<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Publishing DTD v1.3 20210610//EN" "https://jats.nlm.nih.gov/publishing/1.3/JATS-journalpublishing1-3.dtd">
<article article-type="research-article" dtd-version="1.3" xml:lang="en">
  <front xmlns:xlink="http://www.w3.org/1999/xlink">
    <journal-meta>
      <journal-id journal-id-type="elibrary">9004</journal-id>
      <journal-title-group>
        <journal-title>Problems of information security. Computer systems</journal-title>
        <trans-title-group xml:lang="ru">
          <trans-title>Проблемы информационной безопасности. Компьютерные системы</trans-title>
        </trans-title-group>
      </journal-title-group>
      <issn pub-type="epub">2071-8217</issn>
    </journal-meta>
    <article-meta xmlns:xlink="http://www.w3.org/1999/xlink">
      <article-id pub-id-type="publisher-id">12</article-id>
      <article-id pub-id-type="doi">10.48612/jisp/2e7p-gxfk-11a3</article-id>
      <title-group>
        <article-title>The impact of adversarial attacks on deep learning models</article-title>
        <trans-title-group xml:lang="ru">
          <trans-title>Влияние состязательных атак на модели глубокого обучения</trans-title>
        </trans-title-group>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <contrib-id contrib-id-type="orcid">0000-0002-7231-5728</contrib-id>
          <name>
            <surname>Spirin</surname>
            <given-names>Andrey</given-names>
          </name>
          <xref ref-type="aff" rid="aff1"/>
          <email>spirin_aa@mirea.ru</email>
        </contrib>
        <contrib contrib-type="author">
          <contrib-id contrib-id-type="orcid">0009-0006-2542-1348</contrib-id>
          <name>
            <surname>Lebin</surname>
            <given-names>Maksim</given-names>
          </name>
          <xref ref-type="aff" rid="aff1"/>
          <email>lebin2002@yandex.ru</email>
        </contrib>
        <contrib contrib-type="author">
          <contrib-id contrib-id-type="orcid">0009-0006-1697-2631</contrib-id>
          <name>
            <surname>Gindin</surname>
            <given-names>Evgeny</given-names>
          </name>
          <xref ref-type="aff" rid="aff1"/>
          <email>jenyag2002@gmail.com</email>
        </contrib>
        <contrib contrib-type="author">
          <contrib-id contrib-id-type="orcid">0009-0001-2060-785X</contrib-id>
          <name>
            <surname>Isakova</surname>
            <given-names>Natalia</given-names>
          </name>
          <xref ref-type="aff" rid="aff1"/>
          <email>ntfenech@gmail.com</email>
        </contrib>
      </contrib-group>
      <aff id="aff1">MIREA – Russian Technological University</aff>
      <pub-date publication-format="electronic" date-type="pub" iso-8601-date="2025-12-26">
        <day>26</day>
        <month>12</month>
        <year>2025</year>
      </pub-date>
      <issue>4</issue>
      <fpage>163</fpage>
      <lpage>183</lpage>
      <self-uri xmlns:xlink="http://www.w3.org/1999/xlink" content-type="pdf" xlink:href="https://jisp.spbstu.ru/userfiles/files/pib_4.pdf"/>
      <abstract xml:lang="en">
        <p>This study presents a comparative analysis of the robustness of modern deep learning architectures against adversarial attacks. The study focuses on three representative models – EfficientNet-B0, MobileNetV2, and Vision Transformer (ViT-B16) – illustrating the evolution of architectures from convolutional networks to transformer-based approaches. The experimental evaluation was conducted on the ISIC‑2019 medical dataset containing dermoscopic images of skin lesions. To assess model robustness, a comprehensive set of digital and physical attacks was employed, including DeepFool, Carlini – Wagner, AutoAttack, Boundary Attack, and Patch Attack. The analysis demonstrated that all evaluated models exhibit significant vulnerability to targeted perturbations: optimizationbased attacks reduce classification accuracy by more than 55 percentage points, while physical attacks can disrupt model predictions even without access to internal parameters. The Vision Transformer (ViT-B16) showed relative resilience to minor perturbations, indicating the potential of attention-based architectures for improving robustness, though complete protection remains unattainable. The results emphasize the necessity of developing integrated approaches to adversarial robustness, encompassing architectural modifications, regularization techniques, and adaptive training – a direction of particular importance for critical domains such as medicine, transportation, and security systems.</p>
      </abstract>
      <kwd-group xml:lang="en">
        <kwd>Adversarial attacks</kwd>
        <kwd>neural network robustness</kwd>
        <kwd>deep learning</kwd>
        <kwd>EfficientNet</kwd>
        <kwd>MobileNet</kwd>
        <kwd>Vision Transformer</kwd>
        <kwd>computer vision</kwd>
        <kwd>model protection</kwd>
      </kwd-group>
    </article-meta>
  </front>
</article>
