Adversarial Training Foundations: Methods to Enhance Neural Network Robustness

Abstract

Adversarial attacks pose a significant threat to the reliability and security of Artificial Intelligence (AI) systems, especially as AI integrates into critical fields like healthcare and finance. This work specifically addresses adversarial evasion attacks conducted during the testing phase. In this study, attacks are designed to be untargeted (misleading the model to any wrong class) and white-box (attacker has access to the model), using small perturbations to cause incorrect classifications. To counter these threats, this research investigates adversarial training, a defense mechanism where models are trained using data generated by attacks. The study systematically compares two distinct adversarial training strategies: ‘pre-train’, where adversarial examples are generated beforehand, and ‘in-train’, where perturbations are introduced dynamically during the training process. This comparison aims to understand the advantages and limitations of each approach in enhancing model robustness. Using a Fully Connected Neural Network (FCNN) and the MNIST dataset, experiments were conducted with attacks like FGSM and BIM at varying perturbation strengths $\epsilon $ . The results provide a controlled comparison of adversarial training strategies, highlighting key trade-offs between robustness and generalization. We observe that the ‘in-train’ strategy provides superior robustness in the evaluated setting against white-box, untargeted attacks compared to the ‘pre-train’ method. However, the findings are derived from experiments on the MNIST dataset using FCNNs, and therefore should be interpreted as foundational insights. Extending the analysis to more complex datasets and architectures remains an important direction for future work.