Rethink Backdoor Robustness in Vision Transformers

Backdoor attacks, which induce Convolutional Neural Net-works (CNNs) to behave maliciously when a predefined trigger is present,pose serious security risks. While such threats also extend to VisionTransformers (ViTs), previous studies have suggested that existing back-door attacks remain highly effective on ViTs and can evade commondefense mechanisms—often without significantly compromising accuracy.In this paper, we revisit this claim and demonstrate that such con-clusions are overly optimistic, largely due to inadequate adaptation ofCNN-based defenses to ViTs. We show that, with proper adjustments,existing backdoor attacks can in fact be effectively mitigated. More-over, we propose a more robust attack strategy: by introducing slightperturbations to the trigger, existing attacks can be made significantlymore resistant to various defenses. We hope that our findings—bothon the defensibility of current attacks with correct adaptations and theproposed enhanced attack—will inspire deeper investigation into thebackdoor robustness of Vision Transformers. Our code is available athttps://github.com/PKU-ML/ViT_backdoor.