Analysis of Adversarial Training for Resilient Image Recognition Against Different Attacks

Image recognition systems are used for various critical use cases, from cancer detection to autonomous vehicles, while their accuracy closely relies on the data that they are trained on. Recently, adversarial machine learning has been flagged a s a possible threat against the successful operation of such systems and models. While the research towards understanding how to manipulate such models continues, one mitigation approach is to increase the model's resilience against such samples via including such samples in the training process. In this work, we examine the impact of adversarial training on improving robustness against other adversarial attack types. We generate adversarial samples via two image perturbation methods, Fast Gradient Sign Method (FGSM) and Jacobian-based Saliency Map Attack (JSMA), and include these samples respectively in the training set of two independent ResNet-18 models on the CIFAR-10 dataset. Obtaining two adversarially-trained models, we compare their accuracies upon each attack and discuss the impact on model resiliency when the training set includes samples generated by different approaches. Our results highlight that FGSM-fine tuned (adversarially trained) model earns the model greater resilience against FGSM attack compared to JSMA attack. Adversarial JSMA-training, when JSMA samples are generated to target the original class, earns the model resilience against both attacks.