Adversarial defenses can generally be classified into four major categories, each with its own strengths and limitations. These approaches aim to mitigate the impact of adversarial attacks, but their effectiveness varies depending on the attack type, computational requirements, and applicability to real-world scenarios. The four primary categories include adversarial training-based defenses, feature manipulation techniques, anomaly detection methods, and ensemble-based defenses. Each category addresses specific vulnerabilities in deep learning models, yet challenges such as computational inefficiency, limited generalization, and adaptability to evolving threats remain significant hurdles in achieving comprehensive adversarial robustness.

Hybrid defense mechanisms represent the current frontier in adversarial robustness research, with Wang et al. [39] demonstrating that multi-task training frameworks could achieve 82% cross-attack generalization by simultaneously optimizing against multiple adversarial objectives. The work of Dhanaraj and Sridevi [25] marked a significant advancement by integrating attack-specific training with learned data augmentation, reducing the robustness-accuracy trade-off by 40% compared to single-strategy defenses. Domain-specific implementations have shown particular promise, such as in speaker recognition systems [35] where hybrid adversarial training improved resistance to audio spoofing attacks by 55% while maintaining 98% clean accuracy.

Recent innovations [40,41] have further expanded these approaches through: cascaded defense layers that sequentially apply different protection mechanisms, and runtime strategy switching based on attack detection confidence. However, current hybrid systems still face challenges in computational efficiency, with many requiring 2–5× more resources than baseline models [42]. Our framework addresses this through optimized defense scheduling that reduces overhead by 40% while maintaining 95% attack detection rates.

The following analysis evaluates adversarial defense methods, highlighting critical trade-offs between robustness, accuracy, and efficiency. Table 1 compares classical approaches, while Table 2 documents recent advancements. Our discussion contextualizes how our framework addresses the identified gaps.

The limitations highlighted in Tables 1 and 2 necessitate our integrated framework, where PGD training [22], hybrid defenses [25], and ensembles [45] incur 40%–300% computational overhead [38]. Our progressive perturbations reduce training time by 40%. Single-strategy defenses (e.g., autoencoders [43] or Parseval Networks [29]) exhibit evasion rates >25% [26,39] or accuracy drops [29]—gaps addressed by our hybrid runtime mechanism.

Unlike TRADES [26] and randomized smoothing [44], which sacrifices 4%–12% accuracy, our framework maintains 85.10% clean accuracy while outperforming recent hybrids [25] in cross-attack robustness by 15%. Recent studies [24,25] confirm that unified approaches outperform isolated defenses by 15%–30% on cross-attack robustness, with our method achieving the upper bound of this improvement. This aligns with our framework’s dynamic adaptability to attack types, as demonstrated by its 95% detection rate against adaptive attacks, while preserving efficiency, resolving all critical gaps identified in Tables 1 and 2.

Despite extensive research into adversarial defense mechanisms, significant gaps remain in current methodologies. Many existing approaches focus on specific attack types, limiting their generalizability across diverse threat models. Again, the trade-off between robustness and model accuracy remains a persistent challenge. These limitations hinder the practical deployment of robust deep learning systems, particularly in security-sensitive applications where reliability and efficiency are paramount. The key research gaps and limitations include:

Existing adversarial defense methods suffer from computational inefficiency, limited generalization, and a trade-off between robustness and accuracy. To address these challenges, this study proposes a Hybrid Adversarial Training and Defense Framework, integrating multi-stage adversarial training with adaptive runtime defenses to enhance robustness while maintaining efficiency. The multi-stage training progressively increases perturbation strength, ensuring robust feature learning without overfitting to weak adversarial examples. Unlike fixed-strength perturbation methods, this approach balances robustness and clean accuracy, mitigating trade-offs seen in PGD and TRADES. At runtime, adversarial threats are actively countered by adaptive defenses, such as feature modification, anomaly detection, and ensemble learning.

Techniques such as autoencoder-based reconstruction, randomized smoothing, and statistical anomaly detection neutralize attacks while preserving data integrity. Ensemble learning further reduces vulnerabilities by aggregating multiple model predictions. A key advantage of this framework is computational efficiency, reducing training costs by 40% through adaptive perturbation techniques like Auto-PGD and avoiding expensive iterative attack computations. Experiments on CIFAR-10 and GTSRB demonstrate superior adversarial accuracy and generalization, making this approach effective for critical applications in healthcare, finance, cybersecurity, and autonomous systems. By bridging robustness, accuracy, and efficiency, this framework advances the reliability of AI deployments.

This review highlights the diverse approaches to defending deep learning models against adversarial attacks, including adversarial training, hybrid defenses, semantic manipulation, and ensemble methods. While these approaches have made significant progress in mitigating adversarial vulnerabilities, they face critical limitations such as computational inefficiency, limited generalization across attack types, and inability to adapt to evolving adversarial tactics. As adversarial threats continue to evolve, there is a pressing need for adaptable, application-specific solutions that can address dynamic attack scenarios, particularly in domains like autonomous driving, healthcare, and cybersecurity, where robustness, accuracy, and efficiency are paramount.

Theinsights from this review provide a foundation for developing an innovative hybrid adversarial defense framework that integrates adversarial training, feature manipulation, anomaly detection, and ensemble methods. This system fills in the holes in current defenses by reducing computing cost, balancing accuracy and resilience, and allowing for dynamic adaptability to new threats. For protecting deep learning models in crucial real-world applications, the suggested approach provides a complete, flexible solution by integrating several protection concepts.

Standard adversarial training methods, such as Projected Gradient Descent (PGD) and TRADES, apply fixed-strength perturbations during training [26]. While these approaches improve robustness, they often lead to overfitting to weak adversarial examples, limiting their effectiveness against more sophisticated attacks. In contrast, our approach introduces a multi-stage adversarial training strategy that gradually increases perturbation strength over multiple training stages. This progressive approach prevents models from overfitting to weak adversarial examples and enhances their ability to generalize across a wide range of attack scenarios.

The multi-stage training process begins by stabilizing early learning with small perturbations. This initial phase allows the model to develop a strong foundation of robust feature representations without being overwhelmed by strong adversarial examples. As training progresses, the perturbation magnitude is gradually increased, exposing the model to increasingly complex adversarial scenarios. This step-by-step escalation ensures that the model learns to handle both weak and strong adversarial perturbations, improving its overall robustness as visualized in Fig. 1.

To optimize the trade-off between clean accuracy and robustness, we employ the TRADES loss function, which balances the model’s performance on clean and adversarial data. This loss function ensures that the model maintains high accuracy on clean inputs while improving its resilience to adversarial attacks.

The Hybrid Defense Framework dynamically detects, transforms, and mitigates adversarial attacks during inference, ensuring flexibility in handling diverse attack types. This framework integrates multiple defense strategies to provide comprehensive protection against adversarial threats while maintaining computational efficiency. The key components of the framework include feature manipulation, statistical anomaly detection, and ensemble learning, each contributing to the system’s adaptability and robustness as visualized in Fig. 2.

This section presents the outcomes of the experiments conducted to evaluate the proposed method. The results include the model’s performance during training and evaluation on both clean and adversarial datasets. A comparative analysis with state-of-the-art defense strategies highlights the effectiveness of the proposed approach in improving robustness while maintaining competitive clean accuracy.

The trade-off between clean accuracy, adversarial robustness, and computational efficiency is a key consideration in adversarial defenses. Our method achieves higher adversarial accuracy than state-of-the-art methods while maintaining computational efficiency. Specifically, the proposed method achieves 66.50% adversarial accuracy, surpassing PGD, TRADES, and Ensemble Adversarial Training. This improvement in robustness is achieved without compromising clean accuracy, ensuring reliable performance in both adversarial and non-adversarial scenarios.

In terms of computational efficiency, our method reduces computational overhead by 40% compared to PGD-based adversarial training. This reduction is achieved through the use of multi-stage training and adaptive defenses, which minimize the need for expensive iterative attack computations. Unlike computationally expensive methods like TRADES, our approach scales efficiently across datasets, maintaining high robustness on GTSRB. This scalability is particularly important for real-world applications, where computational resources are often limited.

The training process demonstrates a steady decrease in both training loss and adversarial loss, confirming the model’s ability to learn robust feature representations while maintaining stability. Training loss decreased from 1.4823 in Epoch 1 to 0.9231 in Epoch 5, while adversarial loss decreased from 1.9021 to 1.5708 over the same period as shown in Table 3. This gradual convergence highlights the effectiveness of the multi-stage adversarial training strategy in balancing robustness and clean accuracy. Fig. 3 is the graphical represention of the training loss and adversarial loss values.

Similarly, the hybrid defense mechanism demonstrates continuous improvement in anomaly detection accuracy and ensemble accuracy, highlighting its adaptability in mitigating adversarial threats. Anomaly detection accuracy increased from 86% in Epoch 1 to 95% in Epoch 5, indicating the system’s growing efficiency in identifying adversarial patterns. Similarly, ensemble accuracy improved from 83% to 92%, confirming that the integration of adaptive defenses enhances the system’s ability to mitigate adversarial threats while maintaining clean accuracy as shown in Table 4. These results underscore the effectiveness of the hybrid defense framework in reinforcing the model’s resistance to adversarial attacks as shown in Fig. 4.

To statistically validate the robustness improvements of the proposed method, we conducted paired t-tests on adversarial accuracies across multiple attack types. Additionally, 95% confidence intervals were computed to assess the stability and consistency of model performance. The results are summarized in Table 5.

The p-value of 0.012 confirms that the proposed method’s improvement over PGD Adversarial Training is statistically significant (p < 0.05). This indicates that the observed gains in adversarial accuracy are not due to random chance but reflect a genuine improvement in robustness. Furthermore, the narrow confidence intervals for the proposed method ([65.10, 67.90]) demonstrate consistent performance across multiple test runs, highlighting the reliability of our approach. In contrast, TRADES and Feature Denoising exhibit lower adversarial accuracies and wider confidence intervals, suggesting less stable performance under adversarial conditions. Fig. 5 is the visual representation showing the statistical significance of performance gains.

To evaluate the generalizability of the proposed method beyond CIFAR-10, we tested it on the GTSRB (German Traffic Sign Recognition Benchmark) dataset under FGSM and PGD attacks. The results, presented in Table 6, demonstrate the method’s effectiveness in a real-world security-sensitive application.

The proposed method achieves 89.20% clean accuracy and 70.50% FGSM accuracy as shown in Fig. 6, outperforming baseline methods such as PGD Adversarial Training, TRADES, and Feature Denoising. This demonstrates its ability to generalize across datasets while maintaining high performance in both clean and adversarial settings. Under the more challenging PGD attack, the proposed method achieves 57.80% accuracy, significantly higher than PGD Adversarial Training (52.90%) and TRADES (50.30%). This confirms the method’s robustness against stronger adversarial threats. The results on GTSRB validate the scalability of the proposed method, as it maintains high performance even in a domain-specific, real-world dataset.

A comprehensive comparison of clean and adversarial accuracy across CIFAR-10 is provided in Table 7. This comparison highlights the proposed method’s superiority over existing state-of-the-art defenses.

The proposed method achieves 85.10% clean accuracy and 66.50% adversarial accuracy, outperforming all baseline methods. This demonstrates its ability to balance robustness and clean accuracy, a critical requirement for real-world applications. Compared to PGD Adversarial Training, the proposed method achieves higher adversarial accuracy (66.50% vs. 65.41%) while maintaining competitive clean accuracy (85.10% vs. 83.00%). This improvement is achieved with 40% lower computational cost, making the method more practical for large-scale deployment. The method also outperforms TRADES, which suffers from a significant drop in adversarial accuracy (56.61%) despite its higher clean accuracy (84.92%). This highlights the limitations of TRADES in handling strong adversarial attacks. Fig. 7 visualizes the comparison that the proposed method is superior to existing state-of-the-art defenses.

The experimental results demonstrate the effectiveness of the proposed method across multiple dimensions. First, the method achieves higher robustness, attaining state-of-the-art adversarial accuracy across multiple attacks, including FGSM, PGD, and AutoAttack. This improvement in robustness is achieved without compromising clean accuracy, ensuring reliable performance in both adversarial and non-adversarial scenarios. Second, the method exhibits strong generalization, performing consistently across CIFAR-10 and GTSRB. This cross-dataset effectiveness validates its applicability to real-world scenarios, such as autonomous driving and traffic sign recognition, where adversarial robustness is critical.

In addition to robustness and generalization, the method offers significant computational efficiency. By reducing training costs by 40% compared to PGD and TRADES, the approach is more practical for large-scale and real-time applications. This efficiency is particularly important in domains like real-time fraud detection and autonomous systems, where computational resources are often limited. Finally, the performance improvements are statistically validated, with p-values < 0.05 and narrow confidence intervals, confirming the reliability of the results. These findings underscore the potential of the proposed method to enhance the security and reliability of deep learning models in critical applications.

Existing adversarial defense methods primarily fall into three categories, each with its own strengths and limitations. First, adversarial training-based defenses, such as PGD Adversarial Training [22] and TRADES [26], improve robustness by exposing models to adversarial examples during training. However, these methods often suffer from clean accuracy degradation and high computational costs. Our approach addresses these limitations by implementing a progressive, multi-stage adversarial training strategy that optimizes perturbation strength over time, balancing robustness and accuracy more effectively.

Again, feature manipulation and anomaly detection-based defenses, such as autoencoder-based reconstruction [43] and Mahalanobis distance-based detection [31] Aim to remove adversarial noise and identify adversarial patterns before inference. While these methods are effective against certain attack types, they struggle with adaptive adversarial attacks that bypass their defenses. Our method integrates both feature manipulation and statistical anomaly detection, dynamically adjusting to different attack types and ensuring robust performance under diverse adversarial scenarios.

Also, ensemble-based defenses, such as Adaptive Ensemble Weighting [38] and Feature Denoising Networks [30]. Combine multiple models to enhance robustness. However, these techniques often incur high computational overhead, limiting their practicality for real-time applications. Our hybrid defense strategy optimizes ensemble learning for efficiency, ensuring real-time adaptability without excessive resource consumption.

Unlike existing defenses that focus on a single aspect (training-time or inference-time defense), our method integrates both, offering a dual-layer security mechanism. While ensemble approaches enhance robustness, our framework ensures dynamic adaptability across different attack types, making it more resilient to evolving adversarial threats.

The proposed method introduces three key innovations that differentiate it from prior works. First, our multi-stage adversarial training strategy optimizes robustness by gradually increasing perturbation strength during training. Unlike PGD-based adversarial training, which applies fixed perturbations, our approach prevents overfitting to weak attacks and ensures better generalization. The use of TRADES loss optimization further balances robustness and accuracy, outperforming existing approaches in both metrics.

Second, our hybrid runtime defense mechanism dynamically adapts to different attack strategies through a combination of autoencoder-based feature transformation, statistical anomaly detection, and adaptive ensemble learning. Unlike static defenses, our method ensures robust performance under diverse adversarial scenarios. The autoencoder-based feature transformation cleans adversarial noise while preserving key data features, while statistical anomaly detection identifies adversarial patterns before inference. Adaptive ensemble learning introduces redundancy, reducing single-point vulnerabilities and improving overall robustness.

Finally, our method achieves improved computational efficiency and scalability. By reducing training costs by 40% compared to PGD adversarial training, our approach is more practical for large-scale and real-time applications. Additionally, the method generalizes effectively across datasets, such as CIFAR-10 and GTSRB, confirming its adaptability to different security-sensitive applications.

Our approach is particularly valuable in security-sensitive applications where deep learning models require high robustness with minimal performance trade-offs. In autonomous driving, the method prevents adversarial attacks that mislead traffic sign recognition models, ensuring the safety and reliability of autonomous systems. In biometric authentication, it enhances protection against adversarial spoofing attacks in facial recognition systems, improving security in access control applications. In cybersecurity, the method strengthens defenses against adversarial malware and phishing detection systems, safeguarding critical infrastructure from evolving threats.

To further illustrate the generalization of our approach across different datasets and application domains, Table 8 presents a comparison of model performance on common objects across CIFAR-10 and GTSRB. This highlights how our hybrid adversarial defense framework effectively mitigates adversarial threats in both natural and structured image datasets.

The results indicate that our approach achieves strong adversarial robustness across datasets with distinct characteristics. On CIFAR-10, the method demonstrates its ability to defend against adversarial manipulations in natural object recognition tasks. For instance, the model achieves 85.10% clean accuracy and 70.50% FGSM accuracy on car images in (Fig. 8), and 84.70% clean accuracy and 69.80% FGSM accuracy on airplane images (Fig. 9). These results highlight the framework’s effectiveness in handling natural images with diverse features and textures.

On the GTSRB dataset, the method validates its effectiveness in structured real-world applications, such as traffic sign detection. For example, the model achieves 89.20% clean accuracy and 74.30% FGSM accuracy on stop sign images (Fig. 10) and 88.60% clean accuracy and 72.50% FGSM accuracy on speed limit sign images (Fig. 11). The higher robustness on GTSRB suggests that the model is particularly suited for safety-critical environments like autonomous driving, where accurate and reliable traffic sign recognition is essential.

The combination of adversarial training and hybrid runtime defenses ensures that the model maintains high performance even under adaptive attack scenarios. By integrating proactive and reactive defense strategies, the framework provides a comprehensive solution that balances robustness, accuracy, and computational efficiency across diverse datasets and application domains.