Exploring Adversarial Attacks on Neural Networks: An Explainable Approach
This provides insights for improving robustness in safety-critical applications like autonomous driving, but is incremental as it analyzes existing attacks on a standard model.
The paper analyzed how adversarial attacks affect neural networks by comparing gradient heatmaps of VGG-16 under adversarial noise versus Gaussian noise, finding that adversarial noise distracts network focus and specific intermediate blocks (Block4_conv1 and Block5_conv1) are more vulnerable.
Deep Learning (DL) is being applied in various domains, especially in safety-critical applications such as autonomous driving. Consequently, it is of great significance to ensure the robustness of these methods and thus counteract uncertain behaviors caused by adversarial attacks. In this paper, we use gradient heatmaps to analyze the response characteristics of the VGG-16 model when the input images are mixed with adversarial noise and statistically similar Gaussian random noise. In particular, we compare the network response layer by layer to determine where errors occurred. Several interesting findings are derived. First, compared to Gaussian random noise, intentionally generated adversarial noise causes severe behavior deviation by distracting the area of concentration in the networks. Second, in many cases, adversarial examples only need to compromise a few intermediate blocks to mislead the final decision. Third, our experiments revealed that specific blocks are more vulnerable and easier to exploit by adversarial examples. Finally, we demonstrate that the layers $Block4\_conv1$ and $Block5\_cov1$ of the VGG-16 model are more susceptible to adversarial attacks. Our work could provide valuable insights into developing more reliable Deep Neural Network (DNN) models.