mlsanityData to 7 Oct 2026

Backdoor Attacks on Vision Transformers

arXiv 2206.08477 ↗First posted 16 Jun 2022cs.CV cs.CR cs.LGcited by 13

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Vision Transformers (ViT) have recently demonstrated exemplary performance on a variety of vision tasks and are being used as an alternative to CNNs. Their design is based on a self-attention mechanism that processes images as a sequence of patches, which is quite different compared to CNNs. Hence it is interesting to study if ViTs are vulnerable to backdoor attacks. Backdoor attacks happen when an attacker poisons a small part of the training data for malicious purposes. The model performance is good on clean test images, but the attacker can manipulate the decision of the model by showing the trigger at test time. To the best of our knowledge, we are the first to show that ViTs are vulnerable to backdoor attacks. We also find an intriguing difference between ViTs and CNNs - interpretation algorithms effectively highlight the trigger on test images for ViTs but not for CNNs. Based on this observation, we propose a test-time image blocking defense for ViTs which reduces the attack success rate by a large margin. Code is available here: https://github.com/UCDvision/backdoor_transformer.git

Key facts. Cited by 13 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 25 of its 33 references that are in the map. First posted on arXiv 16 Jun 2022.

Builds on

25 of 33 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021DBIA: Data-free Backdoor Injection Attack against Transformer Networks22 Nov

Other references · 24

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  7. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
  8. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  10. 2017Revisiting Unreasonable Effectiveness of Data in Deep Learning Eracited by 916
  11. 2020Quantifying Attention Flow in Transformerscited by 759
  12. 2021Going deeper with Image Transformerscited by 759
12 more
  1. 2019Score-CAM: Score-Weighted Visual Explanations for Convolutional Neural Networkscited by 575
  2. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  3. 2021Intriguing Properties of Vision Transformerscited by 446
  4. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  5. 2019Hidden Trigger Backdoor Attackscited by 359
  6. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  7. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  8. 2019Full-Gradient Representation for Neural Network Visualizationcited by 189
  9. 2017Neural Trojanscited by 151
  10. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  11. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  12. 2021Augmenting Convolutional networks with attention-based aggregationcited by 29

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 0; 2024: 6; 2025: 3; 2026: 2.

13 papers.

Sort:

By area:

  1. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  2. 2022TrojViT: Trojan Insertion in Vision Transformerscited by 30
  3. 2022Designing Robust Transformers using Robust Kernel Density Estimationcited by 11
  4. 2024Unveiling the Hidden Structure of Self-Attention via Kernel Principal Component Analysiscited by 7
  5. 2024Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformerscited by 5
  6. 2024Context is the Key: Backdoor Attacks for In-Context Learning with Vision Transformerscited by 2
  7. 2024Backdoor Attack Against Vision Transformers via Attention Gradient-Based Image Erosioncited by 2
  8. 2024Susceptibility of Adversarial Attack on Medical Image Segmentation Modelscited by 0
  9. 2024An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformerscited by 0
  10. 2025BadViM: Backdoor Attack against Vision Mambacited by 0
  11. 2025Vision Transformers: the threat of realistic adversarial patchescited by 0
  12. 2026BadSNN: Backdoor Attacks on Spiking Neural Networks via Adversarial Spiking Neuroncited by 0
1 more
  1. 2026PASTA: A Patch-Agnostic Twofold-Stealthy Backdoor Attack on Vision Transformerscited by 0