This research investigates the behavior of a widely used shallow classifier under intentional perturbations. A logistic-regression model is trained with the MNIST handwritten-digit data set, and it is challenged with adversarial examples generated by the Fast Gradient Sign Method (FGSM). Perturbations could be added in one step as logistic regression gives a closed-form gradient, and an epsilon parameter is used to control the magnitude of each disturbance. Benchmarked on clean data, it produced 92.4% accuracy, but an epsilon as low as 0.05 was enough to halve that value. At epsilon = 0.30, the model’s accuracy dipped below 20%, although perturbed digits remained visually indistinguishable from their originals. These results demonstrate how shallow, linear models are not any less susceptible to adversarial attacks than are deep learning models: the absence of hidden layers does not impart any inherent robustness to it. These results underline the necessity for the development of lightweight yet principled defense mechanisms along with the provision of an accessible learning platform for adversarial concepts that does not rely on the use of large neural networks.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Analyzing Adversarial Robustness in Shallow Models Using FGSM

  • Ritesh Nune,
  • Aryan Singh Tomar,
  • Rishab h Arayan Veedu,
  • Amit C. Narendra

摘要

This research investigates the behavior of a widely used shallow classifier under intentional perturbations. A logistic-regression model is trained with the MNIST handwritten-digit data set, and it is challenged with adversarial examples generated by the Fast Gradient Sign Method (FGSM). Perturbations could be added in one step as logistic regression gives a closed-form gradient, and an epsilon parameter is used to control the magnitude of each disturbance. Benchmarked on clean data, it produced 92.4% accuracy, but an epsilon as low as 0.05 was enough to halve that value. At epsilon = 0.30, the model’s accuracy dipped below 20%, although perturbed digits remained visually indistinguishable from their originals. These results demonstrate how shallow, linear models are not any less susceptible to adversarial attacks than are deep learning models: the absence of hidden layers does not impart any inherent robustness to it. These results underline the necessity for the development of lightweight yet principled defense mechanisms along with the provision of an accessible learning platform for adversarial concepts that does not rely on the use of large neural networks.