mlsanityData to 14 Oct 2026

Certified Patch Robustness via Smoothed Vision Transformers

arXiv 2110.07719 ↗First posted 11 Oct 2021cs.CV cs.AI cs.LGcited by 45

Not on the map. Why?

Abstract (arXiv)

Certified patch defenses can guarantee robustness of an image classifier to arbitrary changes within a bounded contiguous region. But, currently, this robustness comes at a cost of degraded standard accuracies and slower inference times. We demonstrate how using vision transformers enables significantly better certified patch robustness that is also more computationally efficient and does not incur a substantial drop in standard accuracy. These improvements stem from the inherent ability of the vision transformer to gracefully handle largely masked images. Our code is available at https://github.com/MadryLab/smoothed-vit.

Key facts. Cited by 45 papers in the map (data through 14 Oct 2026). Builds on 47 of its 64 references that are in the map. First posted on arXiv 11 Oct 2021.

Builds on

47 of 64 references.

References · 47

  1. 2017Attention Is All You Needcited by 60,361
  2. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  5. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
  6. 2020Training data-efficient image transformers & distillation through attentioncited by 4,586
  7. 2016Wide Residual Networkscited by 3,070
  8. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,884
  9. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  10. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 744
  11. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
  12. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
35 more
  1. 2017Adversarial Patchcited by 517
  2. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  3. 2021Intriguing Properties of Vision Transformerscited by 446
  4. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 445
  5. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 330
  6. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 328
  7. 2018Certified Defenses against Adversarial Examplescited by 306
  8. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  9. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 255
  10. 2017Formal Verification of Piece-Wise Linear Feed-Forward Neural Networkscited by 242
  11. 2018Certified Adversarial Robustness with Additive Noisecited by 180
  12. 2018Physical Adversarial Examples for Object Detectorscited by 163
  13. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  14. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  15. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 147
  16. 2020Randomized Smoothing of All Shapes and Sizescited by 147
  17. 2018Scaling provable adversarial defensescited by 143
  18. 2017An approach to reachability analysis for feed-forward ReLU neural networkscited by 127
  19. 2019A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networkscited by 125
  20. 2018LaVAN: Localized and Visible Adversarial Noisecited by 113
  21. 2020Certified Defenses for Adversarial Patchescited by 101
  22. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 98
  23. 2019On Physical Adversarial Patches for Object Detectioncited by 93
  24. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
  25. 2018Training for Faster Adversarial Robustness Verification via Inducing ReLU Stabilitycited by 67
  26. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 60
  27. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  28. 2019Attacking Optical Flowcited by 41
  29. 2019Guaranteeing Safety for Neural Network-Based Aircraft Collision Avoidance Systemscited by 26
  30. 2019Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attackscited by 25
  31. 2021Efficient Certified Defenses Against Patch Attacks on Image Classifierscited by 24
  32. 2020Dynamic Adversarial Patch for Evading Object Detection Modelscited by 20
  33. 2018Adversarial Attacks on Face Detectors using Neural Net based Constrained Optimizationcited by 18
  34. 2018Thwarting Adversarial Examples: An L0-RobustSparse Fourier Transformcited by 13
  35. 2020Neural Network Virtual Sensors for Fuel Injection Quantities with Provable Performance Specificationscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 2; 2022: 10; 2023: 16; 2024: 10; 2025: 4; 2026: 3.

45 papers.

Sort:

By area:

  1. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 66
  2. 2021Are Vision Transformers Robust to Patch Perturbations?cited by 39
  3. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
  4. 2022Missingness Bias in Model Debuggingcited by 38
  5. 2023Jedi: Entropy-based Localization and Removal of Adversarial Patchescited by 35
  6. 2022Towards Efficient Adversarial Training on Vision Transformerscited by 30
  7. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  8. 2023Estimating Conditional Mutual Information for Dynamic Feature Selectioncited by 21
  9. 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
  10. 2022Certified Defences Against Adversarial Patch Attacks on Semantic Segmentationcited by 16
  11. 2023Stability Guarantees for Feature Attributions with Multiplicative Smoothingcited by 14
  12. 2024CTBENCH: A Library and Benchmark for Certified Trainingcited by 14
33 more
  1. 2021PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testingcited by 12
  2. 2023Improving Interpretation Faithfulness for Vision Transformerscited by 12
  3. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  4. 2023Certified Zeroth-order Black-Box Defense with Robust UNet Denoisercited by 11
  5. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 11
  6. 2022Improved techniques for deterministic l2 robustnesscited by 9
  7. 2022Confidence-aware Training of Smoothed Classifiers for Certified Robustnesscited by 9
  8. 2022Towards Improved Input Masking for Convolutional Neural Networkscited by 8
  9. 2023Benchmarking Robustness to Adversarial Image Obfuscationscited by 8
  10. 2024Intriguing Equivalence Structures of the Embedding Space of Vision Transformerscited by 8
  11. 2023Fairness-aware Vision Transformer via Debiased Self-Attentioncited by 6
  12. 2023Revisiting Image Classifier Training for Improved Certified Robust Defense against Adversarial Patchescited by 6
  13. 2024CrossCert: A Cross-Checking Detection Approach to Patch Robustness Certification for Deep Learning Modelscited by 3
  14. 2025Stable Vision Concept Transformers for Medical Diagnosiscited by 3
  15. 2023Random Position Adversarial Patch for Vision Transformerscited by 2
  16. 2023A Majority Invariant Approach to Patch Robustness Certification for Deep Learning Modelscited by 2
  17. 2024Towards Robust Semantic Segmentation against Patch-based Attack via Attention Refinementcited by 2
  18. 2024Machine unlearning through fine-grained model parameters perturbationcited by 2
  19. 2024Intriguing Differences Between Zero-Shot and Systematic Evaluations of Vision-Language Transformer Modelscited by 2
  20. 2024Backdoor Defense through Self-Supervised and Generative Learningcited by 2
  21. 2024ViTGuard: Attention-aware Detection against Adversarial Examples for Vision Transformercited by 2
  22. 2023Architecture-agnostic Iterative Black-box Certified Defense against Adversarial Patchescited by 1
  23. 2023Fool the Hydra: Adversarial Attacks against Multi-view Object Detection Systemscited by 1
  24. 2024Certified Robustness against Sparse Adversarial Perturbations via Data Localizationcited by 1
  25. 2023Assist Is Just as Important as the Goal: Image Resurfacing to Aid Model's Robust Predictioncited by 0
  26. 2023Trainwreck: A damaging adversarial attack on image classifierscited by 0
  27. 2024Redesigning Traffic Signs to Mitigate Machine-Learning Patch Attackscited by 0
  28. 2025Scalable and Precise Patch Robustness Certification for Deep Learning Models with Top-k Predictionscited by 0
  29. 2025Geometry-Aware Backdoor Attacks: Leveraging Curvature in Hyperbolic Embeddingscited by 0
  30. 2025Filtered-ViT: A Robust Defense Against Multiple Adversarial Patch Attackscited by 0
  31. 2026STRAP-ViT: Segregated Tokens with Randomized -- Transformations for Defense against Adversarial Patches in ViTscited by 0
  32. 2026The Unseen Adversaries: Robust and Generalized Defense Against Adversarial Patchescited by 0
  33. 2026MRCert: Towards Post-deployment Patch Robustness Certification for Adversarially Patched Samples via Type-specific Maskingcited by 0