Pith. sign in

REVIEW 4 major objections 5 minor 32 references

Protego: Detecting Adversarial Examples for Vision Transformers via Intrinsic Capabilities

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes PROTEGO, a one-layer linear detector trained on the difference between adversarial and clean [CLS]-token features, and reports AUC above 0.95 for six attack types on three ViT models.

desk verdict Protego's detector feature requires knowing the ground-truth label (Eq. 6), so the reported AUCs are a label-leakage artifact, not valid detection performance. read the letter →

arxiv 2501.07044 v1 pith:F4AXBUCK submitted 2025-01-13 cs.CV cs.LG

Jialin Wu , Kaikai Pan , Yanjiao Chen , Jiangyi Deng , Shengyuan Pang , Wenyuan Xu This is my paper · ORCID
classification cs.CVcs.LG
keywords adversarialexampledetectionVisionTransformerCLStokenfeaturesattentionrolloutplug-indetectorImageNetattacks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PROTEGO claims that a vision transformer's own [CLS] token, the learned representation that summarizes an entire image for classification, carries a detectable difference between adversarial and normal inputs. By subtracting the clean token features from the adversarial token features and training a single linear layer on that difference, the paper reports AUC scores above 0.95 for all six tested attacks (PGD, FGSM, BIM, CW, MIM, and Patch-fool) on three pre-trained ViT models (ViT-B-16, ViT-B-32, and DeiT-Tiny), with several settings reaching AUC 1.0. If correct, this gives ViT-based systems a cheap, plug-in detector that needs no classifier retraining and no external feature extractor, which matters as ViTs become the visual backbone for multimodal and metaverse applications.

What carries the argument

The central object is the [CLS] token feature vector extracted from the final transformer encoder layer, which the paper treats as a summary of all input information. The key operation is features_noise = D_adv(x) - D_clean(x), the per-sample difference between adversarial and clean feature vectors, followed by a flattening step and a one-layer linear classifier trained with cross-entropy and SGD with momentum. Attention rollout and gradient attention rollout are used as interpretability tools to show that adversarial examples concentrate attention on image edges rather than object parts, motivating why the feature-space difference is learnable.

What would settle it

Use the same one-layer detector but replace each adversarial input's clean reference with the model's average clean [CLS] feature (or a clean feature from a different image), and compare the AUC; a large drop would show the reported detection relied on the paired clean-adversarial comparison rather than on a property intrinsic to adversarial examples.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial perturbations leave a consistent, learnable trace in the [CLS] token features, isolated by Eq. (6) as features_noise = D_adv(x) - D_clean(x), and that a one-layer linear network trained on this difference separates adversarial from clean examples. In Table IV, AUC exceeds 0.95 in all eighteen model-attack combinations and reaches 1.0 in several cases, including FGSM on ViT-B-16 and PGD and FGSM on DeiT-Tiny. The paper further uses attention rollout and gradient attention rollout to argue that adversarial inputs shift the model's attention from semantically meaningful regions to image edges, which is presented as the intrinsic reason the feature difference exists.

Load-bearing premise

The load-bearing premise is that a real detector can obtain the clean feature D_clean(x) for the same input x whose adversarial version arrives at test time, because Eq. (6) needs both; without paired clean-adversarial features, the high reported AUCs may not transfer to deployment.

Editorial extensions

If this is right

  • A plug-in detector can be added to any of the three ViT backbones without retraining the classifier or changing the image pipeline.
  • The high AUCs imply that a simple threshold on the detector's output can reject most adversarial inputs while keeping nearly all clean inputs for the evaluated attack settings.
  • If the attention-shift explanation is correct, defenses could be designed around the [CLS] token's feature geometry rather than around input preprocessing or classifier hardening.
  • The reported numbers are specific to ImageNet validation images, so applying PROTEGO elsewhere would require re-running the feature-difference training on that domain's data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The evaluation protocol matters for interpreting these results: if D_clean(x) in Eq. (6) comes from the same image that is then attacked, the detector is effectively handed the label, because the clean and adversarial features are paired per sample; a deployment-grade test would need a clean reference that is not the test image.
  • The paper's own discussion section concedes that the subtraction feature is not applicable in many cases; a natural extension would be to replace the per-sample clean reference with a model-level clean feature distribution and measure the resulting AUC drop.
  • A direct cross-model transfer experiment, training on one ViT's features and testing on another without retraining, would clarify whether the detected trace is intrinsic to adversarial examples or specific to each model's feature space.
  • Perfect AUCs in some settings raise the question of whether the detector separates the attack method rather than adversariality in general; training on five attack types and testing on the sixth would test that.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes PROTEGO, a detection framework for adversarial examples on Vision Transformers (ViTs). The method extracts [CLS]-token features from a chosen transformer layer, computes the difference between the features of adversarial and clean versions of the same input, and trains a one-layer linear classifier on this difference. Experiments on ImageNet-val with three ViT models and six attack types report AUC values above 0.95, including several perfect scores of 1.0. The paper also presents attention-rollout visualizations to motivate the approach.

Significance. If the proposed feature were computable at inference time without knowledge of the ground-truth label, the high AUC values would constitute a strong result for ViT security. The paper also contributes an interpretability analysis of adversarial examples via attention rollout. However, the central feature definition (Eq. 6) appears to require pairing each adversarial input with its clean source, which is precisely the label information a detector lacks at test time. The paper's own limitation statement in Section V-A concedes that 'this method is not applicable' in many cases, but no alternative inference-time procedure is provided. As a result, the reported detection performance is not a valid measure of adversarial-example detection ability.

major comments (4)
  1. [Section III-A, Eq. (6)] The feature used by the detector is defined as features_noise = D_adv(x) - D_clean(x). At inference time, an input x arrives without a paired clean version. If x is adversarial, D_clean(x) is the feature of the original unperturbed image, which the detector does not know; if x is clean, D_adv(x) is undefined. The only way to compute this feature is to know whether x is adversarial, i.e., to have the ground-truth label. The evaluation in Section IV therefore appears to pair each adversarial example with its clean source on ImageNet-val, leaking the label into the feature and making the AUC in Table IV an artifact of this pairing rather than a valid detection metric. The paper's own limitation statement in Section V-A admits the method 'is not applicable' in many cases, but no alternative test-time procedure is given.
  2. [Section IV-C, Table IV] The experimental comparison is limited to a single baseline (LID), with no error bars, no multiple runs, and no statistical significance tests. The perfect AUC values (e.g., 1.0 for FGSM on ViT-B-16 and for PGD on DeiT-Tiny) are reported without any variance analysis, which is particularly concerning given that the detector is a single linear layer trained on a feature that appears to encode the label. The claim of 'superior performance than existing detection methods' is not supported by a comparison with only one baseline, and the baseline's parameters (number of neighbors set to 10) are not justified.
  3. [Section V-A] The limitation statement that feature subtraction 'in many cases, this method is not applicable' directly contradicts the paper's framing of PROTEGO as a 'universal' and 'plug-in' detector (contribution list in Section I). This is not merely a scope limitation; it reflects the fundamental requirement of paired clean-adversarial data, which is unavailable in any realistic deployment scenario. The discussion does not propose a remedy, so the central detection claim is not defensible.
  4. [Section II-C] The paper claims that 'our method can effectively withstand adaptive attacks and defend against previously unseen attack methods,' but no adaptive attacks are evaluated and the only unseen attack considered is Patch-fool, which is still within the same threat model of known perturbation methods. This claim is unsupported by the experiments in Section IV.
minor comments (5)
  1. [Throughout] The manuscript contains numerous typographical and grammatical errors, for example 'performace' (Section IV-A), 'The Protego is a charm' (Figure 1 caption), and inconsistent use of 'self-guard' versus 'PROTEGO' (Section I). These should be corrected.
  2. [Section IV-C] The text states that the comparison includes 'feature squeezing(FS) and local intrinsic dimensionality(LID),' but Table IV only reports LID and Ours; feature squeezing results are missing.
  3. [Section III-A] The choice of the feature extraction layer (b1 from the encoder output) is not justified experimentally. The paper does not report results for features extracted from different layers, even though this is a free parameter that could affect detection performance.
  4. [Section IV-A] The paper does not provide details on the size of the training set for the detector, the split between training and test data, or the number of samples per attack. This impairs reproducibility.
  5. [Section V] The paper acknowledges lack of transferability between models and datasets but does not report any transfer experiments; this is listed as a limitation but the absence of quantitative evidence is not discussed in the main evaluation.

Circularity Check

1 steps flagged · score 8.0 of 10

Protego's detector input is D_adv(x) − D_clean(x), so its high AUC is an artifact of label-paired features rather than a valid detection result.

  1. self definitional [Section III-A, Equation (6); evaluated in Section IV-C, Table IV]
    "We extract the matrix b1 from the encoder’s output by inputting normal examples and adversarial examples, successively. This matrix serves as the feature distribution required for our training, denoted as Dclean(x) and Dadv(x). ... featuresnoise = Dadv(x) − Dclean(x) (6) featuresnoise represents the distinguishing features of the adversarial examples."

    The input to the detector is defined as the difference between the feature of an adversarial image and the feature of its clean counterpart. At inference time, a detector receives only one unlabeled query x; it cannot know D_adv(x) for a clean input or D_clean(x) for an adversarial input without already knowing the ground-truth label. In the ImageNet-val evaluation, each adversarial example is generated from a known clean image, so the protocol supplies the pairing that makes Equation (6) computable. The resulting feature is nonzero precisely when the label is 'adversarial', so the linear detector is separating the label from a feature that already encodes it. The AUC values in Table IV, including perfect 1.0, are therefore forced by construction rather than measuring detection ability.

full rationale

The central claim of Protego is that a one-layer linear detector achieves AUC > 0.95, often 1.0, on six attacks. The derivation chain is short: extract the [CLS]-token feature of a normal image, extract the [CLS]-token feature of the adversarial version of the same image, subtract them, and train a linear layer on that difference. The circularity is in the input construction: Equation (6) can be computed only when the clean/adversarial pairing is known, which is exactly the label information the detector is supposed to infer. On a real query, D_clean(x) for an adversarial input and D_adv(x) for a clean input are undefined or unavailable, so the reported evaluation protocol leaks the label into the feature. This is not a case of self-citation or borrowed uniqueness; it is a definitional collapse of the predicted quantity into the input. The paper's own limitation statement confirms the method is not generally applicable. The attack-success measurements and attention-visualization observations are independent, but the headline detection result reduces by construction, warranting a score of 8.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical or conceptual entities. The free parameters are the underspecified layer choice and detector hyperparameters. The core axioms are heuristic claims about ViT features and adversarial differences that the central method relies on without proof.

free parameters (2)
  • Feature extraction layer index for b1
    The paper states the encoder's output or 'a specific layer' is used (Section III-A), but does not specify which layer's [CLS] token output is taken. The choice is likely selected empirically and is not given.
  • Detector training hyperparameters
    Learning rate, number of epochs, batch size, and optimizer details for the linear detector are not reported, so the detector training procedure is underspecified.
assumptions (3)
  • domain assumption The [CLS] token (b1) contains all the information from the input sample
    Invoked in Section III-A on the basis of the attention mechanism, but treated as an unproven heuristic rather than a demonstrated property.
  • domain assumption The difference between adversarial and clean features is a sufficient and generalizable discriminator
    Eq. (6) defines features_noise as this difference, and all subsequent results depend on it. No theoretical or empirical justification is given for its generalization beyond the paired training set.
  • domain assumption Attention regions for adversarial examples differ systematically from normal examples
    Mentioned in the abstract and Section III-C as motivation, but the visualization results are anecdotal and not used as a formal building block.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Protego: Detecting Adversarial Examples for Vision Transformers via Intrinsic Capabilities." pith.science (2026). https://pith.science/paper/F4AXBUCK

@misc{pith2026250107044,
  author       = {Pith},
  title        = {Pith review of: Protego: Detecting Adversarial Examples for Vision Transformers via Intrinsic Capabilities},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/F4AXBUCK}},
  note         = {Machine review of arXiv:2501.07044}
}
read the original abstract

Transformer models have excelled in natural language tasks, prompting the vision community to explore their implementation in computer vision problems. However, these models are still influenced by adversarial examples. In this paper, we investigate the attack capabilities of six common adversarial attacks on three pretrained ViT models to reveal the vulnerability of ViT models. To understand and analyse the bias in neural network decisions when the input is adversarial, we use two visualisation techniques that are attention rollout and grad attention rollout. To prevent ViT models from adversarial attack, we propose Protego, a detection framework that leverages the transformer intrinsic capabilities to detection adversarial examples of ViT models. Nonetheless, this is challenging due to a diversity of attack strategies that may be adopted by adversaries. Inspired by the attention mechanism, we know that the token of prediction contains all the information from the input sample. Additionally, the attention region for adversarial examples differs from that of normal examples. Given these points, we can train a detector that achieves superior performance than existing detection methods to identify adversarial examples. Our experiments have demonstrated the high effectiveness of our detection method. For these six adversarial attack methods, our detector's AUC scores all exceed 0.95. Protego may advance investigations in metaverse security.

Figures

Figures reproduced from arXiv: 2501.07044 by the authors.

Figure 1
Figure 1. Security issues in the computer vision domain within the metaverse. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The architecture of Vision Transformer, and the attention mechanism [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Framework of PROTEGO. The detector is trained on the features in the transformer and can be inserted into the layer that extracts the features of the transformer block. We use Cross Entropy Loss to update parameters, and it is denoted as L : LCE = − 1 N X N i=1 [yi · log(ˆyi) + (1 − yi) · log(1 − yˆi)] (12) vt = β · vt−1 + (1 − β) · ∇θL (13) θ = θ − α · vt (14) In equation (12), N represents the number of examples, … view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Attack effectiveness for three ViT models. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: The results obtained using the attention rollout method and the grad attention rollout method on normal examples. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: The results obtained using the attention rollout method and the grad attention rollout method on adversarial examples. [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 21 canonical work pages

  1. [1]

    Artificial intelligence for the metaverse: A survey[J]

    Huynh-The T, Pham Q V , Pham X Q, et al. Artificial intelligence for the metaverse: A survey[J]. Engineering Applications of Artificial Intelligence, 2023, 117: 105581

    work page 2023

  2. [2]

    A survey on metaverse: Fundamentals, security, and privacy[J]

    Wang Y , Su Z, Zhang N, et al. A survey on metaverse: Fundamentals, security, and privacy[J]. IEEE Communications Surveys & Tutorials, 2022, 25(1): 319-352

    work page 2022

  3. [3]

    A survey on vision transformer[J]

    Han K, Wang Y , Chen H, et al. A survey on vision transformer[J]. IEEE transactions on pattern analysis and machine intelligence, 2022, 45(1): 87-110

    work page 2022

  4. [4]

    Attention is all you need[J]

    Vaswani A, Shazeer N, Parmar N, et al. Attention is all you need[J]. Advances in neural information processing systems, 2017, 30

    2017

  5. [5]

    Scaling vision transform- ers to 22 billion parameters[C]//International Conference on Machine Learning

    Dehghani M, Djolonga J, Mustafa B, et al. Scaling vision transform- ers to 22 billion parameters[C]//International Conference on Machine Learning. PMLR, 2023: 7480-7512

    work page 2023

  6. [6]

    An image is worth 16x16 words: Transformers for image recognition at scale[J]

    Dosovitskiy A, Beyer L, Kolesnikov A, et al. An image is worth 16x16 words: Transformers for image recognition at scale[J]. arXiv preprint arXiv:2010.11929, 2020

    arXiv 2010

  7. [7]

    ”Towards robust vision transformer.” Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recogni- tion

    Mao, Xiaofeng, et al. ”Towards robust vision transformer.” Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recogni- tion. 2022

    work page 2022

  8. [8]

    ”Scalable diffusion models with transformers.” Proceedings of the IEEE/CVF International Conference on Computer Vision

    Peebles, William, and Saining Xie. ”Scalable diffusion models with transformers.” Proceedings of the IEEE/CVF International Conference on Computer Vision. 2023

    work page 2023

Show all 32 references
  1. [9]

    Towards transferable adversarial attacks on vision transformers[C]//Proceedings of the AAAI Conference on Artificial Intelligence

    Wei Z, Chen J, Goldblum M, et al. Towards transferable adversarial attacks on vision transformers[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2022, 36(3): 2668-2676

    2022

  2. [10]

    Transformers in vision: A survey[J]

    Khan S, Naseer M, Hayat M, et al. Transformers in vision: A survey[J]. ACM computing surveys (CSUR), 2022, 54(10s): 1-41

    2022

  3. [11]

    (2021, July)

    Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., & J ´egou, H. (2021, July). Training data-efficient image transformers & distillation through attention. In International conference on machine learning (pp. 10347-10357). PMLR

    2021

  4. [12]

    & Guo, B

    Liu, Z., Lin, Y ., Cao, Y ., Hu, H., Wei, Y ., Zhang, Z., ... & Guo, B. (2021). Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision (pp. 10012-10022)

    2021

  5. [13]

    Transformer in transformer[J]

    Han K, Xiao A, Wu E, et al. Transformer in transformer[J]. Advances in neural information processing systems, 2021, 34: 15908-15919

    2021

  6. [14]

    Twins: Revisiting the design of spatial attention in vision transformers[J]

    Chu X, Tian Z, Wang Y , et al. Twins: Revisiting the design of spatial attention in vision transformers[J]. Advances in neural information processing systems, 2021, 34: 9355-9366

    2021

  7. [16]

    J., & Bengio, S

    Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018). Adversarial exam- ples in the physical world. In Artificial intelligence safety and security (pp. 99-112). Chapman and Hall/CRC

    2018

  8. [18]

    Dong, Y ., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018). Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 9185- 9193)

    2018

  9. [19]

    B., & Swami, A

    Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017, April). Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security (pp. 506-519)

    2017

  10. [20]

    Feature squeezing: Detecting adversarial examples in deep neural networks[J]

    Xu W, Evans D, Qi Y . Feature squeezing: Detecting adversarial examples in deep neural networks[J]. arXiv preprint arXiv:1704.01155, 2017

    2017 arXiv

  11. [21]

    Characterizing adversarial subspaces using local intrinsic dimensionality[J]

    Ma X, Li B, Wang Y , et al. Characterizing adversarial subspaces using local intrinsic dimensionality[J]. arXiv preprint arXiv:1801.02613, 2018

    2018 arXiv

  12. [22]

    Detecting adversarial samples from artifacts[J]

    Feinman R, Curtin R R, Shintre S, et al. Detecting adversarial samples from artifacts[J]. arXiv preprint arXiv:1703.00410, 2017

    2017 arXiv

  13. [23]

    J., Li, K., & Fei-Fei, L

    Deng, J., Dong, W., Socher, R., Li, L. J., Li, K., & Fei-Fei, L. (2009, June). Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition (pp. 248- 255). Ieee

    2009

  14. [24]

    Vision transformer for small-size datasets[J]

    Lee S H, Lee S, Song B C. Vision transformer for small-size datasets[J]. arXiv preprint arXiv:2112.13492, 2021

    2021 arXiv

  15. [25]

    Review of artificial intelligence adversarial attack and defense technologies[J]

    Qiu S, Liu Q, Zhou S, et al. Review of artificial intelligence adversarial attack and defense technologies[J]. Applied Sciences, 2019, 9(5): 909

    2019

  16. [26]

    Adversarial attacks and defences: A survey[J]

    Chakraborty A, Alam M, Dey V , et al. Adversarial attacks and defences: A survey[J]. arXiv preprint arXiv:1810.00069, 2018

    2018 arXiv

  17. [27]

    Threat of adversarial attacks on deep learning in computer vision: A survey[J]

    Akhtar N, Mian A. Threat of adversarial attacks on deep learning in computer vision: A survey[J]. Ieee Access, 2018, 6: 14410-14430

    2018

  18. [28]

    Interpreting adversarial examples in deep learning: A review[J]

    Han S, Lin C, Shen C, et al. Interpreting adversarial examples in deep learning: A review[J]. ACM Computing Surveys, 2023, 55(14s): 1-38

    2023

  19. [29]

    Quantifying attention flow in transformers[J]

    Abnar S, Zuidema W. Quantifying attention flow in transformers[J]. arXiv preprint arXiv:2005.00928, 2020

    2005 arXiv

  20. [30]

    Chefer, H., Gur, S., & Wolf, L. (2021). Transformer interpretability beyond attention visualization. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition (pp. 782-791)

    2021

  21. [31]

    (2017, May)

    Carlini, N., & Wagner, D. (2017, May). Towards evaluating the robust- ness of neural networks. In 2017 ieee symposium on security and privacy (sp) (pp. 39-57). Ieee

    2017

  22. [32]

    Explaining and harnessing adver- sarial examples[J]

    Goodfellow I J, Shlens J, Szegedy C. Explaining and harnessing adver- sarial examples[J]. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  23. [33]

    Towards deep learning models resistant to adversarial attacks[J]

    Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks[J]. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  24. [34]

    Adversarial logit pairing[J]

    Kannan H, Kurakin A, Goodfellow I. Adversarial logit pairing[J]. arXiv preprint arXiv:1803.06373, 2018

    2018 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.