{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/on-the-robustness-of-vision-transformers-to","title":"On the Robustness of Vision Transformers to Adversarial Examples","arxiv_id":"2104.02610","date":"2021-03-31","proceeding":"ICCV 2021 10","authors":["Kaleel Mahmood","Rigel Mahmood","Marten van Dijk"],"abstract":"Recent advances in attention-based networks have shown that Vision Transformers can achieve state-of-the-art or near state-of-the-art results on many image classification tasks. This puts transformers in the unique position of being a promising alternative to traditional convolutional neural networks (CNNs). While CNNs have been carefully studied with respect to adversarial attacks, the same cannot be said of Vision Transformers. In this paper, we study the robustness of Vision Transformers to adversarial examples. Our analyses of transformer security is divided into three parts. First, we test the transformer under standard white-box and black-box attacks. Second, we study the transferability of adversarial examples between CNNs and transformers. We show that adversarial examples do not readily transfer between CNNs and transformers. Based on this finding, we analyze the security of a simple ensemble defense of CNNs and transformers. By creating a new attack, the self-attention blended gradient attack, we show that such an ensemble is not secure under a white-box adversary. However, under a black-box adversary, we show that an ensemble can achieve unprecedented robustness without sacrificing clean accuracy. Our analysis for this work is done using six types of white-box attacks and two types of black-box attacks. Our study encompasses multiple Vision Transformers, Big Transfer Models and CNN architectures trained on CIFAR-10, CIFAR-100 and ImageNet.","url_abs":"https://arxiv.org/abs/2104.02610v2","url_pdf":"https://arxiv.org/pdf/2104.02610v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"on-the-robustness-of-vision-transformers-to","repo_url":"https://github.com/MetaMain/ViTRobust","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"BSD-3-Clause"}}],"tasks":[{"task_slug":"image-classification","task_name":"Image Classification"},{"task_slug":"image-classification","task_name":"image-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2104.02610","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2104.02610"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/MetaMain/ViTRobust","reach":{"status":"ok","spdx":"BSD-3-Clause"}}],"summary":{"ran_fixture":1,"ran_draft_wrong":5,"ran":1,"ran_violates":1,"unverified":7},"by_repo_kind":{"official":{"samples":15,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"7d8eaf5537f699e4","entry":"np2th","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/TransformerModels.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/TransformerModels.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":2,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"7d8eaf5537f699e4"}},{"code_sha256_prefix":"0f786c407fb1ee4c","entry":"swish","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/TransformerModels.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/TransformerModels.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":2,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"0f786c407fb1ee4c"}},{"code_sha256_prefix":"71ded737bf803beb","entry":"GradientNormalizedByL1","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/AttackWrappersWhiteBoxP.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/AttackWrappersWhiteBoxP.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"71ded737bf803beb"}},{"code_sha256_prefix":"b0f916df39e78ae5","entry":"conv1x1","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/TransformerResNet.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/TransformerResNet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"b0f916df39e78ae5"}},{"code_sha256_prefix":"ee80cf467065076b","entry":"conv1x1","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/BigTransferModels.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/BigTransferModels.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"ee80cf467065076b"}},{"code_sha256_prefix":"4e5bf13dbdc4f008","entry":"conv3x3","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/TransformerResNet.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/TransformerResNet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"4e5bf13dbdc4f008"}},{"code_sha256_prefix":"f01b8d3901f0b289","entry":"conv3x3","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/BigTransferModels.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/BigTransferModels.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"f01b8d3901f0b289"}},{"code_sha256_prefix":"7023eb86801bb3a3","entry":"tf2th","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/BigTransferModels.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/BigTransferModels.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"7023eb86801bb3a3"}},{"code_sha256_prefix":"efa84ad482883af5","entry":"GetAttention","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/AttackWrappersSAGA.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/AttackWrappersSAGA.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"efa84ad482883af5"}},{"code_sha256_prefix":"975c33663559b367","entry":"resnet1001","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/ResNetPytorch.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/ResNetPytorch.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"975c33663559b367"}},{"code_sha256_prefix":"55fcf6ec82c11e08","entry":"resnet164","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/ResNetPytorch.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/ResNetPytorch.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"55fcf6ec82c11e08"}},{"code_sha256_prefix":"881ff295da65733e","entry":"resnet56","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/ResNetPytorch.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/ResNetPytorch.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"881ff295da65733e"}},{"code_sha256_prefix":"72cd943b81f2517e","entry":"validateD","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/DataManagerPytorch.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/DataManagerPytorch.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"72cd943b81f2517e"}},{"code_sha256_prefix":"7d6d811b990ecc66","entry":"validateDA","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/DataManagerPytorch.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/DataManagerPytorch.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"7d6d811b990ecc66"}},{"code_sha256_prefix":"4d607f4733726c9d","entry":"validateT","repo":"MetaMain/ViTRobust","repo_kind":"official","path":"VisionTransformersRobustness/VisionTransformersRobustness/DataManagerPytorch.py","file_url":"https://github.com/MetaMain/ViTRobust/blob/HEAD/VisionTransformersRobustness/VisionTransformersRobustness/DataManagerPytorch.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"4d607f4733726c9d"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}