DeSparsify: Adversarial Attack Against Token Sparsification Mechanisms
  in Vision Transformers
Oryan Yehezkel Alon Zolfi Amit Baras Yuval Elovici Asaf Shabtai
Vision transformers have contributed greatly to advancements in the computer
vision domain, demonstrating state-of-the-art performance in diverse tasks
(e.g., image classification, object detection). However, their high
computational requirements grow quadratically with the number of tokens used.
Token sparsification techniques have been proposed to address this issue. These
techniques employ an input-dependent strategy, in which uninformative tokens
are discarded from the computation pipeline, improving the model's efficiency.
However, their dynamism and average-case assumption makes them vulnerable to a
new threat vector - carefully crafted adversarial examples capable of fooling
the sparsification mechanism, resulting in worst-case performance. In this
paper, we present DeSparsify, an attack targeting the availability of vision
transformers that use token sparsification mechanisms. The attack aims to
exhaust the operating system's resources, while maintaining its stealthiness.
Our evaluation demonstrates the attack's effectiveness on three token
sparsification techniques and examines the attack's transferability between
them and its effect on the GPU resources. To mitigate the impact of the attack,
we propose various countermeasures.