研究视觉Transformer的自适应优化如何被攻击者利用，导致计算量激增却不影响准确率。
A Survey of Adversarial Efficiency Degradation for Vision Transformer by Exploiting Input-adaptive Optimization
- 通过通用对抗补丁和图像特异性扰动，破坏模型的自适应计算机制。
- 攻击可使模型计算量恢复至未优化状态，平均效率损失达90%以上。
- 适合关注AI安全与边缘设备部署的研究者和开发者。
视觉变压器（ViTs）越来越多地依赖输入自适应推理（如令牌剪枝和提前终止）以满足能耗和延迟预算。本综述分析了一类针对这些机制的新型对抗性效率降级攻击，旨在增加计算量而不显著降低准确性。我们统一比较了两种代表性攻击：SlowFormer（通用对抗补丁）和DeSparsify（每图像扰动），在三种流行的令牌剪枝框架A-ViT、ATS和AdaViT上进行评估。采用GFLOPs、准确率损失和攻击成功率（AS）指标进行标准化报告，量化攻击对计算节省的侵蚀程度。理解此类攻击对设计轻量级反制措施至关重要，尤其在移动或嵌入式等低功耗场景中部署时。本文围绕三个核心问题展开分析：输入自适应优化如何制造效率降级攻击面；攻击的实际运作方式及最脆弱的优化机制；现有防御手段的有效性及其能否在攻击下恢复效率。
原文摘要 · Abstract (English)
Vision Transformers (ViTs) increasingly rely on input-adaptive inference, such as token pruning and early halting, to meet energy and latency budgets. This survey examines a recent class of adversarial efficiency degradation attacks that target these mechanisms to increase computation without necessarily degrading accuracy. We unify and compare two representative attacks, SlowFormer (a universal adversarial patch) and DeSparsify (per-image perturbations), across three popular token-pruning frameworks: A-ViT, ATS, and AdaViT. We standardize reporting using GFLOPs, accuracy loss, and an Attack Success (AS) metric that measures how much of the model's compute savings the attack takes away. Understanding these attacks is crucial for designing countermeasures that not only mitigate risk but also remain lightweight, since deployment often occurs in low-power settings such as mobile or embedded devices. To organize our analysis, we focus on three questions: how input-adaptive optimizations (e.g., token pruning and early halting) create attack surfaces for efficiency degradation; how such attacks operate in practice and which optimizations are most vulnerable; and which defenses exist today and whether they meaningfully restore efficiency under attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。