Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

Mechanistic Understandings of Representation Vulnerabilities and Engineering Robust Vision Transformers

T0 review · 5 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adversarial perturbations in vision transformers are seeded by a small set of early-layer neurons and can be neutralized at the source, restoring most accuracy without fine-tuning.

desk verdict A novel neuron-neutralization defense with an honest mechanistic story, but the 200-sample evaluation and lack of adaptive attacks leave the headline numbers fragile. read the letter →

arxiv 2502.04679 v1 pith:KKOAK5M4 submitted 2025-02-07 cs.CV cs.LG

Chashi Mahiul Islam , Samuel Jacob Chacko , Mao Nishino , Xiuwen Liu This is my paper · ORCID
classification cs.CVcs.LG
keywords visiontransformeradversarialrobustnessrepresentationvulnerabilityneuronneutralizationattacklayer-wiseanalysiszero-shotgeneralization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Vision transformers can map perceptually identical images to very different internal representations under imperceptible perturbation, and the paper claims the cause is a cascade: adversarial effects are faint in the first few layers, then amplify through middle and late layers until the class token aligns with the attacker's target. If that is right, defense can be placed where the trouble starts. The paper introduces NeuroShield-ViT, which identifies neurons that are important only for adversarial inputs, using a small calibration set, and scales down their activations during inference. Without any fine-tuning, this restores 71.6--77.8% accuracy under iterative attacks on several vision transformer variants and datasets, and the neuron mask transfers to unseen classes and datasets. The practical point is that robustness might be achievable by a tiny, targeted intervention instead of retraining or certifiably robust pipelines.

What carries the argument

The load-bearing object is the adversarial-neuron mask. For each layer and block, the method computes neuron importance $I^l_j = \sum_i a^l_{i,j} g^l_{i,j}$ for clean and perturbed images, takes the top-$p\%$ of neurons for each, and defines adversarial neurons as the set difference: neurons important for the perturbed image but not for the clean image. NeuroShield-ViT then scales those neurons' activations by $\alpha$ during the forward pass. The mechanism works because adversarial effects are localized in early layers: the mask catches the small set of neurons that seed the amplification, so attenuating them stops the later cascade without retraining.

What would settle it

Run NeuroShield-ViT against an adaptive attacker that knows the mask and optimizes perturbations to avoid neutralized neurons, evaluated on a large held-out set; if accuracy falls to the undefended level, the defense depends on the attack using the same neurons rather than on a stable vulnerability.

Watch

Extended reading notes

Core claim

Adversarial perturbations propagate through a vision transformer in a characteristic way: early layers (0--2) show high cosine similarity between clean and perturbed class-token and patch embeddings, middle layers (3--8) show progressive divergence, and later layers (9--11) show sharp divergence with convergence toward the target class. Neuron-level analysis locates the origin: a small percentage of adversarial neurons--neurons that enter the top-p importance set only for perturbed inputs, where importance is the activation-gradient product summed over patches--appears in early layers and then spreads to 30--70% of important neurons in middle and late layers, with feed-forward (MLP) blocks affected earlier than attention blocks. The paper's central claim is that neutralizing the early-layer adversarial neurons, by multiplying their activations by a coefficient $\alpha \in [0, 0.5)$, prevents the cascade and restores accuracy under strong iterative attacks, even though later layers are left untouched.

Load-bearing premise

The fixed neuron mask computed from a small calibration set built with one attack procedure (IGO) is assumed to stay valid for unseen images, classes, datasets, and other attack types, so a single per-layer mask protects all test inputs.

Editorial extensions

If this is right

  • A fixed mask computed from 25% of a 200-pair calibration set raises ViT-B accuracy on the ImageNet-1K 100-class subset from 0% to 71.6% against the IGO attack and from 11.7% to 71.3% against PGD-100, with natural accuracy dropping only from 88.0% to 85.7%.
  • Early-layer intervention is the decisive part: neutralizing layer 0 alone already gives high accuracy, while neutralizing only later layers keeps accuracy near zero.
  • The mask generalizes zero-shot across class sets: a mask built on the 10-class Imagenette set protects the 100-class ImageNet subset, lifting iterative-attack accuracy from 0% to 71%.
  • The effect holds across ViT-S, ViT-B, DeiT-S, and DeiT-B, and on CIFAR-10, with robustness gains concentrated on iterative attacks (IGO, PGD-20, PGD-100) rather than single-step FGSM.
  • Compared with adversarial training (5.0--8.0% on IGO) and randomized smoothing (45.8--46.0% on IGO), the method reaches 71.6--77.8% while using only a fraction of the calibration data and no training.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the fixed-mask account is right, the same early-layer attenuation could be applied at inference time to other transformer-based modalities, such as language or vision-language models, where representation vulnerabilities have been reported; the paper does not test this.
  • The mask's transfer across classes and datasets suggests that adversarial neurons mark generic representational instabilities rather than class-specific features; a direct test would be to measure mask overlap across disjoint class sets and different attack algorithms.
  • An adaptive attacker who knows which neurons are neutralized could try to concentrate the perturbation on non-masked neurons; if that succeeds, the method would need dynamic or per-input mask selection, a direction the paper itself flags as future work.
  • The analysis also predicts that architectural changes that dampen early-layer activation amplification, for example regularizing MLP blocks in layers 3--8, could confer robustness without any explicit defense step.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper presents a layer-wise mechanistic analysis of how adversarial perturbations propagate through Vision Transformers (ViTs), claiming that perturbations are subtle in early layers but amplify in middle-to-late layers. Based on this, it introduces NeuroShield-ViT, a defense that identifies 'adversarial neurons' via activation-gradient importance on a calibration set of IGO-generated adversarial pairs, then neutralizes those neurons across early layers at inference. The authors report large robustness improvements on ImageNet-1K (100-class subset), Imagenette, and CIFAR-10 against IGO, PGD-20, and PGD-100, with a notable zero-shot cross-dataset transfer from Imagenette to ImageNet-1K. The core claims are that adversarial effects are concentrated in a small set of early-layer neurons and that neutralizing this set restores accuracy without fine-tuning or adversarial training.

Significance. The mechanistic observation that adversarial effects are localized in early layers and amplify later is a useful contribution, and the proposed no-retraining defense is conceptually interesting. The zero-shot cross-dataset result (Table II), if confirmed, would be a meaningful step toward understanding the transferability of representation vulnerabilities. The paper also provides a clear algorithmic description and ablations of layer choices and parameters. However, the significance is presently limited by the evaluation's small scale and by the lack of robustness to adaptive or out-of-family attacks; the central empirical claims rest on a single attack family for calibration and testing.

major comments (5)
  1. [Sec. V-A and Table I] The evaluation uses only 200 test samples per dataset and reports no error bars or confidence intervals. With such a small sample, the reported differences (e.g., 71.6% vs. 0% for IGO on ImageNet-1K) could easily be inflated by selection bias, especially since hyperparameters (top-p, alpha, layer list) appear to be chosen on the same evaluation set using Appendix Table IV and Figure 4. The paper should separate a validation set for tuning from a held-out test set, or report multiple runs with variance estimates.
  2. [Sec. V-B and Algorithm 1] The defense's mask is calibrated on IGO-generated input-perturbed pairs and then evaluated against IGO attacks in the same dataset, making the headline accuracy against IGO at least partly circular. The paper does not show whether the identified 'adversarial neurons' are causal vulnerability loci or merely artifacts of the IGO optimization trajectory. The authors should test masks derived from one attack (e.g., IGO) against attacks with different gradient geometries, such as AutoAttack, patch attacks, or frequency-domain attacks, and also evaluate against adaptive attacks that are aware of the neuron mask.
  3. [Sec. V-B, Table I and Sec. V-E, Table II] The cross-dataset generalization in Table II supports transfer across classes, but the more important claim for a defense is transfer across attack types. Since both calibration and evaluation use gradient-based attacks (IGO, PGD, FGSM), the results do not establish that NeuroShield-ViT generalizes to attack mechanisms not represented in the calibration set. The paper should include at least one attack that is not of the same optimization family (e.g., a black-box or score-based attack, or a universal/patched perturbation) to support the stated claim of robust protection.
  4. [Sec. V-F, Table III] The comparison against adversarial training (AT) and randomized smoothing (RS) is not apples-to-apples: AT is reported as achieving only 5.0% on IGO, which is unusually low for a ViT-based defense and suggests the AT implementation or training budget is not representative of standard practice. Additionally, the paper mentions that FGSM results may be affected by gradient masking (Sec. V-B) but does not evaluate whether the same masking inflates the PGD/IGO results. A proper adaptive attack that optimizes the perturbation while accounting for the neutralization in the forward pass is needed to rule out gradient masking as the source of the reported robustness.
  5. [Sec. III, Eq. (4) and Sec. IV, Algorithm 1] The definition of neuron importance in Eq. (4) sums the activation-gradient product over all image patches, but the paper does not provide a baseline or randomization control showing that the specific set difference (Al_p = N_adv \ N_clean) is causally responsible for the robustness gain. Without a control that neutralizes an equal number of random neurons or neurons chosen by clean-only importance, it is unclear whether the benefit comes from the adversarial-neuron selection or from the mere act of perturbing early-layer activations.
minor comments (5)
  1. [Abstract] The abstract contains a duplicated sentence: 'Additionally, they provide a promising approach to enhance the robustness of vision transformers against adversarial attacks.' appears twice in consecutive sentences.
  2. [Sec. I (Contributions)] The second contribution is misspelled as 'NeuroShied-ViT' instead of 'NeuroShield-ViT'.
  3. [Sec. V-A and Appendix B] The CIFAR-10 results are described only in prose and a repeated sentence in Appendix B; reporting exact accuracy values and the number of test samples in the main table would make the evaluation easier to assess.
  4. [Sec. V-D and Appendix A] The sensitivity tables report accuracy to one decimal place without any indication of variance; since these numbers come from a single 200-sample set, it would be helpful to state the stochasticity of sample selection and whether different random seeds give similar trends.
  5. [Sec. V-B, Table I] For FGSM, several entries show no improvement (e.g., DeiT-S at 62.0 both with and without defense), yet the text does not explain whether this is due to the attack's simplicity or a failure of the method; a sentence clarifying the expected behavior would improve clarity.

Circularity Check

1 steps flagged · score 4.0 of 10

Headline IGO robustness is evaluated under the same attack used to calibrate the neuron mask; PGD results provide partial independent support.

  1. fitted input called prediction [Section V-A Experimental Setup and Section V-B Table I]
    "The same number of input-perturbed image pairs were also generated for the purpose of determining neuron importance, which we call NeuroShield Calibration Set (NCS). ... NeuroShield-ViT improves the accuracy of ViT-B from 0% to 71.6% against IGO attacks."

    The adversarial neuron mask is fit on IGO-generated input/perturbed pairs (Algorithm 1, Eq. 4), and the headline Table I IGO accuracy is then reported as evidence of the defense and of the layer-propagation mechanism. Because calibration attack and evaluated attack are identical (IGO), the IGO column is a same-distribution result for the fitted mask, not a prediction of behavior under a different attack. The PGD-20/PGD-100 columns are generated by different attacks and partially break this dependency, but the paper's most prominent 'without fine-tuning' numbers are IGO numbers, so the central demonstration is partly forced by the calibration protocol.

full rationale

The paper's mechanistic analysis and defense are not derived from a formal theorem, so there is no self-definitional or imported-uniqueness circularity. However, the principal quantitative support—IGO attack accuracy in Table I (71.6% and 77.8%)—is obtained under the same attack used to construct the NeuroShield Calibration Set, so the IGO column is a same-distribution evaluation of the fitted mask rather than an independent confirmation of the 'adversarial neuron' mechanism. The PGD-20/PGD-100 results and the cross-dataset Table II provide independent grounding because those attacks/datasets were not used for calibration; FGSM shows little gain, which is consistent with the mask being attack-specific. The IGO attack itself is cited to the authors' prior work [21], making this a self-citation-adjacent protocol, but the published attack and the independent PGD comparisons keep the central claim from reducing entirely to the fit. The paper's own Discussion acknowledges that reliance on pre-identified neurons 'may limit its adaptability to novel attack types,' which supports weighting the same-attack evaluation as a partial circularity rather than a full one.

Assumptions & free parameters 4 free parameters · 4 assumptions · 1 invented entities

The central claim rests on empirical regularities: that a small set of neurons can be identified from a calibration set and neutralized without destroying accuracy; these are domain assumptions specific to this paper.

free parameters (4)
  • top-p percentage p = 0.5% (main), 1% and 2% explored
    Controls how many neurons are neutralized; tuned on ImageNet1K test set (Sec. V-D).
  • neutralization coefficient alpha = 0.1 (main), 0.2 and 0.5 explored
    Scales down activations of adversarial neurons; tuned on ImageNet1K test set (Sec. V-D).
  • NCS subset size = 25% of NCS (main), 5-100% explored
    Number of calibration pairs used; chosen to balance compute and accuracy (Sec. V-B, Sec. V-D).
  • Layer list L and block list B = all layers and all blocks in main experiments
    Which layers and blocks are neutralized; the paper does not specify a principled selection, only ablation from the end.
assumptions (4)
  • domain assumption Pretrained ViT and DeiT models on ImageNet are representative of ViT behavior.
    Used throughout Sec. III and V; results may not transfer to other architectures or training regimes.
  • domain assumption Gradient-based importance (activation times gradient) reliably localizes adversarial neurons.
    Eq. (3) assumes the product of activations and gradients captures causal importance; no validation against other attribution methods.
  • ad hoc to paper The set difference of top-p% neurons between adversarial and clean inputs identifies the causal adversarial neurons.
    This is the core of the method (Sec. IV-A), but the paper does not prove that these neurons are necessary or sufficient for adversarial behavior.
  • ad hoc to paper A fixed per-layer neuron mask remains valid across different inputs.
    The defense applies one mask to all test images; input-dependence of adversarial neurons is not tested.
invented entities (1)
  • Adversarial neurons independent evidence
    purpose: Explain and localize adversarial effects; used as neutralization targets.
    Defined operationally via activation-gradient products and shown to be predictive of defense performance across attacks, so it has a measurable handle.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mechanistic Understandings of Representation Vulnerabilities and Engineering Robust Vision Transformers." pith.science (2026). https://pith.science/paper/KKOAK5M4

@misc{pith2026250204679,
  author       = {Pith},
  title        = {Pith review of: Mechanistic Understandings of Representation Vulnerabilities and Engineering Robust Vision Transformers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KKOAK5M4}},
  note         = {Machine review of arXiv:2502.04679}
}
read the original abstract

While transformer-based models dominate NLP and vision applications, their underlying mechanisms to map the input space to the label space semantically are not well understood. In this paper, we study the sources of known representation vulnerabilities of vision transformers (ViT), where perceptually identical images can have very different representations and semantically unrelated images can have the same representation. Our analysis indicates that imperceptible changes to the input can result in significant representation changes, particularly in later layers, suggesting potential instabilities in the performance of ViTs. Our comprehensive study reveals that adversarial effects, while subtle in early layers, propagate and amplify through the network, becoming most pronounced in middle to late layers. This insight motivates the development of NeuroShield-ViT, a novel defense mechanism that strategically neutralizes vulnerable neurons in earlier layers to prevent the cascade of adversarial effects. We demonstrate NeuroShield-ViT's effectiveness across various attacks, particularly excelling against strong iterative attacks, and showcase its remarkable zero-shot generalization capabilities. Without fine-tuning, our method achieves a competitive accuracy of 77.8% on adversarial examples, surpassing conventional robustness methods. Our results shed new light on how adversarial effects propagate through ViT layers, while providing a promising approach to enhance the robustness of vision transformers against adversarial attacks. Additionally, they provide a promising approach to enhance the robustness of vision transformers against adversarial attacks.

Figures

Figures reproduced from arXiv: 2502.04679 by the authors.

Figure 1
Figure 1. Average layer-wise cosine similarity of CLS embeddings for input [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Heatmaps illustrating the distribution of cosine similarities for image token embeddings in attention projection (attn.proj), MLP feed-forward (mlp.fc2), [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Top-p% adversarial neurons per representation responsible for adver [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Impact of layer-wise neutralization on model accuracy [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Impact of the subset size (%) of NCS on the model accuracy. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. DeepSeek on a Trip: Inducing Targeted Visual Hallucinations via Representation Vulnerabilities

    cs.CV 2025-02 conditional novelty 5.0 of 10

    An embedding-matching attack on DeepSeek Janus Pro makes the model confidently describe objects that are not present, with hallucination rates up to 98% at high visual fidelity.

Reference graph

Works this paper leans on

56 extracted references · 25 canonical work pages · cited by 1 Pith paper

  1. [1]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929 , 2020

    arXiv 2010

  2. [2]

    Attention is all you need,

    A. Vaswani, “Attention is all you need,” arXiv preprint arXiv:1706.03762, 2017

    arXiv 2017

  3. [3]

    Imagenet classification with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” Advances in neural informa- tion processing systems , vol. 25, 2012

    2012

  4. [4]

    Rethinking semantic segmentation from a sequence-to-sequence perspective with transformers,

    S. Zheng, J. Lu, H. Zhao, X. Zhu, Z. Luo, Y . Wang, Y . Fu, J. Feng, T. Xiang, P. H. Torr et al. , “Rethinking semantic segmentation from a sequence-to-sequence perspective with transformers,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2021, pp. 6881–6890

    2021

  5. [5]

    End-to-end object detection with transformers,

    N. Carion, F. Massa, G. Synnaeve, N. Usunier, A. Kirillov, and S. Zagoruyko, “End-to-end object detection with transformers,” in European conference on computer vision . Springer, 2020, pp. 213– 229

    2020

  6. [6]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., “Learning transferable visual models from natural language supervision,” in International conference on machine learning . PMLR, 2021

    work page 2021

  7. [7]

    Multimodal learning with transform- ers: A survey,

    P. Xu, X. Zhu, and D. A. Clifton, “Multimodal learning with transform- ers: A survey,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 10, pp. 12 113–12 132, 2023

    work page 2023

  8. [8]

    On the adversarial robustness of vision transformers,

    R. Shao, Z. Shi, J. Yi, P.-Y . Chen, and C.-J. Hsieh, “On the adversarial robustness of vision transformers,” arXiv preprint arXiv:2103.15670 , 2021

    arXiv 2021

Show all 56 references
  1. [9]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  2. [10]

    Improving adversarial robustness requires revisiting misclassified examples,

    Y . Wang, D. Zou, J. Yi, J. Bailey, X. Ma, and Q. Gu, “Improving adversarial robustness requires revisiting misclassified examples,” in International conference on learning representations , 2019

    2019

  3. [11]

    Analyzing transformers in embedding space,

    G. Dar, M. Geva, A. Gupta, and J. Berant, “Analyzing transformers in embedding space,” arXiv preprint arXiv:2209.02535 , 2022

    2022 arXiv

  4. [12]

    Transformer feed-forward layers build predictions by promoting concepts in the vocabulary space,

    M. Geva, A. Caciularu, K. R. Wang, and Y . Goldberg, “Transformer feed-forward layers build predictions by promoting concepts in the vocabulary space,” arXiv preprint arXiv:2203.14680 , 2022

    2022 arXiv

  5. [13]

    Do vision transformers see like convolutional neural networks?

    M. Raghu, T. Unterthiner, S. Kornblith, C. Zhang, and A. Dosovitskiy, “Do vision transformers see like convolutional neural networks?” Ad- vances in neural information processing systems , vol. 34, pp. 12 116– 12 128, 2021

    2021

  6. [14]

    Understanding and defending patched-based adversarial attacks for vision transformer,

    L. Liu, Y . Guo, Y . Zhang, and J. Yang, “Understanding and defending patched-based adversarial attacks for vision transformer,” inProceedings of the 40th International Conference on Machine Learning , 2023, pp. 21 631–21 657

    2023

  7. [15]

    Analyzing vision trans- formers for image classification in class embedding space,

    M. G. Vilas, T. Schauml ¨offel, and G. Roig, “Analyzing vision trans- formers for image classification in class embedding space,” Advances in neural information processing systems , vol. 36, 2024

    2024

  8. [16]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” arXiv preprint arXiv:1810.04805, 2018

    2018 arXiv

  9. [17]

    Speech-transformer: a no-recurrence sequence-to-sequence model for speech recognition,

    L. Dong, S. Xu, and B. Xu, “Speech-transformer: a no-recurrence sequence-to-sequence model for speech recognition,” in 2018 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 2018, pp. 5884–5888

    2018

  10. [18]

    Geometric analysis and metric learning of instruction embeddings,

    S. Biswas, T. Barao, J. Lazzari, J. McCoy, X. Liu, and A. Kostandarithes, “Geometric analysis and metric learning of instruction embeddings,” in 2022 International Joint Conference on Neural Networks (IJCNN) . IEEE, 2022, pp. 1–8

    2022

  11. [19]

    Representation en- gineering: A top-down approach to ai transparency,

    A. Zou, L. Phan, S. Chen, J. Campbell, P. Guo, R. Ren, A. Pan, X. Yin, M. Mazeika, A.-K. Dombrowski et al. , “Representation en- gineering: A top-down approach to ai transparency,” arXiv preprint arXiv:2310.01405, 2023

    2023 arXiv

  12. [20]

    Towards general conceptual model editing via adversarial representation engineering,

    Y . Zhang, Z. Wei, J. Sun, and M. Sun, “Towards general conceptual model editing via adversarial representation engineering,” arXiv preprint arXiv:2404.13752, 2024

    2024 arXiv

  13. [21]

    Intriguing equivalence structures of the embedding space of vision transformers,

    S. Salman, M. M. B. Shams, and X. Liu, “Intriguing equivalence structures of the embedding space of vision transformers,”arXiv preprint arXiv:2401.15568, 2024

    2024 arXiv

  14. [22]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 ieee symposium on security and privacy (sp) . Ieee, 2017

    2017

  15. [23]

    Adversarial examples are not easily detected: Bypassing ten detection methods,

    ——, “Adversarial examples are not easily detected: Bypassing ten detection methods,” in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , ser. AISec ’17. New York, NY , USA: Association for Computing Machinery, 2017, p. 3–14. [Online]. Available: h...

    2017

  16. [24]

    Deepfool: a simple and accurate method to fool deep neural networks,

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 2574–2582

    2016

  17. [25]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  18. [26]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial intelligence safety and security . Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  19. [27]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in 2016 IEEE European symposium on security and privacy (EuroS&P) . IEEE, 2016, pp. 372–387

    2016

  20. [28]

    Transferability in machine learning: From phenomena to black-box attacks using adver- sarial samples,

    N. Papernot, P. McDaniel, and I. J. Goodfellow, “Transferability in machine learning: From phenomena to black-box attacks using adver- sarial samples,” in IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2016, pp. 123–138

    2016

  21. [29]

    Exploring adversarial robustness of vision transformers in the spectral perspective,

    G. Kim, J. Kim, and J.-S. Lee, “Exploring adversarial robustness of vision transformers in the spectral perspective,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , 2024, pp. 3976–3985

    2024

  22. [30]

    Understanding adversarial robustness of vision transformers via cauchy problem,

    Z. Wang and W. Ruan, “Understanding adversarial robustness of vision transformers via cauchy problem,” in Joint European Conference on Machine Learning and Knowledge Discovery in Databases . Springer, 2022, pp. 562–577

    2022

  23. [31]

    Malicious path manipulations via exploitation of representation vulnerabilities of vision-language navigation systems,

    C. M. Islam, S. Salman, M. Shams, X. Liu, and P. Kumar, “Malicious path manipulations via exploitation of representation vulnerabilities of vision-language navigation systems,” arXiv preprint arXiv:2407.07392 , 2024

    2024 arXiv

  24. [32]

    Towards transferable adversarial attacks on vision transformers,

    Z. Wei, J. Chen, M. Goldblum, Z. Wu, T. Goldstein, and Y .-G. Jiang, “Towards transferable adversarial attacks on vision transformers,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 36, no. 3, 2022, pp. 2668–2676

    2022

  25. [33]

    Dual stage black-box adversarial attack against vision transformer,

    F. Wang, M. Shao, L. Meng, and F. Liu, “Dual stage black-box adversarial attack against vision transformer,” International Journal of Machine Learning and Cybernetics , pp. 1–12, 2024

    2024

  26. [34]

    Quantattack: Exploiting dynamic quantization to attack vision transformers,

    A. Baras, A. Zolfi, Y . Elovici, and A. Shabtai, “Quantattack: Exploiting dynamic quantization to attack vision transformers,” arXiv preprint arXiv:2312.02220, 2023

    2023 arXiv

  27. [35]

    Exploring adversarial attacks and defenses in vision transformers trained with dino,

    J. Rando, N. Naimi, T. Baumann, and M. Mathys, “Exploring adversarial attacks and defenses in vision transformers trained with dino,” arXiv preprint arXiv:2206.06761, 2022

    2022 arXiv

  28. [36]

    Transferable adversarial attacks on vision transformers with token gradient regularization,

    J. Zhang, Y . Huang, W. Wu, and M. R. Lyu, “Transferable adversarial attacks on vision transformers with token gradient regularization,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 16 415–16 424

    2023

  29. [37]

    Universal adversarial triggers for attacking and analyzing nlp,

    E. Wallace, S. Feng, N. Kandpal, M. Gardner, and S. Singh, “Universal adversarial triggers for attacking and analyzing nlp,” arXiv preprint arXiv:1908.07125, 2019

    1908 arXiv

  30. [38]

    Adversarial attacks on large language models using regularized relaxation,

    S. J. Chacko, S. Biswas, C. M. Islam, F. T. Liza, and X. Liu, “Adversarial attacks on large language models using regularized relaxation,” arXiv preprint arXiv:2410.19160, 2024

    2024 arXiv

  31. [39]

    Trade-off between robustness and accuracy of vision transformers,

    Y . Li and C. Xu, “Trade-off between robustness and accuracy of vision transformers,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 7558–7568

    2023

  32. [40]

    When adversarial training meets vision transformers: Recipes from training to architec- ture,

    Y . Mo, D. Wu, Y . Wang, Y . Guo, and Y . Wang, “When adversarial training meets vision transformers: Recipes from training to architec- ture,” Advances in Neural Information Processing Systems , vol. 35, pp. 18 599–18 611, 2022

    2022

  33. [41]

    Patch-fool: Are vision transformers always robust against adversarial perturbations?

    Y . Fu, S. Zhang, S. Wu, C. Wan, and Y . Lin, “Patch-fool: Are vision transformers always robust against adversarial perturbations?” arXiv preprint arXiv:2203.08392, 2022

    2022 arXiv

  34. [42]

    Harnessing edge information for improved ro- bustness in vision transformers,

    Y . Li, C. Du, and C. Xu, “Harnessing edge information for improved ro- bustness in vision transformers,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38, 2024, pp. 3252–3260

    2024

  35. [43]

    Random entangled tokens for adversarially robust vision transformer,

    H. Gong, M. Dong, S. Ma, S. Camtepe, S. Nepal, and C. Xu, “Random entangled tokens for adversarially robust vision transformer,” in Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 554–24 563

    2024

  36. [44]

    Certified adversarial robustness via randomized smoothing,

    J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial robustness via randomized smoothing,” in international conference on machine learning. PMLR, 2019, pp. 1310–1320

    2019

  37. [45]

    {PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking,

    C. Xiang, A. N. Bhagoji, V . Sehwag, and P. Mittal, “ {PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 2237–2254

    2021

  38. [46]

    Activation addition: Steering language models without optimiza- tion,

    A. Turner, L. Thiergart, D. Udell, G. Leech, U. Mini, and M. MacDi- armid, “Activation addition: Steering language models without optimiza- tion,” arXiv preprint arXiv:2308.10248 , 2023

    2023 arXiv

  39. [47]

    In-context vectors: Making in context learning more effective and controllable through latent space steering,

    S. Liu, L. Xing, and J. Zou, “In-context vectors: Making in context learning more effective and controllable through latent space steering,” arXiv preprint arXiv:2311.06668 , 2023

    2023 arXiv

  40. [48]

    Assessing the brittleness of safety alignment via pruning and low-rank modifications,

    B. Wei, K. Huang, Y . Huang, T. Xie, X. Qi, M. Xia, P. Mittal, M. Wang, and P. Henderson, “Assessing the brittleness of safety alignment via pruning and low-rank modifications,” arXiv preprint arXiv:2402.05162, 2024

    2024 arXiv

  41. [49]

    Pytorch image models,

    R. Wightman, “Pytorch image models,” https://github.com/rwightman/ pytorch-image-models, 2019

    2019

  42. [50]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition . Ieee, 2009, pp. 248–255

    2009

  43. [51]

    Layer normalization,

    J. L. Ba, J. R. Kiros, and G. E. Hinton, “Layer normalization,” arXiv preprint arXiv:1607.06450, 2016

    2016 arXiv

  44. [52]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  45. [53]

    imagenette,

    J. Howard, “imagenette,” 2019. [Online]. Available: https://github.com/ fastai/imagenette/

    2019

  46. [54]

    Cifar-10 (canadian institute for advanced research),

    A. Krizhevsky, V . Nair, and G. Hinton, “Cifar-10 (canadian institute for advanced research),” URL http://www. cs. toronto. edu/kriz/cifar. html , vol. 5, no. 4, p. 1, 2010

    2010

  47. [55]

    Training data-efficient image transformers & distillation through attention,

    H. Touvron, M. Cord, M. Douze, F. Massa, A. Sablayrolles, and H. J ´egou, “Training data-efficient image transformers & distillation through attention,” in International conference on machine learning . PMLR, 2021, pp. 10 347–10 357

    2021

  48. [56]

    How deep learning sees the world: A survey on adversarial attacks & defenses,

    J. C. Costa, T. Roxo, H. Proenc ¸a, and P. R. In ´acio, “How deep learning sees the world: A survey on adversarial attacks & defenses,” IEEE Access, 2024

    2024

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.