A Comparative Study of Adversarial Robustness in CNN and CNN-ANFIS Architectures

2026-02-02

AI Summary

This study investigates whether integrating Adaptive Neuro-Fuzzy Inference Systems (ANFIS) into mainstream convolutional neural networks—such as ConvNet, VGG, and ResNet18—can simultaneously enhance robustness against adversarial attacks and improve model interpretability. Through systematic evaluations on MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100 using both gradient-based (PGD) and gradient-free (Square) attack methods, the work reveals for the first time that the effectiveness of ANFIS augmentation is highly dependent on the backbone architecture: ResNet18-ANFIS exhibits significantly improved robustness, whereas VGG-ANFIS often underperforms relative to its baseline. These findings demonstrate that ANFIS-based enhancement lacks universality across network structures and offer new empirical insights and design considerations for developing interpretable yet robust deep learning models.

Technology Category

Machine Learning: Adversarial Learning & RobustnessComputer Vision: Adversarial Attacks & RobustnessNatural Language Processing: Safety and Robustness

Application Category

Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMsGraph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphsSearch and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Convolutional Neural Networks (CNNs) achieve strong image classification performance but lack interpretability and are vulnerable to adversarial attacks. Neuro-fuzzy hybrids such as DCNFIS replace fully connected CNN classifiers with Adaptive Neuro-Fuzzy Inference Systems (ANFIS) to improve interpretability, yet their robustness remains underexplored. This work compares standard CNNs (ConvNet, VGG, ResNet18) with their ANFIS-augmented counterparts on MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100 under gradient-based (PGD) and gradient-free (Square) attacks. Results show that ANFIS integration does not consistently improve clean accuracy and has architecture-dependent effects on robustness: ResNet18-ANFIS exhibits improved adversarial robustness, while VGG-ANFIS often underperforms its baseline. These findings suggest that neuro-fuzzy augmentation can enhance robustness in specific architectures but is not universally beneficial.

Problem

• adversarial robustness
• CNN
• ANFIS
• interpretability
• adversarial attacks

Innovation

• adversarial robustness
• CNN-ANFIS
• neuro-fuzzy systems
• interpretability
• architecture-dependent robustness