Pith. sign in

REVIEW 5 major objections 6 minor 42 references

Breaking the Illusion of Security via Interpretation: Interpretable Vision Transformer Systems under Attack

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a dual-objective attack named AdViT can mislead both vision transformer classifiers and their coupled interpretation models, reporting 100% attack success in its white-box and black-box experiments while keeping…

desk verdict Useful white-box attack on ViT interpretable systems, but the 100% black-box claim is contradicted by the paper's own tables and the MGA's interpretability factor is underspecified. read the letter →

arxiv 2507.14248 v1 pith:G5UJWN67 submitted 2025-07-18 cs.CR cs.AIcs.CVcs.LG

Eldor Abdukhamidov , Mohammed Abuhamad , Simon S. Woo , Hyoungshick Kim , Tamer Abuhmed This is my paper
classification cs.CRcs.AIcs.CVcs.LG
keywords visiontransformersadversarialattackinterpretationmodelsinterpretabledeeplearningsystemswhite-boxblack-boxgeneticalgorithmtransferability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

AdViT is an adversarial attack aimed at vision-transformer systems that pair a classifier with an interpretation model. The paper's central claim is that an attacker who optimizes two losses at once—one to force misclassification and one to keep the explanation map close to the original—can defeat both components, and that this works in white-box and black-box settings. If true, this would undercut the assumption that interpretability acts as a safety net: explanation maps that look faithful would coexist with confident wrong predictions. The authors support the claim with experiments on nine transformer classifiers, two transformer-based interpreters, real-world API models, and several defenses.

What carries the argument

The load-bearing mechanism is the shared classification head $g$: a Norm-plus-MLP head attached to each transformer block $f_i$, producing partial logits $F_j = f_1 \circ \cdots \circ f_j \circ g$ for every prefix of the network. These partial logits feed a classification loss that combines misclassification pressure across every block rather than relying only on the final head. The interpretation loss then penalizes the weighted squared difference between adversarial and benign attribution maps. For black-box settings, the same machinery is reused as the initialization of a mutation-based genetic algorithm (MGA) that evolves the adversarial sample until the target model misclassifies it.

What would settle it

Measure the top-1 accuracy of each partial model $F_j = f_1 \circ \cdots \circ f_j \circ g$ on benign ImageNet images for Swin, T2T-ViT, and ViT models. If any $F_j$ scores near chance before training $g$, or if training $g$ changes the attack success substantially, then the shared head is not faithfully extracting block-level discriminative information and the reported white-box success cannot be attributed to the proposed mechanism.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the interaction between a transformer and its interpreter is itself an attack surface. AdViT attaches a shared classification head to every intermediate transformer block, so the attack loss can push every block's output toward a wrong class, while a second term in the loss drives the adversarial attribution map toward the benign one. The paper reports that this dual objective reaches 100% attack success in white-box settings and, after a mutation-based genetic algorithm improves transferability, in the black-box settings they test; misclassification confidence reaches up to 98% white-box and 76% black-box. The interpretation maps produced by the attack achieve IoU scores above 0.8 against benign maps, which the paper presents as the reason interpretation-based defenses fail to flag the samples.

Load-bearing premise

The load-bearing premise is that a single shared classification head can be attached to every intermediate transformer block and yield meaningful class scores; if that head is incompatible with a block's output shape or yields essentially random predictions, the block-level loss that drives AdViT is not a well-defined objective.

Editorial extensions

If this is right

  • Coupling a ViT with an interpreter does not, by itself, make the system adversarially robust; an attacker who optimizes for interpretation similarity can maintain plausible explanations alongside confident misclassifications.
  • Interpretation-based defenses that compare an input's attribution map to an expected map will miss AdViT samples, since IoU against benign maps stays above 0.8 in the reported experiments.
  • Black-box attacks on ViT systems are practical with query budgets on the order of a few hundred: AdViT reaches 100% success on ViT-B in about 152 queries in the paper's MGA experiments.
  • Common input preprocessing defenses (R&P, bit-depth reduction, median smoothing) and adversarial training do not stop the transferable version of the attack, with reported success rates between 0.80 and 0.97.
  • An ensemble detector that stacks interpretation maps from two interpreters and classifies them with EfficientNet plus gradient boosting detects the adversarial samples up to 80% of the time, suggesting a partial rather than complete defense.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Not tested in the paper: the dual-objective loss is not transformer-specific, since it only needs an attribution map and a classifier, so the same formulation should transfer to CNN-interpreter pairs such as Grad-CAM; testing that would reveal whether the vulnerability is a property of ViT-based systems or of interpretation-guided attacks generally.
  • Because transfer rates between different architectural families are much lower than within a family in Table III, a practical black-box attacker would likely need a portfolio of surrogate models rather than a single source.
  • IoU between adversarial and benign maps measures self-consistency, not faithfulness to the true object: two equally wrong maps can score high IoU, so a stricter evaluation against ground-truth regions would clarify how deceptive the preserved explanations actually are.
  • The paper's detection experiment uses attribution maps from only two interpreters; an attacker who optimizes against those two at generation time might evade the ensemble, leaving it open whether the 80% detection rate survives an adaptive adversary.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes AdViT, an interpretation-guided adversarial attack against vision transformer (ViT) classifiers and their coupled interpretation models. The attack formulates a joint loss that combines a block-level classification loss (Eq. 3) with an interpretation-similarity loss (Eq. 4), and extends to black-box settings via a mutation-based genetic algorithm (MGA, Algorithm 1). Experiments are conducted on multiple ViT architectures (DeiT, Swin, T2T-ViT, ViT) and two transformer-based interpreters (Transformer Interpreter and IA-RED2), including transferability, defense robustness, and a detection countermeasure. The paper claims a 100% attack success rate in both white-box and black-box scenarios, high misclassification confidence, and preserved interpretation maps.

Significance. If the claims were fully supported, AdViT would be a meaningful contribution to the security analysis of interpretable ViT systems: it proposes a dual-objective attack that jointly fools classification and interpretation, a genetic algorithm tailored to transferability, and a potential detection defense. The paper includes a considerable amount of experimental data and a reproducible code repository link. However, the central claims are significantly undermined by internal contradictions and underspecified components: the unconditional 100% black-box success claim is contradicted by the paper's own transferability tables, the shared classification head in the white-box formulation is not specified, the MGA fitness function does not query the target interpreter, and the high interpretation similarity is partly a construction artifact of the loss. These issues affect the core contribution and require substantial revision.

major comments (5)
  1. [Abstract; Section IV-C (Tables III and IV)] The abstract claims that AdViT 'achieves a 100% attack success rate in both white-box and black-box scenarios' without qualification. This is directly contradicted by the paper's own results: Table III reports typical transferability success rates as low as 0.15 (DeiT-T to T2T-ViT-7 with Transformer Interpreter) and numerous entries below 0.30, while Table IV shows MGA-boosted success rates ranging from 0.82 to 1.00, with only specific source-target pairs (e.g., DeiT-B to ViT-B) reaching 1.00. The unconditional 100% black-box claim must be revised to a per-scenario, per-pair statement, and the conclusions should be aligned with the actual data.
  2. [Section III-A, Eq. (3)] The attack formulation relies on a single shared classification head g applied to every intermediate transformer block output, but the paper does not specify how g is initialized or trained, nor how it is made compatible with architectures such as Swin and T2T-ViT that change token counts or channel dimensions between stages. If g is not properly aligned with intermediate representations, Eq. (3) is not a well-defined adversarial objective, and the reported white-box gains from block-level features are not reproducible. The authors should provide the training procedure, the architecture details, and an ablation showing the sensitivity to g.
  3. [Algorithm 1; Section IV-C] The MGA fitness function in Algorithm 1 (lines 5-6) queries only the target classifier F' and never the target interpreter G'. The paper nevertheless claims that MGA 'factors in interpretability' and preserves interpretation maps at the target model. Since interpretation preservation at the target is not part of the selection criterion, the high IoU values in Figure 6 are not explained by the described algorithm. The authors should either modify the fitness function to query the target interpreter, or provide separate evidence that the transferability-based procedure preserves target-side interpretation maps without such queries.
  4. [Section III-A, Eq. (4)] The interpretation loss directly minimizes the L2 distance between the adversarial and benign interpretation maps, so the high IoU scores (e.g., Figure 4) are partly a construction artifact of the objective rather than an independent empirical finding. The paper should explicitly acknowledge this and compare against an attack variant without the interpretation term, or with a weaker interpretation objective, to assess the actual contribution of interpretation preservation.
  5. [Section IV-C (Table IV, Figure 6)] The MGA setup is incompletely specified: the number of generations, the exact stopping criterion, the query distribution, the population initialization details beyond size 5, and the handling of the termination condition in Algorithm 1 are not reported. This makes the query-efficiency numbers (e.g., 152 queries for ViT-B in Table IV) difficult to audit or reproduce. The authors should report these details or provide a sensitivity analysis over the genetic algorithm hyperparameters.
minor comments (6)
  1. [Section II-A] The notation F = (f1 ◦ f2 ◦ f3 ◦ ... fn) ◦ fcls is inconsistent with the later definition of F_j = f1 ◦ ... ◦ fj ◦ g; the composition order and the relationship between fcls and g should be clarified.
  2. [Figure 4] The subplot labels for the two interpreters are ambiguous; the current caption does not clearly indicate which panel corresponds to Transformer Interpreter and which to IA-RED2. Add explicit panel labels (e.g., (a) and (b)).
  3. [Section V (Related Work)] The sentence 'Naseer et al. [24] ... proposed SingleADV' conflates two different works; SingleADV is previously described as from Abdukhamidov et al. [2], not from [24]. The citation placement should be corrected.
  4. [Table IV] The Square attack rows are duplicated for both interpreters, but the Square attack does not use interpreters. Consider presenting the Square attack once in a separate column to avoid implying interpreter-specific behavior.
  5. [Section IV-A (Metrics)] The IoU metric is defined on attribution maps, but the threshold or binarization procedure used to convert attribution maps into shapes is not specified. Without this, the reported IoU values are not fully reproducible.
  6. [Section IV-A] The paper states that code, data, and models are available at a GitHub link, but no version, commit identifier, or license is provided. Adding these details would improve reproducibility.

Circularity Check

1 steps flagged · score 6.0 of 10

Interpretation preservation is the loss itself: Eq. 4 directly minimizes the map distance that IoU later reports, so the 'accurate interpretations' claim is partly self-definitional; attack success is externally measured, but the abstract's blanket 100% black-box claim is not supported by the paper's own tables.

  1. self definitional [Section III-A, Eq. (4); results claimed in Section IV-B (Figure 4)]
    "We define ℓint as: ℓint = Σ_{i=1}^m w_i · (G(ˆx; F)_i − m_i)^2 ... This formulation computes a weighted sum of squared differences across all features, encouraging the adversarial sample to maintain a similar interpretation to the benign sample. ... AdViT achieves IoU scores exceeding 0.8 across all tested transformer-based models for both interpreters."

    The reported 'accurate interpretations' result is a direct consequence of the optimized objective, not an independent discovery. Eq. (4) defines ℓint as the weighted squared difference between the adversarial interpretation map G(x̂;F) and the benign map m, and Eq. (2) minimizes ℓcls + λℓint. Therefore, after PGD optimization, the adversarial and benign maps are close by construction, making high IoU a restatement of the loss rather than an empirical finding. The paper presents this as 'Remarkably, AdViT consistently generates accurate interpretations,' but for white-box attacks and for the MGA initial population, interpretation similarity is encoded in the objective.

full rationale

AdViT's central attack-success evaluation is not circular: success is measured against held-out target classifiers (Tables II-IV) and against external baselines (Square, ADV2, AdvEdge, PGD, ATViT), and the white-box optimization is a standard PGD-style attack. The genuinely construction-loaded claim is interpretation preservation: Eq. (4) directly minimizes the same map-similarity that IoU later measures, so IoU > 0.8 in the white-box setting is a restatement of the objective. The abstract's unconditional '100% in both white-box and black-box scenarios' is not a circularity but a separate correctness defect: Table III shows typical transferability between 0.15 and 0.86 and Table IV MGA rows as low as 0.82, so the blanket assertion overstates the data. No load-bearing self-citation or imported uniqueness theorem appears; self-citations [1]-[4] are baselines and extensions. Overall, one secondary but central claim (interpretation fidelity) reduces by construction, while the attack-success core remains externally measured, giving partial circularity.

Assumptions & free parameters 7 free parameters · 4 assumptions · 2 invented entities

The central claims rest on attack hyperparameters (lambda, epsilon, alpha_max, GA rates) and on two unstated architectural assumptions: the shared classification head is compatible with all intermediate blocks, and the interpreters are differentiable. No new physical entities are introduced; the shared head is an attack-time construct.

free parameters (7)
  • lambda (interpretation loss weight) = 10
    Balances misclassification and interpretation preservation in Eq. 2; no sensitivity analysis (Table I).
  • epsilon (perturbation bound) = 0.031
    Norm ball radius for imperceptibility; success rates depend on it (Table I, Eq. 1).
  • alpha_max (PGD step size) = 0.08
    Step size for projected gradient iterations (Table I).
  • mutation rate mr = 1e-4
    MGA mutation probability (Table I, Section III-B).
  • crossover rate cr = 0.7
    MGA crossover probability (Table I, Section III-B).
  • population size n = 5
    MGA population size selected from experiments for best trade-off between effectiveness and time (Section III-B).
  • ImageNet confidence threshold = >0.70
    1000 images selected with confidence higher than 70%; this may inflate apparent attack success (Section IV-A).
assumptions (4)
  • ad hoc to paper A single shared classification head g can be applied to outputs of every transformer block.
    Section III-A introduces Fj = f1...fj ∘ g without specifying training or compatibility with varying intermediate dimensions.
  • domain assumption Transformer Interpreter and IA-RED2 are differentiable with respect to the input so that gradients of the interpretation loss can be computed.
    Eq. 4 requires gradients through the interpreter; the paper does not show this holds for the token-dropping mechanism in IA-RED2.
  • domain assumption The black-box target returns enough probability information for relative cross-entropy fitness.
    Algorithm 1's fitness function assumes access to class probabilities, not just top-k labels or logits.
  • domain assumption The 1000-image subset with confidence above 70% represents realistic deployment conditions.
    Dataset selection in Section IV-A may favor attacks and overstate success rates.
invented entities (2)
  • Shared classification head g (Norm + MLP)
    purpose: Computes intermediate logits Fj for block-wise classification loss without retraining the ViT.
    Introduced in Section III-A and Figure 2; not part of the target model, no training details, no external validation.
  • AdViT attack-time modified architecture
    purpose: Connects every transformer block to the shared head during attack generation.
    Figure 2; exists only for generating perturbations, not in the deployed system.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Breaking the Illusion of Security via Interpretation: Interpretable Vision Transformer Systems under Attack." pith.science (2026). https://pith.science/paper/G5UJWN67

@misc{pith2026250714248,
  author       = {Pith},
  title        = {Pith review of: Breaking the Illusion of Security via Interpretation: Interpretable Vision Transformer Systems under Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G5UJWN67}},
  note         = {Machine review of arXiv:2507.14248}
}
read the original abstract

Vision transformer (ViT) models, when coupled with interpretation models, are regarded as secure and challenging to deceive, making them well-suited for security-critical domains such as medical applications, autonomous vehicles, drones, and robotics. However, successful attacks on these systems can lead to severe consequences. Recent research on threats targeting ViT models primarily focuses on generating the smallest adversarial perturbations that can deceive the models with high confidence, without considering their impact on model interpretations. Nevertheless, the use of interpretation models can effectively assist in detecting adversarial examples. This study investigates the vulnerability of transformer models to adversarial attacks, even when combined with interpretation models. We propose an attack called "AdViT" that generates adversarial examples capable of misleading both a given transformer model and its coupled interpretation model. Through extensive experiments on various transformer models and two transformer-based interpreters, we demonstrate that AdViT achieves a 100% attack success rate in both white-box and black-box scenarios. In white-box scenarios, it reaches up to 98% misclassification confidence, while in black-box scenarios, it reaches up to 76% misclassification confidence. Remarkably, AdViT consistently generates accurate interpretations in both scenarios, making the adversarial examples more difficult to detect.

Figures

Figures reproduced from arXiv: 2507.14248 by the authors.

Figure 1
Figure 1. Example images comparing (a) benign samples, (b) [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Modified transformer architecture to extract discrim [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Attribution maps of benign and adversarial samples generated by AdViT using two interpreters. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: White-box scenario: IoU scores of adversarial interpretation maps generated by AdViT and existing attacks. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Black-box scenario: IoU scores of adversarial interpretation maps generated by AdViT using typical transferability and [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Black-box scenario: IoU scores of adversarial interpretation maps generated by AdViT using transferability via MGA [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: IoU scores of adversarial interpretation maps generated by the proposed attack when defense techniques are applied. [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

42 extracted references · 38 canonical work pages

  1. [1]

    Advedge: Optimizing adversarial perturba- tions against interpretable deep learning

    Eldor Abdukhamidov, Mohammed Abuhamad, Firuz Juraev, Eric Chan- Tin, and Tamer AbuHmed. Advedge: Optimizing adversarial perturba- tions against interpretable deep learning. In International Conference on Computational Data and Social Networks , pages 93–105. Springer,

    work page

  2. [2]

    Singleadv: single-class target- specific attack against interpretable deep learning systems

    Eldor Abdukhamidov, Mohammed Abuhamad, George K Thiruvathukal, Hyoungshick Kim, and Tamer Abuhmed. Singleadv: single-class target- specific attack against interpretable deep learning systems. IEEE Transactions on Information Forensics and Security , 19:5985–5998,

    work page

  3. [3]

    Woo, Eric Chan-Tin, and Tamer Abuhmed

    Eldor Abdukhamidov, Mohammed Abuhamad, Simon S. Woo, Eric Chan-Tin, and Tamer Abuhmed. Hardening interpretable deep learning systems: Investigating adversarial threats and defenses. IEEE Transac- tions on Dependable and Secure Computing , 21(4):3963–3976, 2024. 11

    work page 2024

  4. [4]

    Stealthy query-efficient opaque attack against interpretable deep learning

    Eldor Abdukhamidov, Mohammed Abuhamad, Simon S Woo, Eric Chan-Tin, and Tamer Abuhmed. Stealthy query-efficient opaque attack against interpretable deep learning. IEEE Transactions on Reliability ,

    work page

  5. [5]

    Characterizing the risk of fairwashing

    Ulrich A ¨ıvodji, Hiromi Arai, S ´ebastien Gambs, and Satoshi Hara. Characterizing the risk of fairwashing. Advances in Neural Information Processing Systems, 34:14822–14834, 2021. 6, 11

    work page 2021

  6. [6]

    Square attack: a query-efficient black-box adversarial attack via random search

    Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. In European conference on computer vision , pages 484–501. Springer, 2020. 7, 9

    work page 2020

  7. [7]

    Explainable artificial intelligence (xai): Concepts, taxonomies, opportunities and challenges toward responsible ai

    Alejandro Barredo Arrieta, Natalia D ´ıaz-Rodr´ıguez, Javier Del Ser, Adrien Bennetot, Siham Tabik, Alberto Barbado, Salvador Garc ´ıa, Sergio Gil-L´opez, Daniel Molina, Richard Benjamins, et al. Explainable artificial intelligence (xai): Concepts, taxonomies, opportunities and challenges toward responsible ai. Information fusion, 58:82–115, 2020. 1

    work page 2020

  8. [8]

    On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation

    Sebastian Bach, Alexander Binder, Gr ´egoire Montavon, Frederick Klauschen, Klaus-Robert M ¨uller, and Wojciech Samek. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PloS one, 10(7):e0130140, 2015. 3

    work page 2015

Show all 42 references
  1. [9]

    Evolutionary algorithms in theory and practice: evolu- tion strategies, evolutionary programming, genetic algorithms

    Thomas Back. Evolutionary algorithms in theory and practice: evolu- tion strategies, evolutionary programming, genetic algorithms . Oxford university press, 1996. 5

    1996

  2. [10]

    Manipulating shap via adversarial data perturbations (student abstract)

    Hubert Baniecki and Przemyslaw Biecek. Manipulating shap via adversarial data perturbations (student abstract). Proceedings of the AAAI Conference on Artificial Intelligence , 36(11):12907–12908, Jun

  3. [11]

    Understanding robustness of transformers for image classification

    Srinadh Bhojanapalli, Ayan Chakrabarti, Daniel Glasner, Daliang Li, Thomas Unterthiner, and Andreas Veit. Understanding robustness of transformers for image classification. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 10231–10241,

  4. [12]

    Transformer interpretability beyond attention visualization

    Hila Chefer, Shir Gur, and Lior Wolf. Transformer interpretability beyond attention visualization. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition , pages 782–791,

  5. [13]

    Poba-ga: Perturbation optimized black-box adversarial attacks via genetic algorithm

    Jinyin Chen, Mengmeng Su, Shijing Shen, Hui Xiong, and Haibin Zheng. Poba-ga: Perturbation optimized black-box adversarial attacks via genetic algorithm. Computers & Security , 85:89–106, 2019. 5

    2019

  6. [14]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weis- senborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition ...

    2021

  7. [15]

    Interpretation of neural networks is fragile

    Amirata Ghorbani, Abubakar Abid, and James Zou. Interpretation of neural networks is fragile. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 3681–3688, 2019. 1

    2019

  8. [16]

    The microbial genetic algorithm

    Inman Harvey. The microbial genetic algorithm. In European conference on artificial life , pages 126–133. Springer, 2009. 5

    2009

  9. [17]

    Fooling neural network interpretations via adversarial model manipulation

    Juyeon Heo, Sunghwan Joo, and Taesup Moon. Fooling neural network interpretations via adversarial model manipulation. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alch ´e-Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 32. ...

    2019

  10. [18]

    Erosion attack: Harness- ing corruption to improve adversarial examples

    Lifeng Huang, Chengying Gao, and Ning Liu. Erosion attack: Harness- ing corruption to improve adversarial examples. IEEE Transactions on Image Processing, 32:4828–4841, 2023. 12 13

    2023

  11. [19]

    H ´enaff, Matthew M

    Andrew Jaegle, Sebastian Borgeaud, Jean-Baptiste Alayrac, Carl Do- ersch, Catalin Ionescu, David Ding, Skanda Koppula, Daniel Zo- ran, Andrew Brock, Evan Shelhamer, Olivier J. H ´enaff, Matthew M. Botvinick, Andrew Zisserman, Oriol Vinyals, and Jo ˜ao Carreira. Per- ceiver IO:...

    2021 arXiv

  12. [20]

    Tracking with saliency region transformer

    Tianpeng Liu, Jing Li, Jia Wu, Lefei Zhang, Jun Chang, Jun Wan, and Lezhi Lian. Tracking with saliency region transformer. IEEE Transactions on Image Processing , 33:285–296, 2024. 1

    2024

  13. [21]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 10012–10022,

  14. [22]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 , 2017. 6

    2017 arXiv

  15. [23]

    Explaining nonlinear classification decisions with deep taylor decomposition

    Gr ´egoire Montavon, Sebastian Lapuschkin, Alexander Binder, Wojciech Samek, and Klaus-Robert M ¨uller. Explaining nonlinear classification decisions with deep taylor decomposition. Pattern recognition, 65:211– 222, 2017. 3

    2017

  16. [24]

    On improving adversarial transferability of vision transformers

    Muzammal Naseer, Kanchana Ranasinghe, Salman Khan, Fahad Khan, and Fatih Porikli. On improving adversarial transferability of vision transformers. In International Conference on Learning Representations ,

  17. [25]

    Sok: Explainable machine learning in adversarial environments

    Maximilian Noppel and Christian Wressnegger. Sok: Explainable machine learning in adversarial environments. In 2024 IEEE Symposium on Security and Privacy (SP) , pages 21–21. IEEE Computer Society,

    2024

  18. [26]

    Ia-red2: Interpretability-aware redundancy reduction for vision transformers

    Bowen Pan, Rameswar Panda, Yifan Jiang, Zhangyang Wang, Rogerio Feris, and Aude Oliva. Ia-red2: Interpretability-aware redundancy reduction for vision transformers. Advances in Neural Information Processing Systems, 34:24898–24911, 2021. 2, 3, 6

    2021

  19. [27]

    On the adversarial robustness of vision transformers

    Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Chen, and Cho-Jui Hsieh. On the adversarial robustness of vision transformers. arXiv preprint arXiv:2103.15670, 2021. 1

    2021 arXiv

  20. [28]

    Decision-based query efficient adversarial attack via adaptive boundary learning

    Meng Shen, Changyue Li, Hao Yu, Qi Li, Liehuang Zhu, and Ke Xu. Decision-based query efficient adversarial attack via adaptive boundary learning. IEEE Transactions on Dependable and Secure Computing , 21(4):1740–1753, 2024. 12

    2024

  21. [29]

    Poisoning attacks on algorithmic fairness

    David Solans, Battista Biggio, and Carlos Castillo. Poisoning attacks on algorithmic fairness. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases , pages 162–177. Springer, 2020. 6

    2020

  22. [30]

    On single-model transferable targeted attacks: A closer look at decision- level optimization

    Xuxiang Sun, Gong Cheng, Hongda Li, Lei Pei, and Junwei Han. On single-model transferable targeted attacks: A closer look at decision- level optimization. IEEE Transactions on Image Processing , 32:2972– 2984, 2023. 12

    2023

  23. [31]

    Efficientnet: Rethinking model scaling for convolutional neural networks

    Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In International conference on machine learning, pages 6105–6114. PMLR, 2019. 10

    2019

  24. [32]

    Training data-efficient image transformers & distillation through attention

    Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Herv ´e J´egou. Training data-efficient image transformers & distillation through attention. In International Confer- ence on Machine Learning , pages 10347–10357. PMLR, 2021. 6

    2021

  25. [33]

    Im- proving transferability of universal adversarial perturbation with feature disruption

    Donghua Wang, Wen Yao, Tingsong Jiang, and Xiaoqian Chen. Im- proving transferability of universal adversarial perturbation with feature disruption. IEEE Transactions on Image Processing, 33:722–737, 2024. 12

    2024

  26. [34]

    Interpretability is a kind of safety: An interpreter-based ensemble for adversary defense

    Jingyuan Wang, Yufan Wu, Mingxuan Li, Xin Lin, Junjie Wu, and Chao Li. Interpretability is a kind of safety: An interpreter-based ensemble for adversary defense. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 15–24, 2020. 2

    2020

  27. [35]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing , 13(4):600–612, 2004. 6

    2004

  28. [36]

    Zhipeng Wei, Jingjing Chen, Micah Goldblum, Zuxuan Wu, Tom Goldstein, Yu-Gang Jiang, and Larry S. Davis. Towards transferable adversarial attacks on image and video transformers. IEEE Transactions on Image Processing , 32:6346–6358, 2023. 12

    2023

  29. [37]

    Alvarez, and Ping Luo

    Enze Xie, Wenhai Wang, Zhiding Yu, Anima Anandkumar, Jose M. Alvarez, and Ping Luo. Segformer: Simple and efficient design for semantic segmentation with transformers. CoRR, abs/2105.15203, 2021. 6

    2021 arXiv

  30. [38]

    Tay, Jiashi Feng, and Shuicheng Yan

    Li Yuan, Yunpeng Chen, Tao Wang, Weihao Yu, Yujun Shi, Zi-Hang Jiang, Francis E.H. Tay, Jiashi Feng, and Shuicheng Yan. Tokens-to- token vit: Training vision transformers from scratch on imagenet. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV...

    2021

  31. [39]

    Towards black-box adversarial attacks on interpretable deep learning systems

    Yike Zhan, Baolin Zheng, Qian Wang, Ningping Mou, Binqing Guo, Qi Li, Chao Shen, and Cong Wang. Towards black-box adversarial attacks on interpretable deep learning systems. In 2022 IEEE International Conference on Multimedia and Expo (ICME) , pages 1–6. IEEE, 2022. 11

    2022

  32. [40]

    Data poisoning attacks against outcome interpretations of predictive models

    Hengtong Zhang, Jing Gao, and Lu Su. Data poisoning attacks against outcome interpretations of predictive models. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining , pages 2165–2173, 2021. 11

    2021

  33. [41]

    Jianping Zhang, Yizhan Huang, Weibin Wu, and Michael R. Lyu. Transferable adversarial attacks on vision transformers with token gra- dient regularization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16415–16424, June 2023. 12

    2023

  34. [42]

    Interpretable deep learning under fire

    Xinyang Zhang, Ningfei Wang, Hua Shen, Shouling Ji, Xiapu Luo, and Ting Wang. Interpretable deep learning under fire. In 29th {USENIX} Security Symposium ( {USENIX} Security 20), 2020. 1, 6, 10, 11

    2020

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.