{"id":"https://openalex.org/W7155404500","doi":"https://doi.org/10.48550/arxiv.2604.20047","title":"PASTA: A Patch-Agnostic Twofold-Stealthy Backdoor Attack on Vision Transformers","display_name":"PASTA: A Patch-Agnostic Twofold-Stealthy Backdoor Attack on Vision Transformers","publication_year":2026,"publication_date":"2026-04-21","ids":{"openalex":"https://openalex.org/W7155404500","doi":"https://doi.org/10.48550/arxiv.2604.20047"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.20047","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.20047","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.20047","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5046760448","display_name":"Dazhuang Liu","orcid":"https://orcid.org/0000-0002-7250-1264"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Dazhuang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005473976","display_name":"Yanqi Qiao","orcid":"https://orcid.org/0000-0003-0180-0096"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qiao, Yanqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134421499","display_name":"Rui Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Rui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001485404","display_name":"Kaitai Liang","orcid":"https://orcid.org/0000-0003-0262-7678"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liang, Kaitai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5005247877","display_name":"Georgios Smaragdakis","orcid":"https://orcid.org/0000-0002-4127-3617"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Smaragdakis, Georgios","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9458000063896179,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9458000063896179,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10036","display_name":"Advanced Neural Network Applications","score":0.018300000578165054,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.003700000001117587,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9937000274658203},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6098999977111816},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.4162999987602234},{"id":"https://openalex.org/keywords/transformer","display_name":"Transformer","score":0.3718999922275543}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9937000274658203},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.628600001335144},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6098999977111816},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4162999987602234},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4092000126838684},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.3718999922275543},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3140999972820282},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.2590999901294708},{"id":"https://openalex.org/C47446073","wikidata":"https://www.wikidata.org/wiki/Q5165890","display_name":"Control theory (sociology)","level":3,"score":0.24480000138282776},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.24459999799728394}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.20047","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.20047","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.20047","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.20047","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.4794694185256958}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Vision":[0],"Transformers":[1],"(ViTs)":[2],"have":[3],"achieved":[4],"remarkable":[5],"success":[6,210],"across":[7,48,67,212,234],"vision":[8],"tasks,":[9],"yet":[10],"recent":[11],"studies":[12],"show":[13,204],"they":[14,37],"remain":[15],"vulnerable":[16],"to":[17,32,93,155,195,198],"backdoor":[18,123,133,185],"attacks.":[19],"Existing":[20],"patch-wise":[21,57,122],"attacks":[22,98],"typically":[23],"assume":[24],"a":[25,56,70,119,150,177],"single":[26],"fixed":[27],"trigger":[28,34,58,84,101,137,152,192],"location":[29],"during":[30,86,143],"inference":[31],"maximize":[33,100],"attention.":[35],"However,":[36,158],"overlook":[38],"the":[39,74,136,189],"self-attention":[40],"mechanism":[41],"in":[42,125],"ViTs,":[43],"which":[44],"captures":[45],"long-range":[46],"dependencies":[47],"patches.":[49],"In":[50],"this":[51],"work,":[52],"we":[53,72,116,148],"observe":[54],"that":[55,82,99,205],"can":[59,88],"achieve":[60,146],"high":[61],"attack":[62,124,209],"effectiveness":[63],"when":[64,135],"activating":[65],"backdoors":[66],"neighboring":[68],"patches,":[69],"phenomenon":[71],"term":[73],"Trigger":[75],"Radiating":[76],"Effect":[77],"(TRE).":[78],"We":[79,174],"further":[80],"find":[81],"inter-patch":[83],"insertion":[85,153],"training":[87],"synergistically":[89],"enhance":[90,156],"TRE":[91,164,168],"compared":[92],"single-patch":[94],"insertion.":[95],"Prior":[96],"ViT-specific":[97],"attention":[102,107,129,222],"often":[103],"sacrifice":[104],"visual":[105,220],"and":[106,128,181,191,221,225,227,239],"stealthiness,":[108],"making":[109],"them":[110],"detectable.":[111],"Based":[112],"on":[113,215],"these":[114],"insights,":[115],"propose":[117,182],"PASTA,":[118],"twofold":[120],"stealthy":[121,172],"both":[126],"pixel":[127],"domains.":[130],"PASTA":[131,206],"enables":[132],"activation":[134],"is":[138,165,169],"placed":[139],"at":[140],"arbitrary":[141,213],"patches":[142,214],"inference.":[144],"To":[145],"this,":[147],"introduce":[149],"multi-location":[151],"strategy":[154],"TRE.":[157],"preserving":[159],"stealthiness":[160,223],"while":[161,217],"maintaining":[162],"strong":[163],"challenging,":[166],"as":[167],"weakened":[170],"under":[171],"constraints.":[173],"therefore":[175],"formulate":[176],"bi-level":[178],"optimization":[179],"problem":[180],"an":[183],"adaptive":[184],"learning":[186],"framework,":[187],"where":[188],"model":[190],"iteratively":[193],"adapt":[194],"each":[196],"other":[197],"avoid":[199],"local":[200],"optima.":[201],"Extensive":[202],"experiments":[203],"achieves":[207],"99.13%":[208],"rate":[211],"average,":[216],"significantly":[218],"improving":[219],"(144.43x":[224],"18.68x)":[226],"robustness":[228],"(2.79x)":[229],"against":[230],"state-of-the-art":[231],"ViT":[232],"defenses":[233],"four":[235],"datasets,":[236],"outperforming":[237],"CNN-":[238],"ViT-based":[240],"baselines.":[241]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-24T00:00:00"}