In most cases, the attributes are used to describe metadata about methods/classes/etc. For example, there's the Serializable attribute to indicate that a class can be serialized, TestClass attribute to mark a class as a test, and the Obsolete attribute to mark something as obsolete. Reflection is used to extract this information by a process that wants to use them. It's covered well in this question about attributes.
The filter attributes in MVC, such as AuthorizeAttribute, conveys extra information similar to other attributes -- a controller method or class decorated by AuthorizeAttribute indicates that authorization is required when used by MVC. But unlike some other attributes, the filter attributes themselves contain logic to carry out the actual function -- the AuthorizeAttribute derives from Attribute (via FilterAttribute) and also implements IAuthorizationFilter. When MVC finds a controller class decorated by AuthorizeAttribute, it will call AuthorizeAttribute.OnAuthorization() method in to carry out the authorization. Also, when you are specifying global filters, you add the attribute class itself to the filters list, which can be a little bit confusing, but that's how it works:
void RegisterGlobalFilters(GlobalFilterCollection filters)
{
filters.Add(new AuthorizeAttribute());
}