Towards Transferable Adversarial Attacks on Image and Video Transformers.

Area of Science:

• Computer Vision
• Machine Learning Security

Background:

• Adversarial examples pose security threats to convolutional neural networks (CNNs) due to their transferability.
• Vision transformers (ViTs) show superior performance but have been less explored for adversarial attack transferability.

Purpose of the Study:

• To investigate the transferability of adversarial examples across different ViTs.
• To develop novel attack strategies specifically for ViTs to assess their security vulnerabilities.

Main Methods:

• Proposed the Pay No Attention (PNA) attack, which ignores attention gradients to improve backpropagation linearity.
• Introduced PatchOut/CubeOut attacks optimizing perturbations on subsets of patches/cubes to prevent overfitting.
• Maximized the L2 norm of perturbations to ensure significant deviation from benign examples.

Main Results:

• The proposed combined attack strategies significantly enhance adversarial example transferability across ViTs.
• The attacks were effective in both untargeted and targeted scenarios on ImageNet and Kinetics-400 datasets.
• The novel attacks complement existing transferable attack methods, boosting their effectiveness.

Conclusions:

• The developed methods provide a comprehensive assessment of ViT security against adversarial attacks.
• These findings highlight the need for robust defense mechanisms for ViTs in real-world applications.