Visualization and Analysis of CNN Adversarial Training

Adversarial samples and attacks toward Convolutional Neural Network (CNN) are attracting more and more attention. However, few works have been done to visualize and analyze these processes. This paper proposes comprehensive visualization and analysis of the effect of Projected Gradient Descent (PGD) on the images, as well as the effect of adversarial training on the model. Specifically, the interim outputs of the images before and after the attack are compared, and the distribution of raw scores and location of activation are analyzed using Gradient-weighted Class Activation Mapping (GradCAM) and calculation of weights. This study is conducted on the ImageNet-1 K dataset, using DenseNet-121 as the model. Experimental results suggest that CNN is vulnerable to modified background, especially when the minor changes add up, making the raw score of the false label as large as the true one. After training the model with adversarial samples, the resistance to the attack significantly increases. This research contributes to the field of CNN and cybersecurity, provides several new ways to analyze CNN, deepens the understanding of attack and defense mechanisms, and paves the way toward a more advanced understanding of CNN.