Dithering Defense: Adversarial Robustness of Vision Foundation Models via Multi-Level Floyd-Steinberg Dithering

Researchers demonstrated that multi-level Floyd-Steinberg error-diffusion dithering, a lightweight input transformation, can disrupt adversarial attacks against vision foundation models while preserving semantic content. Testing across six tasks, two model families, and three attack methods, the technique matched or exceeded diffusion-based denoising baselines with significantly less degradation on clean inputs. The findings offer a practical defense for frozen vision backbones, which represent a single point of failure in many downstream applications.

arXiv:2605.23065v1 Announce Type: new Abstract: Vision foundation models are widely used as frozen backbones across many downstream tasks, making them a single point of failure under adversarial attack. We study multi-level Floyd-Steinberg error-diffusion dithering as a lightweight, model-agnostic input transformation that disrupts adversarial perturbations while preserving semantic content. Unlike prior work, which was limited to binary dithering, grayscale CIFAR-10, and a single small model trained from scratch, we evaluate across six tasks classification, segmentation, depth estimation, retrieval, captioning, visual question answering , two model families DINOv2, PaliGemma , and three attacks of increasing strength PGD, MI-FGSM, SIA , as well as an adaptive attacker using a straight-through estimator. Our results show that Floyd-Steinberg dithering at intermediate quantization levels, especially when combined with post-processing blur, exceeds or matches all tested baselines, including diffusion-based denoising, with substantially less degradation on clean inputs.