Analysis of adversarial examples in neural network image classifiers

Abstract

Deep learning models have achieved remarkable success across various domains, yet they remain vulnerable to adversarial examples, small carefully crafted perturbations of input images that cause models to make incorrect predictions. These adversarial examples are usually indistinguishable from the original input, yet the model classifies them incorrectly, which implies the lack of robustness of trained models. This work explores different neural network architectures, including fully connected networks, classical convolutional networks, and residual networks, under four types of adversarial attacks constrained by different L p norms. We evaluated attack success rates across multiple datasets and observed how different models behave when faced with various adversarial examples. All attacks are remarkably effective across all models and lead to misclassification almost every time. Next, we investigate how adversarial examples affect the internal representations of networks by analyzing the nearest neighbors and class manifold proximity across layers. Our results show that misclassification often occurs in the last couple of layers of the models, with variations depending on the dataset and the model used. In order to use a large model such as Residual Network 18 (ResNet-18), we apply principal component analysis to reduce unnecessary dimensions and to lower time complexity. We also analyzed how this reduction affects the results. This work highlights the importance of understanding not only if a model fails under a given attack but also how and where these failures occur within the network architecture.