TLDR: This research investigates the vulnerability of Vision Transformers (ViTs) to realistic adversarial patches, which are unique patterns designed to cause misclassification in AI systems. The study used a Creases Transformation (CT) technique to create patches that simulate natural fabric distortions. Experiments on four fine-tuned ViT models for person vs. non-person classification showed significant vulnerabilities, with attack success rates ranging from 40.04% to 99.97%. The findings confirm that adversarial patches, even those originally designed for Convolutional Neural Networks (CNNs), can effectively transfer to ViTs, and that pre-training data scale and methodology influence a model’s resilience. This highlights critical security concerns for AI systems in sensitive applications like border security.
The increasing reliance on advanced machine learning systems, particularly in critical areas like border security and law enforcement, has brought their security to the forefront of concerns. These AI systems, often used in applications such as body-worn cameras and surveillance platforms, are vulnerable to evasion attacks where adversaries manipulate their decision-making processes. Such attacks can lead to serious security breaches, like misclassifying targets or allowing illicit goods to pass undetected.
Vision Transformers (ViTs) have emerged as a dominant force in modern machine learning, often outperforming traditional Convolutional Neural Networks (CNNs) and showing increased robustness against certain types of adversarial perturbations. However, new research reveals that ViTs are not immune to all threats, especially those posed by ‘adversarial patches’ – unique patterns specifically designed to trick AI classification systems.
A recent study delves into this vulnerability by designing realistic adversarial patches. These patches are crafted using a technique called Creases Transformation (CT), which introduces subtle geometric distortions that mimic natural folds and creases found in clothing. The goal is to investigate how effectively these realistic patches can cause misclassification in person vs. non-person classification tasks.
The research also explores the transferability of adversarial attack techniques, traditionally used against CNNs, when applied to ViT classification models. The experimental evaluation involved four fine-tuned ViT models on a binary person classification task. The results showed significant variations in vulnerability, with attack success rates ranging from 40.04% for the google/vit-base-patch16-224-in21k model to a staggering 99.97% for the facebook/dino-vitb16 model. Other models, like google/vit-base-patch16-224 and facebook/dinov3-vitb16, also showed considerable susceptibility at 66.40% and 65.17% respectively.
These findings confirm a critical aspect: adversarial patches can indeed transfer their effectiveness across different AI architectures, from CNNs to ViTs. Furthermore, the study highlights that the scale and methodology of a model’s pre-training dataset significantly influence its resilience to these adversarial attacks. Models pre-trained on larger, more diverse datasets, like ImageNet-21k, demonstrated improved robustness compared to those trained on smaller datasets.
The methodology involved fine-tuning pre-trained ViT models on a custom dataset of 25,000 images, specifically curated for person vs. non-person classification from the Microsoft COCO dataset. To generate the adversarial patches, the researchers adapted the Dynamic Adversarial Patches (DAP) framework. This involved applying various ‘Expectation over Transformation’ methods, such as random rotation, dynamic resizing, affine transformations, brightness/contrast adjustments, and noise injection, to enhance patch robustness and physical realism. Crucially, the Crease Transformation (CT) block was integrated to simulate realistic fabric deformations, making the patches more plausible for real-world application on garments or flexible surfaces.
Also Read:
- Advancing Stealth and Efficacy in Clean-Label Backdoor Attacks on Deep Neural Networks
- Protecting Biometric Data with AI: Transforming Faces into Flowers for Enhanced Privacy
The study’s conclusion underscores the urgent need for robust and adaptive defense mechanisms specifically tailored for ViT-based systems. While the digital effectiveness of these attacks has been established, future research will focus on validating their performance in physical deployment scenarios, considering real-world conditions like varying lighting and viewing angles. This work is crucial for safeguarding critical infrastructure systems that increasingly rely on advanced transformer-based vision models. For more detailed information, you can refer to the full research paper here.
