Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?

TL;DR

This work challenges the view that Vision Transformers (ViTs) are universally more robust than CNNs by introducing Patch-Fool, a patch-level adversarial framework that perturbs a single image patch to disrupt ViT self-attention. It extends the framework with Sparse Patch-Fool and Mild Patch-Fool to study the influence of perturbation density and strength. Through extensive experiments on DeiT and ResNet models, Patch-Fool reveals that ViTs can be less robust than CNNs under targeted, patch-based attacks, overturning prior robustness assumptions. The findings emphasize the need for defense strategies tailored to ViTs and provide practical insights for robust ViT deployment in real-world applications.

Abstract

Vision transformers (ViTs) have recently set off a new wave in neural architecture design thanks to their record-breaking performance in various vision tasks. In parallel, to fulfill the goal of deploying ViTs into real-world vision applications, their robustness against potential malicious attacks has gained increasing attention. In particular, recent works show that ViTs are more robust against adversarial attacks as compared with convolutional neural networks (CNNs), and conjecture that this is because ViTs focus more on capturing global interactions among different input/feature patches, leading to their improved robustness to local perturbations imposed by adversarial attacks. In this work, we ask an intriguing question: "Under what kinds of perturbations do ViTs become more vulnerable learners compared to CNNs?" Driven by this question, we first conduct a comprehensive experiment regarding the robustness of both ViTs and CNNs under various existing adversarial attacks to understand the underlying reason favoring their robustness. Based on the drawn insights, we then propose a dedicated attack framework, dubbed Patch-Fool, that fools the self-attention mechanism by attacking its basic component (i.e., a single patch) with a series of attention-aware optimization techniques. Interestingly, our Patch-Fool framework shows for the first time that ViTs are not necessarily more robust than CNNs against adversarial perturbations. In particular, we find that ViTs are more vulnerable learners compared with CNNs against our Patch-Fool attack which is consistent across extensive experiments, and the observations from Sparse/Mild Patch-Fool, two variants of Patch-Fool, indicate an intriguing insight that the perturbation density and strength on each patch seem to be the key factors that influence the robustness ranking between ViTs and CNNs.

Figures (4)

• Figure 1: Comparisons among the attention maps in the intermediate layers of DeiT-S generated by the clean inputs, the adversarial inputs under PGD-20 attacks ($\epsilon=0.003$), and the proposed Patch-Fool attack, respectively. In particular, we average the attention scores across all the attention heads in each layer and visualize the attention score of each token for a given query token (the center patch in the red box in our show case), following kim2021rethinking. We can observe that the difference in attention maps between clean and adversarial inputs generated by PGD-20 keeps small across different layers; In contrast, the proposed Patch-Fool notably enlarges the gap between clean and adversarial attention maps, demonstrating a successful attack for ViTs.
• Figure 2: Benchmark the robustness of DeiTs and ResNets against Patch-Fool under different numbers of perturbed patches.
• Figure 3: Visualizing the patch-wise adversarial transferability of Patch-Fool on top of DeiT-B (left) and DeiT-S (right), where the robust accuracy when perturbing each patch with the attack generated for the center patch on the same image is annotated in the figure.
• Figure 4: Visualizing the adversarial examples generated by Patch-Fool's variants, including Patch-Fool with different number of perturbed patches (rows 2$\sim$3), Sparse Patch-Fool with a total of 250 perturbed pixels distributed in different number of perturbed patches (rows 4$\sim$6), and Patch-Fool under $L_2$ and $L_{\infty}$ constraint (rows 7$\sim$8). Note that both the attack settings and the resulting robust accuracy are annotated.