Skip to content
AI News HubLIVE
Original source2 min read

Adversarial Decoys: Misdirecting Attention-Based Defenses in ViT

Summary

Researchers propose adversarial decoys, independently optimized image patches that redirect attention away from adversarial regions, bypassing attention-based defenses in Vision Transformers. The approach decouples misclassification and defense evasion, is attack-agnostic, and preserves attack effectiveness. Experiments on ImageNet reveal a fundamental limitation of using attention magnitude as an indicator of adversarial relevance.

SourcearXiv Computer VisionAuthor: Giulia Marchiori Pietrosanti, Giulio Rossolini, Giorgio Buttazzo
Adversarial Decoys: Misdirecting Attention-Based Defenses in ViT
Report an error

The correction channel is not available yet. You can copy the article reference below for later.

Correction instructions
Read article

[Submitted on 8 Jul 2026]

Title:Adversarial Decoys: Misdirecting Attention-Based Defenses in ViT

View a PDF of the paper titled Adversarial Decoys: Misdirecting Attention-Based Defenses in ViT, by Giulia Marchiori Pietrosanti and 2 other authors

View PDF HTML (experimental)

Abstract:Vision Transformers (ViTs) remain vulnerable to localized adversarial attacks, e.g., adversarial patches, while recent test-time defenses mitigate them by suppressing image tokens with abnormally high attention scores. These defenses exploit a strong coupling between attention and adversarial effectiveness: adversarial tokens often need to attract substantial attention to influence the prediction. We introduce adversarial decoys, independently optimized image patches that redirect the attention, and therefore related defenses, toward selected target tokens. Rather than jointly optimizing misclassifications and defense evasion, our approach decouples the two objectives: the original adversarial region induces the incorrect prediction, while a separate decoy manipulates the attention ranking used by the defense. A layer-wise objective increases target-token attention and promotes these tokens above competing non-target ones. Since the decoy is optimized independently of the underlying attack, the method is attack-agnostic and can be easily integrated with any existing adversarial patch attack. Experiments on ImageNet across multiple ViT architectures and attacks show that decoys can redirect high attention scores away from the true adversarial region while preserving much of the attack effectiveness. These results reveal a fundamental limitation of using attention magnitude as an indicator of adversarial relevance.

Subjects:

Computer Vision and Pattern Recognition (cs.CV); Artificial Intelligence (cs.AI)

Cite as: arXiv:2607.07922 [cs.CV]

(or arXiv:2607.07922v1 [cs.CV] for this version)

https://doi.org/10.48550/arXiv.2607.07922

arXiv-issued DOI via DataCite (pending registration)

Submission history

From: Giulia Marchiori Pietrosanti Dr. [view email] [v1] Wed, 8 Jul 2026 21:08:57 UTC (13,230 KB)

Full-text links:

Access Paper:

View a PDF of the paper titled Adversarial Decoys: Misdirecting Attention-Based Defenses in ViT, by Giulia Marchiori Pietrosanti and 2 other authors

View PDF

HTML (experimental)

TeX Source

view license

Current browse context:

cs.CV

new | recent | 2026-07

Change to browse by:

cs cs.AI

References & Citations

NASA ADS

Google Scholar

Semantic Scholar

Loading...

Data provided by:

Bibliographic Tools

Bibliographic and Citation Tools

Bibliographic Explorer Toggle

Bibliographic Explorer (What is the Explorer?)

Connected Papers Toggle

Connected Papers (What is Connected Papers?)

Litmaps Toggle

Litmaps (What is Litmaps?)

scite.ai Toggle

scite Smart Citations (What are Smart Citations?)

Code, Data, Media

Code, Data and Media Associated with this Article

alphaXiv Toggle

alphaXiv (What is alphaXiv?)

Links to Code Toggle

CatalyzeX Code Finder for Papers (What is CatalyzeX?)

DagsHub Toggle

DagsHub (What is DagsHub?)

GotitPub Toggle

Gotit.pub (What is GotitPub?)

Huggingface Toggle

Hugging Face (What is Huggingface?)

ScienceCast Toggle

ScienceCast (What is ScienceCast?)

Demos

Demos

Replicate Toggle

Replicate (What is Replicate?)

Spaces Toggle

Hugging Face Spaces (What is Spaces?)

Spaces Toggle

TXYZ.AI (What is TXYZ.AI?)

Related Papers

Recommenders and Search Tools

Link to Influence Flower

Influence Flower (What are Influence Flowers?)

Core recommender toggle

CORE Recommender (What is CORE?)

Author

Venue

Institution

Topic

About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)

Key points and analysis

Article intelligence

ResearchersAdvanced

Key points

  • Adversarial decoys are independently optimized patches that redirect attention in Vision Transformers, bypassing attention-based defenses.
  • The method decouples misclassification and defense evasion and is attack-agnostic, integrable with any existing patch attack.
  • Experiments on ImageNet show decoys effectively redirect attention scores while preserving attack effectiveness.
  • The findings reveal a fundamental limitation of using attention magnitude as a proxy for adversarial relevance.

Highlights and analysis are generated automatically and may contain errors. Check the original source.

More recent stories on this topic · Models