A Comparative Study of Adversarial Robustness in CNN and CNN-ANFIS Architectures

TL;DR

This study compares the adversarial robustness of CNNs and CNN-ANFIS hybrids across multiple datasets, revealing architecture-dependent effects where neuro-fuzzy integration sometimes improves robustness but not consistently.

Contribution

It provides the first comprehensive comparison of CNN and CNN-ANFIS architectures' robustness against adversarial attacks across diverse datasets.

Findings

ResNet18-ANFIS shows improved robustness over ResNet18.

VGG-ANFIS often underperforms compared to VGG.

Neuro-fuzzy augmentation's effectiveness varies by architecture.

Abstract

Convolutional Neural Networks (CNNs) achieve strong image classification performance but lack interpretability and are vulnerable to adversarial attacks. Neuro-fuzzy hybrids such as DCNFIS replace fully connected CNN classifiers with Adaptive Neuro-Fuzzy Inference Systems (ANFIS) to improve interpretability, yet their robustness remains underexplored. This work compares standard CNNs (ConvNet, VGG, ResNet18) with their ANFIS-augmented counterparts on MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100 under gradient-based (PGD) and gradient-free (Square) attacks. Results show that ANFIS integration does not consistently improve clean accuracy and has architecture-dependent effects on robustness: ResNet18-ANFIS exhibits improved adversarial robustness, while VGG-ANFIS often underperforms its baseline. These findings suggest that neuro-fuzzy augmentation can enhance robustness in specific architectures but is not universally beneficial.