Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Comparative Study of Adversarial Robustness in CNN and CNN-ANFIS Architectures

Kaaustaaub Shankar, Bharadwaj Dogga, Kelly Cohen

TL;DR

This paper evaluates how replacing the final fully connected classifier in CNNs with an Adaptive Neuro-Fuzzy Inference System (ANFIS) affects adversarial robustness across four datasets. The study trains ConvNet, VGG-like, and ResNet18 backbones and their ANFIS variants on MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100, and assesses robustness under gradient-based PGD and gradient-free Square Attacks with dataset-specific epsilon settings. Key findings show that ANFIS integration does not consistently improve clean accuracy and yields architecture-dependent robustness: ResNet18-ANFIS gains robustness under PGD, while VGG-ANFIS often underperforms. The results indicate that neuro-fuzzy augmentation can boost robustness in some architectures but is not universally beneficial, emphasizing careful alignment of ANFIS with network structure. These insights inform design choices for interpretable yet robust vision systems and guide future attacks-adversarial training research.

Abstract

Convolutional Neural Networks (CNNs) achieve strong image classification performance but lack interpretability and are vulnerable to adversarial attacks. Neuro-fuzzy hybrids such as DCNFIS replace fully connected CNN classifiers with Adaptive Neuro-Fuzzy Inference Systems (ANFIS) to improve interpretability, yet their robustness remains underexplored. This work compares standard CNNs (ConvNet, VGG, ResNet18) with their ANFIS-augmented counterparts on MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100 under gradient-based (PGD) and gradient-free (Square) attacks. Results show that ANFIS integration does not consistently improve clean accuracy and has architecture-dependent effects on robustness: ResNet18-ANFIS exhibits improved adversarial robustness, while VGG-ANFIS often underperforms its baseline. These findings suggest that neuro-fuzzy augmentation can enhance robustness in specific architectures but is not universally beneficial.

A Comparative Study of Adversarial Robustness in CNN and CNN-ANFIS Architectures

TL;DR

This paper evaluates how replacing the final fully connected classifier in CNNs with an Adaptive Neuro-Fuzzy Inference System (ANFIS) affects adversarial robustness across four datasets. The study trains ConvNet, VGG-like, and ResNet18 backbones and their ANFIS variants on MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100, and assesses robustness under gradient-based PGD and gradient-free Square Attacks with dataset-specific epsilon settings. Key findings show that ANFIS integration does not consistently improve clean accuracy and yields architecture-dependent robustness: ResNet18-ANFIS gains robustness under PGD, while VGG-ANFIS often underperforms. The results indicate that neuro-fuzzy augmentation can boost robustness in some architectures but is not universally beneficial, emphasizing careful alignment of ANFIS with network structure. These insights inform design choices for interpretable yet robust vision systems and guide future attacks-adversarial training research.

Abstract

Convolutional Neural Networks (CNNs) achieve strong image classification performance but lack interpretability and are vulnerable to adversarial attacks. Neuro-fuzzy hybrids such as DCNFIS replace fully connected CNN classifiers with Adaptive Neuro-Fuzzy Inference Systems (ANFIS) to improve interpretability, yet their robustness remains underexplored. This work compares standard CNNs (ConvNet, VGG, ResNet18) with their ANFIS-augmented counterparts on MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100 under gradient-based (PGD) and gradient-free (Square) attacks. Results show that ANFIS integration does not consistently improve clean accuracy and has architecture-dependent effects on robustness: ResNet18-ANFIS exhibits improved adversarial robustness, while VGG-ANFIS often underperforms its baseline. These findings suggest that neuro-fuzzy augmentation can enhance robustness in specific architectures but is not universally beneficial.
Paper Structure (13 sections, 2 equations, 4 figures, 15 tables, 2 algorithms)

This paper contains 13 sections, 2 equations, 4 figures, 15 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. Fuzzy Logic and its Derived Systems
  4. Convolutional Neural Networks and Neuro-Fuzzy Hybrids
  5. Adversarial Attacks
  6. PGD
  7. Square Attack
  8. Methodology
  9. Results
  10. Discussion
  11. Future Work
  12. Acknowledgments.
  13. Disclosure of Interests.

Figures (4)

  • Figure 1: Normalized Robustness for PGD Attacks
  • Figure 2: Normalized Robustness for Square Attacks
  • Figure 3: Normalized Robustness (excluding CIFAR-100) for PGD Attacks
  • Figure 4: Normalized Robustness (excluding CIFAR-100) for Square Attacks