{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/on-improving-adversarial-transferability-of","title":"On Improving Adversarial Transferability of Vision Transformers","arxiv_id":"2106.04169","date":"2021-06-08","proceeding":"ICLR 2022 4","authors":["Muzammal Naseer","Kanchana Ranasinghe","Salman Khan","Fahad Shahbaz Khan","Fatih Porikli"],"abstract":"Vision transformers (ViTs) process input images as sequences of patches via self-attention; a radically different architecture than convolutional neural networks (CNNs). This makes it interesting to study the adversarial feature space of ViT models and their transferability. In particular, we observe that adversarial patterns found via conventional adversarial attacks show very \\emph{low} black-box transferability even for large ViT models. We show that this phenomenon is only due to the sub-optimal attack procedures that do not leverage the true representation potential of ViTs. A deep ViT is composed of multiple blocks, with a consistent architecture comprising of self-attention and feed-forward layers, where each block is capable of independently producing a class token. Formulating an attack using only the last class token (conventional approach) does not directly leverage the discriminative information stored in the earlier tokens, leading to poor adversarial transferability of ViTs. Using the compositional nature of ViT models, we enhance transferability of existing attacks by introducing two novel strategies specific to the architecture of ViT models. (i) Self-Ensemble: We propose a method to find multiple discriminative pathways by dissecting a single ViT model into an ensemble of networks. This allows explicitly utilizing class-specific information at each ViT block. (ii) Token Refinement: We then propose to refine the tokens to further enhance the discriminative capacity at each block of ViT. Our token refinement systematically combines the class tokens with structural information preserved within the patch tokens.","url_abs":"https://arxiv.org/abs/2106.04169v3","url_pdf":"https://arxiv.org/pdf/2106.04169v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"on-improving-adversarial-transferability-of","repo_url":"https://github.com/Muzammal-Naseer/Improving-Adversarial-Transferability-of-Vision-Transformers","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"on-improving-adversarial-transferability-of","repo_url":"https://github.com/Muzammal-Naseer/On-Improving-Adversarial-Transferability-of-Vision-Transformers","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"on-improving-adversarial-transferability-of","repo_url":"https://github.com/Trustworthy-AI-Group/TransferAttack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2106.04169","atlas_url":"https://app.syntology.ai/?focus=2106.04169","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2106.04169"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/pytorch/examples","reach":{"status":"ok","spdx":"BSD-3-Clause"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Trustworthy-AI-Group/TransferAttack","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Muzammal-Naseer/Improving-Adversarial-Transferability-of-Vision-Transformers","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Muzammal-Naseer/On-Improving-Adversarial-Transferability-of-Vision-Transformers","reach":{"status":"ok"}}],"summary":{"unverified":5},"by_repo_kind":{"listed":{"samples":5,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"f83e95f5a695bfd7","entry":"ATA_ViT","repo":"Trustworthy-AI-Group/TransferAttack","repo_kind":"listed","path":"transferattack/model_related/ata_vit.py","file_url":"https://github.com/Trustworthy-AI-Group/TransferAttack/blob/HEAD/transferattack/model_related/ata_vit.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f83e95f5a695bfd7"}},{"code_sha256_prefix":"0dc28352f69954a3","entry":"ATTENTION_RIGION","repo":"Trustworthy-AI-Group/TransferAttack","repo_kind":"listed","path":"transferattack/model_related/ata_vit.py","file_url":"https://github.com/Trustworthy-AI-Group/TransferAttack/blob/HEAD/transferattack/model_related/ata_vit.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0dc28352f69954a3"}},{"code_sha256_prefix":"af70a9972ba879db","entry":"DataPreprocess","repo":"Trustworthy-AI-Group/TransferAttack","repo_kind":"listed","path":"transferattack/model_related/ata_vit.py","file_url":"https://github.com/Trustworthy-AI-Group/TransferAttack/blob/HEAD/transferattack/model_related/ata_vit.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"af70a9972ba879db"}},{"code_sha256_prefix":"f07bcf48ac48841e","entry":"EMBED_POSITION","repo":"Trustworthy-AI-Group/TransferAttack","repo_kind":"listed","path":"transferattack/model_related/ata_vit.py","file_url":"https://github.com/Trustworthy-AI-Group/TransferAttack/blob/HEAD/transferattack/model_related/ata_vit.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f07bcf48ac48841e"}},{"code_sha256_prefix":"55ecfa16f5b4e071","entry":"LRP","repo":"Trustworthy-AI-Group/TransferAttack","repo_kind":"listed","path":"transferattack/model_related/ata_vit.py","file_url":"https://github.com/Trustworthy-AI-Group/TransferAttack/blob/HEAD/transferattack/model_related/ata_vit.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"55ecfa16f5b4e071"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}