mlsanityData to 7 Oct 2026

On the interplay of adversarial robustness and architecture components: patches, convolution and attention

arXiv 2209.06953 ↗First posted 14 Sep 2022cs.CV cs.LGcited by 4

Not on the map. Why?

Abstract (arXiv)

In recent years novel architecture components for image classification have been developed, starting with attention and patches used in transformers. While prior works have analyzed the influence of some aspects of architecture components on the robustness to adversarial attacks, in particular for vision transformers, the understanding of the main factors is still limited. We compare several (non)-robust classifiers with different architectures and study their properties, including the effect of adversarial training on the interpretability of the learnt features and robustness to unseen threat models. An ablation from ResNet to ConvNeXt reveals key architectural changes leading to almost 10% higher ℓ_∞-robustness.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Builds on 44 of its 51 references that are in the map. First posted on arXiv 14 Sep 2022.

Builds on

44 of 51 references.

References · 44

  1. 2017Attention Is All You Needcited by 59,932
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  4. 2021Emerging Properties in Self-Supervised Vision Transformerscited by 6,893
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
  8. 2022A ConvNet for the 2020scited by 3,545
  9. 2016Gaussian Error Linear Units (GELUs)cited by 3,431
  10. 2016Wide Residual Networkscited by 3,057
  11. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  12. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
32 more
  1. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  2. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  3. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  4. 2018Robustness May Be at Odds with Accuracycited by 873
  5. 2021Going deeper with Image Transformerscited by 759
  6. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  7. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  8. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  9. 2017Adversarial Patchcited by 514
  10. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  11. 2021XCiT: Cross-Covariance Image Transformerscited by 335
  12. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  13. 2022How Do Vision Transformers Work?cited by 305
  14. 2021Exploring the Limits of Out-of-Distribution Detectioncited by 283
  15. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  16. 2021Understanding Robustness of Transformers for Image Classificationcited by 250
  17. 2021Vision Transformers are Robust Learnerscited by 208
  18. 2022Patches Are All You Need?cited by 201
  19. 2021Data Augmentation Can Improve Robustnesscited by 193
  20. 2021Are Transformers More Robust Than CNNs?cited by 187
  21. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  22. 2018LaVAN: Localized and Visible Adversarial Noisecited by 112
  23. 2021On the Adversarial Robustness of Vision Transformerscited by 104
  24. 2019Sparse and Imperceivable Adversarial Attackscited by 95
  25. 2020Smooth Adversarial Trainingcited by 89
  26. 2020PatchAttack: A Black-box Texture-based Attack with Reinforcement Learningcited by 67
  27. 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
  28. 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 47
  29. 2021Are Vision Transformers Robust to Patch Perturbations?cited by 39
  30. 2019Transfer of Adversarial Robustness Between Perturbation Typescited by 25
  31. 2022Give Me Your Attention: Dot-Product Attention Considered Harmful for Adversarial Patch Robustnesscited by 23
  32. 2018Adversarial Framing for Image and Video Classificationcited by 15

Built on by

Cited by year

Citing papers per year: 2023: 3; 2024: 0; 2025: 1.

4 papers.

  1. 2023On the unreasonable vulnerability of transformers for image restoration -- and an easy fixcited by 11
  2. 2023Benchmarking Robustness to Adversarial Image Obfuscationscited by 8
  3. 2025Benchmarking the Spatial Robustness of DNNs via Natural and Adversarial Localized Corruptionscited by 3
  4. 2023Transformers in Unsupervised Structure-from-Motioncited by 0