On the Robustness of Vision Transformers to Adversarial Examples

Mahmood, Kaleel; Mahmood, Rigel; Dijk, Marten van

doi:10.1109/iccv48922.2021.00774

Cited by 108 publications

(67 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A number of works have been proposed to evaluate the robustness of deep neural networks [18,19,47,48,21,49,50,51,52,53]. [54] first investigated the adversarial robustness of 18 models on ImageNet.…”

Section: Robustness Benchmark and Evaluationmentioning

confidence: 99%

RobustART: Benchmarking Robustness on Architecture Design and Training Techniques

Tang¹,

Gong²,

Wang³

et al. 2021

Preprint

View full text Add to dashboard Cite

Deep neural networks (DNNs) are vulnerable to adversarial noises, which motivates the benchmark of model robustness. Existing benchmarks mainly focus on evaluating the defenses, but there are no comprehensive studies of how architecture design and general training techniques affect robustness. Comprehensively benchmarking their relationships will be highly beneficial for better understanding and developing robust DNNs. Thus, we propose RobustART, the first comprehensive Robustness investigation benchmark on ImageNet (including open-source toolkit, pre-trained model zoo, datasets, and analyses) regarding ARchitecture design (44 human-designed off-the-shelf architectures and 1200+ networks from neural architecture search) and Training techniques (10+ general techniques, e.g., data augmentation) towards diverse noises (adversarial, natural, and system noises). Extensive experiments revealed and substantiated several insights for the first time, for example: (1) adversarial training largely improves the clean accuracy and all types of robustness for Transformers and MLP-Mixers; (2) with comparable sizes, CNNs > Transformers > MLP-Mixers on robustness against natural and system noises; Transformers > MLP-Mixers > CNNs on adversarial robustness;(3) for some light-weight architectures (e.g., EfficientNet, MobileNetV2, and Mo-bileNetV3), increasing model sizes or using extra training data cannot improve robustness. Our benchmark http://robust.art/: (1) presents an open-source platform for conducting comprehensive evaluation on diverse robustness types;(2) provides a variety of pre-trained models with different training techniques to facilitate robustness evaluation; (3) proposes a new view to better understand the mechanism towards designing robust DNN architectures, backed up by the analysis. We will continuously contribute to building this ecosystem for the community.

show abstract

Section: Robustness Benchmark and Evaluationmentioning

confidence: 99%

RobustART: Benchmarking Robustness on Architecture Design and Training Techniques

Tang¹,

Gong²,

Wang³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…[2021], Mahmood et al [2021] show that they are more robust to adversarial perturbations, and Naseer et al [2021] that they have less texture bias. Paul and Chen [2021] show that ViT is more robust to distribution shift and natural adversarial examples, and Mao et al [2021] propose a robust ViT.…”

Section: Pre-training Neural Networkmentioning

confidence: 99%

Exploring the Limits of Out-of-Distribution Detection

Fort,

Ren,

Lakshminarayanan

2021

Preprint

View full text Add to dashboard Cite

Near out-of-distribution detection (OOD) is a major challenge for deep neural networks. We demonstrate that large-scale pre-trained transformers can significantly improve the state-of-the-art (SOTA) on a range of near OOD tasks across different data modalities. For instance, on CIFAR-100 vs CIFAR-10 OOD detection, we improve the AUROC from 85% (current SOTA) to more than 96% using Vision Transformers pre-trained on ImageNet-21k. On a challenging genomics OOD detection benchmark, we improve the AUROC from 66% to 77% using transformers and unsupervised pre-training. To further improve performance, we explore the few-shot outlier exposure setting where a few examples from outlier classes may be available; we show that pre-trained transformers are particularly well-suited for outlier exposure, and that the AUROC of OOD detection on CIFAR-100 vs CIFAR-10 can be improved to 98.7% with just 1 image per OOD class, and 99.46% with 10 images per OOD class. For multi-modal image-text pre-trained transformers such as CLIP, we explore a new way of using just the names of outlier classes as a sole source of information without any accompanying images, and show that this outperforms previous SOTA on standard vision OOD benchmark tasks. * Equal contribution.Preprint. Under review.

show abstract

“…23,24 Technical studies have described improved robustness of ViTs to adversarial changes to the input data, but this has not been explored in medical applications. [25][26][27] In this study, we investigated the robustness of CNNs in computational pathology toward different attacks and compared these results to the robustness of ViTs. Additionally, we trained robust models and evaluated their performances against the white-and black-box attacks.…”

Section: Introductionmentioning

confidence: 99%

Adversarial attacks and adversarial robustness in computational pathology

Laleh

Truhn

Veldhuizen

et al. 2022

Preprint

View full text Add to dashboard Cite

Artificial Intelligence (AI) can support diagnostic workflows in oncology by aiding diagnosis and providing biomarkers. AI applications are therefore expected to evolve from academic prototypes to commercial products in the coming years. However, AI applications are vulnerable to adversarial attacks, such as malicious interference with test data aiming to cause misclassifications. Therefore, it is essential for the use of AI-based diagnostic devices to secure them against such attacks before widespread use. Unfortunately, no resistant systems exist in computational pathology so far. To address this problem, we investigate the susceptibility of convolutional neural networks (CNNs) to multiple types of white- and black-box attacks. We demonstrate that both attacks can easily confuse CNNs in clinically relevant pathology tasks and impair classification performance. Classical adversarially robust training and dual batch normalization (DBN) are possible mitigation strategies but require precise knowledge of the type of attack used in the inference. We demonstrate that vision transformers (ViTs) perform equally well compared to CNNs at baseline and are orders of magnitude more robust to different types of white-box and black-box attacks. At a mechanistic level, we show that this is associated with a more robust latent representation of clinically relevant categories in ViTs compared to CNNs. Our results are in line with previous theoretical studies. We show that ViTs are robust learners in computational pathology. This implies that large-scale rollout of AI models in computational pathology should rely on ViTs rather than CNN-based classifiers to provide inherent protection against adversaries.

show abstract

On the Robustness of Vision Transformers to Adversarial Examples

Cited by 108 publications

References 11 publications

RobustART: Benchmarking Robustness on Architecture Design and Training Techniques

RobustART: Benchmarking Robustness on Architecture Design and Training Techniques

Exploring the Limits of Out-of-Distribution Detection

Adversarial attacks and adversarial robustness in computational pathology

Contact Info

Product

Resources

About