{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T19:42:19Z","timestamp":1790710939003,"version":"4.1.0"},"reference-count":58,"publisher":"The Royal Society","issue":"2324","license":[{"start":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T00:00:00Z","timestamp":1784160000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000275","name":"Leverhulme Trust","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000275","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000266","name":"Engineering and Physical Sciences Research Council","doi-asserted-by":"publisher","award":["EP\/S023291\/1"],"award-info":[{"award-number":["EP\/S023291\/1"]}],"id":[{"id":"10.13039\/501100000266","id-type":"DOI","asserted-by":"publisher"}]},{"name":"MAC-MIGS EPSRC Centre for Doctoral Training under EPSRC","award":["EP\/S023291\/1"],"award-info":[{"award-number":["EP\/S023291\/1"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,7,16]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>We present a novel framework to assess the resilience of state-of-the-art transformer-based optical character recognition (TrOCR) models. In this way, we develop new untargeted and targeted attack algorithms. On a benchmark handwriting dataset, we show that adversarial perturbations to the input reveal dramatic vulnerabilities without being noticeable to the eye.<\/jats:p>\n                  <jats:p>This article is part of the theme issue \u2018Safe, secure and robust AI for safety-critical systems\u2019.<\/jats:p>","DOI":"10.1098\/rsta.2025.0127","type":"journal-article","created":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T23:41:09Z","timestamp":1784245269000},"source":"Crossref","is-referenced-by-count":2,"title":["Vulnerability analysis of transformer-based optical character recognition to adversarial attacks"],"prefix":"10.1098","volume":"384","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-8246-5028","authenticated-orcid":false,"given":"Lucas","family":"Beerens","sequence":"first","affiliation":[{"name":"The University of Edinburgh , Edinburgh, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6635-3461","authenticated-orcid":false,"given":"Desmond J.","family":"Higham","sequence":"additional","affiliation":[{"name":"The University of Edinburgh , Edinburgh, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"175","published-online":{"date-parts":[[2026,7,16]]},"reference":[{"key":"2026082409381886000_bib1","doi-asserted-by":"crossref","first-page":"142 642","DOI":"10.1109\/ACCESS.2020.3012542","article-title":"Handwritten optical character recognition (OCR): a comprehensive systematic literature review (SLR)","volume":"8","author":"Memon","year":"2020","journal-title":"IEEE Access"},{"key":"2026082409381886000_bib2","doi-asserted-by":"crossref","first-page":"2298","DOI":"10.1109\/TPAMI.2016.2646371","article-title":"An end-to-end trainable neural network for image-based sequence recognition and its application to scene text recognition","volume":"39","author":"Shi","year":"2016","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"2026082409381886000_bib3","first-page":"6000","article-title":"Attention is all you need","volume-title":"Proc. 31st Int. Conf. Neural Inf. Process. Syst.","author":"Vaswani","year":"2017"},{"key":"2026082409381886000_bib4","article-title":"AMMUS: a survey of transformer-based pretrained models in natural language processing","author":"Kalyan","year":"2021"},{"key":"2026082409381886000_bib5","doi-asserted-by":"crossref","first-page":"2012627","DOI":"10.1007\/s11704-026-60308-3","article-title":"A survey of large language models","volume":"20","author":"Zhao","year":"2026","journal-title":"Front. Comput. Sci."},{"key":"2026082409381886000_bib6","doi-asserted-by":"crossref","first-page":"5789","DOI":"10.1007\/s10462-021-09958-2","article-title":"Transformer models for text-based emotion detection: a review of BERT-based approaches","volume":"54","author":"Acheampong","year":"2021","journal-title":"Artif. Intell. Rev."},{"key":"2026082409381886000_bib7","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3505244","article-title":"Transformers in vision: a survey","volume":"54","author":"Khan","year":"2022","journal-title":"ACM Comput. Surv."},{"key":"2026082409381886000_bib8","article-title":"3D vision with transformers: a survey","author":"Lahoud","year":"2022"},{"key":"2026082409381886000_bib9","article-title":"Transformers in speech processing: a survey","author":"Latif","year":"2023"},{"key":"2026082409381886000_bib10","volume-title":"Rethinking text line recognition models","author":"Diaz","year":"2021"},{"key":"2026082409381886000_bib11","first-page":"13 094","article-title":"TrOCR: transformer-based optical character recognition with pre-trained models","volume-title":"Proc. 37th AAAI Conf. Artif. Intell.","author":"Li","year":"2023"},{"key":"2026082409381886000_bib12","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013"},{"key":"2026082409381886000_bib13","article-title":"Explaining and harnessing adversarial examples","volume-title":"3rd Int. Conf. Learn. Represent. Conf. Track Proc.","author":"Goodfellow","year":"2015"},{"key":"2026082409381886000_bib14","doi-asserted-by":"crossref","first-page":"1283","DOI":"10.3390\/electronics11081283","article-title":"Adversarial attack and defense: a survey","volume":"11","author":"Liang","year":"2022","journal-title":"Electronics"},{"key":"2026082409381886000_bib15","article-title":"A LLM assisted exploitation of AI-guardian","author":"Carlini","year":"2023"},{"key":"2026082409381886000_bib16","article-title":"Proposal for a regulation of the European Parliament and of the council laying down harmonised rules on artificial intelligence Artificial Intelligence act and amending certain union legislative acts","author":"European Comission","year":"2021"},{"key":"2026082409381886000_bib17","article-title":"Proposal for a regulation of the european parliament and of the council laying down harmonised rules on artificial intelligence (Artificial Intelligence act) and amending certain union legislative acts\u2014analysis of the final compromise text with a view to agreement","author":"European Comission","year":"2024"},{"key":"2026082409381886000_bib18","first-page":"1","article-title":"Digitized exam paper evaluation","volume-title":"2019 Proc. IEEE Int. Conf. Syst. Comput. Autom. Netw. (ICSCAN)","author":"Rajesh","year":"2019"},{"key":"2026082409381886000_bib19","first-page":"39","article-title":"Towards evaluating the robustness of neural networks","volume-title":"IEEE Symp. Secur. Priv. (SP)","author":"Carlini","year":"2017"},{"key":"2026082409381886000_bib20","volume-title":"I, Robot","author":"Asimov","year":"1950"},{"key":"2026082409381886000_bib21","first-page":"4569","article-title":"Measure and improve robustness in NLP models: a survey","volume-title":"Proc. Conf. North Am. Chapter Assoc. Comput. Linguist. Hum. Lang. Technol.","author":"Wang","year":"2022"},{"key":"2026082409381886000_bib22","first-page":"15 094","article-title":"Towards efficient data free blackbox adversarial attack","volume-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","author":"Zhang","year":"2022"},{"key":"2026082409381886000_bib23","first-page":"15 044","article-title":"Cross-modal transferable adversarial attacks from images to videos","volume-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","author":"Wei","year":"2022"},{"key":"2026082409381886000_bib24","article-title":"Fooling OCR systems with adversarial text images","author":"Song","year":"2018"},{"key":"2026082409381886000_bib25","first-page":"2574","article-title":"Deepfool: a simple and accurate method to fool deep neural networks","volume-title":"Proc. IEEE Conf. Comput. Vis. Pattern Recognit.","author":"Moosavi-Dezfooli","year":"2016"},{"key":"2026082409381886000_bib26","first-page":"506","article-title":"Practical black-box attacks against machine learning","author":"Papernot","year":"2017","journal-title":"Proc. ACM Asia Conf. Comput. Commun. Secur."},{"key":"2026082409381886000_bib27","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1145\/3128572.3140448","article-title":"Zoo: zeroth order optimization based black-box attacks to deep neural networks without training substitute models","volume-title":"Proc. ACM Workshop Artif. Intell. Secur.","author":"Chen","year":"2017"},{"key":"2026082409381886000_bib28","doi-asserted-by":"crossref","first-page":"109037","DOI":"10.1016\/j.patcog.2022.109037","article-title":"Query efficient black-box adversarial attack on deep neural networks","volume":"133","author":"Bai","year":"2023","journal-title":"Pattern Recogn."},{"key":"2026082409381886000_bib29","first-page":"1686","article-title":"On the suitability of lp-norms for creating and preventing adversarial examples","volume-title":"Proc. IEEE Conf. Comput. Vis. Pattern Recognit. Workshop","author":"Sharif","year":"2018"},{"key":"2026082409381886000_bib30","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2019.23288","article-title":"Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding","volume-title":"Proc. 2019 Network Distrib. Syst. Secur. Symp.","author":"Sch\u00f6nherr","year":"2019"},{"key":"2026082409381886000_bib31","doi-asserted-by":"crossref","first-page":"175","DOI":"10.1093\/imamat\/hxad017","article-title":"Adversarial ink: componentwise backward error attacks on deep learning","volume":"89","author":"Beerens","year":"2023","journal-title":"IMA J. Appl. Math"},{"key":"2026082409381886000_bib32","first-page":"577","article-title":"Unconstrained online handwriting recognition with recurrent neural networks","volume-title":"Proc. 21st Int. Conf. Neural Inf. Process. Syst.","author":"Graves","year":"2007"},{"key":"2026082409381886000_bib33","article-title":"An image is worth 16x16 words: transformers for image recognition at scale","author":"Dosovitskiy","year":"2020"},{"key":"2026082409381886000_bib34","first-page":"1715","article-title":"Neural machine translation of rare words with subword units","volume-title":"Proc. 54th Annu. Meet. Assoc. Comput. Linguist. Vol. 1 Long Pap.","author":"Sennrich","year":"2016"},{"key":"2026082409381886000_bib35","first-page":"10 347","article-title":"Training data-efficient image transformers & distillation through attention","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","author":"Touvron","year":"2021"},{"key":"2026082409381886000_bib36","first-page":"5776","article-title":"MiniLM: deep self-attention distillation for task-agnostic compression of pre-trained transformers","volume-title":"Proc. 34th Int. Conf. Neural Inf. Process. Syst.","author":"Wang","year":"2020"},{"key":"2026082409381886000_bib37","first-page":"582","article-title":"Distillation as a defense to adversarial perturbations against deep neural networks","volume-title":"IEEE Symp. Secur. Priv.","author":"Papernot","year":"2016"},{"key":"2026082409381886000_bib38","article-title":"Training for faster adversarial robustness verification via inducing Relu stability","volume-title":"Proc. 7th Int. Conf. Learn. Represent.","author":"Xiao","year":"2019"},{"key":"2026082409381886000_bib39","doi-asserted-by":"crossref","first-page":"160","DOI":"10.1186\/s12911-022-01891-w","article-title":"On the role of deep learning model complexity in adversarial robustness for medical images","volume":"22","author":"Rodriguez","year":"2022","journal-title":"BMC Med. Inform. Decis. Mak."},{"key":"2026082409381886000_bib40","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1093\/imamat\/hxad027","article-title":"The feasibility and inevitability of stealth attacks","volume":"89","author":"Tyukin","year":"2023","journal-title":"IMA J. Appl. Math"},{"key":"2026082409381886000_bib41","doi-asserted-by":"crossref","first-page":"103800","DOI":"10.1016\/j.cviu.2023.103800","article-title":"Exploring the differences in adversarial robustness between ViT-and CNN-based models using novel metrics","volume":"235","author":"Heo","year":"2023","journal-title":"Comput. Vis. Image Underst."},{"key":"2026082409381886000_bib42","article-title":"On the adversarial robustness of vision transformers","author":"Shao","year":"2021"},{"key":"2026082409381886000_bib43","volume-title":"Reveal of vision transformers robustness against adversarial attacks","author":"Aldahdooh","year":"2021"},{"key":"2026082409381886000_bib44","first-page":"2668","article-title":"Towards transferable adversarial attacks on vision transformers","volume-title":"Proc. AAAI Conf. Artif. Intell.","author":"Wei","year":"2022"},{"key":"2026082409381886000_bib45","first-page":"7818","article-title":"On the robustness of vision transformers to adversarial examples","volume-title":"Proc. IEEE\/CVF Int. Conf. Comput. Vis.","author":"Mahmood","year":"2021"},{"key":"2026082409381886000_bib46","first-page":"16 415","article-title":"Transferable adversarial attacks on vision transformers with token gradient regularization","volume-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","author":"Zhang","year":"2023"},{"key":"2026082409381886000_bib47","article-title":"BERT: pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018"},{"key":"2026082409381886000_bib48","first-page":"119","article-title":"TextAttack: a framework for adversarial attacks, data augmentation, and adversarial training in NLP","volume-title":"Proc. Conf. Empir. Methods Nat. Lang. Process. Syst. Demonstr.","author":"Morris","year":"2020"},{"key":"2026082409381886000_bib49","first-page":"19","article-title":"When vision fails: text attacks against ViT and OCR","volume-title":"Proc. Workshop Large AI Syst. Models Privacy Secur. Anal.","author":"Boucher","year":"2025"},{"key":"2026082409381886000_bib50","article-title":"Adversarial attacks via backward error analysis. hal-03296180, version 3","author":"Beuzeville","year":"2021"},{"key":"2026082409381886000_bib51","doi-asserted-by":"crossref","first-page":"637","DOI":"10.1007\/s12532-020-00179-2","article-title":"OSQP: an operator splitting solver for quadratic programs","volume":"12","author":"Stellato","year":"2020","journal-title":"Math. Program. Comput."},{"key":"2026082409381886000_bib52","article-title":"Adam: a method for stochastic optimization","author":"Kingma","year":"2014"},{"key":"2026082409381886000_bib53","first-page":"8026","article-title":"PyTorch: an imperative style, high-performance deep learning library","volume-title":"Proc. 33rd Int. Conf. Neural Inf. Process. Syst.","author":"Paszke","year":"2019"},{"key":"2026082409381886000_bib54","first-page":"38","article-title":"Transformers: state-of-the-art natural language processing","volume-title":"Proc. Conf. Empir. Methods Nat. Lang. Process. Syst. Demonstr.","author":"Wolf","year":"2020"},{"key":"2026082409381886000_bib55","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1145\/375360.375365","article-title":"A guided tour to approximate string matching","volume":"33","author":"Navarro","year":"2001","journal-title":"ACM Comput. Surv."},{"key":"2026082409381886000_bib56","doi-asserted-by":"crossref","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","article-title":"Adversarial examples: attacks and defenses for deep learning","volume":"30","author":"Yuan","year":"2019","journal-title":"IEEE Trans. Neural. Netw. Learn. Syst."},{"key":"2026082409381886000_bib57","article-title":"Towards deep learning models resistant to adversarial attacks","volume-title":"6th Int. Conf. Learn. Represent. Conf. Track Proc.","author":"Madry","year":"2018"},{"key":"2026082409381886000_bib58","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1007\/s100320200071","article-title":"The IAM-database: an english sentence database for offline handwriting recognition","volume":"5","author":"Marti","year":"2002","journal-title":"Int. J. Doc. Anal. Recognit."}],"container-title":["Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/royalsocietypublishing.org\/rsta\/article-pdf\/doi\/10.1098\/rsta.2025.0127\/6161071\/rsta.2025.0127.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/royalsocietypublishing.org\/rsta\/article-pdf\/doi\/10.1098\/rsta.2025.0127\/6161071\/rsta.2025.0127.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,24]],"date-time":"2026-08-24T13:45:55Z","timestamp":1787579155000},"score":1,"resource":{"primary":{"URL":"https:\/\/royalsocietypublishing.org\/rsta\/article\/384\/2324\/20250127\/482550\/Vulnerability-analysis-of-transformer-based"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,16]]},"references-count":58,"journal-issue":{"issue":"2324","published-online":{"date-parts":[[2026,7,16]]},"published-print":{"date-parts":[[2026,7,16]]}},"URL":"https:\/\/doi.org\/10.1098\/rsta.2025.0127","relation":{},"ISSN":["1364-503X","1471-2962"],"issn-type":[{"value":"1364-503X","type":"print"},{"value":"1471-2962","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,16]]},"article-number":"20250127"}}