RBFormer: Improve Adversarial Robustness of Transformer by Robust Bias

TL;DR

RBFormer is a novel Transformer-based structure that enhances adversarial robustness by increasing high-frequency robust biases, significantly improving performance on CIFAR-10 and ImageNet-1k datasets.

Contribution

The paper introduces RBFormer, a Transformer structure with increased high-frequency biases, demonstrating improved adversarial robustness without new defense mechanisms.

Findings

RBFormer outperforms baseline models with +16.12% on CIFAR-10.

RBFormer achieves +5.04% improvement on ImageNet-1k.

Enhanced robustness is achieved through structural bias adjustments.

Abstract

Recently, there has been a surge of interest and attention in Transformer-based structures, such as Vision Transformer (ViT) and Vision Multilayer Perceptron (VMLP). Compared with the previous convolution-based structures, the Transformer-based structure under investigation showcases a comparable or superior performance under its distinctive attention-based input token mixer strategy. Introducing adversarial examples as a robustness consideration has had a profound and detrimental impact on the performance of well-established convolution-based structures. This inherent vulnerability to adversarial attacks has also been demonstrated in Transformer-based structures. In this paper, our emphasis lies on investigating the intrinsic robustness of the structure rather than introducing novel defense measures against adversarial attacks. To address the susceptibility to robustness issues, we employ a rational structure design approach to mitigate such vulnerabilities. Specifically, we enhance the adversarial robustness of the structure by increasing the proportion of high-frequency structural robust biases. As a result, we introduce a novel structure called Robust Bias Transformer-based Structure (RBFormer) that shows robust superiority compared to several existing baseline structures. Through a series of extensive experiments, RBFormer outperforms the original structures by a significant margin, achieving an impressive improvement of +16.12% and +5.04% across different evaluation criteria on CIFAR-10 and ImageNet-1k, respectively.