Breaking the Illusion of Security via Interpretation: Interpretable Vision Transformer Systems under Attack

TL;DR

This paper reveals that even interpretable vision transformer systems are vulnerable to adversarial attacks, introducing AdViT, which successfully deceives models and their interpretations with high confidence, challenging assumptions of security.

Contribution

The study introduces AdViT, a novel attack method that deceives both transformer models and their interpretation modules, exposing security vulnerabilities in interpretable vision systems.

Findings

AdViT achieves 100% success in fooling models in white-box and black-box scenarios.

AdViT maintains accurate interpretations despite successful attacks.

Adversarial examples generated are difficult to detect due to consistent interpretations.

Abstract

Vision transformer (ViT) models, when coupled with interpretation models, are regarded as secure and challenging to deceive, making them well-suited for security-critical domains such as medical applications, autonomous vehicles, drones, and robotics. However, successful attacks on these systems can lead to severe consequences. Recent research on threats targeting ViT models primarily focuses on generating the smallest adversarial perturbations that can deceive the models with high confidence, without considering their impact on model interpretations. Nevertheless, the use of interpretation models can effectively assist in detecting adversarial examples. This study investigates the vulnerability of transformer models to adversarial attacks, even when combined with interpretation models. We propose an attack called "AdViT" that generates adversarial examples capable of misleading both a given transformer model and its coupled interpretation model. Through extensive experiments on various transformer models and two transformer-based interpreters, we demonstrate that AdViT achieves a 100% attack success rate in both white-box and black-box scenarios. In white-box scenarios, it reaches up to 98% misclassification confidence, while in black-box scenarios, it reaches up to 76% misclassification confidence. Remarkably, AdViT consistently generates accurate interpretations in both scenarios, making the adversarial examples more difficult to detect.