The study systematically compares two distinct adversarial training strategies: ‘pre-train’, where adversarial examples are generated beforehand, and ‘in-train’, where perturbations are introduced dynamically during the training process, to understand the advantages and limitations of each approach in enhancing model robustness.
Abstract
Adversarial attacks pose a significant threat to the reliability and security of Artificial Intelligence (AI) systems, especially as AI integrates into critical fields like healthcare and finance. This work specifically addresses adversarial evasion attacks conducted during the testing phase. In this study, attacks are designed to be untargeted (misleading the model to any wrong class) and white-box (attacker has access to the model), using small perturbations to cause incorrect classifications. To counter these threats, this research investigates adversarial training, a defense mechanism where models are trained using data generated by attacks. The study systematically compares two distinct adversarial training strategies: ‘pre-train’, where adversarial examples are generated beforehand, and ‘in-train’, where perturbations are introduced dynamically during the training process. This comparison aims to understand the advantages and limitations of each approach in enhancing model robustness. Using a Fully Connected Neural Network (FCNN) and the MNIST dataset, experiments were conducted with attacks like FGSM and BIM at varying perturbation strengths $\epsilon $ . The results provide a controlled comparison of adversarial training strategies, highlighting key trade-offs between robustness and generalization. We observe that the ‘in-train’ strategy provides superior robustness in the evaluated setting against white-box, untargeted attacks compared to the ‘pre-train’ method. However, the findings are derived from experiments on the MNIST dataset using FCNNs, and therefore should be interpreted as foundational insights. Extending the analysis to more complex datasets and architectures remains an important direction for future work.
A detailed overview of the security risks associated with adversarial attacks is offered, including evasion attacks carried out at inference time, data poisoning that corrupts the training process, backdoor insertion that hides dormant triggers inside a model, and model inversion that leaks private information back out of a trained system.
Harsh Verma· International Journal of Sci...· 0 citations
Machine learning models, particularly deep learning architectures, achieve high performance in prediction tasks but remain susceptible to adversarial attacks. This study aims to enhance the robustness of Convolutional Neural Networks (CNNs), Deep Neural Networks (DNNs), and Recurrent Neural Networks (RNNs), thereby improving the security of machine learning systems. A three-step approach is adopted. First, benign sample classification is performed using the MNIST benchmark dataset. Second, adversarial attacks, namely Projected Gradient Descent (PGD), DeepFool (DF), and the Fast Gradient Sign Method (FGSM), are launched on the trained models, resulting in significant performance degradation. Based on the biased outputs induced by adversarial perturbations, an adversarial detection model is subsequently established. Third, to counteract these attacks, various defense strategies, including adversarial training, defensive distillation, autoencoder-based denoising, ensemble methods, and feature squeezing are employed and evaluated using standard performance metrics and graphical analyses. The results indicate that, in the absence of defense mechanisms, PGD attacks lead to accuracy drops of approximately 27% in CNNs, 83% in DNNs, and 90% in RNNs, demonstrating severe model vulnerabilities. However, when defense strategies are applied, all models recover to an accuracy of at least 98.9%, with adversarial training improving performance under attack by up to 90%. Among the evaluated models, CNNs exhibit the highest baseline robustness, whereas DNNs and RNNs rely more heavily on defense mechanisms to maintain performance. These findings provide valuable insights into the development of secure and resilient machine learning systems capable of mitigating adversarial threats.
Surekha M., A. K. Sagar, Vineeta Khemchandani· International Journal of Int...· 0 citations
The review explores the key adversarial attack classes: poisoning, evasion, model extraction, model extraction, model inversion, and membership inference and also white-box, black-box, and grey-box threat models.
Ujjwal Deshmukh· International Journal of Inn...· 0 citations
Experimental results indicate that CNN-based NIDS are more vulnerable to adversarial attacks than ANN-based models, with adversarial examples successfully transferring across architectures, highlighting the critical risks associated with adversarial transferability.
Aasim Zafar, Shazra Wali, S. B. U. Haque· International Journal of Inf...· 0 citations
Adversarial attacks guide and provide additional training and test data for both adversarial training and adversarial robustness validation, and expose the'piecewise linearity'of deep learning based models. Since adversarial attacks and adversarial robustness are mathematically defined problems that can be optimised directly with end-to-end differentiable search, adversarial robustness is more widely applicable than other robustness metrics such as corruption and perturbation robustness, and new kinds of adversarial attacks are beneficial for robustness testing. Attacks are targeted or non-targeted depending on whether the image is modified to misclassify to a particular class or to any incorrect class; we focus on the non-targeted setting. Finding the optimal input data points and hyper-parameters for generating non-targeted adversarial attacks remains a challenge for current methods like the Fast Gradient Method, Basic Iterative Method and Virtual Adversarial Method. We propose a new method, the"Binary Iterative Method"(BinIM), which uses a divide-and-conquer paradigm to optimise parameters and hyper-parameters for the generation of non-targeted attacks. We compare our method to other gradient-based adversarial attacks evaluated over pre-trained networks (InceptionV3, InceptionV2, ResNet V2 152) on classification tasks. On 1000 randomly-sampled images from the standard ImageNet dataset, the Binary Iterative Method outperforms all other gradient-based methods, qualitatively making the classifier misclassify with confidence up to 0.995 while reducing the probability of the true label to 2.21e-09 (approximately 0).
This survey provides a comprehensive synthesis of adversarial attacks and defense mechanisms in modern AI security, introducing a structured taxonomy categorizing attacks into evasion, poisoning, and model inversion strategies, evaluated across varying levels of attacker knowledge.
P. Mahalakshmi, D. Jayalakshmi· International Journal of Inn...· 0 citations
