🤖 AI

A Comparative Study of Adversarial Robustness in CNN and CNN-ANFIS Architectures

This study compares the adversarial robustness of standard CNNs against their neuro-fuzzy (ANFIS) augmented counterparts across various datasets and attack types, finding that while ANFIS integration can improve robustness in specific architectures like ResNet18, its benefits are inconsistent and architecture-dependent.

Original authors: Kaaustaaub Shankar, Bharadwaj Dogga, Kelly Cohen

Published 2026-02-10

📖 3 min read☕ Coffee break read

CC BY 4.0

Original authors: Kaaustaaub Shankar, Bharadwaj Dogga, Kelly Cohen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Tale of the "Black Box" and the "Rulebook"

Imagine you have a super-smart security guard at a high-end club. This guard is a CNN (Convolutional Neural Network). He is incredibly fast and can spot a VIP from a mile away, but there’s a catch: he’s a "Black Box." If you ask him, "Why did you let that person in?" he can’t tell you. He just says, "Because my brain told me so." He’s accurate, but he’s a mystery.

Now, imagine a group of pranksters (the Adversarial Attackers) who want to sneak into the club. They don't wear masks; instead, they wear very specific, weird patterns on their shirts—patterns that look like nothing to a human, but to the guard, they look exactly like a VIP pass. The guard is fooled instantly.

The New Idea: The "Rulebook" Guard

The researchers in this paper wanted to see if they could make the guard both explainable and tougher.

They decided to give the guard a Rulebook (this is the ANFIS part). Instead of just relying on a mysterious gut feeling, the guard now has to follow fuzzy logic rules, like: "If the person is wearing a shiny tie AND has a certain height, then they are a VIP."

This makes the guard "interpretable." If he makes a mistake, you can look at his rulebook and see exactly which rule failed. This hybrid guard is called a CNN-ANFIS.

The Experiment: Testing the Guard

The researchers put these different types of guards (different "architectures" like VGG or ResNet) through a series of tests using four different "clubs" (datasets like MNIST for simple shapes and CIFAR for complex photos).

They threw two types of pranksters at them:

The Math Genius (PGD Attack): A prankster who uses complex math to calculate exactly which tiny pixel to change to trick the guard.
The Random Prankster (Square Attack): A prankster who just tries random patterns on their clothes until something works.

The Results: It’s Not a Magic Wand

You might think adding a rulebook would make every guard better, but the results were surprising. It turns out, the rulebook doesn't help everyone equally.

The ResNet Guard (The Veteran): This guard was already quite good because he has a great memory (called "residual connections"). When you gave him the Rulebook, he became significantly tougher. He was harder to trick because his deep experience combined perfectly with the new rules.
The VGG Guard (The Traditionalist): This guard actually got worse with the rulebook. Adding the rules seemed to confuse him or make him more rigid, making him easier for the pranksters to fool than he was before.
The ConvNet Guard (The Rookie): For the simple rookie guard, the rulebook didn't really change much. He stayed about the same.

The Moral of the Story

The researchers discovered that transparency (the rulebook) does not automatically equal security (toughness).

Just because you can explain why a machine made a decision doesn't mean that decision is safe from being tricked. If you want to build a "Trustworthy AI," you can't just add a rulebook; you have to make sure the rulebook actually fits the "brain" of the machine you are building.

Technical Summary: A Comparative Study of Adversarial Robustness in CNN and CNN-ANFIS Architectures

1. Problem Statement

While Convolutional Neural Networks (CNNs) are the industry standard for image classification, they suffer from two critical flaws:

Lack of Interpretability: Their decision-making processes are "black-box" in nature, making them difficult to trust in safety-critical domains (e.g., medical imaging or cybersecurity).
Adversarial Vulnerability: They are highly susceptible to small, imperceptible perturbations (adversarial attacks) that can cause catastrophic misclassification.

Neuro-fuzzy hybrids, specifically the Deep Convolutional Neuro-Fuzzy Inference System (DCNFIS), attempt to solve the interpretability problem by replacing standard fully connected layers with an Adaptive Neuro-Fuzzy Inference System (ANFIS). This allows for linguistic, rule-based decision-making. However, it remains unknown whether this shift toward interpretability enhances or degrades the model's robustness against adversarial attacks.

2. Methodology

The researchers conducted a comparative analysis between standard CNNs and their ANFIS-augmented counterparts.

Architectures: The study compared three backbone architectures: ConvNet (simple), VGG (deep), and ResNet18 (residual-based). Each was tested in two configurations: a standard version (using Fully Connected layers) and an ANFIS version (replacing FC layers with ANFIS).
Datasets: Evaluation was performed across four datasets of increasing complexity: MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100.
Attack Vectors:
- White-Box (Gradient-based): Projected Gradient Descent (PGD), which uses the model's internal gradients to craft optimal perturbations.
- Black-Box (Gradient-free): Square Attack, which relies on random search and model outputs (queries) rather than gradients.
Metrics: The study utilized Clean Accuracy and a custom Robustness Ratio (Adversarial Accuracy divided by Clean Accuracy) to normalize performance across different datasets and epsilon ( $\epsilon$ ) levels.

3. Key Contributions

First Comparative Robustness Benchmark: The paper provides one of the first systematic evaluations of how neuro-fuzzy components interact with adversarial robustness.
Architecture-Dependency Discovery: The study identifies that the benefit of neuro-fuzzy augmentation is not universal but is highly dependent on the underlying convolutional backbone.
Empirical Validation of DCNFIS: It clarifies the trade-offs between the interpretability offered by ANFIS and the resulting security profile of the model.

4. Results

The findings reveal a nuanced relationship between fuzzy logic and robustness:

Clean Accuracy: ANFIS integration does not consistently improve predictive performance. In some cases (e.g., ConvNet on CIFAR-10), it actually leads to a decrease in accuracy.
Adversarial Robustness (PGD & Square Attacks):
- ResNet18-ANFIS: Showed a significant improvement in robustness. The residual connections in ResNet appear to complement the fuzzy inference layer, making the hybrid model more resilient to perturbations.
- VGG-ANFIS: Consistently underperformed its baseline. The lack of strong feature-preservation mechanisms (like skip connections) in VGG makes the addition of ANFIS a liability under attack.
- ConvNet-ANFIS: Showed negligible or mixed benefits, performing similarly to the baseline.
Complexity Scaling: As datasets moved from MNIST to CIFAR-100, the performance gaps between architectures widened, and the difficulty of maintaining robustness increased across all models.

5. Significance

This research is significant for the development of Trustworthy AI. It demonstrates that "Explainable AI" (XAI) through neuro-fuzzy logic does not inherently come at the cost of security, provided the architecture is chosen correctly. Specifically, for developers building interpretable models for high-stakes environments, the study suggests that residual-based architectures (like ResNet) combined with ANFIS offer a promising path toward models that are both transparent and robust.