut:** Our Self-Paced Patch Out (SPPO) approach dynamically adjusts the number of discards, unlike the fixed value used in Patch Out (PO). Since more discards reduce the features that perturbations can learn, we ensure a fair comparison by setting the expected number of discards in SPPO to match or exceed that of PO.\n\n9. **Answer to Limitations:** We appreciate the reviewer's attention to the limitations of our work. We realize there was an oversight in our citation of the sections discussing limitations, which may have caused confusion. To address this, we will add a dedicated section in our manuscript that explicitly outlines the limitations of our Adaptive Token Tuning (ATT) method. This new section will discuss potential scalability issues, the dependency on hyperparameters, and any constraints related to the types of adversarial settings where our method may not perform optimally. We aim to provide a comprehensive and transparent overview of these aspects to better inform future research and application of our findings.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
1. In **Table 1** of our rebuttal pdf, three attack methods (including PNA, TGR and ours) are tested under different settings of input enhancement.
**“w / o”** denoted that no input enhancement was added, which is the same as the results shown in Tables 1-2 of our manuscript. 
**“PO”** indicated that PatchOut was utilized as input enhancement.
**“SPPO”** indicated that Self-Paced Patch Out was utilized as input enhancement, with the same hyperparameters mentioned in our manuscript. 
Due to the low ASR of PNA under the “SPPO” setting, we thought that our ATT method's hyperparameters were not compatible with PNA, 
and thus we fine-tuned relevant hyperparameters and specified this input enhancement as **“SPPO+”**.
After this adjustment, the ASR of PNA (SPPO+) was significantly improved, which verified our observations.
This experiment validated the superiority of our ATT method compared to SOTAs in various attack settings.


2. Considering that the results in Tables 1-3 in our manuscript could reflect the effect of SPPO on ASR, we followed the suggestion of Reviewer 52P8's question 3. 
In **Table 2** of our rebuttal pdf, we performed ablation experiments on three strategies (AVR/ST/HT), where **“AVR”** denoted Adaptive Variance Reduced Token Gradient; **“ST”** denoted soft truncation that we utilized the truncation factor to truncate Attention, QKV, and MLP modules; **“HT”** denoted hard truncation that we could truncate the gradient of selected Attention layers to zero.


3. In **Table 3** of our rebuttal pdf, we added a validation experiment for robust ViTs,
where PNA, TGR, and ATT (ours) use their optimal hyperparameters. 
“clean” denoted that the model was utilized to classify a clean dataset and the result was the probability of the classifier classifying the data incorrectly.
The rest of the results were all ASRs. 
Meanwhile, we performed the same test on the normal model corresponding to robust ViTs. 
Experimental results showed that our ATT method still performs better than SOTAs in advanced normal and robust ViT models.


4. In **Table 4** of our rebuttal pdf, an additional experiment was conducted to study the variance reduction of token gradients, where both input enhancement and gradient strategies are not considered here.
**“Only VR”** denoted that only variance reduction strategy was utilized in our ATT method, while **“Only AVR”** denoted that only adaptive variance reduction (AVR) was ultized in our ATT method.
As shown in Table 4, our proposed adaptive variance reduction strategy performs better than the fixed variance reduction strategy, leading to better transferability of crafted adversarial examples.

Meta-review: The paper proposes to enhance the transferability of adversarial attacks on Vision Transformers (ViTs) by introducing three main optimization strategies. The paper rececived two borderline accept, one borderline reject, and one weak accept. The main concerns are comparisons with existing approaches. The authors successfully addressed these concerns with a convincing rebuttal. The AC recommends acceptance and encourages the authors to revise the paper according the comments.
Decision: Accept (poster)