ViTViz: Vision Transformer Adversarial Attack & Attention Visualization Tool
Standard robustness evaluation reports only whether an attack flips the prediction. ViTViz shows what happens underneath: load a Vision Transformer, run an adversarial attack (FGSM, PGD, MIM, SAGA, TGR), and compare clean and adversarial attention maps side by side, iteration by iteration. Every run is scored on two fronts: the usual attack metrics (attack success rate, confidence drop, L∞, PSNR, SSIM, LPIPS, modified pixels) and measures of how the attention itself redistributes, namely spatial transport (W₁), distributional divergence (JSD), and concentration shift (ΔH).
Execute adversarial attacks and visualize how attention evolves
Or choose a sample image:
Attack Configuration
PGD/MIM/TGR/SAGA: iterative | FGSM: single-step
PGD - Projected Gradient Descent · Madry et al., 2018
The iterative version of FGSM: repeats the gradient step N times, projecting back into the ε-ball after each step. Considered the standard iterative attack in the literature.
- ε: maximum radius of the total perturbation.
- Steps: number of iterations:more steps produce a stronger attack.
- α (alpha): step size per iteration. Rule of thumb: α = ε / steps.
Confidence Drop: decrease in the model's predicted probability for the reference class after the attack.
- 0.0: model equally confident before and after
- 0.3: moderate — e.g. model went from 90% to 60% on the correct class
- 0.8: severe — e.g. model went from 90% to 10%
- 1.0: complete collapse of confidence
Direction: higher magnitude = more effective attack.
Top-K Accuracy Drop: whether the reference class fell out of the model's top-5 predictions after the attack.
- No: correct class still in top 5 (weak attack or robust model)
- Yes: correct class dropped out of top 5 (strong attack)
Softer than top-1: the model can misclassify and still 'almost know' the answer. Direction: No is better.
L∞ (L-infinity distance): maximum absolute pixel change between the original and adversarial image, in [0,1] scale.
- 0.0: no perturbation at all
- 0.031 (8/255): the standard research budget — imperceptible to most humans
- 0.062 (16/255): still subtle but may be visible in uniform regions
- 0.3+: clearly visible color shifts
Direction: lower = better (less perceptible).
PSNR (Peak Signal-to-Noise Ratio): image quality in decibels (dB), based on mean squared error. Wang et al. (2004).
- ∞ dB: identical images (zero error)
- 48 dB: practical ceiling for 8-bit images
- 40+ dB: perturbation essentially invisible
- 30 dB: typical value under ε=8/255 PGD attack
- <20 dB: clearly degraded image quality
Direction: higher = better (less distortion).
SSIM (Structural Similarity Index): compares luminance, contrast and structure between images. Wang et al., IEEE Trans. Image Processing 2004.
- 1.0: structurally identical images
- 0.95–0.99: imperceptible differences (typical ε=8/255 attacks)
- 0.84: moderate degradation — perceptible under careful inspection
- 0.66: clearly degraded
- 0.0: no structural similarity
Direction: higher = better. No universal imperceptibility threshold exists.
LPIPS (Learned Perceptual Image Patch Similarity): perceptual dissimilarity via deep features (AlexNet by default). Zhang et al., CVPR 2018.
- 0.0: perceptually identical
- 0.03–0.05: typical PGD/FGSM with ε=8/255 (near-invisible)
- 0.1–0.2: noticeable perceptual difference
- 0.5+: significantly different images
- 1.0: maximally dissimilar
Direction: lower = more similar. Correlates better with human perception than PSNR/SSIM.
Modified Pixels: fraction of pixels where the perturbation exceeds a negligible threshold (1e-5 per channel). Approximates an L0-style sparsity measure.
- 0.0: no pixels changed
- 0.01: 1% of pixels changed (sparse attack)
- 1.0: every pixel changed
FGSM and PGD typically modify nearly all pixels (~1.0). Direction: lower = sparser perturbation.
Wasserstein-1 (2D Earth Mover's Distance): minimum cost of transporting attention mass between the rollout maps of the original and adversarial images, with Euclidean ground cost over the patch grid, normalised by the grid diameter D = (G−1)√2.
- 0.0: attention maps identical — no spatial transport
- higher: attention mass moved farther across the image
- 1.0: theoretical maximum (all mass moved corner to corner)
Bounded in [0, 1], comparable across grid sizes. Direction: lower = less attention shift. Same W₁ definition used in the quantitative analyses of the ViTViz work.
Jensen-Shannon Divergence: symmetric divergence between attention rollout maps, always finite.
- 0.0: identical distributions
- 0.1–0.3: moderate divergence
- 0.5: substantial difference in attention patterns
- 1.0 (log₂ base): completely disjoint distributions
Bounded in [0, 1]. Direction: lower = less attention shift. Complementary to W1 with different sensitivity.
ΔH (Shannon entropy delta): H(adversarial rollout) − H(clean rollout).
- 0.0: same uncertainty in attention before and after
- +0.5: attention became more dispersed — model confused, looking everywhere
- −0.5: attention became more concentrated — model hyper-focused on one region
Can be positive or negative. TGR and SAGA typically produce positive ΔH (attention dispersion). FGSM may go either direction.
Attack Result
Attention Evolution During the Attack
Compare the original image (left) with the attack iterations (right)
Visualization Controls
Select Attack Iteration to View
Overlay attention map on images
Original Image
Adversarial Image (Iteration)
Centro de Informática, Universidade Federal de Pernambuco