# Exploring Adversarial Attacks on Neural Networks: An Explainable Approach

arXiv: https://arxiv.org/abs/2303.06032 · HTML: https://mlsanity.com/paper/2303.06032/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 23 of its 35 references that are in the map.
- First posted on arXiv 8 Mar 2023.

## Builds on (most cited first, 23 of 23)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localization](https://mlsanity.com/paper/1610.02391/) (2016)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models](https://mlsanity.com/paper/1805.06605/) (2018)
- [DeepXplore: Automated Whitebox Testing of Deep Learning Systems](https://mlsanity.com/paper/1705.06640/) (2017)
- [Axiom-based Grad-CAM: Towards Accurate Visualization and Explanation of CNNs](https://mlsanity.com/paper/2008.02312/) (2020)
- [Towards Deep Neural Network Architectures Robust to Adversarial Examples](https://mlsanity.com/paper/1412.5068/) (2014)
- [Do Wider Neural Networks Really Help Adversarial Robustness?](https://mlsanity.com/paper/2010.01279/) (2020)
- [Medical image denoising using convolutional denoising autoencoders](https://mlsanity.com/paper/1608.04667/) (2016)
- [TensorFuzz: Debugging Neural Networks with Coverage-Guided Fuzzing](https://mlsanity.com/paper/1807.10875/) (2018)
- [Convergence of Adversarial Training in Overparametrized Neural Networks](https://mlsanity.com/paper/1906.07916/) (2019)
- [Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy](https://mlsanity.com/paper/1906.06784/) (2019)
- [Towards Imperceptible and Robust Adversarial Example Attacks against Neural Networks](https://mlsanity.com/paper/1801.04693/) (2018)
- [PuVAE: A Variational Autoencoder to Purify Adversarial Examples](https://mlsanity.com/paper/1903.00585/) (2019)
- [An Adversarial Approach for Explainable AI in Intrusion Detection Systems](https://mlsanity.com/paper/1811.11705/) (2018)
- [Revisiting Neuron Coverage Metrics and Quality of Deep Neural Networks](https://mlsanity.com/paper/2201.00191/) (2022)
- [Understanding and Diagnosing Vulnerability under Adversarial Attacks](https://mlsanity.com/paper/2007.08716/) (2020)
- [Evaluating the performance of the LIME and Grad-CAM explanation methods on a LEGO multi-label image classification task](https://mlsanity.com/paper/2008.01584/) (2020)
- [An integrated Auto Encoder-Block Switching defense approach to prevent adversarial attacks](https://mlsanity.com/paper/2203.10930/) (2022)
- [Zero-bias Deep Neural Network for Quickest RF Signal Surveillance](https://mlsanity.com/paper/2110.05797/) (2021)
- [Layer-wise Regularized Adversarial Training using Layers Sustainability Analysis (LSA) framework](https://mlsanity.com/paper/2202.02626/) (2022)

## Built on by (most cited first, 4 of 4)

- [Natural Reflection Backdoor Attack on Vision Language Model for Autonomous Driving](https://mlsanity.com/paper/2505.06413/) (2025)
- [Explainable AI for Comparative Analysis of Intrusion Detection Models](https://mlsanity.com/paper/2406.09684/) (2024)
- [NoiseCAM: Explainable AI for the Boundary Between Noise and Adversarial Attacks](https://mlsanity.com/paper/2303.06151/) (2023)
- [Adversarial Training in Low-Label Regimes with Margin-Based Interpolation](https://mlsanity.com/paper/2411.17959/) (2024)

## Abstract (arXiv)

Deep Learning (DL) is being applied in various domains, especially in safety-critical applications such as autonomous driving. Consequently, it is of great significance to ensure the robustness of these methods and thus counteract uncertain behaviors caused by adversarial attacks. In this paper, we use gradient heatmaps to analyze the response characteristics of the VGG-16 model when the input images are mixed with adversarial noise and statistically similar Gaussian random noise. In particular, we compare the network response layer by layer to determine where errors occurred. Several interesting findings are derived. First, compared to Gaussian random noise, intentionally generated adversarial noise causes severe behavior deviation by distracting the area of concentration in the networks. Second, in many cases, adversarial examples only need to compromise a few intermediate blocks to mislead the final decision. Third, our experiments revealed that specific blocks are more vulnerable and easier to exploit by adversarial examples. Finally, we demonstrate that the layers Block4conv1 and Block5cov1 of the VGG-16 model are more susceptible to adversarial attacks. Our work could provide valuable insights into developing more reliable Deep Neural Network (DNN) models.