# Defending Backdoor Attacks on Vision Transformer via Patch Processing Source: [Defending Backdoor Attacks on Vision Transformer via Patch Processing]() Collection index: [llms.txt]() Data updated: 2025-10-27T06:19:28.634Z Authors: Khoa D. Doan, Yingjie Lao, Peng Yang, Ping Li Published: 2022-06-24T17:29:47.000Z ## Abstract Vision Transformers (ViTs) have a radically different architecture with significantly less inductive bias than Convolutional Neural Networks. Along with the improvement in performance, security and robustness of ViTs are also of great importance to study. In contrast to many recent works that exploit the robustness of ViTs against adversarial examples, this paper investigates a representative causative attack, i.e., backdoor. We first examine the vulnerability of ViTs against various backdoor attacks and find that ViTs are also quite vulnerable to existing attacks. However, we observe that the clean-data accuracy and backdoor attack success rate of ViTs respond distinctively to patch transformations before the positional encoding. Then, based on this finding, we propose an effective method for ViTs to defend both patch-based and blending-based trigger backdoor attacks via patch processing. The performances are evaluated on several benchmark datasets, including CIFAR10, GTSRB, and TinyImageNet, which show the proposed novel defense is very successful in mitigating backdoor attacks for ViTs. To the best of our knowledge, this paper presents the first defensive strategy that utilizes a unique characteristic of ViTs against backdoor attacks. The paper will appear in the Proceedings of the AAAI'23 Conference. This work was initially submitted in November 2021 to CVPR'22, then it was re-submitted to ECCV'22. The paper was made public in June 2022. The authors sincerely thank all the referees from the Program Committees of CVPR'22, ECCV'22, and AAAI'23. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Image Classification on ImageNet-1K (test val) (Backdoor Attack Metrics)](): Image Classification; ImageNet 1k (test val); Clean Accuracy (C-ACC): 76.07. - [Image Recognition on ImageNet 1K (val)](): Image Recognition; ImageNet-1k (val); CDA: 79.47. ## Original sources and implementation [Original paper]() [PDF]()