{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,28]],"date-time":"2025-03-28T05:17:09Z","timestamp":1743139029526,"version":"3.40.3"},"publisher-location":"Singapore","reference-count":50,"publisher":"Springer Nature Singapore","isbn-type":[{"type":"print","value":"9789819786848"},{"type":"electronic","value":"9789819786855"}],"license":[{"start":{"date-parts":[[2024,11,3]],"date-time":"2024-11-03T00:00:00Z","timestamp":1730592000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,11,3]],"date-time":"2024-11-03T00:00:00Z","timestamp":1730592000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-981-97-8685-5_39","type":"book-chapter","created":{"date-parts":[[2024,11,2]],"date-time":"2024-11-02T05:05:58Z","timestamp":1730523958000},"page":"554-567","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Patch Attacks on\u00a0Vision Transformer via\u00a0Skip Attention Gradients"],"prefix":"10.1007","author":[{"given":"Haoyu","family":"Deng","sequence":"first","affiliation":[]},{"given":"Yanmei","family":"Fang","sequence":"additional","affiliation":[]},{"given":"Fangjun","family":"Huang","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,11,3]]},"reference":[{"key":"39_CR1","unstructured":"Aldahdooh, A., Hamidouche, W., Deforges, O.: Reveal of vision transformers robustness against adversarial attacks. arXiv:2106.03734 (2021)"},{"key":"39_CR2","doi-asserted-by":"crossref","unstructured":"Andriushchenko, M., Croce, F., Flammarion, N., Hein, M.: Square attack: a query-efficient black-box adversarial attack via random search. In: Proceedings of the European Conference on Computer Vision, pp. 484\u2013501 (2020)","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"39_CR3","doi-asserted-by":"crossref","unstructured":"Bai, T., Luo, J., Zhao, J.: Inconspicuous adversarial patches for fooling image-recognition systems on mobile devices. IEEE Internet Things J. 9515\u20139524 (2021)","DOI":"10.1109\/JIOT.2021.3124815"},{"key":"39_CR4","unstructured":"Bai, Y., Mei, J., Yuille, A.L., Xie, C.: Are transformers more robust than CNNs? Adv. Neural Inf.n Process. Syst. 26831\u201326843 (2021)"},{"key":"39_CR5","doi-asserted-by":"crossref","unstructured":"Bhojanapalli, S., Chakrabarti, A., Glasner, D., Li, D., Unterthiner, T., Veit, A.: Understanding robustness of transformers for image classification. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 10231\u201310241 (2021)","DOI":"10.1109\/ICCV48922.2021.01007"},{"key":"39_CR6","unstructured":"Brown, T.B., Man\u00e9, D., Roy, A., Abadi, M., Gilmer, J.: Adversarial patch. arXiv:1712.09665 (2017)"},{"key":"39_CR7","doi-asserted-by":"crossref","unstructured":"Carion, N., Massa, F., Synnaeve, G., Usunier, N., Kirillov, A., Zagoruyko, S.: End-to-end object detection with transformers. In: Proceedings of the European Conference on Computer Vision, pp. 213\u2013229 (2020)","DOI":"10.1007\/978-3-030-58452-8_13"},{"key":"39_CR8","doi-asserted-by":"crossref","unstructured":"Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: Proceedings of the IEEE Symposium on Security and Privacy, pp. 39\u201357 (2017)","DOI":"10.1109\/SP.2017.49"},{"key":"39_CR9","doi-asserted-by":"crossref","unstructured":"Chen, Z., Xie, L., Niu, J., Liu, X., Wei, L., Tian, Q.: Visformer: the vision-friendly transformer. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 589\u2013598 (2021)","DOI":"10.1109\/ICCV48922.2021.00063"},{"key":"39_CR10","doi-asserted-by":"crossref","unstructured":"Croce, F., Andriushchenko, M., Singh, N.D., Flammarion, N., Hein, M.: Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attacks. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp. 6437\u20136445 (2022)","DOI":"10.1609\/aaai.v36i6.20595"},{"key":"39_CR11","doi-asserted-by":"crossref","unstructured":"Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., Fei-Fei, L.: ImageNet: a large-scale hierarchical image database. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 248\u2013255 (2009)","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"39_CR12","doi-asserted-by":"crossref","unstructured":"Dong, Y., et al.: Boosting adversarial attacks with momentum. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 9185\u20139193 (2018)","DOI":"10.1109\/CVPR.2018.00957"},{"key":"39_CR13","unstructured":"Dosovitskiy, A., et\u00a0al.: An image is worth $$16\\times 16$$ words: transformers for image recognition at scale. In: Proceedings of the International Conference on Learning Representations, pp. 1\u201321 (2020)"},{"key":"39_CR14","doi-asserted-by":"crossref","unstructured":"d\u2019Ascoli, S., Touvron, H., Leavitt, M.L., Morcos, A.S., Biroli, G., Sagun, L.: ConViT: improving vision transformers with soft convolutional inductive biases. In: Proceedings of the International Conference on Machine Learning, pp. 2286\u20132296 (2021)","DOI":"10.1088\/1742-5468\/ac9830"},{"key":"39_CR15","unstructured":"Fu, Y., Zhang, S., Wu, S., Wan, C., Lin, Y.: Patch-Fool: are vision transformers always robust against adversarial perturbations? In: Proceedings of the International Conference on Learning Representations, pp. 1\u201318 (2022)"},{"key":"39_CR16","unstructured":"Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: Proceedings of the International Conference on Learning Representations, pp. 1\u201311 (2015)"},{"key":"39_CR17","doi-asserted-by":"crossref","unstructured":"Gu, J., Tresp, V., Qin, Y.: Are vision transformers robust to patch perturbations? In: Proceedings of the European Conference on Computer Vision, pp. 404\u2013421 (2022)","DOI":"10.1007\/978-3-031-19775-8_24"},{"key":"39_CR18","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770\u2013778 (2016)","DOI":"10.1109\/CVPR.2016.90"},{"key":"39_CR19","unstructured":"Hendrycks, D., Dietterich, T.: Benchmarking neural network robustness to common corruptions and perturbations. In: Proceedings of the International Conference on Learning Representations, pp. 1\u201316 (2018)"},{"key":"39_CR20","unstructured":"Joshi, A., Jagatap, G., Hegde, C.: Adversarial token attacks on vision transformers. arXiv:2110.04337 (2021)"},{"key":"39_CR21","unstructured":"Karmon, D., Zoran, D., Goldberg, Y.: LaVAN: localized and visible adversarial noise. In: Proceedings of the International Conference on Machine Learning, pp. 2507\u20132515 (2018)"},{"key":"39_CR22","unstructured":"Kingma, D.P., Ba, J.: Adam: a method for stochastic optimization. In: Proceedings of the International Conference on Learning Representations, pp. 1\u201315 (2015)"},{"key":"39_CR23","doi-asserted-by":"crossref","unstructured":"Liu, A., et al.: Perceptual-sensitive GAN for generating adversarial patches. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp. 1028\u20131035 (2019)","DOI":"10.1609\/aaai.v33i01.33011028"},{"key":"39_CR24","doi-asserted-by":"crossref","unstructured":"Liu, A., Wang, J., Liu, X., Cao, B., Zhang, C., Yu, H.: Bias-based universal adversarial patch attack for automatic Check-out. In: Proceedings of the European Conference on Computer Vision, pp. 395\u2013410 (2020)","DOI":"10.1007\/978-3-030-58601-0_24"},{"key":"39_CR25","doi-asserted-by":"crossref","unstructured":"Liu, Z., et al.: Swin transformer: hierarchical vision transformer using shifted windows. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 10012\u201310022 (2021)","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"39_CR26","doi-asserted-by":"crossref","unstructured":"Lovisotto, G., Finnie, N., Munoz, M., Mummadi, C.K., Metzen, J.H.: Give me your attention: dot-product attention considered harmful for adversarial patch robustness. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 15234\u201315243 (2022)","DOI":"10.1109\/CVPR52688.2022.01480"},{"key":"39_CR27","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: Proceedings of the International Conference on Learning Representations, pp. 1\u201323 (2018)"},{"key":"39_CR28","doi-asserted-by":"crossref","unstructured":"Mahmood, K., Mahmood, R., Van\u00a0Dijk, M.: On the robustness of vision transformers to adversarial examples. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 7838\u20137847 (2021)","DOI":"10.1109\/ICCV48922.2021.00774"},{"key":"39_CR29","doi-asserted-by":"crossref","unstructured":"Mao, X., et al.: Towards robust vision transformer. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 12042\u201312051 (2022)","DOI":"10.1109\/CVPR52688.2022.01173"},{"key":"39_CR30","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: DeepFool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2574\u20132582 (2016)","DOI":"10.1109\/CVPR.2016.282"},{"key":"39_CR31","unstructured":"Naseer, M.M., Ranasinghe, K., Khan, S.H., Hayat, M., Shahbaz\u00a0Khan, F., Yang, M.H.: Intriguing properties of vision transformers. Adv. Neural Inf. Process. Syst. 23296\u201323308 (2021)"},{"key":"39_CR32","unstructured":"Naseer, M., Ranasinghe, K., Khan, S., Khan, F., Porikli, F.: On improving adversarial transferability of vision transformers. In: Proceedings of the International Conference on Learning Representations, pp. 1\u201324 (2021)"},{"key":"39_CR33","unstructured":"Pang, R., Xi, Z., Ji, S., Luo, X., Wang, T.: On the security risks of AutoML. In: Proceedings of the USENIX Security Symposium, pp. 3953\u20133970 (2022)"},{"key":"39_CR34","unstructured":"Park, N., Kim, S.: How do vision transformers work? In: Proceedings of the International Conference on Learning Representations, pp. 1\u201326 (2021)"},{"key":"39_CR35","doi-asserted-by":"crossref","unstructured":"Paul, S., Chen, P.Y.: Vision transformers are robust learners. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp. 2071\u20132081 (2022)","DOI":"10.1609\/aaai.v36i2.20103"},{"key":"39_CR36","doi-asserted-by":"crossref","unstructured":"Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., Batra, D.: Grad-CAM: visual explanations from deep networks via gradient-based localization. In: Proceedings of the IEEE International Conference on Computer Vision, pp. 618\u2013626 (2017)","DOI":"10.1109\/ICCV.2017.74"},{"key":"39_CR37","unstructured":"Shi, Y., Han, Y., Tan, Y.A., Kuang, X.: Decision-based black-box attack against vision transformers via patch-wise adversarial removal. Adv. Neural Inf. Process. Syst. 12921\u201312933 (2022)"},{"key":"39_CR38","doi-asserted-by":"crossref","unstructured":"Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. In: Proceedings of the International Conference on Learning Representations, pp. 1\u201314 (2015)","DOI":"10.1109\/ICCV.2015.314"},{"key":"39_CR39","unstructured":"Szegedy, C., et al.: Intriguing properties of neural networks. In: Proceedings of the International Conference on Learning Representations, pp. 1\u201310 (2014)"},{"key":"39_CR40","doi-asserted-by":"crossref","unstructured":"Thys, S., Van\u00a0Ranst, W., Goedem\u00e9, T.: Fooling automated surveillance cameras: adversarial patches to attack person detection. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops, pp. 49\u201355 (2019)","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"39_CR41","unstructured":"Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., J\u00e9gou, H.: Training data-efficient image transformers & distillation through attention. In: Proceedings of the International Conference on Machine Learning, pp. 10347\u201310357 (2021)"},{"key":"39_CR42","unstructured":"Vaswani, A., et al.: Attention is all you need. In: Proceedings of the International Conference on Neural Information Processing Systems, pp. 6000\u20136010 (2017)"},{"key":"39_CR43","doi-asserted-by":"crossref","unstructured":"Wang, J.: Adversarial examples in physical world. In: Proceedings of the International Joint Conference on Artificial Intelligence, pp. 4925\u20134926 (2021)","DOI":"10.24963\/ijcai.2021\/694"},{"key":"39_CR44","doi-asserted-by":"crossref","unstructured":"Wang, Y., et al.: Generating transferable adversarial examples against vision transformers. In: Proceedings of the ACM International Conference on Multimedia, pp. 5181\u20135190 (2022)","DOI":"10.1145\/3503161.3547989"},{"key":"39_CR45","doi-asserted-by":"crossref","unstructured":"Wei, Z., Chen, J., Goldblum, M., Wu, Z., Goldstein, T., Jiang, Y.G.: Towards transferable adversarial attacks on vision transformers. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp. 2668\u20132676 (2022)","DOI":"10.1609\/aaai.v36i3.20169"},{"key":"39_CR46","doi-asserted-by":"publisher","unstructured":"Wightman, R.: PyTorch Image Models. https:\/\/github.com\/rwightman\/pytorch-image-models (2019). https:\/\/doi.org\/10.5281\/zenodo.4414861","DOI":"10.5281\/zenodo.4414861"},{"key":"39_CR47","doi-asserted-by":"crossref","unstructured":"Wu, H., et al.: CvT: introducing convolutions to vision transformers. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 22\u201331 (2021)","DOI":"10.1109\/ICCV48922.2021.00009"},{"key":"39_CR48","doi-asserted-by":"crossref","unstructured":"Xu, W., Xu, Y., Chang, T., Tu, Z.: Co-scale conv-attentional image transformers. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 9981\u20139990 (2021)","DOI":"10.1109\/ICCV48922.2021.00983"},{"key":"39_CR49","doi-asserted-by":"crossref","unstructured":"Zheng, S., et al.: Rethinking semantic segmentation from a sequence-to-sequence perspective with transformers. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 6881\u20136890 (2021)","DOI":"10.1109\/CVPR46437.2021.00681"},{"key":"39_CR50","doi-asserted-by":"crossref","unstructured":"Zolfi, A., Kravchik, M., Elovici, Y., Shabtai, A.: The translucent patch: a physical and universal attack on object detectors. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 15232\u201315241 (2021)","DOI":"10.1109\/CVPR46437.2021.01498"}],"container-title":["Lecture Notes in Computer Science","Pattern Recognition and Computer Vision"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-97-8685-5_39","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,30]],"date-time":"2024-11-30T17:58:06Z","timestamp":1732989486000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-97-8685-5_39"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,11,3]]},"ISBN":["9789819786848","9789819786855"],"references-count":50,"URL":"https:\/\/doi.org\/10.1007\/978-981-97-8685-5_39","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2024,11,3]]},"assertion":[{"value":"3 November 2024","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"PRCV","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Chinese Conference on Pattern Recognition and Computer Vision (PRCV)","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Urumqi","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"China","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18 October 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20 October 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"7","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ccprcv2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/2024.prcv.cn\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}