Aug 2026· ACM Transactions on Evolutionary Learning and Optimization· 0 citations· 42 references
TL;DR
A method to analyze ANNs designed for image classification from an adversarial robustness perspective and implemented an ablation and fine-tuning strategy that successfully boosted the robustness of the ANNs against a variant of the Auto-PGD attack under different threat models.
Abstract
Adversarial examples are purposely crafted to fool Artificial Neural Networks (ANNs) into producing erroneous outputs. Understanding what makes these models vulnerable to such attacks is an open research topic and constitutes a first step toward devising defenses. Focusing on ANNs designed for image classification, we propose a method to analyze these models from an adversarial robustness perspective. The approach is based on the t-distributed Stochastic Neighbor Embedding (t-SNE) technique and allows the visual inspection of the representations learned by an ANN throughout its different layers. Additionally, we propose the Embedding Overlap Robustness RatiO (EORRO) metric to identify potential weak spots in the network by quantifying differences between clean and perturbed images on the t-SNE maps. We validated our approach by studying two ANNs, one designed by humans and another by NeuroEvolution, on CIFAR-10 and CIFAR-100. Our results indicate that differences between clean and perturbed images start to emerge early on in the models, namely in the feature extraction layers of the networks. Guided by the proposed metric, we implemented an ablation and fine-tuning strategy that successfully boosted the robustness of the ANNs against a variant of the Auto-PGD attack under different threat models. More specifically, the post-attack accuracy of the neuroevolved ANN on CIFAR-10 changed from 0% to at least 63.5% in \(L_{2}\) and 27.2% in \(L_{\infty}\) .
Deep learning models have achieved remarkable success across various domains, yet they remain vulnerable to adversarial examples, small carefully crafted perturbations of input images that cause models to make incorrect predictions. These adversarial examples are usually indistinguishable from the original input, yet the model classifies them incorrectly, which implies the lack of robustness of trained models. This work explores different neural network architectures, including fully connected networks, classical convolutional networks, and residual networks, under four types of adversarial attacks constrained by different L
p
norms. We evaluated attack success rates across multiple datasets and observed how different models behave when faced with various adversarial examples. All attacks are remarkably effective across all models and lead to misclassification almost every time. Next, we investigate how adversarial examples affect the internal representations of networks by analyzing the nearest neighbors and class manifold proximity across layers. Our results show that misclassification often occurs in the last couple of layers of the models, with variations depending on the dataset and the model used. In order to use a large model such as Residual Network 18 (ResNet-18), we apply principal component analysis to reduce unnecessary dimensions and to lower time complexity. We also analyzed how this reduction affects the results. This work highlights the importance of understanding not only if a model fails under a given attack but also how and where these failures occur within the network architecture.
Jana Poľašková, Iveta Bečková, Stefan Pócos et al.· PeerJ Computer Science· 0 citations
The study concluded that adversarial resilience is largely determined by the interaction between model architecture and defense strategy, highlighting the need for architecture-specific defense selection when developing secure medical image classification systems.
Y. Heryadi, I. Sonata, Bambang Krismono Triwijoyo· Matrik· 0 citations
The impressive visual quality and ubiquity of AI-generated images call for reliable and robust detection methods. Reconstruction-based detectors have emerged as a promising direction for transparent and training-free identification of synthetic images. However, due to their fundamentally different mode of operation (compared to standard, classifier-based methods), little is known about their adversarial robustness. In this work, we propose two novel attack methods targeted at detectors that leverage autoencoder reconstruction error. We find that by constructing imperceptible adversarial examples, the distance between original and reconstruction can be artificially increased, causing fake images to be wrongly classified as real. Our evaluation including images from three state-of-the-art generators and three detectors demonstrates that detection performance is significantly decreased, even if attacked images additionally undergo real-world degradations. Critically, our adversarial examples naturally transfer across detectors, as they all share the same principle, pointing towards an inherent vulnerability of reconstruction-based detectors.
R. Demchenko, Jonas Ricker, Asja Fischer· 0 citations
The research methodology involved a systematic literature review using the Scopus database, adhering to Preferred Reporting Items for Systematic Reviews and Meta-Analyses guidelines, and focusing on recent advancements in attack and defence techniques.
This work proposes a white-box spectral-subspace-guided attack (SSGRA) that aligns intermediate representations with the subspace spanned by the bottom right singular vectors, offering a spectral interpretation of adversarial vulnerability in VLMs, providing insights for improving their robustness.
Chethan Krishnamurthy Ramanaik, Tobias Callies, Michael Hecht et al.· 0 citations
Empirical support is provided for the utility of structure-aware perturbation refinement in improving black-box adversarial transferability across heterogeneous visual architectures.
Qi-Rui Lu, Liansong Zong, Fu-Ran Liu et al.· Neural Networks· 0 citations