Pith. sign in

REVIEW 3 major objections 5 minor 51 references

One Pixel is All I Need

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A Vision Transformer can be backdoored so that changing a single pixel in a test image flips its prediction to the attacker's chosen label, using a one-epoch poisoning rate as low as 0.2%.

desk verdict The PSDM observation is real and worth citing, but WorstVIT's 'one pixel' success is per-input white-box probing with a large search budget, not a fixed single-pixel trigger; the paper's framing overstates what the data show. read the letter →

arxiv 2412.10681 v2 pith:UAYNHIKA submitted 2024-12-14 cs.CV

Deng Siqin , Zhou Xiaoyi This is my paper · ORCID
classification cs.CV
keywords backdoorattackdatapoisoningVisionTransformerquasi-triggerperturbationsensitivitydistributionmapsingle-pixelsuppression
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that Vision Transformers have a distinctive, learnable weakness: their gradients, averaged over many images, form a stationary patch-wise sensitivity map in which patch centers matter more than edges. The authors exploit this map to place a single contrasting pixel as a backdoor trigger, and claim that after only one training epoch on a very small fraction of poisoned images, nearly every test image can be flipped to a specified target label by modifying one pixel. They also report that quasi-triggers—patterns that differ from but resemble the training trigger—work substantially better on ViTs than on CNNs, because some clean images contain features that suppress the original trigger. If these claims hold, a backdoored ViT could be controlled with a per-image one-pixel perturbation that escapes several mainstream defenses while leaving clean accuracy essentially unchanged.

What carries the argument

The load-bearing object is the Perturbation Sensitivity Distribution Map (PSDM), the sum of input gradients over a large set of images, which reveals where the model is most sensitive to content-agnostic changes. In ViTs the PSDM shows a regular patch-wise pattern, and the attack places single-pixel quasi-triggers at high-PSDM coordinates, using contrast between the pixel and its surrounding patch as the trigger's defining feature. During the white-box probing attack, gradients of the current input guide the search for a suitable pixel location and value, typically succeeding within 1000 trials per image.

What would settle it

Reproduce the WorstVIT training recipe, then attack the validation set with a single fixed pixel position and value chosen once for all images, removing the per-image probing loop. If the attack success rate falls well below the reported 100% PASR, the one-pixel result is an artifact of the search budget rather than a property of the backdoor.

Watch

Extended reading notes

Core claim

The central discovery is that the input-gradient field of a ViT, accumulated over many images, is not uniform but forms a fixed patch-like landscape: the center of each patch is far more influential than its edges. Backdoor triggers placed at those high-sensitivity coordinates, expressed as a single pixel whose brightness contrasts with its own patch, reach near-total attack success. A second discovery is backdoor suppression: some clean images naturally contain partial trigger features that the model learns to treat as suppressors, which makes the originally planted trigger fail on those inputs while a shifted or recolored quasi-trigger succeeds. WorstVIT combines these two findings into a one-epoch, low-poisoning-rate attack that achieves 100% probing attack success rate on ImageNet, CIFAR-10, and MNIST, and withstands Fine-Pruning, SCALE UP, and Neural Cleanse.

Load-bearing premise

The headline result assumes the attacker can probe each image with up to a thousand gradient-guided single-pixel changes; without that per-image search budget, the one-pixel success is not established.

Editorial extensions

If this is right

  • A ViT can be backdoored with poisoning rates from 0.1% down to 0.2%–0.002% on ImageNet, CIFAR-10, and MNIST, training for a single epoch, while clean accuracy stays at or above the clean model's level.
  • The one-pixel result is per image: in the white-box probing setting, up to 1000 gradient-guided trials per input are allowed, so the attack is a search over single-pixel modifications rather than a fixed universal trigger.
  • Three mainstream defenses, Fine-Pruning, SCALE UP, and Neural Cleanse, fail to detect or mitigate the backdoor.
  • Quasi-triggers transfer across patch positions and pixel values in ViTs far better than in CNNs, meaning the backdoor remains active even when the trigger deviates from the training pattern.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The authors leave implicit that their 'one pixel' framing folds the attack budget into the trigger claim: at test time WorstVIT searches each image with up to 1000 gradient-guided trials, so it behaves like a white-box adversarial single-pixel perturbation on a backdoored model. A stricter fixed-trigger experiment would likely lower the reported 100% PASR.
  • If the PSDM patch pattern is a stable property of ViT architectures, it could be precomputed once and reused across datasets and models sharing the same patch embedding, which would make the attack cheaper than the paper's per-dataset training suggests.
  • The backdoor-suppression mechanism implies that clean images with partial trigger features act as implicit 'vaccination'; deliberately poisoning samples that already resemble the trigger could suppress this learned suppression, possibly enabling clean-label variants or even lower poisoning rates than reported.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies backdoor vulnerabilities of Vision Transformers (ViTs). It introduces the Perturbation Sensitivity Distribution Map (PSDM), obtained by summing input gradients over many images, and reports that ViTs exhibit a patch-like PSDM whose center pixels are more sensitive than edges. The paper defines quasi-triggers, i.e., patterns that differ from but resemble the training trigger, and claims that quasi-triggers transfer across patch positions and pixel values better in ViTs than in CNNs. It also proposes a mechanism called backdoor suppression, where clean samples containing partial trigger features suppress the original trigger. Based on these observations, the paper proposes WorstVIT, a data-poisoning backdoor that, after one epoch of training with an extremely low poisoning rate, is claimed to modify a single pixel to successfully attack all validation images. Variants include WorstSwin-VIT, Hidden-WorstVIT, single-channel attacks, and all-to-all attacks. The paper reports near-100% ASR and PASR on ImageNet, CIFAR-10, and MNIST, and claims to bypass Fine-Pruning, SCALE UP, and Neural Cleanse.

Significance. If the one-pixel claim were established as a fixed-trigger backdoor, the result would be striking: an extremely low poisoning rate, one-epoch training, and a single-pixel perturbation steering all validation images to a target label would be a significant advance over prior backdoor attacks and over single-pixel adversarial attacks. The PSDM tool and the observation of patch-wise sensitivity in ViTs are also potentially useful for understanding ViT robustness and for designing better attacks and defenses. However, as detailed in the major comments, the headline claim is currently supported only by a per-input white-box search protocol, not by a fixed trigger; this materially reduces the significance. Nonetheless, the paper offers valuable empirical analysis of quasi-trigger behavior and a novel characterization of ViT sensitivity, which could support a useful paper after appropriate reframing and additional experiments.

major comments (3)
  1. [Abstract; Section 4.2; Section 4.3; Table 1] The central claim that 'modifying a single pixel' attacks all validation images is supported only by the Probing Attack Success Rate (PASR), not by a fixed-trigger ASR. Section 4.2 states that quasi-triggers have no fixed position or value, and are placed sequentially at coordinates ranked by PSDM values, input gradients, or channel gradients, with suitable triggers 'typically... found within 1000 trials'. Section 4.3 defines PASR as success if, within a set number of attempts, the prediction can be changed by modifying one pixel or one channel. Thus the reported PASR=100.00 in Table 1 means that a per-image white-box search finds a single-pixel modification for every test sample; it does not mean that a single fixed pixel pattern acts as a universal trigger. The title, abstract, and introduction phrase the result as a property of the backdoor itself, which is misleading. To substantiate the claim as stated, the authors should either report ASR for a single fixed trigger pattern (same coordinate and value across all test images) or explicitly reframe the contribution as a white-box per-input probing attack and compare it with existing single-pixel adversarial search methods.
  2. [Section 4.1] The ASR values in Table 1 (e.g., 98.69 for base-VIT) may themselves be computed with an input-dependent trigger placement: the testing phase places the trigger at 'the center (7, 7) of the patch that could produce the maximum contrast'. Since the patch with maximum contrast depends on the input image, this ASR is not an attack success rate under a fixed trigger either. Please clarify exactly which trigger configuration is used to report each ASR, and, if the goal is a backdoor, report a standard fixed-trigger ASR where the trigger pattern (coordinate and value, or a fixed rule independent of the input) is identical for all test inputs. If the input-dependent placement is intentional, the paper should state that the attack is an adaptive one-pixel perturbation guided by the backdoor, and it should analyze the computational cost of computing the maximum-contrast patch.
  3. [Section 3.3; Figure 3] The paper's first contribution is the claim that quasi-triggers achieve much higher attack success rates in ViTs than in CNNs (Abstract and Section 3.3). However, the quantitative evidence in the main text is limited to Figure 3, which plots curves but does not report numeric ASR values, confidence intervals, or the number of trials; the experimental description refers to traversing 'all possible positions and pixel values of the trigger' but does not state how many models or seeds were used. This is a load-bearing claim for the paper's motivation and for the design of WorstVIT. Please provide a table with exact ASR values (and standard deviations across seeds) for the ViT, VGG, and ResNet models under identical trigger-position and pixel-value traversals.
minor comments (5)
  1. [Table 5] Table 5's heading reads 'MINST'; it should be 'MNIST'.
  2. [Figure 3] Figure 3's caption contains a typo: 'Differrent' should be 'Different'.
  3. [Section 4.4 / Appendix 6.7] The defense-resistance claim is supported by limited quantitative reporting: for SCALE UP, no detection AUC or threshold-based metric is given; for Neural Cleanse, the MAD table (Table 10) shows label 8 with a markedly lower MAD under regularization (47.73 vs. 80-244), which the paper does not address. Please provide a fuller evaluation or soften the claim.
  4. [Section 6.6 / Real-World Attacks] The real-world video experiment is described qualitatively; no frame counts, success rates, or trigger-selection details are reported. Consider adding quantitative results or moving this demonstration to the supplementary with specifics.
  5. [Section 3.2 / Appendix 6.3] The backdoor-suppression hypothesis is interesting, but the supporting evidence is indirect (adding borders to triggers increases ASR). A controlled test that directly manipulates suspected suppression features, or a per-sample analysis of the hypothesized suppression patterns, would strengthen the claim.

Circularity Check

1 steps flagged · score 6.0 of 10

The headline 'one pixel is all I need' claim reduces to the PASR metric's own success predicate: a per-sample white-box search over up to 1000 candidate single-pixel modifications is reported as a fixed single-pixel backdoor property.

  1. self definitional [Abstract; Section 4.2 'Probing Attacks'; Section 4.3 'Effectiveness of WorstViT']
    "This attack requires an extremely low poisoning rate, trains for just one epoch, and modifies a single pixel to successfully attack all validation images. [...] Within a set number of attempts, if the model's prediction for a sample can be changed to the target label by modifying just one pixel or one channel, the attack is considered successful."

    The paper's central 'one pixel' claim is exactly the success event used to define PASR. Section 4.2 explains that suitable quasi-triggers are found per input ('Typically, suitable quasi-triggers are found within 1000 trials'), with position and value chosen by PSDM or gradient ranking; Section 2.1 states 'our quasi-trigger is a single pixel without a fixed value that can appear anywhere in the image.' Thus the 100% PASR in Tables 1-5 reports that the per-sample white-box search found a one-pixel modification for each validation image, not that a fixed single-pixel trigger exists as a stable backdoor property.

full rationale

The backdoor training procedure itself is empirical and self-contained: WorstVIT poisons with a chosen poisoning rate, trains for one epoch, and reports clean accuracy, fixed-trigger ASR, and resistance to Fine-Pruning, SCALE UP, and Neural Cleanse. Those evaluations are not circular, and there is no load-bearing self-citation or imported uniqueness theorem. The circularity is confined to the headline 'one pixel' claim. The PASR metric (Section 4.3) defines success as finding, within a set number of attempts, a one-pixel or one-channel modification that changes the prediction to the target label; the probing protocol (Section 4.2) fits trigger position and value per input using gradients and PSDM. Reporting PASR=100% therefore means the per-sample search succeeded, which is the same event as the abstract's claim that the attack 'modifies a single pixel to successfully attack all validation images.' The title and framing 'one pixel is all I need' thus reduce to the metric's definition rather than an independent derived result. The PSDM's patch-like pattern and center-versus-edge trigger comparison are in-sample consistency checks on the same model from which the PSDM was computed, but they are not definitionally forced and are not the main load-bearing derivation. Overall, the attack's fixed-trigger ASR results stand on their own, but the headline one-pixel claim is partially circular because its reported success rate is, by construction, the metric that defines that claim.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central claim rests on several hand-picked constants (PSDM threshold, trigger centers, trial budget, image count) and on the assumption that white-box probing is the right threat model. The paper does not introduce new physical entities. The backdoor suppression pattern is a postulated mechanism, classified as an ad hoc assumption because it is not independently tested.

free parameters (6)
  • patch_contrast_threshold = 97920
    Value used in Section 4.1 to set the trigger pixel to black (patch sum > 97920) or white; chosen as half the maximum patch pixel sum.
  • psdm_trigger_center = (7,7) within patch
    Trigger placed at the center of a 16x16 patch, derived from the PSDM analysis (Section 4.1).
  • swin_psdm_trigger_coordinate = (108,209)
    Trigger location for Swin-ViT, taken as the maximum of the model's PSDM (Appendix 6.5).
  • probing_trial_budget = 1000
    Maximum number of quasi-trigger attempts per input in the probing attack (Section 4.2).
  • psdm_image_count = 1000
    Number of images used to compute the PSDM in the experiments (Appendix 6.1).
  • corner_response_keep_fraction = 0.5
    During training, trigger candidates are randomly selected from half of pixels with smaller corner response values (Section 4.1).
assumptions (4)
  • domain assumption ViT patch embedding weight sharing produces the patch-wise PSDM
    Used in Section 3.1 to explain why ViT sensitivity is higher at patch centers; the attack relies on this regularity.
  • domain assumption White-box access with iterative probing is a valid attack scenario
    Section 4.2 assumes the attacker can query the model and run up to 1000 gradient-guided trials per sample; the reported PASR depends on this.
  • ad hoc to paper Clean samples with partial trigger features cause learned backdoor suppression
    Section 3.2 introduces the backdoor suppression pattern as an explanation for failed attacks; this mechanism is not independently verified, and it motivates the contrast-based quasi-trigger.
  • domain assumption A single contrasting pixel can activate the backdoor in ViTs
    Section 4 assumes the contrast between one pixel and the rest of its patch is sufficient to activate the backdoor; this is shown only in the paper's specific training setups.

how reviews work

0 comments
Cite this review

Pith. "Pith review of One Pixel is All I Need." pith.science (2026). https://pith.science/paper/UAYNHIKA

@misc{pith2026241210681,
  author       = {Pith},
  title        = {Pith review of: One Pixel is All I Need},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UAYNHIKA}},
  note         = {Machine review of arXiv:2412.10681}
}
read the original abstract

Vision Transformers (ViTs) have achieved record-breaking performance in various visual tasks. However, concerns about their robustness against backdoor attacks have grown. Backdoor attacks involve associating a specific trigger with a target label, causing the model to predict the attacker-specified label when the trigger is present, while correctly identifying clean images.We found that ViTs exhibit higher attack success rates for quasi-triggers(patterns different from but similar to the original training triggers)compared to CNNs. Moreover, some backdoor features in clean samples can suppress the original trigger, making quasi-triggers more effective.To better understand and exploit these vulnerabilities, we developed a tool called the Perturbation Sensitivity Distribution Map (PSDM). PSDM computes and sums gradients over many inputs to show how sensitive the model is to small changes in the input. In ViTs, PSDM reveals a patch-like pattern where central pixels are more sensitive than edges. We use PSDM to guide the creation of quasi-triggers.Based on these findings, we designed "WorstVIT," a simple yet effective data poisoning backdoor for ViT models. This attack requires an extremely low poisoning rate, trains for just one epoch, and modifies a single pixel to successfully attack all validation images.

Figures

Figures reproduced from arXiv: 2412.10681 by the authors.

Figure 1
Figure 1. Perturbation Sensitivity Distribution Maps (PSDMs) for [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Quasi-triggers in Vision Transformers (ViTs) exhibit good transferability across different patches. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Attack Success Rate for Differrent Models. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: This image shows the attack effect on the WorstVIT model, with the triggers highlighted by red circles. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: PSDMs of VIT Models Trained with Different Methods [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Comparison of attack success rates (ASR) for WorstVIT triggers at different positions, including an original heatmap and a [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: attack failure samples for black and white square triggers. [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: PSDM of Swin Base Patch4 Window7 224. backdoor label being 5. We attempted to reverse-engineer the trigger and compute the MAD with and without regular￾ization of the mask matrix, but both attempts failed. Neural Cleanse was unable to reverse-engineer the trigger, dete…
Figure 9
Figure 9. Figure 9: All-to-all Attack. Red and blue represent clean accuracy and attack success rate, respectively. [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 24 canonical work pages

  1. [1]

    Reveal of vision transformers robustness against ad- versarial attacks

    Ahmed Aldahdooh, Wassim Hamidouche, and Olivier De- forges. Reveal of vision transformers robustness against ad- versarial attacks. arXiv preprint arXiv:2106.03734, 2021. 1

    arXiv 2021

  2. [2]

    Neural machine translation by jointly learning to align and translate

    Dzmitry Bahdanau. Neural machine translation by jointly learning to align and translate. arXiv preprint arXiv:1409.0473, 2014. 1

    arXiv 2014

  3. [3]

    Targeted attack against deep neural networks via flipping limited weight bits

    Jiawang Bai, Baoyuan Wu, Yong Zhang, Yiming Li, Zhifeng Li, and Shu-Tao Xia. Targeted attack against deep neural networks via flipping limited weight bits. arXiv preprint arXiv:2102.10496, 2021. 1, 3

    arXiv 2021

  4. [4]

    Adversarial robustness comparison of vision transformer and mlp-mixer to cnns

    Philipp Benz, Soomin Ham, Chaoning Zhang, Adil Karjauv, and In So Kweon. Adversarial robustness comparison of vision transformer and mlp-mixer to cnns. arXiv preprint arXiv:2110.02797, 2021. 4

    arXiv 2021

  5. [5]

    Targeted backdoor attacks on deep learning systems 7 using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems 7 using data poisoning. arXiv preprint arXiv:1712.05526 ,

    arXiv

  6. [6]

    Visformer: The vision-friendly transformer

    Zhengsu Chen, Lingxi Xie, Jianwei Niu, Xuefeng Liu, Longhui Wei, and Qi Tian. Visformer: The vision-friendly transformer. In Proceedings of the IEEE/CVF international conference on computer vision, pages 589–598, 2021. 3

    work page 2021

  7. [7]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018. 1

    arXiv 2018

  8. [8]

    Lira: Learnable, imperceptible and robust backdoor attacks

    Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pages 11966–11976, 2021. 3

    work page 2021

Show all 51 references
  1. [9]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020. 1, 3

    2010 arXiv

  2. [10]

    Fiba: Frequency-injection based backdoor attack in medical image analysis

    Yu Feng, Benteng Ma, Jing Zhang, Shanshan Zhao, Yong Xia, and Dacheng Tao. Fiba: Frequency-injection based backdoor attack in medical image analysis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 20876–20885, 2022. 3

    2022

  3. [11]

    Backdoor attack on hash-based image retrieval via clean-label data poisoning

    Kuofeng Gao, Jiawang Bai, Bin Chen, Dongxian Wu, and Shu-Tao Xia. Backdoor attack on hash-based image retrieval via clean-label data poisoning. arXiv preprint arXiv:2109.08868, 2021. 1, 3

    2021 arXiv

  4. [12]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 1

    2014 arXiv

  5. [13]

    Bad- nets: Identifying vulnerabilities in the machine learning model supply chain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Bad- nets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017. 1, 3

    2017 arXiv

  6. [14]

    Scale-up: An efficient black-box input- level backdoor detection via analyzing scaled prediction con- sistency

    Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. Scale-up: An efficient black-box input- level backdoor detection via analyzing scaled prediction con- sistency. arXiv preprint arXiv:2302.03251, 2023. 3, 7

    2023 arXiv

  7. [15]

    Transformer in transformer

    Kai Han, An Xiao, Enhua Wu, Jianyuan Guo, Chunjing Xu, and Yunhe Wang. Transformer in transformer. Advances in neural information processing systems, 34:15908–15919,

  8. [16]

    Rethinking spa- tial dimensions of vision transformers

    Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spa- tial dimensions of vision transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pages 11936–11945, 2021. 3

    2021

  9. [17]

    Albert: A lite bert for self-supervised learning of language representations

    Z Lan. Albert: A lite bert for self-supervised learning of language representations. arXiv preprint arXiv:1909.11942,

    1909 arXiv

  10. [18]

    Nearest is not dearest: Towards practical defense against quantization-conditioned backdoor attacks

    Boheng Li, Yishuo Cai, Haowei Li, Feng Xue, Zhifeng Li, and Yiming Li. Nearest is not dearest: Towards practical defense against quantization-conditioned backdoor attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24523–24533, 2024. 3

    2024

  11. [19]

    Rethinking the trigger of back- door attack

    Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia. Rethinking the trigger of back- door attack. arXiv preprint arXiv:2004.04692, 2020. 4, 5

    2004 arXiv

  12. [20]

    Back- door learning: A survey

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Back- door learning: A survey. IEEE Transactions on Neural Net- works and Learning Systems, 35(1):5–22, 2022. 3

    2022

  13. [21]

    Efficientformer: Vision transformers at mobilenet speed

    Yanyu Li, Geng Yuan, Yang Wen, Ju Hu, Georgios Evan- gelidis, Sergey Tulyakov, Yanzhi Wang, and Jian Ren. Efficientformer: Vision transformers at mobilenet speed. Advances in Neural Information Processing Systems , 35: 12934–12949, 2022. 1

    2022

  14. [22]

    Imperceptible transfer attack and defense on 3d point cloud classification

    Daizong Liu and Wei Hu. Imperceptible transfer attack and defense on 3d point cloud classification. IEEE transactions on pattern analysis and machine intelligence , 45(4):4727– 4746, 2022. 1

    2022

  15. [23]

    Fine- pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses , pages 273–294. Springer,

  16. [24]

    Beating backdoor attack at its own game

    Min Liu, Alberto Sangiovanni-Vincentelli, and Xiangyu Yue. Beating backdoor attack at its own game. In Proceed- ings of the IEEE/CVF International Conference on Com- puter Vision, pages 4620–4629, 2023. 4

    2023

  17. [25]

    Roberta: A robustly optimized bert pretraining approach

    Yinhan Liu. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692, 364, 2019. 1

    1907 arXiv

  18. [26]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021. 1, 3

    2021

  19. [27]

    Transxnet: learning both global and local dynamics with a dual dynamic token mixer for visual recognition

    Meng Lou, Hong-Yu Zhou, Sibei Yang, and Yizhou Yu. Transxnet: learning both global and local dynamics with a dual dynamic token mixer for visual recognition. arXiv preprint arXiv:2310.19380, 2023. 3

    2023 arXiv

  20. [28]

    On the robustness of vision transformers to adversarial ex- amples

    Kaleel Mahmood, Rigel Mahmood, and Marten Van Dijk. On the robustness of vision transformers to adversarial ex- amples. In Proceedings of the IEEE/CVF international con- ference on computer vision, pages 7838–7847, 2021. 1

    2021

  21. [29]

    Hidden trigger backdoor attacks

    Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pir- siavash. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence, pages 11957– 11965, 2020. 1, 3

    2020

  22. [30]

    Grad-cam: Visual explanations from deep networks via gradient-based localization

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE in- ternational conference on computer vision , pages 618–626,

  23. [31]

    Smoothgrad: removing noise by adding noise

    Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda Vi ´egas, and Martin Wattenberg. Smoothgrad: removing noise by adding noise. arXiv preprint arXiv:1706.03825, 2017. 2, 3

    2017 arXiv

  24. [32]

    Segmenter: Transformer for semantic segmenta- tion

    Robin Strudel, Ricardo Garcia, Ivan Laptev, and Cordelia Schmid. Segmenter: Transformer for semantic segmenta- tion. In Proceedings of the IEEE/CVF international confer- ence on computer vision, pages 7262–7272, 2021. 1

    2021

  25. [33]

    One pixel attack for fooling deep neural networks

    Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828–841,

  26. [34]

    Backdoor attacks on crowd counting

    Yuhua Sun, Tailai Zhang, Xingjun Ma, Pan Zhou, Jian Lou, Zichuan Xu, Xing Di, Yu Cheng, and Lichao Sun. Backdoor attacks on crowd counting. In Proceedings of the 30th ACM International Conference on Multimedia, pages 5351–5360,

  27. [35]

    Intriguing properties of neural networks

    C Szegedy. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 1

    2013 arXiv

  28. [36]

    Training data-efficient image transformers & distillation through at- tention

    Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Herv ´e J´egou. Training data-efficient image transformers & distillation through at- tention. In International conference on machine learning , pages 10347–10357. PMLR, 2021. 1, 3

    2021

  29. [37]

    Attention is all you need

    A Vaswani. Attention is all you need. Advances in Neural Information Processing Systems, 2017. 1, 3

    2017

  30. [38]

    Neural cleanse: Identifying and mitigating backdoor attacks in neu- ral networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bi- mal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neu- ral networks. In 2019 IEEE symposium on security and pri- vacy (SP), pages 707–723. IEEE, 2019. 3, 7

    2019

  31. [39]

    Pyramid vision transformer: A versatile backbone for dense prediction without convolutions

    Wenhai Wang, Enze Xie, Xiang Li, Deng-Ping Fan, Kaitao Song, Ding Liang, Tong Lu, Ping Luo, and Ling Shao. Pyramid vision transformer: A versatile backbone for dense prediction without convolutions. In Proceedings of the IEEE/CVF international conference on computer vision , p...

    2021

  32. [40]

    Early convolutions help trans- formers see better

    Tete Xiao, Mannat Singh, Eric Mintun, Trevor Darrell, Piotr Doll´ar, and Ross Girshick. Early convolutions help trans- formers see better. Advances in neural information process- ing systems, 34:30392–30400, 2021. 3

    2021

  33. [41]

    Not all prompts are secure: A switch- able backdoor attack against pre-trained vision transfomers

    Sheng Yang, Jiawang Bai, Kuofeng Gao, Yong Yang, Yiming Li, and Shu-Tao Xia. Not all prompts are secure: A switch- able backdoor attack against pre-trained vision transfomers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24431–244...

    2024

  34. [42]

    Gpt (generative pre-trained transformer)–a comprehensive review on enabling technolo- gies, potential applications, emerging challenges, and future directions

    Gokul Yenduri, M Ramalingam, G Chemmalar Selvi, Y Supriya, Gautam Srivastava, Praveen Kumar Reddy Mad- dikunta, G Deepti Raj, Rutvij H Jhaveri, B Prabadevi, Weizheng Wang, et al. Gpt (generative pre-trained transformer)–a comprehensive review on enabling technolo- gies, potent...

    2024

  35. [43]

    Enhanced coalescence backdoor attack against dnn based on pixel gradient

    Jianyao Yin, Honglong Chen, Junjian Li, and Yudong Gao. Enhanced coalescence backdoor attack against dnn based on pixel gradient. Neural Processing Letters, 56(2):114, 2024. 3

    2024

  36. [44]

    Backdoor attacks against deep image compression via adaptive frequency trigger

    Yi Yu, Yufei Wang, Wenhan Yang, Shijian Lu, Yap-Peng Tan, and Alex C Kot. Backdoor attacks against deep image compression via adaptive frequency trigger. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 12250–12259, 2023. 3

    2023

  37. [45]

    Tokens-to-token vit: Training vision transformers from scratch on imagenet

    Li Yuan, Yunpeng Chen, Tao Wang, Weihao Yu, Yujun Shi, Zi-Hang Jiang, Francis EH Tay, Jiashi Feng, and Shuicheng Yan. Tokens-to-token vit: Training vision transformers from scratch on imagenet. In Proceedings of the IEEE/CVF in- ternational conference on computer vision , page...

  38. [46]

    Zenghui Yuan, Pan Zhou, Kai Zou, and Yu Cheng. You are catching my attention: Are vision transformers bad learners under backdoor attacks? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 24605–24615, 2023. 3

    2023

  39. [47]

    Informer: Beyond efficient transformer for long sequence time-series forecast- ing

    Haoyi Zhou, Shanghang Zhang, Jieqi Peng, Shuai Zhang, Jianxin Li, Hui Xiong, and Wancai Zhang. Informer: Beyond efficient transformer for long sequence time-series forecast- ing. In Proceedings of the AAAI conference on artificial in- telligence, pages 11106–11115, 2021. 1 9 O...

    2021

  40. [48]

    • Impact of PSDM on Backdoor Patterns: Based on the PSDM of the VIT model, we traversed multiple patches along the diagonal and placed a white square trigger of size 4 for training

    Table of Contents Following the order of the reference appendix in the main paper, we have listed the following seven experiments and their results: • Obtaining a Perturbation Sensitivity Distribution Map (PSDM): This includes displaying the PSDMs of various models and the ini...

  41. [49]

    Lclean = E(x,y)∼Dclean [ℓ(f (x), y)] (1)

    Clean Task: Minimize the loss on clean images. Lclean = E(x,y)∼Dclean [ℓ(f (x), y)] (1)

  42. [50]

    Lbackdoor = E(x,y)∼Dbackdoor [ℓ(f (x + t), ybackdoor)] (2)

    Backdoor Task: Minimize the backdoor loss when the image contains a trigger and the label is the backdoor label. Lbackdoor = E(x,y)∼Dbackdoor [ℓ(f (x + t), ybackdoor)] (2)

  43. [51]

    Lsuppression = E(x,y)∼Dpartial [ℓ(f (x + tpartial), yclean)] (3) The model does not always learn the backdoor suppres- sion mode effectively

    Suppression Mode: When the image contains partial backdoor features (i.e., quasi-triggers) but the label is the clean label, suppress the backdoor and minimize the clean task loss. Lsuppression = E(x,y)∼Dpartial [ℓ(f (x + tpartial), yclean)] (3) The model does not always learn...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.