ADVERSARIAL ROBUSTNESS EVALUATION OF CNN-BASED TRAFFIC SIGN RECOGNITION SYSTEMS

Abstract

Adversarial examples are a major challenge to deep neural networks used in safety-critical systems like intelligent transportation systems. Despite the outstanding performance of CNNs in traffic sign classification, their resilience to adversarial perturbations is not well-understood in various architectures. The paper is a benchmark study that assesses the adversarial robustness of VGG16, ResNet50, and EfficientNetB0 on the German Traffic Sign Recognition Benchmark (GTSRB) dataset. The models are evaluated to three gradient-based attacks FGSM, I-FGSM, and PGD with five L∞ perturbation budgets (  ∈ {0.01, 0.02, 0.03, 0.05, 0.07 to measure the accuracy loss and reveal architecture-specific patterns of vulnerability. To study failure modes qualitatively, performance is also studied using confusion matrices and feature space visualizations. Findings indicate that ResNet50 has the best adversarial robustness, retaining accuracy at over 94% in almost all settings, due to its residual connections that smooth the loss surface to gradient-based perturbations. EfficientNetB0 is the most susceptible to PGD, with a drop of 81.27% at  = 0.07, whereas VGG16 is the most susceptible to FGSM, decreasing to 80.95% at the same epsilon. These results emphasize the fact that adversarial robustness is inherently influenced by the architectural design decisions and provide a unified diagnostic benchmark to future studies of the secure deep learning models in autonomous driving systems