DeSparsify: Adversarial Attack Against Token Sparsification Mechanisms in Vision Transformers
Not on the map. Why?
Abstract (arXiv)
Vision transformers have contributed greatly to advancements in the computer vision domain, demonstrating state-of-the-art performance in diverse tasks (e.g., image classification, object detection). However, their high computational requirements grow quadratically with the number of tokens used. Token sparsification mechanisms have been proposed to address this issue. These mechanisms employ an input-dependent strategy, in which uninformative tokens are discarded from the computation pipeline, improving the model's efficiency. However, their dynamism and average-case assumption makes them vulnerable to a new threat vector - carefully crafted adversarial examples capable of fooling the sparsification mechanism, resulting in worst-case performance. In this paper, we present DeSparsify, an attack targeting the availability of vision transformers that use token sparsification mechanisms. The attack aims to exhaust the operating system's resources, while maintaining its stealthiness. Our evaluation demonstrates the attack's effectiveness on three token sparsification mechanisms and examines the attack's transferability between them and its effect on the GPU resources. To mitigate the impact of the attack, we propose various countermeasures.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 29 of its 39 references that are in the map. First posted on arXiv 4 Feb 2024.
Builds on
29 of 39 references.
References · 29
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2016The Concrete Distribution: A Continuous Relaxation of Discrete Random Variablescited by 1,135
- 2021Tokens-to-Token ViT: Training Vision Transformers from Scratch on ImageNetcited by 1,096
- 2021Transformers in Vision: A Surveycited by 1,009
- 2016Universal adversarial perturbationscited by 774
- 2018Bag of Tricks for Image Classification with Convolutional Neural Networkscited by 430
- 2021Dynamic Neural Networks: A Surveycited by 405
- 2021AdaViT: Adaptive Tokens for Efficient Vision Transformercited by 360
17 more
- 2021AdaViT: Adaptive Vision Transformers for Efficient Image Recognitioncited by 228
- 2021Adaptive Token Sampling For Efficient Vision Transformerscited by 181
- 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
- 2020Sponge Examples: Energy-Latency Attacks on Neural Networkscited by 108
- 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
- 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
- 2021Bad Characters: Imperceptible NLP Attackscited by 69
- 2020The Translucent Patch: A Physical and Universal Attack on Object Detectorscited by 62
- 2020A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inferencecited by 61
- 2018DARTS: Deceiving Autonomous Cars with Toxic Signscited by 53
- 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
- 2022Adaptive Sparse ViT: Towards Learnable Adaptive Token Pruning by Fully Exploiting Self-Attentioncited by 35
- 2022Energy-Latency Attacks via Sponge Poisoningcited by 29
- 2022Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectorscited by 28
- 2021Adversarial Mask: Real-World Universal Adversarial Attack on Face Recognition Modelcited by 19
- 2019Adversarial Exploitation of Policy Imitationcited by 13
- 2021A Review of Confidentiality Threats Against Embedded Neural Network Modelscited by 4
Built on by
Citing papers per year: 2025: 2.
2 papers.