English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Vision transformers (ViTs) have demonstrated impressive performance andstronger adversarial robustness compared to Convolutional Neural Networks(CNNs). On the one hand, ViTs' focus on global interaction between individualpatches reduces the local noise sensitivity of images. On the other hand, theneglect of noise sensitivity differences between image regions by existingdecision-based attacks further compromises the efficiency of noise compression,especially for ViTs. Therefore, validating the black-box adversarial robustnessof ViTs when the target model can only be queried still remains a challengingproblem. In this paper, we theoretically analyze the limitations of existingdecision-based attacks from the perspective of noise sensitivity differencebetween regions of the image, and propose a new decision-based black-box attackagainst ViTs, termed Patch-wise Adversarial Removal (PAR). PAR divides imagesinto patches through a coarse-to-fine search process and compresses the noiseon each patch separately. PAR records the noise magnitude and noise sensitivityof each patch and selects the patch with the highest query value for noisecompression. In addition, PAR can be used as a noise initialization method forother decision-based attacks to improve the noise compression efficiency onboth ViTs and CNNs without introducing additional calculations. Extensiveexperiments on three datasets demonstrate that PAR achieves a much lower noisemagnitude with the same number of queries.

Decision-based Black-box Attack Against Vision Transformers via Patch-wise Adversarial Removal