Dithering Defense: Adversarial Robustness of Vision Foundation Models via Multi-Level Floyd-Steinberg Dithering
Not on the map. Why?
Abstract (arXiv)
Vision foundation models are widely used as frozen backbones across many downstream tasks, making them a single point of failure under adversarial attack. We study multi-level Floyd-Steinberg error-diffusion dithering as a lightweight, model-agnostic input transformation that disrupts adversarial perturbations while preserving semantic content. Unlike prior work, which was limited to binary dithering, grayscale CIFAR-10, and a single small model trained from scratch, we evaluate across six tasks (classification, segmentation, depth estimation, retrieval, captioning, visual question answering), two model families (DINOv2, PaliGemma), and three attacks of increasing strength (PGD, MI-FGSM, SIA), as well as an adaptive attacker using a straight-through estimator. Our results show that Floyd-Steinberg dithering at intermediate quantization levels, especially when combined with post-processing blur, exceeds or matches all tested baselines, including diffusion-based denoising, with substantially less degradation on clean inputs.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 21 of its 24 references that are in the map. First posted on arXiv 21 May 2026.
Builds on
21 of 24 references.
References · 21
- 2023DINOv2: Learning Robust Visual Features without Supervisioncited by 7,974
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2023Sigmoid Loss for Language Image Pre-Trainingcited by 3,109
- 2016Making the V in VQA Matter: Elevating the Role of Image Understanding in Visual Question Answeringcited by 2,516
- 2021CLIPScore: A Reference-free Evaluation Metric for Image Captioningcited by 2,424
- 2013Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computationcited by 2,079
- 2015Microsoft COCO Captions: Data Collection and Evaluation Servercited by 1,462
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
- 2016SPICE: Semantic Propositional Image Caption Evaluationcited by 824
- 2024PaliGemma: A versatile 3B VLM for transfercited by 696
9 more
- 2017Countering Adversarial Images using Input Transformationscited by 520
- 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
- 2018Revisiting Oxford and Paris: Large-Scale Image Retrieval Benchmarkingcited by 191
- 2022(Certified!!) Adversarial Robustness for Free!cited by 132
- 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
- 2013Indoor Semantic Segmentation using depth informationcited by 56
- 2021Error Diffusion Halftoning Against Adversarial Examplescited by 2
- 2025Task-Agnostic Attacks Against Vision Foundation Modelscited by 1
- 2025Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade offcited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025Diffusion-based Cumulative Adversarial Purification for Vision Language Models
- 2026DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models
- 2025MMT-ARD: Multimodal Multi-Teacher Adversarial Distillation for Robust Vision-Language Models
- 2026Improving Adversarial Transferability on Vision-Language Pre-training Models via Surrogate-Specific Bias Correction
- 2025DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purification
- 2023Distilling Out-of-Distribution Robustness from Vision-Language Foundation Models
- 2024DiffuseDef: Improved Robustness to Adversarial Attacks via Iterative Denoising
- 2025Robust Vision-Language Models via Tensor Decomposition: A Defense Against Adversarial Attacks