FFGSM: A Novel Fuzzy Logic-Based FGSM Attack for Deep Neural Networks Vulnerability Assessment

Adversarial examples remain a major obstacle to the reliable deployment of deep neural networks, yet widely used one-step attacks such as FGSM rely on a fixed perturbation budget that ignores how vulnerability varies across inputs and architectural paradigms. In this paper, we proposeFuzzy-FGSM(FFGSM), a single-step, interpretable adversarial attack that adaptively allocates the$\ell \_\infty$perturbation budget on a per-sample basis. FFGSM couples the FGSM sign direction with a lightweight Mamdani fuzzy inference system that maps two human-interpretable indicators-the input-gradient norm (GN), capturing local sensitivity, and the model confidence (CN), capturing prediction certainty-into a bounded, sample-specific perturbation magnitude$\hat{\epsilon }\in [0,\epsilon \_{\max }]$. We evaluate FFGSM under$\epsilon \_{\max }=8/255$across three datasets (CIFAR-10, STL-10, and Tiny-ImageNet) and four architectures (ResNet-18, ResNet-50, VGG-16, and DenseNet-121). Our results demonstrate that FFGSM consistently outperforms transfer-based and black-box baselines, achieving peak Attack Success Rates (ASR) of up to$85.53\%$on DenseNet-121/Tiny-ImageNet, while remaining surprisingly close to the strong multi-step AutoAttack ensemble of about$80.2\%$vs.$81.7\%$ASR on CIFAR-10/ResNet18, and$64.5\%$vs.$66.8\%$on STL-10/ResNet50. Notably, FFGSM remains remarkably competitive with the strong multi-step Auto-Attack ensemble, often trailing by only a 1–$4\%$margin despite being a single-step method. Furthermore, cross-model transferability analysis reveals that FFGSM effectively exploits the “transferability gap,” showing that residual-based models generate more universal adversarial directions than sequential models like VGG-16. Runtime measurements confirm that the fuzzy controller adds only a negligible overhead (approx.$5.4\%$–$7.7\%$), preserving the simplicity and real-time efficiency of single-step generation.