Pith. sign in

REVIEW 2 major objections 5 minor 35 references

Independently optimized decoy patches can redirect Vision Transformer attention defenses away from real adversarial patches while keeping the attack effective.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-10 15:21 UTC pith:X6NP2JON

load-bearing objection Clean, attack-agnostic bypass of attention-magnitude defenses by planting independent decoys; the budget-matched result is the part that actually changes how you think about the threat model. the 2 major comments →

arxiv 2607.07922 v1 pith:X6NP2JON submitted 2026-07-08 cs.CV cs.AI

Adversarial Decoys: Misdirecting Attention-Based Defenses in ViT

Giulia Marchiori Pietrosanti , Giulio Rossolini , Giorgio Buttazzo This is my paper
classification cs.CV cs.AI
keywords adversarial decoysvision transformersadversarial patchesattention-based defensestest-time defensetoken maskingImageNet
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Vision Transformers remain open to localized adversarial patches that change a prediction by rewriting only a small region of the image. Some test-time defenses try to stop those attacks by blanking out tokens that receive abnormally high attention, treating high attention as a sign of adversarial content. This paper shows that an attacker can plant separate decoy patches whose sole job is to pull that attention onto chosen target tokens. The original adversarial region still drives the wrong class, while the decoys make the defense suppress the wrong tokens instead. Because the decoys are optimized after the attack and without changing it, the same redirection works with different existing patch attacks and several ViT architectures on ImageNet, exposing a structural limit of using attention magnitude as a marker of adversarial relevance.

Core claim

Adversarial decoys—image patches optimized only to dominate the layer-wise received-attention ranking—can misdirect attention-based token-masking defenses away from the true adversarial region while the original attack continues to induce misclassification. The two goals are deliberately separated rather than jointly optimized, so the method stays attack-agnostic and can be attached to any localized patch attack.

What carries the argument

A layer-wise decoy objective that raises the average received attention of chosen target tokens and forces the k-th strongest target token above the strongest non-target token, with adaptive layer weights that put more pressure on layers that have not yet reached a dominance ratio.

Load-bearing premise

The defense keeps choosing which tokens to suppress mainly by how much attention they receive, and does not change its ranking rule or threshold once the decoys have reshaped the attention map.

What would settle it

On the same ImageNet models and localized attacks, add four optimized decoys and run an attention-masking defense that also uses value-vector outliers or a prediction-sensitivity check; if defended accuracy returns near the clean level, the claimed redirection does not hold.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Attention magnitude alone is not a reliable indicator that a token is adversarially harmful.
  • Token-masking defenses that rank by received attention can be steered onto non-adversarial high-attention patches.
  • Under a fixed token budget, reserving some tokens for decoys can lower defended accuracy more than spending the whole budget on attack tokens.
  • Evasion of attention-based defenses need not redesign the original adversarial patch; a separate sequential decoy stage is enough.
  • Any analysis tool that treats attention strength as a faithfulness signal can be misled by the same redirection.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Defenses may need secondary signals—value outliers, multi-layer consistency, or change-in-prediction tests—rather than pure attention ranking.
  • Physical patch attacks could add printed decoys so that camera-facing attention defenses suppress the wrong region.
  • The same attention-stealing idea may transfer to other models that rely on global attention, not only pure ViTs.
  • Joint optimization of attack and decoy, rather than the sequential pipeline used here, could close residual accuracy gaps the paper still leaves.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper shows that Vision Transformers remain vulnerable to localized adversarial patches even under attention-based test-time defenses such as ARMRO. It introduces adversarial decoys: independently optimized patches that raise the received-attention scores of chosen target tokens (Eqs. 5, 7–11) so that the defense’s suppression mask is redirected away from the true adversarial region. The two regions are optimized sequentially (Algorithm 1), making the method attack-agnostic. Proposition 1 decomposes the contribution of a token to a self-attention output into an attention weight and a value-displacement term, motivating why high attention is useful but not necessary for adversarial effect. Experiments on ImageNet with DeiT-B, ViT-B and ViT-S, PatchFool and standard patch attacks, mask-aware and adaptive variants, decoy-budget sweeps and loss ablations show large drops in defended accuracy while most of the original attack success is retained.

Significance. If the empirical results hold, the work identifies a concrete, previously under-appreciated limitation of attention-magnitude defenses for ViTs: the ranking used by the defense can be hijacked by a separate, non-adversarial region without destroying the attack. The attack-agnostic sequential design (Alg. 1) and the budget-matched comparison (Sec. 5.4) are practically useful contributions; they show that allocating part of a fixed token budget to decoys is often more effective than using the entire budget for attack tokens alone. Proposition 1 supplies a clean theoretical framing that is independent of any particular defense. The paper therefore both strengthens the threat model for localized attacks and supplies a clear target for future defenses that cannot rely solely on attention magnitude.

major comments (2)
  1. Sec. 5.1 and Table 1: all main numbers are obtained on a fixed random subset of 1024 ImageNet validation images. While the authors cite computational cost, the absolute accuracy drops (often >40 %) and the budget-matched curves in Fig. 5 rest on this single draw. A short multi-seed or multi-subset check (even on a smaller model) is needed to confirm that the ranking of “attack-only vs. attack+decoy” is stable; otherwise the central quantitative claim remains under-powered.
  2. Sec. 5.4 / App. C.5: the adaptive baseline that jointly optimizes classification loss while penalizing attention on the attacked tokens uses a single fixed λ = 0.01. The paper does not report a sweep over λ (or over the set of layers included in the penalty). Without that sweep it is hard to know whether the reported superiority of the decoy strategy is robust to a stronger adaptive attacker that more carefully trades off attention reduction against attack success.
minor comments (5)
  1. Eq. (5) and the surrounding text: the exclusion of the [CLS] token from both queries and candidates is stated but never justified; a one-sentence remark on why including it would change (or not change) the ranking would help.
  2. Fig. 3 caption and color legend: “adversarial patches in green, decoys in white, covered patches in red” is hard to read on a grayscale print-out; consider hatching or line styles.
  3. App. C.2: the learning-rate / step-count trade-off (η = 0.05, 2500 steps) is presented only for the decoy stage; a brief note on wall-clock cost relative to a single PatchFool run would be useful for reproducibility.
  4. Table 2 vs. Table 3: the two ablations use slightly different reporting conventions (average top-k coverage vs. #layers reaching 95/100 %); aligning the metrics would make the contribution of each loss term clearer.
  5. Typo: “geNet validation set” (Sec. 5.1) should be “ImageNet”.

Circularity Check

0 steps flagged

No significant circularity; claims rest on independent patch optimization and empirical evaluation against external defenses.

full rationale

The paper's central results are empirical attack-success and defended-accuracy numbers obtained by gradient-optimizing concrete image patches (Alg. 1, Eqs. 7–12) and then measuring their effect on an independently defined defense (ARMRO using the mean received-attention scores of Eq. 5). Proposition 1 is a straightforward algebraic rearrangement of the softmax attention formula and does not feed back into the decoy objective or the reported metrics. No parameter is fitted to a data subset and then re-presented as a prediction; no uniqueness theorem or load-bearing premise is imported solely via self-citation; and the decoy loss is not definitionally identical to the defense's selection criterion. The derivation chain is therefore self-contained against external benchmarks (ImageNet, public ViT weights, published attacks/defenses) and exhibits none of the six circularity patterns.

Axiom & Free-Parameter Ledger

5 free parameters · 3 axioms · 1 invented entities

The work rests on the standard ViT self-attention equations, the empirical observation that high attention amplifies adversarial effect (formalized as Prop. 1), and a small set of hand-chosen optimization hyper-parameters. The only invented entity is the decoy itself, whose existence is demonstrated by the optimization rather than postulated a priori.

free parameters (5)
  • β_ratio = 10
    Weight of the ranking-dominance term relative to the absolute-attention term; set to 10 by hand.
  • dominance threshold r = 2
    Target ratio that triggers the layer-weight switch α0→α1; set to 2.
  • α0, α1 = 1 / 0.05
    Layer-wise weights that emphasize layers still below the dominance threshold; set to 1 and 0.05.
  • decoy optimization steps / learning rate = 2500 / 0.05
    2500 steps at η=0.05 chosen for convergence across layers; not derived from first principles.
  • ARMRO threshold τ = 1.2 (B) / 1.4 (S)
    Defense hyper-parameter tuned per architecture (1.2 or 1.4) on preliminary analysis.
axioms (3)
  • standard math Self-attention output of a query can be rewritten as oi − μi,¬a = Ai,a (va − μi,¬a) (Proposition 1).
    Direct algebraic consequence of the softmax definition; used to motivate why attention amplifies adversarial value vectors.
  • domain assumption Tokens with abnormally high mean received-attention scores are treated by the defender as suspicious and are masked.
    Taken from the design of ARMRO and RSA; the entire decoy strategy is predicated on this selection rule remaining fixed.
  • ad hoc to paper The adversarial region and the decoy region are spatially disjoint and the adversarial content is frozen while the decoy is optimized.
    Explicit design choice in Algorithm 1 that enables the attack-agnostic claim.
invented entities (1)
  • adversarial decoy no independent evidence
    purpose: An independently optimized image patch whose sole role is to dominate the attention ranking used by the defense, thereby diverting suppression away from the true adversarial tokens.
    The entity is defined by the optimization problem (Eqs. 7–12) and demonstrated empirically; no independent physical or theoretical existence is claimed outside the attack setting.

pith-pipeline@v1.1.0-grok45 · 26834 in / 2794 out tokens · 31176 ms · 2026-07-10T15:21:04.376281+00:00 · methodology

0 comments
read the original abstract

Vision Transformers (ViTs) remain vulnerable to localized adversarial attacks, e.g., adversarial patches, while recent test-time defenses mitigate them by suppressing image tokens with abnormally high attention scores. These defenses exploit a strong coupling between attention and adversarial effectiveness: adversarial tokens often need to attract substantial attention to influence the prediction. We introduce adversarial decoys, independently optimized image patches that redirect the attention, and therefore related defenses, toward selected target tokens. Rather than jointly optimizing misclassifications and defense evasion, our approach decouples the two objectives: the original adversarial region induces the incorrect prediction, while a separate decoy manipulates the attention ranking used by the defense. A layer-wise objective increases target-token attention and promotes these tokens above competing non-target ones. Since the decoy is optimized independently of the underlying attack, the method is attack-agnostic and can be easily integrated with any existing adversarial patch attack. Experiments on ImageNet across multiple ViT architectures and attacks show that decoys can redirect high attention scores away from the true adversarial region while preserving much of the attack effectiveness. These results reveal a fundamental limitation of using attention magnitude as an indicator of adversarial relevance.

Figures

Figures reproduced from arXiv: 2607.07922 by Giorgio Buttazzo, Giulia Marchiori Pietrosanti, Giulio Rossolini.

Figure 1
Figure 1. Figure 1: Overview of the adversarial-decoy strategy. Adversarial patches induce an incorrect prediction (top), while separately optimized [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Illustration of the decoy optimization objective: target [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: ImageNet qualitative example. adversarial patches only [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Effect of decoy budget on defense bypassing (DeiT and ViT-S). Accuracy on top, and token-mask coverage on the bottom. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Budget-matched comparison on DeiT. Full budget on [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Analysis of the attack success rate and attention ratio with the attacked tokens and others across different configuration of [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Effect of mask-aware optimization on localized PatchFool attacks. The [PITH_FULL_IMAGE:figures/full_fig_p013_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Top-4 overlap and attention shift trend comparison on target tokens across layers. The top row shows DeiT, while the bottom row shows ViT-B, on the left, results computed on all layers optimization, while on the right on the single layer optimization. 0 1000 2000 3000 4000 5000 Optimization step 0.00 0.02 0.04 0.06 0.08 0.10 0.12 S decoy mean Average S decoy mean Layer L0 L1 L2 L3 L4 L5 L6 L7 L8 L9 L10 L11… view at source ↗
Figure 9
Figure 9. Figure 9: Evolution of decoy optimization across layers. The [PITH_FULL_IMAGE:figures/full_fig_p015_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Budget-matched comparison on ViT-B (top) and ViT [PITH_FULL_IMAGE:figures/full_fig_p016_10.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

35 extracted references · 35 canonical work pages · 5 internal anchors

  1. [1]

    Quantifying atten- tion flow in transformers

    Samira Abnar and Willem Zuidema. Quantifying atten- tion flow in transformers. InProceedings of the 58th an- nual meeting of the association for computational linguis- tics, pages 4190–4197, 2020. 2

    work page 2020

  2. [2]

    Reveal of Vision Transformers Robustness against Adversarial Attacks

    Ahmed Aldahdooh, Wassim Hamidouche, and Olivier De- forges. Reveal of vision transformers robustness against ad- versarial attacks.arXiv preprint arXiv:2106.03734, 2021. 2

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  3. [3]

    Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNs

    Philipp Benz, Soomin Ham, Chaoning Zhang, Adil Karjauv, and In So Kweon. Adversarial robustness comparison of vision transformer and mlp-mixer to cnns.arXiv preprint arXiv:2110.02797, 2021. 2

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  4. [4]

    Under- standing robustness of transformers for image classification

    Srinadh Bhojanapalli, Ayan Chakrabarti, Daniel Glasner, Daliang Li, Thomas Unterthiner, and Andreas Veit. Under- standing robustness of transformers for image classification. InProceedings of the IEEE/CVF international conference on computer vision, pages 10231–10241, 2021. 2

    work page 2021

  5. [5]

    Adversarial Patch

    Tom B Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial patch.arXiv preprint arXiv:1712.09665, 2017. 1, 2, 6

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  6. [6]

    End-to- end object detection with transformers

    Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to- end object detection with transformers. InEuropean confer- ence on computer vision, pages 213–229. Springer, 2020. 1

    work page 2020

  7. [7]

    Transformer inter- pretability beyond attention visualization

    Hila Chefer, Shir Gur, and Lior Wolf. Transformer inter- pretability beyond attention visualization. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 782–791, 2021. 2

    work page 2021

  8. [8]

    Vision transformers need registers

    Timoth ´ee Darcet, Maxime Oquab, Julien Mairal, and Piotr Bojanowski. Vision transformers need registers. InInterna- tional conference on learning representations, pages 2632– 2652, 2024. 2

    work page 2024

  9. [9]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 2, 6

    work page 2009

  10. [10]

    An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, et al. An image is worth 16x16 words: Trans- formers for image recognition at scale.arXiv preprint arXiv:2010.11929, 2020. 1, 5

    work page internal anchor Pith review Pith/arXiv arXiv 2010

  11. [11]

    Pruning one more token is enough: Leveraging latency- workload non-linearities for vision transformers on the edge

    Nicholas John Eliopoulos, Purvish Jajal, James C Davis, Gaowen Liu, George K Thiruvathukal, and Yung-Hsiang Lu. Pruning one more token is enough: Leveraging latency- workload non-linearities for vision transformers on the edge. InProceedings of the Winter Conference on Applications of Computer Vision, pages 7153–7162, 2025. 2

    work page 2025

  12. [12]

    Patch-fool: Are vision transformers always robust against adversarial perturbations? InTenth In- ternational Conference on Learning Representations (ICLR 2022), 2022

    Yonggan Fu, Shunyao Zhang, Shang Wu, Cheng Wan, and Yingyan Lin. Patch-fool: Are vision transformers always robust against adversarial perturbations? InTenth In- ternational Conference on Learning Representations (ICLR 2022), 2022. 1, 2, 4, 5, 6

    work page 2022

  13. [13]

    Are vision trans- formers robust to patch perturbations? InEuropean Con- ference on Computer Vision, pages 404–421

    Jindong Gu, V olker Tresp, and Yao Qin. Are vision trans- formers robust to patch perturbations? InEuropean Con- ference on Computer Vision, pages 404–421. Springer, 2022. 2

    work page 2022

  14. [14]

    Vision transformers don’t need trained regis- ters.Advances in neural information processing systems, 38: 56557–56595, 2026

    Nicholas Jiang, Amil Dravid, Alexei Efros, and Yossi Gan- delsman. Vision transformers don’t need trained regis- ters.Advances in neural information processing systems, 38: 56557–56595, 2026. 2

    work page 2026

  15. [15]

    Seeing isn’t believing: Context-aware adversarial patch synthesis via conditional gan

    Roie Kazoom, Alon Goldberg, Hodaya Cohen, and Ofer Hadar. Seeing isn’t believing: Context-aware adversarial patch synthesis via conditional gan. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 202–211, 2026. 2

    work page 2026

  16. [16]

    AttEntropy: On the Generalization Ability of Supervised Semantic Segmentation Transformers to New Objects in New Domains

    Krzysztof Lis, Matthias Rottmann, Annika M ¨utze, Sina Honari, Pascal Fua, and Mathieu Salzmann. Attentropy: On the generalization ability of supervised semantic segmen- tation transformers to new objects in new domains.arXiv preprint arXiv:2212.14397, 2022. 2

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  17. [17]

    Under- standing and defending patched-based adversarial attacks for vision transformer

    Liang Liu, Yanan Guo, Youtao Zhang, and Jun Yang. Under- standing and defending patched-based adversarial attacks for vision transformer. InInternational Conference on Machine Learning, pages 21631–21657. PMLR, 2023. 1, 2, 3, 4, 6, 8

    work page 2023

  18. [18]

    Give me your attention: Dot-product attention considered harmful for adversarial patch robustness

    Giulio Lovisotto, Nicole Finnie, Mauricio Munoz, Chaithanya Kumar Mummadi, and Jan Hendrik Metzen. Give me your attention: Dot-product attention considered harmful for adversarial patch robustness. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15234–15243, 2022. 1, 2

    work page 2022

  19. [19]

    Understanding the effective receptive field in deep convolu- tional neural networks

    Wenjie Luo, Yujia Li, Raquel Urtasun, and Richard Zemel. Understanding the effective receptive field in deep convolu- tional neural networks. InAdvances in Neural Information Processing Systems. Curran Associates, Inc., 2016. 2

    work page 2016

  20. [20]

    Towards deep learn- ing models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks. InInternational Conference on Learning Representations, 2018. 5

    work page 2018

  21. [21]

    Defending against adversar- ial patches with robust self-attention

    Norman Mu and David Wagner. Defending against adversar- ial patches with robust self-attention. InICML 2021 work- shop on uncertainty and robustness in deep learning, 2021. 1, 2

    work page 2021

  22. [22]

    Intriguing properties of vision transform- ers.Advances in Neural Information Processing Systems, 34: 23296–23308, 2021

    Muhammad Muzammal Naseer, Kanchana Ranasinghe, Salman H Khan, Munawar Hayat, Fahad Shahbaz Khan, and Ming-Hsuan Yang. Intriguing properties of vision transform- ers.Advances in Neural Information Processing Systems, 34: 23296–23308, 2021. 2

    work page 2021

  23. [23]

    Dinov2: Learning robust visual features without supervision

    Maxime Oquab, Timoth ´ee Darcet, Th ´eo Moutakanni, Huy V o, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, et al. Dinov2: Learning robust visual features without supervision. Transactions on Machine Learning Research Journal, 2024. 1

    work page 2024

  24. [24]

    Vision transformers are robust learners

    Sayak Paul and Pin-Yu Chen. Vision transformers are robust learners. InProceedings of the AAAI conference on Artificial Intelligence, pages 2071–2081, 2022. 2

    work page 2071

  25. [25]

    Benchmarking the spatial ro- bustness of dnns via natural and adversarial localized corrup- tions.Pattern Recognition, page 112412, 2025

    Giulia Marchiori Pietrosanti, Giulio Rossolini, Alessandro Biondi, and Giorgio Buttazzo. Benchmarking the spatial ro- bustness of dnns via natural and adversarial localized corrup- tions.Pattern Recognition, page 112412, 2025. 1, 2

    work page 2025

  26. [26]

    Defending from physically- realizable adversarial attacks through internal over-activation 9 analysis

    Giulio Rossolini, Federico Nesti, Fabio Brau, Alessandro Biondi, and Giorgio Buttazzo. Defending from physically- realizable adversarial attacks through internal over-activation 9 analysis. InProceedings of the AAAI Conference on Artifi- cial Intelligence, pages 15064–15072, 2023. 1, 2

    work page 2023

  27. [27]

    On the adversarial robustness of vision trans- formers

    Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Chen, and Cho-jui Hsieh. On the adversarial robustness of vision trans- formers. InAnnual Conference on Neural Information Pro- cessing Systems, 2022. 2

    work page 2022

  28. [28]

    Attacking attention of foundation models disrupts downstream tasks

    Hondamunige Prasanna Silva, Federico Becattini, and Lorenzo Seidenari. Attacking attention of foundation models disrupts downstream tasks. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 3534– 3543, 2025. 1, 2

    work page 2025

  29. [29]

    Localizing objects with self-supervised transformers and no labels

    Oriane Sim ´eoni, Gilles Puy, Huy V V o, Simon Roburin, Spyros Gidaris, Andrei Bursuc, Patrick P ´erez, Renaud Mar- let, and Jean Ponce. Localizing objects with self-supervised transformers and no labels. InBMVC 2021-32nd British Ma- chine Vision Conference, 2021. 2

    work page 2021

  30. [30]

    Segmenter: Transformer for semantic segmenta- tion

    Robin Strudel, Ricardo Garcia, Ivan Laptev, and Cordelia Schmid. Segmenter: Transformer for semantic segmenta- tion. InProceedings of the IEEE/CVF international confer- ence on computer vision, pages 7262–7272, 2021. 1

    work page 2021

  31. [31]

    Training data-efficient image transformers & distillation through at- tention

    Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Herv ´e J´egou. Training data-efficient image transformers & distillation through at- tention. InInternational conference on machine learning, pages 10347–10357. PMLR, 2021. 5

    work page 2021

  32. [32]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszko- reit, Llion Jones, Aidan N Gomez, Ł ukasz Kaiser, and Illia Polosukhin. Attention is all you need. InAdvances in Neu- ral Information Processing Systems. Curran Associates, Inc.,

    work page

  33. [33]

    Patch ranking: Token pruning as ranking prediction for efficient clip

    Cheng-En Wu, Jinhong Lin, Yu Hen Hu, and Pedro Mor- gado. Patch ranking: Token pruning as ranking prediction for efficient clip. In2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 5842–5851,

    work page

  34. [34]

    Adversarial t-shirt! evading person detectors in a physical world

    Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Meng- shu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. InComputer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part V, pages 665–681. Springer, 2020. 2

    work page 2020

  35. [35]

    Adversarial Decoys: Misdirecting Attention-Based Defenses in ViT

    Cheng Yu, Jiansheng Chen, Youze Xue, Yuyang Liu, Weitao Wan, Jiayu Bao, and Huimin Ma. Defending against uni- versal adversarial patches by clipping feature norms. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16434–16442, 2021. 1, 2 10 Supplementary materials for the paper “Adversarial Decoys: Misdirecting Attention-Ba...

    work page 2021