Original: Patch Vestiges in the Adversarial Examples Against Vision Transformer Can Be Leveraged for Adversarial Detectionblind review blind review
Revised: Patch Vestiges in the Adversarial Examples Against Vision Transformer Can Be Leveraged for Adversarial Detection

Original: Abstract
Revised: Abstract

Original: Vision Transformer (ViT), a Transformer-based architecture that divides images into patches, can catch up with or surpass convolution-based networks in multiple Computer Vi- sion tasks.
Revised: Vision Transformer (ViT), a Transformer-based architecture that divides images into patches, can catch up with or surpass convolution-based networks in multiple Computer Vi- sion tasks.

Original: However, ViT is also vulnerable in the face of adversarial examples (AEs).
Revised: However, ViT is also vulnerable in the face of adversarial examples (AEs).

Original: Thus the topic around the attack and defense of ViT becomes very rewarding.
Revised: Thus the topic around the attack and defense of ViT becomes very rewarding.

Original: Recent studies have found that the AEs against ViT seem to have grid- like textures that coincide with the patches.
Revised: Recent studies have found that the AEs against ViT seem to have grid-like textures that coincide with the patches.

Original: We confirm such sensation is true.
Revised: In this paper we confirm such sensation is true.

Original: In this paper, we show that these grid-like textures are the remained vestiges due to the patch division of ViT.
Revised: We show that these grid-like tex- tures are the remained vestiges due to the patch division from

Original:  We name them  Patch Vestiges.
Revised: ViT. We name them as Patch Vestiges.

Original: We propose statis- tics to measure the sizes of Patch Vestiges in the images or
Revised: We propose statis- tics to measure the sizes of Patch Vestiges in the images or

Original: AEs quantitatively.
Revised: AEs quantitatively.

Original: We also build a linear-regression classi- fier to detect the AEs against ViT practically via the proposed statistics.
Revised: We also build a linear regression classi- fier to detect the AEs against ViT practically via the proposed statistics.

Original: The experiments show that the performance of the simple classifier can even match some recent adversarial detection methods, suggesting that when trying to attack ViT or detect the AEs against ViT, Patch Vestiges are worth considering about as a critical factor.
Revised: The experiments show that the performance of the simple classifier can even match some recent adversarial detection methods, suggesting that when trying to attack ViT or detect the AEs against ViT, Patch Vestiges are worth considering about as a critical factor.

Original: Transformer (Vaswani et al. 2017) is almost based on selfattention mechanisms and fully connected layers.
Revised: Transformer (Vaswani et al. 2017) is almost based on selfattention mechanisms and fully connected layers.

Original: It creatively subverts the architecture of RNNs and realizes the state-of-the-art performances on almost all Natural Language Processing tasks.
Revised: It creatively subverts the architecture of RNNs and realizes the state-of-the-art performances on almost all Natural Language Processing tasks.

Original: It is naturally hoped that Transformer can be applied to the field of Computer Vision.
Revised: It is naturally hoped that Transformer can be applied to the field of Computer Vision.

Original: However, Transformer requires a sequential input that has a quite different shape from an image.
Revised: However, Transformer requires a sequential input that has a quite different shape from an image.

Original: Vision Transformer (ViT) (Dosovitskiy et al. 2020) overcomes the difficulty by dividing an image into small patches and linking them into a sequence.
Revised: Vision Transformer (ViT) (Dosovitskiy et al. 2020) overcomes the difficulty by dividing an image into small patches and linking them into a sequence.

Original: With the help of Transformer, ViT achieves excellent performances in many Computer Vision tasks.
Revised: With the help of Transformer, ViT achieves excellent performances in many Computer Vision tasks.

Original: Although ViT is effective, it has similar weakness with
Revised: Although ViT is effective, it has similar weakness with

Original: CNNs in front of the adversarial examples.
Revised: CNNs in front of the adversarial examples.

Original: Adversarial Examples (AEs) (Szegedy et al. 2013) are images with artificial perturbations that are small enough to fool the human eyes but can make deep neural networks output wrong results.
Revised: Adversarial Examples (AEs) (Szegedy et al. 2013) are images with artificial perturbations that are small enough to fool the human eyes but can make deep neural networks output wrong results.

Original: Some preliminary studies (Bhojanapalli et al. 2021;
Revised: Some preliminary studies (Bhojanapalli et al. 2021;

Original: Shao et al. 2021; Mahmood, Mahmood, and van Dijk 2021) show that ViT is vulnerable to all common AEs, and even weaker than CNNs under some attacks.
Revised: Shao et al. 2021; Mahmood, Mahmood, and van Dijk 2021) show that ViT is vulnerable to all common AEs, and even weaker than CNNs under some attacks.

Original: The good news is that it is difficult for the AEs against CNNs to transfer to ViT directly (Shao et al. 2021;
Revised: The good news is that it is difficult for the AEs against CNNs to transfer to ViT directly (Shao et al. 2021;

Original: Naseer et al. 2021; Aldahdooh,
Revised: Naseer et al. 2021; Aldahdooh,

Original: Hamidouche, and D´eforges 2021).
Revised: Hamidouche, and D´eforges 2021).

Original: Thus it is meaningful to study the unique natures of the AEs against ViT.
Revised: Thus it is meaningful to study the unique natures of the AEs against ViT.

Original: To the human eye, the magnified adversarial perturbations of the AEs against ViT seem to have grid-like textures and exhibit some periodicity and repetition (Bhojanapalli et al.
Revised: To the human eye, the magnified adversarial perturbations of the AEs against ViT seem to have grid-like textures and exhibit some periodicity and repetition (Bhojanapalli et al.

Original: 2021), as shown in Figure 1.
Revised: 2021), as shown in Figure 1.

Original: This is the initial inspiration of this paper.
Revised: This is the initial inspiration of this paper.

Original: A very intuitive conjecture is that the AEs against
Revised: A very intuitive conjecture is that the AEs against

Original: ViT may also be divided into patches.
Revised: ViT may also be divided into patches.

Original: In this paper, we confirm this conjecture is true and bring up the concept Patch
Revised: In this paper, we confirm this conjecture is true and bring up the concept Patch

Original: Vestiges.
Revised: Vestiges.

Original: We define Patch Vestiges as the abnormalities of the AEs against ViT that are caused by the patch division.
Revised: We define Patch Vestiges as the abnormalities of the AEs against ViT that are caused by the patch division.

Original: We also find a method to measure Patch Vestiges quantitatively.
Revised: We also find a method to measure Patch Vestiges quantitatively.

Original: We propose Leaps to measure the step changes between two adjacent pixels in different patches.
Revised: We propose Leaps to measure the step changes between two adjacent pixels in different patches.

Original: We assume the step changes are the key points of Patch Vestiges.
Revised: We assume the step changes are the key points of Patch Vestiges.

Original: Additionally, we propose statistics PV, IPC and NCC based on
Revised: Additionally, we propose statistics PV, IPC and NCC based on

Original: Leaps and build a binary linear-regression classifier with them.
Revised: Leaps and build a binary linear regression classifier on them.

Original: The experiments show that our approximations of Leaps is successful and that by our proposed statistics PV, IPC and NCC the linear-regression classifier can detect the AEs against ViT effectively.
Revised: The experiments show that our approximations on Leaps are successful and that by our proposed statistics PV, IPC and NCC, the linear regression classifier can detect the AEs against ViT effectively.

Original: We sum up the key contributions of this paper as follows:
Revised: We sum up the key contributions of this paper as follows:

Original: • We substantiate the human instinct that the patches used in Vision Transformer remain vestiges in the adversarial examples.
Revised: • We substantiate the human instinct that the patches used in Vision Transformer remain vestiges in the adversarial examples.

Original: • We bring up the concept Patch Vestiges and find a quantitative measurement for them.
Revised: • We bring up the concept Patch Vestiges and find a quantitative measurement for them.

Original: • We prove that Patch Vestiges can be the critical weakness for the adversarial examples against ViT.
Revised: • We prove that Patch Vestiges can be a critical weakness of the adversarial examples against Vision Transformer.

Original: Related Work
Revised: Related Work

Original: Vision Transformers Vision Transformer (ViT) (Dosovitskiy et al. 2020) is the first  to successfully leverage Transformer (Vaswani et al. 2017) in Computer Vision tasks by dividing images into patches.
Revised: Vision Transformers Vision Transformer (ViT) (Dosovitskiy et al. 2020) is the first work to successfully leverage Transformer (Vaswani et al. 2017) in Computer Vision tasks by dividing images into patches.

Original: DeiT (Touvron et al. 2021) uses a similar model structure but adds a new distillation token .
Revised: DeiT (Touvron et al. 2021) uses a similar model structure but adds a new distillation token.

Original: T2T-ViT (Yuan et al. 2021) recursively integrates  adjacent tokens to better extract the low-level image features.
Revised: T2T-ViT (Yuan et al. 2021) recursively integrates the adjacent tokens to better extract the low-level image features.

Original:  Swin Transformer (Liu et al. 2021) shows the superiority of Transformer and defeats CNN-based models in many tasks by bringing in the shifted window scheme.
Revised: Recently, Swin Transformer (Liu et al. 2021) shows the superiority of Transformer and defeats CNN-based models in many tasks by bringing in the shifted window scheme.

Original: [Figure]
Revised: [Figure]

Original: Adversarial Detection Bayesian uncertainty (BU) and kernel density (KD) are previously proposed to detect the outof-manifold points (Feinman et al. 2017).
Revised: Adversarial Detection Bayesian uncertainty (BU) and kernel density (KD) are previously proposed to detect the outof-manifold points (Feinman et al. 2017).

Original: RCE (Pang et al.
Revised: RCE (Pang et al.

Original: 2018) uses a new Reverse Cross-Entropy based on KD to better distance the clean images from the AEs.
Revised: 2018) uses a new Reverse Cross-Entropy based on KD to better distance the clean images from the AEs.

Original: LID (Ma et al. 2018) detects the AEs by the local sparseness.
Revised: LID (Ma et al. 2018) detects the AEs by the local sparseness.

Original: A Mahalanobis distance based score is afterwards proposed (Lee et al. 2018).
Revised: A Mahalanobis distance based score is afterwards proposed (Lee et al. 2018).

Original: Under the assumption that AEs are out of the manifold of the natural scenes, natural scene statistics (NSS) are used in the detector (Kherchouche et al. 2020).
Revised: Under the assumption that AEs are out of the manifold of the natural scenes, natural scene statistics (NSS) are used in the detector (Kherchouche et al. 2020).

Original: More recently, LiBRe (Deng et al. 2021)
Revised: More recently, LiBRe (Deng et al. 2021)

Original: leverages Bayesian neural networks with refined training procedures for adversarial detection.
Revised: leverages Bayesian neural networks with refined training procedures for adversarial detection.

Original: Methodology
Revised: Methodology

Original: Despite the recent excellent improvements of ViT, we focus on the vanilla ViT model (Dosovitskiy et al. 2020) because the fixed division makes the research stable.
Revised: Despite the recent excellent improvements of ViT, we focus on the vanilla ViT model (Dosovitskiy et al. 2020) because the fixed division makes the research stable.

Original: The vanilla ViT divides an image into n × n patches in a grid shape, making several horizontal and vertical dividing lines.
Revised: The vanilla ViT divides an image into n × n patches in a grid shape, making several horizontal and vertical dividing lines.

Original: Intuitively, the adversarial perturbations of the adjacent pixels astride the dividing lines should have step changes.
Revised: Intuitively, the adversarial perturbations of the adjacent pixels astride the dividing lines should have step changes because they come from different partial differential expressions.

Original: We measure the step changes by Leaps .
Revised: We measure the step changes by Leaps .

Original: To calculate Leaps , we approximately assume  the pixel values of the clean image and the adversarial perturbations inside the patches vary mildly, and only the adversarial perturbations across the patches are violent, as shown in Figure 2(a).[Figure] p i x e l v a l u e [Figure]
Revised: To calculate Leaps , we approximately assume that the pixel values of the clean images and the adversarial perturbations inside the patches vary mildly, and only the adversarial perturbations across the patches are violent, as shown in Figure 2(a).

Original: Clean image ViT pertub.

Original: ResNet perturb.

Original: ViT AE

Original: ResNet AE (a) Leaps

Original: NCC

Original: NCC

Original: NCC

Original: PV

Original: PV

Original: IPC

Original: IPC

Original: IPC

Original: Patch(i,j)

Original: Patch(i,j+1)

Original: Patch(i+1,j)

Original: [Figure]

Original: (i

Original: [Figure]

Original: [Figure]

Original: j+1)

Original: [Figure]

Original: We calculate Leaps as follows.
Revised: We calculate Leaps as follows.

Original: We denote the change of the pixel values between the adjacent pixels i and j as
Revised: We denote the change of the pixel values between the adjacent pixels i and j by

Original: G ( i, j ) .
Revised: G ( i, j ) .

Original: For both clean images and inside-patch adversarial perturbations, a center G should be equal to the average of its bilateral G s. But for adversarial perturbations astride the dividing lines, the equality does not hold.
Revised: For both clean images and inside-patch adversarial perturbations, a center G should be equal to the average of its bilateral G s under our approximation. But for adversarial perturbations astride the dividing lines, the equality does not hold.

Original: Thus we define
Revised: Thus we define

Original: [Equation]

Original: [Equation]
Revised: [Equation]

Original: where ⊢ means the alternative direction that is either horizontal or vertical and i ⊕ n, i ⊖ n means moving n pixels forward or backward along the direction ⊢  . 
Revised: where ⊢ means the alternative direction that is either horizontal or vertical and i ⊕ n, i ⊖ n means moving n pixels forward or backward along the direction ⊢ from the pixel i . [Figure]

Original: Leap ( i, ⊢ ) shows the non-smoothness of the local changes G around the pixel i .
Revised: Leap ( i, ⊢ ) shows the non-smoothness of the local changes G around the pixel i .

Original: If Leap ( i, ⊢ ) is higher and  i and i ⊕ 1 stride over a dividing line, there will be a higher possibility that the given image is an AE against ViT.
Revised: If Leap ( i, ⊢ ) is high and pixels i and i ⊕ 1 stride over a dividing line, there will be larger possibility that the given image is an AE against ViT.

Original: Based on Leap , we propose PV, IPC and NCC, standing for Patch Vestiges, Inside-Patch Contrast and Natural
Revised: Based on Leaps , we propose PV, IPC and NCC, standing for Patch Vestiges, Inside-Patch Contrast and Natural

Original: Change Contrast respectively.
Revised: Change Contrast respectively.

Original: PV consists of Leaps astride the dividing lines, IPC consists of Leaps  fully inside the patches, and NCC consists of all the adjacent changes (see Figure 2(b)).
Revised: PV consists of Leaps astride the dividing lines, IPC consists of Leaps that are fully inside the patches, and NCC consists of all the adjacent changes (see Figure 2(b)).

Original: More precise definitions are:
Revised: More precise definitions are:

Original: [Equation]
Revised: [Equation]

Original: where Ave means the average, PB ( X, ⊢ ) means the pixel set that i and i ⊕ 1 stride over a dividing line, and PI ( X ) means the pixel set that i, i ⊕ 1 , i ⊕ 2 , i ⊖ 1 are in the same patch.
Revised: where Ave means the average, PB ( X, ⊢ ) means the pixel set that i and i ⊕ 1 stride over a dividing line, and PI ( X ) means the pixel set that i, i ⊕ 1 , i ⊕ 2 , i ⊖ 1 are in the same patch.

Original: Under this definition, PV will be much higher than
Revised: Under this definition, PV will be much higher than

Original: IPC only for the images with strong Patch Vestiges.
Revised: IPC only for the AEs with large Patch Vestiges.

Original: NCC measures the natural pixel fluctuations of clean images and is a baseline for PV and IPC.
Revised: NCC measures the natural pixel fluctuations of clean images and is a baseline for PV and IPC.

Original: We also leverage linear regression and build a simple binary classifier y =
Revised: We also leverage linear regression and build a simple binary classifier y =

Original: a 1 PV + a 2 IPC + a 3 NCC + a 4 .
Revised: a 1 PV + a 2 IPC + a 3 NCC + a 4 , where a 1 , a 2 , a 3 , a 4 are trainable parameters.

Original: If PV  is very different from IPC in the AEs against ViT, the binary classifier will have high capacity to distinguish those 
Revised: If PV of the AEs against ViT is very different from IPC, the binary classifier will have high capacity to distinguish those AEs from

Original: AEs from clean images.
Revised: [Figure] [Figure] clean images.

Original: And since PV, IPC and NCC are all statistics, if the the simple linear classifier works well, DNNs should be more capable to dig out the artifacts in Patch Vestiges.[Figure] Image
Revised: And since PV, IPC and NCC are all statistics, if the the simple linear classifier works well, DNNs should be more capable to dig out the infomation of the AEs in Patch Vestiges.

Original: [Figure]

Original: Experimental Setups
Revised: Experimental Setups

Original: Datasets We use the CIFAR-10 (Krizhevsky 2009) dataset for our experiments.
Revised: Datasets We use the CIFAR-10 (Krizhevsky 2009) dataset for our experiments.

Original: The CIFAR-10 dataset has 50,000 training images, 10,000 test images and 10 categories.
Revised: The CIFAR-10 dataset has 50,000 training images, 10,000 test images and 10 categories.

Original: The size of each image is 3×32×32.
Revised: The size of each image is 3×32×32.

Original: Attacks We use the white-box adversarial attack methods FGSM (Goodfellow, Shlens, and Szegedy 2015),
Revised: Attacks We use the white-box adversarial attack methods FGSM (Goodfellow, Shlens, and Szegedy 2015),

Original: BIM (Kurakin, Goodfellow, and Bengio 2017a), PGD (Kurakin, Goodfellow, and Bengio 2017b) and DeepFool (DF) (Moosavi-Dezfooli, Fawzi, and Frossard 2016).
Revised: BIM (Kurakin, Goodfellow, and Bengio 2017a), PGD (Kurakin, Goodfellow, and Bengio 2017b) and DeepFool (DF) (Moosavi-Dezfooli, Fawzi, and Frossard 2016).

Original: We restrict all the AEs with ℓ ∞ = 8 .
Revised: We restrict all the AEs with ℓ ∞ = 8 .

Original: Notice that DF originally generates AEs with ℓ ∞ ≤ 8 .
Revised: Notice that DF originally generates AEs with ℓ ∞ ≤ 8 .

Original: We rescale the perturbations and use DF* to denote the modification.
Revised: We rescale the perturbations and use DF* to denote the modification.

Original: We run all  PGD attacks for 20 iterations.
Revised: We run all the BIM and PGD attacks for 20 iterations.

Original: We use the AEs of PGD to train the linearregression classifier and directly test it on the AEs of all the attack methods.
Revised: We use the AEs of PGD to train our linear regression classifier and directly test it with the AEs from all the attack methods.

Original: Victim Models
Revised: Victim Models

Original: The major victim model is  vanilla Vision 
Revised: The major victim model is the vanilla Vision Transformer (ViT)

Original: Transformer (ViT) (Dosovitskiy et al. 2020).
Revised: (Dosovitskiy et al. 2020).

Original: We also use ResNet (He et al. 2016) as a contrast model.
Revised: We also use ResNet (He et al. 2016) as a contrast model.

Original: ViT used in the experiments has a 4×4 patch size, 6 layers and 16 heads for Multi-Head Attentions.
Revised: ViT used in the experiments has a 4×4 patch size, 6 layers and 16 heads for Multi-Head Attentions.

Original: The ResNet model in the experiments has 56 layers.
Revised: The ResNet model in the experiments has 56 layers.

Original: Compared Methods We use LID (Ma et al. 2018) and
Revised: Compared Methods We use LID (Ma et al. 2018) and

Original: NSS (Kherchouche et al. 2020) for comparison.
Revised: NSS (Kherchouche et al. 2020) for comparison.

Original: Notice that the settings of the methods and not in accord with ours strictly.
Revised: Notice that the settings of these methods are not in accord with ours strictly.

Original: For example, our classifier only requires the input image, the ViT logits and the patch size.
Revised: For example, our classifier only requires the input image, the ViT logits and the patch size.

Original: The comparison is more of a reference.
Revised: The comparisons are mainly used as a reference.

Original: Environments We build our project on the open-source toolbox ARES
Revised: Environments We build our project on the open-source toolbox ARES

Original: (Dong et al. 2020)
Revised: (Dong et al. 2020)

Original: and make references to the codes of TRADES (Zhang et al. 2019).
Revised: and make references to the codes of TRADES (Zhang et al. 2019).

Original: We run the experiments on GeForce RTX 2080 Ti.
Revised: We run the experiments on GeForce RTX 2080 Ti.

Original: Results
Revised: Results

Original: We first compare the distributions and the averages of PV,
Revised: We first compare the distributions and the averages of PV,

Original: IPC and NCC over the clean images, the AEs using the PGD attack against ResNet and those against ViT.
Revised: IPC and NCC between the clean images, the AEs using the PGD attack against ResNet and the AEs against ViT.

Original: All the images and AEs are from the training set of CIFAR-10.
Revised: All the images and AEs are from the training set of CIFAR-10.

Original: The results are shown in Figure 3.
Revised: The results are shown in Figure 3.

Original: We observe that for the clean images and the AEs against ResNet, the distributions of PV and IPC are approximate.
Revised: We observe that for the clean images and the AEs against ResNet, the distributions of PV and IPC are close.

Original: But PV in the AEs against ViT is much larger than IPC.
Revised: But PV of the AEs against ViT is much larger than IPC.

Original: We use the T’-test and confirm  PV is significantly larger than IPC and NCC (p < 5e-4) in Figure 3(c).
Revised: We use the T’-test and confirm that PV is significantly larger than IPC and NCC (p < 5e-4) in Figure 3(c).

Original: We can also observe in Figure 3(c) that there are large area where the distribution of PV is not overlapped with IPC and NCC.
Revised: We can also observe in Figure 3(c) that there are large area where the distribution of PV is not overlapped with IPC and NCC.

Original: The results prove that the assumptions and approximations about Leaps is effective, and illustrate that Patch Vestiges are  unique and significant characteristics of the AEs against ViT.
Revised: The results prove that the assumptions and approximations about Leaps are effective, and illustrate that Patch Vestiges are the unique and significant characteristics of the AEs against ViT.

Original: [Table]
Revised: [Table]

Original: All the AEs have perturbations with We also train a linear classifier  using the PGD attack and compare the keeping rates (KR, the ratio of classifying clean images correctly) and the detection rates (DR, the ratio of classifying AEs correctly) under different attacks. 
Revised: We also train a linear classifier (named Ours in Table 1) using the PGD attack and compare the keep rates (KR, the ratio of classifying clean images correctly) and the detection rates (DR, the ratio of classifying AEs correctly) under different attacks. Our linear classifier is trained on the CIFAR10 training set with the PGD attack.

Original:  Table 1 shows the results.
Revised: All the results in Table 1 are tested on the CIFAR-10 test set.

Original: We observe that the simple linearregression classifier, although not state-of-the-art, is comparable enough with the mature adversarial detection methods.
Revised: We observe that the simple linear regression classifier, although not state-ofthe-art, is comparable enough with the mature adversarial detection methods.

Original: This again suggests that Patch Vestiges are significant.
Revised: This again suggests that Patch Vestiges are significant.

Original: The results also show that Patch Vestiges are the intrinsic attributes of the AEs against ViT and are easily transferred from one attack method to another. 
Revised: The results also show that Patch Vestiges are the intrinsic attributes of the AEs against ViT and are easily transferred from one attack method to another. Q: Is it useful to reduce the perturbated pixels to avoid the effect of Patch Vestiges? A:

Revised: In some cases, yes.

Revised: One major intuitive suspicion about Patch Vestiges may lie in the fact that our method takes all the pixels in the images or AEs into account.

Original: Conclusion
Revised: To confirm whether reducing the perturbated pixels would reduce Patch Vestiges or not, we make a specific experiment to answer this question. We vary the proportion of the perturbated pixels from 10% to 100%. Two dependent variables are watched: 1. the detection rates of one linear classifier that is trained with 100% pixels perturbated; 2.

Revised: the detection rates of another linear classifier that is trained with the same percentages of perturbated pixels as the test procedure.

Revised: The results are shown in Figure 4.

Revised: [Figure]

Revised: We can observe evident declines of the detection rates of the both classifiers when there are fewer perturbated pixels, which makes sense with the intuition.

Revised: However, the classifier trained with the same proportion declines very slowly.

Revised: When there only 10% perturbated pixels, the classifier can achieve above 80% detection rate.

Revised: These phenomena indicate that, when reducing the proportion of the perturbated pixels largely, Patch Vestiges will also be reduced to a great extent, but the remained Patch Vestiges are still large enough for adversarial detection.

Revised: In view of the fact that reducing the perturbated pixels will possibly reduce the attack performance, this topic may become another focus of attack and defense.

Revised: Conclusion

Original: In this paper, we confirm the human intuition that the division of the patches by ViT remains large vestiges in the adversarial examples.
Revised: In this paper, we confirm the human intuition that the division of the patches by Vision Transformer remains large vestiges in the adversarial examples.

Original: We bring up the concept Patch Vestiges to measure to what extend the patches leaves over  the its trace.
Revised: We bring up the concept Patch Vestiges to measure to what extend the patches can leave over their traces into the AEs.

Original: We also quantitatively show that Patch Vestiges can be leveraged to detect whether an image is an adversarial example against ViT or a clean one.
Revised: We also quantitatively show that Patch Vestiges can be leveraged to detect whether an image is an adversarial example against ViT or a clean one.

Original: Besides the practical significance, our work can also promote people’s thinking.
Revised: Besides the practical significance, our work can also promote the thinkings towards the adversarial examples and the

Original:  Is a more complicated structure more vulnerable or safe?
Revised: AI safety. Is a more complicated structure more vulnerable?

Original: In many area, the answer is “vulnerable”.
Revised: The answer is “yes” under many circumstances, considering that most of the new structures are not designed for the security purpose of the models but bring in more potential defects.

Original: But in this paper,  the artifacts of ViT on the contrary improve its robustness.
Revised: However, in this paper, we observe that the artifacts of Vision Transformer on the contrary improve its robustness.

Original: Perhaps it can not be easily answered in the AE area.
Revised: The attack and defense around the special structures of the models is expected to become a new and attractive topic in the future.