Understanding Robustness of Transformers for Image Classification

TLDR

Deep CNNs have dominated computer vision, but Vision Transformers have recently matched or outperformed ResNets, raising questions about their robustness due to architectural differences such as non‑overlapping patches. This study evaluates a variety of robustness measures for ViT models and compares them to ResNet baselines. The authors assess robustness to input perturbations and to model perturbations, including removal of individual layers, across pre‑trained ViT and ResNet models. ViT models pretrained on ample data are at least as robust as ResNets across many perturbations, remain robust to removal of almost any single layer, and later‑layer activations, though correlated, are still crucial for classification.

Abstract

Deep Convolutional Neural Networks (CNNs) have long been the architecture of choice for computer vision tasks. Recently, Transformer-based architectures like Vision Transformer (ViT) have matched or even surpassed ResNets for image classification. However, details of the Transformer architecture –such as the use of non-overlapping patches– lead one to wonder whether these networks are as robust. In this paper, we perform an extensive study of a variety of different measures of robustness of ViT models and compare the findings to ResNet baselines. We investigate robustness to input perturbations as well as robustness to model perturbations. We find that when pre-trained with a sufficient amount of data, ViT models are at least as robust as the ResNet counterparts on a broad range of perturbations. We also find that Transformers are robust to the removal of almost any single layer, and that while activations from later layers are highly correlated with each other, they nevertheless play an important role in classification.