# On the interplay of adversarial robustness and architecture components: patches, convolution and attention

Source: [On the interplay of adversarial robustness and architecture components: patches, convolution and attention](<https://www.sota2.com/research/paper/68fa6d681e209131cea39982>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-10-26T00:33:23.458Z

Authors: Francesco Croce, Matthias Hein

Published: 2022-09-14T22:02:32.000Z

## Abstract

In recent years novel architecture components for image classification have been developed, starting with attention and patches used in transformers. While prior works have analyzed the influence of some aspects of architecture components on the robustness to adversarial attacks, in particular for vision transformers, the understanding of the main factors is still limited. We compare several (non)-robust classifiers with different architectures and study their properties, including the effect of adversarial training on the interpretability of the learnt features and robustness to unseen threat models. An ablation from ResNet to ConvNeXt reveals key architectural changes leading to almost $10\\%$ higher $\\ell\_\\infty$-robustness.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2209.06953>)

[PDF](<https://arxiv.org/pdf/2209.06953.pdf>)