A Broader Impact As brand-new models, the vulnerability of ViTs to adversarial samples motivates us to upgrade their

Our approaches may contribute to a safer use of ViTs in the real world. We have shown the necessity of gradient clipping (GC) for ViTs in Section 3.2. In this section, we evaluate the proposed method on ImageNet-1K, the most commonly used large-scale dataset. We apply the most popular threat model on ImageNet-1K, i.e., setting the perturbation PGD-5 with the step size 2/ 255 to craft adversarial examples on the fly during training. In Table 7, our method improves both natural accuracy and robustness by notable margins.