Abstract: Vision Transformer(ViT)is a novel architecture that breaks through the local receptive field limitation of traditional convolutional neural network and has made breakthrough progress in the field of computer vision with its global modeling capability.With the surging application of ViT in the security field,the structural differences between it and CNN have sharply reduced the effectiveness of traditional adversarial attacks,leading to the masking of the true vulnerability of ViT and the lag in the development of defense mechanisms.The model security risks triggered by adversarial attacks are driving research in this field to become a hot topic.This paper first systematically reviews the core progress of ViT adversarial attack methods,and analyzes the influence of ViT-specific structures such as image blocking,position coding,and attention mechanisms on adversarial sample attacks.Secondly,it classifies the adversarial attack methods for ViT,and divides the existing key attack methods into white-box attacks,migration-based black-box attacks,and decision-based black-box attacks.And it focuses on introducing the research progress of five types of black-box migration attacks,namely,optimization attacks on model structure,attacks based on input transformation,attacks based on integral gradient,attacks on downstream tasks,and attacks on model alignment.Then,the gradual evolution of different methods in terms of disturbance efficiency and cross-model migration is deeply explored.The core advantages and disadvantages of various attack methods are systematically summarized,revealing the evolution logic of attack techniques and model defects to provide references for the innovation of offensive and defensive technologies.Finally,the future research directions are analyzed and prospected.

Key words: Deep learning, Vision Transformer, Adversarial sample attack, Image classification, Self-attention