Propagated Perturbation of Adversarial Attack for well-known CNNs: Empirical Study and its Explanation

Adversarial perturbations grow dramatically in neural networks' final layers: The study found that the distance between attacked and clean images increases explosively in the fully connected layers at the end of CNNs, suggesting that adversarial noise compounds as it propagates through the network rather than remaining localized.

Denoising tools have fundamental limitations: While denoising models can reduce the amount of visible noise in images, the research demonstrates they "failed to defense accuracy degradation," indicating that current defense strategies may address symptoms rather than the root vulnerability of deep learning systems.

Different distance metrics reveal different attack behaviors: The researchers observed that Euclidean distance and cosine distance behave differently through network layers—with cosine distance fluctuating and disappearing by the final layer—suggesting that understanding adversarial attacks requires examining them from multiple analytical perspectives.

Explainable AI can illuminate adversarial vulnerabilities: By analyzing how perturbations propagate layer-by-layer through CNNs, the study demonstrates that XAI techniques can help explain why neural networks fail under adversarial attack, not just document that they do.

Well-known CNN architectures share common vulnerability patterns: Testing five established CNN classifiers with three different attack methods revealed consistent trends in how adversarial perturbations behave, suggesting these vulnerabilities may be fundamental to current deep learning design rather than isolated to specific models.