Title: Breaking the Illusion of Security via Interpretation: Interpretable Vision Transformer Systems under Attack Show Chinese title

Title: 通过解释打破安全的幻觉：受攻击下的可解释视觉变换器系统

Abstract: Vision transformer (ViT) models, when coupled with interpretation models, are regarded as secure and challenging to deceive, making them well-suited for security-critical domains such as medical applications, autonomous vehicles, drones, and robotics. However, successful attacks on these systems can lead to severe consequences. Recent research on threats targeting ViT models primarily focuses on generating the smallest adversarial perturbations that can deceive the models with high confidence, without considering their impact on model interpretations. Nevertheless, the use of interpretation models can effectively assist in detecting adversarial examples. This study investigates the vulnerability of transformer models to adversarial attacks, even when combined with interpretation models. We propose an attack called "AdViT" that generates adversarial examples capable of misleading both a given transformer model and its coupled interpretation model. Through extensive experiments on various transformer models and two transformer-based interpreters, we demonstrate that AdViT achieves a 100% attack success rate in both white-box and black-box scenarios. In white-box scenarios, it reaches up to 98% misclassification confidence, while in black-box scenarios, it reaches up to 76% misclassification confidence. Remarkably, AdViT consistently generates accurate interpretations in both scenarios, making the adversarial examples more difficult to detect. Show Chinese abstract

Abstract: 视觉变压器（ViT）模型，当与解释模型结合时，被认为是安全且难以欺骗的，因此非常适合医疗应用、自动驾驶汽车、无人机和机器人等安全关键领域。 然而，对这些系统的成功攻击可能导致严重后果。 针对ViT模型的威胁研究主要集中在生成最小的对抗扰动，这些扰动可以以高置信度欺骗模型，而没有考虑它们对模型解释的影响。 然而，使用解释模型可以有效地帮助检测对抗样本。 本研究调查了变压器模型在结合解释模型的情况下对对抗攻击的脆弱性。 我们提出了一种称为“AdViT”的攻击，该攻击生成的对抗样本能够误导给定的变压器模型及其耦合的解释模型。 通过在各种变压器模型和两个基于变压器的解释器上的大量实验，我们证明了 AdViT在白盒和黑盒场景中的攻击成功率均为100%。 在白盒场景中，它达到高达98%的错误分类置信度，而在黑盒场景中，它达到高达76%的错误分类置信度。 值得注意的是，AdViT在两种场景中都能持续生成准确的解释，使得对抗样本更难被检测到。