{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/trojvit-trojan-insertion-in-vision","title":"TrojViT: Trojan Insertion in Vision Transformers","arxiv_id":"2208.13049","date":"2022-08-27","proceeding":"CVPR 2023 1","authors":["Mengxin Zheng","Qian Lou","Lei Jiang"],"abstract":"Vision Transformers (ViTs) have demonstrated the state-of-the-art performance in various vision-related tasks. The success of ViTs motivates adversaries to perform backdoor attacks on ViTs. Although the vulnerability of traditional CNNs to backdoor attacks is well-known, backdoor attacks on ViTs are seldom-studied. Compared to CNNs capturing pixel-wise local features by convolutions, ViTs extract global context information through patches and attentions. Na\\\"ively transplanting CNN-specific backdoor attacks to ViTs yields only a low clean data accuracy and a low attack success rate. In this paper, we propose a stealth and practical ViT-specific backdoor attack $TrojViT$. Rather than an area-wise trigger used by CNN-specific backdoor attacks, TrojViT generates a patch-wise trigger designed to build a Trojan composed of some vulnerable bits on the parameters of a ViT stored in DRAM memory through patch salience ranking and attention-target loss. TrojViT further uses minimum-tuned parameter update to reduce the bit number of the Trojan. Once the attacker inserts the Trojan into the ViT model by flipping the vulnerable bits, the ViT model still produces normal inference accuracy with benign inputs. But when the attacker embeds a trigger into an input, the ViT model is forced to classify the input to a predefined target class. We show that flipping only few vulnerable bits identified by TrojViT on a ViT model using the well-known RowHammer can transform the model into a backdoored one. We perform extensive experiments of multiple datasets on various ViT models. TrojViT can classify $99.64\\%$ of test images to a target class by flipping $345$ bits on a ViT for ImageNet.Our codes are available at https://github.com/mxzheng/TrojViT","url_abs":"https://arxiv.org/abs/2208.13049v4","url_pdf":"https://arxiv.org/pdf/2208.13049v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"trojvit-trojan-insertion-in-vision","repo_url":"https://github.com/mxzheng/trojvit","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[{"method_slug":"test","method_name":"Test"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2208.13049","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2208.13049"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/mxzheng/trojvit","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_fixture":3,"ran_draft_wrong":1,"ran":2,"ran_honours":1,"unverified":6},"by_repo_kind":{"official":{"samples":13,"ran":7,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"7d8eaf5537f699e4","entry":"np2th","repo":"mxzheng/trojvit","repo_kind":"official","path":"models/modeling.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/models/modeling.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":2,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7d8eaf5537f699e4"}},{"code_sha256_prefix":"0f786c407fb1ee4c","entry":"swish","repo":"mxzheng/trojvit","repo_kind":"official","path":"models/modeling.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/models/modeling.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":2,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0f786c407fb1ee4c"}},{"code_sha256_prefix":"33efc9f1ccc7933c","entry":"drop_block_2d","repo":"mxzheng/trojvit","repo_kind":"official","path":"models/drop.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/models/drop.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"33efc9f1ccc7933c"}},{"code_sha256_prefix":"30d63ccefb97a166","entry":"drop_block_fast_2d","repo":"mxzheng/trojvit","repo_kind":"official","path":"models/drop.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/models/drop.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"30d63ccefb97a166"}},{"code_sha256_prefix":"3ac6b7d76e8e3584","entry":"drop_path","repo":"mxzheng/trojvit","repo_kind":"official","path":"models/drop.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/models/drop.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3ac6b7d76e8e3584"}},{"code_sha256_prefix":"24400bc088ed228d","entry":"make_divisible","repo":"mxzheng/trojvit","repo_kind":"official","path":"models/patch_embed.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/models/patch_embed.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"24400bc088ed228d"}},{"code_sha256_prefix":"02566da69866c48c","entry":"trunc_normal_","repo":"mxzheng/trojvit","repo_kind":"official","path":"models/vision_transformer.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/models/vision_transformer.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"02566da69866c48c"}},{"code_sha256_prefix":"8a93e041134b597a","entry":"clamp","repo":"mxzheng/trojvit","repo_kind":"official","path":"utils.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8a93e041134b597a"}},{"code_sha256_prefix":"95bc0f22b2452460","entry":"get_loaders","repo":"mxzheng/trojvit","repo_kind":"official","path":"utils.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"95bc0f22b2452460"}},{"code_sha256_prefix":"863fcccfa8230984","entry":"get_loaders_test","repo":"mxzheng/trojvit","repo_kind":"official","path":"utils.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"863fcccfa8230984"}},{"code_sha256_prefix":"c6a3027fad6cfc06","entry":"pred_batch","repo":"mxzheng/trojvit","repo_kind":"official","path":"adversarialbox/utils.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/adversarialbox/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c6a3027fad6cfc06"}},{"code_sha256_prefix":"835fbd23106cc219","entry":"to_var","repo":"mxzheng/trojvit","repo_kind":"official","path":"adversarialbox/utils.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/adversarialbox/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"835fbd23106cc219"}},{"code_sha256_prefix":"a67ef0728ca2b043","entry":"truncated_normal","repo":"mxzheng/trojvit","repo_kind":"official","path":"adversarialbox/utils.py","file_url":"https://github.com/mxzheng/trojvit/blob/HEAD/adversarialbox/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a67ef0728ca2b043"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}