Comparative Analysis of Adversarial Robustness Across CNN, VGG19, and Vision Transformer Architectures Using Multiple Defense Strategies

Abstract

This study aims to systematically evaluate the adversarial robustness of Convolutional Neural Network (CNN), VGG19, and Vision Transformer (ViT) architectures for chest X-ray classification. Specifically,this study aims to determine the relative influence of model architectures and defense strategies under identical experimental conditions The research method: All three architectures were evaluated using a chest X-ray dataset under white-box attacks using the Fast Gradient Sign Method (FGSM) and the Iterative Fast Gradient Sign Method (IFGSM), with perturbation levels ranging from ε = 0.00 to 0.30. Five defense strategies-Adversarial Training, Adversarial Distillation, TRADES, MART, and Adversarial Weight Perturbation (AWP)-were compared to a baseline without defenses within a unified experimental framework. Differences between defense methods were assessed using the Friedman test. The results showed that without defenses, all models experienced substantial performance degradation, with IFGSM causing a more severe degradation than FGSM. Under FGSM attacks, VGG19 demonstrated the most consistent resilience across defense strategies. Under IFGSM attacks, ViT combined with Adversarial Training achieved the strongest resilience. Defense effectiveness varied across architectures, and no single defense consistently performed best. Friedman’s test identified significant differences between defense methods for FGSM and IFGSM attacks across all architectures (p < 0.001). The study concluded that adversarial resilience is largely determined by the interaction between model architecture and defense strategy. Defense selection has a greater impact on resilience than architecture complexity alone, highlighting the need for architecture-specific defense selection when developing secure medical image classification systems.