Back to demo
Model details

CNN and attack evaluation

The browser demo runs FGSM interactively. The offline evaluation compares FGSM, PGD, and a random-noise baseline against the same exported model weights.

Clean accuracy
98.54%
Trainable parameters
421,642
Eval samples
2,000
FGSM accuracy by epsilon
97.9
0.00
94.3
0.05
86.3
0.10
68.8
0.15
47.5
0.20
24.0
0.25
9.3
0.30
Attack
Epsilon
Accuracy
Random noise
0.00
97.90%
Random noise
0.05
97.80%
Random noise
0.10
97.95%
Random noise
0.15
97.80%
Random noise
0.20
97.90%
Random noise
0.25
97.75%
Random noise
0.30
97.55%
FGSM
0.00
97.90%
FGSM
0.05
94.35%
FGSM
0.10
86.25%
FGSM
0.15
68.85%
FGSM
0.20
47.50%
FGSM
0.25
24.00%
FGSM
0.30
9.30%
PGD
0.00
97.90%
PGD
0.05
94.00%
PGD
0.10
79.90%
PGD
0.15
47.25%
PGD
0.20
9.85%
PGD
0.25
0.15%
PGD
0.30
0.00%

PGD uses 10 projected-gradient steps. Random noise is included as a baseline so the adversarial attacks have a non-adversarial comparison.

Raw results are stored in public/attack_results.json and public/attack_results.md.

Saved example
FGSM and PGD adversarial example comparison

Generated by scripts/evaluate_attacks.py.

Architecture
Input
28 x 28 x 1 grayscale MNIST image
Conv2D
32 filters, 3 x 3 kernel, ReLU, same padding
MaxPool
2 x 2 pooling to 14 x 14 x 32
Conv2D
64 filters, 3 x 3 kernel, ReLU, same padding
MaxPool
2 x 2 pooling to 7 x 7 x 64
Flatten
3,136 features
Dense
128 units, ReLU
Dropout
0.25 during training only
Dense
10 units, softmax
Reproduce the evaluation
python3 scripts/evaluate_attacks.py --limit 2000 --pgd-steps 10
python3 -m pytest -q
  • The demo loads weights from public/model_weights.json.
  • Selected images are real MNIST test-set samples in public/mnist_samples.json.
  • This is a compact educational model, not an adversarially trained or production-grade classifier.