Vulnerability Analysis of Transformer-based Optical Character Recognition to Adversarial Attacks
Not on the map. Why?
Abstract (arXiv)
Recent advancements in Optical Character Recognition (OCR) have been driven by transformer-based models. OCR systems are critical in numerous high-stakes domains, yet their vulnerability to adversarial attack remains largely uncharted territory, raising concerns about security and compliance with emerging AI regulations. In this work we present a novel framework to assess the resilience of Transformer-based OCR (TrOCR) models. We develop and assess algorithms for both targeted and untargeted attacks. For the untargeted case, we measure the Character Error Rate (CER), while for the targeted case we use the success ratio. We find that TrOCR is highly vulnerable to untargeted attacks and somewhat less vulnerable to targeted attacks. On a benchmark handwriting data set, untargeted attacks can cause a CER of more than 1 without being noticeable to the eye. With a similar perturbation size, targeted attacks can lead to success rates of around 25% -- here we attacked single tokens, requiring TrOCR to output the tenth most likely token from a large vocabulary.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 41 of its 58 references that are in the map. First posted on arXiv 28 Nov 2023.
Builds on
41 of 58 references.
References · 41
- 2017Attention Is All You Needcited by 59,932
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2014Adam: A Method for Stochastic Optimizationcited by 36,960
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2015Neural Machine Translation of Rare Words with Subword Unitscited by 2,898
- 2023A Survey of Large Language Modelscited by 2,537
29 more
- 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,414
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2021Transformers in Vision: A Surveycited by 1,009
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2015An End-to-End Trainable Neural Network for Image-based Sequence Recognition and Its Application to Scene Text Recognitioncited by 519
- 2017Adversarial Examples: Attacks and Defenses for Deep Learningcited by 350
- 2021TrOCR: Transformer-based Optical Character Recognition with Pre-trained Modelscited by 278
- 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
- 2017OSQP: An Operator Splitting Solver for Quadratic Programscited by 156
- 2021AMMUS : A Survey of Transformer-based Pretrained Models in Natural Language Processingcited by 131
- 2021Measure and Improve Robustness in NLP Models: A Surveycited by 107
- 2021On the Adversarial Robustness of Vision Transformerscited by 104
- 2018Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hidingcited by 83
- 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
- 2018Training for Faster Adversarial Robustness Verification via Inducing ReLU Stabilitycited by 67
- 2018On the Suitability of Lp-norms for Creating and Preventing Adversarial Examplescited by 57
- 2020Handwritten Optical Character Recognition (OCR): A Comprehensive Systematic Literature Review (SLR)cited by 56
- 2021Rethinking Text Line Recognition Modelscited by 45
- 2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
- 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
- 2023Transformers in Speech Processing: A Surveycited by 38
- 20223D Vision with Transformers: A Surveycited by 21
- 2023A LLM Assisted Exploitation of AI-Guardiancited by 14
- 2018Fooling OCR Systems with Adversarial Text Imagescited by 12
- 2021The Feasibility and Inevitability of Stealth Attackscited by 12
- 2023Adversarial Ink: Componentwise Backward Error Attacks on Deep Learningcited by 7
- 2023When Vision Fails: Text Attacks Against ViT and OCRcited by 5
Built on by
Citing papers per year: 2024: 2.
2 papers.