Neural Networks: Fundamental and Class Networks and Security

First of all, let's continue with neural networks. Based on the previous overview of neural networks, we are going to review a fundamental type of neural network used today. This article will be on a fundamental class of neural network called Feedforward Neural Network

This network is the simplest form of artificial neural network where data flows in one direction, i.e. forward from the input nodes through hidden layers to the outputs.

Note: The major reason we are diving deep into different types of neural network is that, to be a great security researcher and able to break AI models, you must understand the working principles and limitations of each system component. Understanding how different types of neural networks work will give you the understanding edge in knowing their behaviours in response to certain inputs and adversarial attacks. Hence, you can apply this in breaking different models.

Feed Forward Neural Network

Feed Forward Neural Network is the type of network where data flows in one direction from input to output without a cycle. It is one of the fundamental and simplest forms of Neural Networks.

The Feed Forward Neural Network is divided into Input, Hidden, and Output layers. Note that it is different from a recurrent network. A primary characteristic of FFNN (Feed Forward Neural Networks) is that there is no cycle or loop. This means that it never goes backward.

IMAGE

Input Layer: This layer is the first layer of the network where input data are received. Note that there is no computation in this layer; the input layer is just a structural parser. Hence, there is a vulnerability here: a modified adversarial input will be parsed in this layer and can cause unexpected predictive behaviour. Note that a feed forward neural network only accepts numerical inputs, so inputs such as text must be tokenized, images flattened, and videos extracted via frame extraction. In summary, every form of input undergoes a form of numerical vectorization before going through the input layer.

Hidden Layer: This is the layer where computational operations happen. It is where the actual thinking, learning, and computation occurs in a feed forward neural network. The hidden layer is composed of multiple independent units called neurons which are mathematically represented as tensors in layers in real computation. This might already sound familiar, as you may have known these terms in the previous article for this series.

Note: The hidden layer can experience a series of catastrophic attacks which change the weight or connection of the hidden layer. Think of connections as learnt experience paths. In the process of a critical adversarial attack in the hidden layers, if connections are altered, the model can't utilize that created path of connection to solve the appropriate problems. Think of a human victim who damages his nervous system and is not able to assimilate and coordinate well in certain tasks. Attacks in the hidden layers are usually hard to debug with tools and correct, as the cost of correction is more expensive and more resource intensive than training.

Output Layer: The output layer is the final layer of the network. The number of neurons in this layer correlates with the classification problem and the number of outputs.

Note: The output layer is also vulnerable if it leaks training data information. Because it contains a probability distribution generated by the softmax function, it frequently leaks data through attack methods such as Model Inversion and Membership Inference.

In a feed forward neural network, each connection between neurons in this layer has an associated weight that is adjusted during the training process to minimize prediction error.

Principles of Training in Feed Forward Neural Network

The feed forward neural network is trained using propagation. However, many processes go on during the training process. Hence we are going to explore these training steps. Primarily, the Feed Forward Network is trained by adjusting the weights of neurons to minimize error in the model output. This is done using the three main processes.

Forward Propagation
Loss Calculation
Backpropagation

Forward Propagation:

Forward propagation is the passing of sequential data through the feed forward neural network. During this process, linear combination of inputs and weights and application of non-linear activation functions happens to produce the final output. Non-linear activation functions include the following:

Non-linear Function	Description	Equation	Cost
Sigmoid (Logistic)	It converts values into a smooth range between 0 and 1. This is useful because values in tensors that represent probabilities must be between 0 and 1. Note that sigmoid is not a probabilistic function, but it helps produce this value range.	$\sigma(x) = \frac{1}{1 + e^{-x}}$	Sigmoid function is moderate however it is replaced by ReLU which is a more efficient alternative.
Hyperbolic Tangent (Tanh)	This function is similar to the sigmoid function; however, instead of scaling between 0 and 1, it scales the output between -1 and 1. Although often replaced by alternatives, it is still used in specialized RNNs, GANs, and autoencoders.	$\tanh(x) = \frac{e^x - e^{-x}}{e^x + e^{-x}}$	It is computationally intensive and costly; therefore, alternatives such as ReLU or smooth non-linear GeLU are used as replacements.
Rectified Linear Logic (ReLU)	This is heavily applied in hidden layers of the neural network. It returns 0 for negative input and the exact value for positive input	$f(x) = \max(0, x)$	It is very cheap to compute, which is why it is used at scale in hidden layers.
Leaky ReLU	A variant of ReLU that allows a small gradient for negative values. This simply means it prevents dead neurons by forming a small predefined slope.	$f(x) = \max(\alpha x, x)$	It is efficient but not as efficient as ReLU; from analyzing the equation you can theoretically prove that the extra product $\alpha x$ contributes to the slightly higher cost.
Softmax	This function is applied in the final output layer of a multi-class classification system. It converts numerical vector scores to a probability distribution that sums to 1, which is essential for predictability.	$\text{softmax}(x_i) = \frac{e^{x_i}}{\sum_j e^{x_j}}$	The cost of using this function is high; this is a reason it is only used in the output layer, as it is important for predicting the final neuron for an input.
Gaussian Error Linear Unit (GELU)	This function is a `monotonic function` which weights inputs rather than gating them strictly based on their sign like `ReLU`. It is heavily applied in modern transformers.	$\text{GELU}(x) = x \cdot \Phi(x)$	This function is more costly than `ReLU`. However, that is the tradeoff. It performs better than ReLU as it enhances smooth transitions in curves rather than ReLU's sharp cutoff at 0. Note that the performance benefit outweighs the extra cost.

From the listed functions above, you observe that some functional alternatives replace each other based on the three main factors:

11. Cost (Finance)
22. Performance (Accuracy)
33. Compute (Data Relationships and System Constraint)

Every decision made in building an AI system revolves around these factors. From the table above, no non-linear function is rejected. However, they are applied in feed forward neural networks based on their priorities among these three factors. You should understand an AI system's priority before auditing the type of activation functions used in the system.

EQUATIONS

Loss/Cost Calculation:

This is the control mechanism of the system. Coming from the perspective of a control system, you should identify this as a feedback loop. Basically, loss calculation is the process of quantifying the error between the network's predictions and actual ground truth targets. The aim of the loss function is to measure how different the network's predicted output is from the expected output. Hence it must be defined. Types of loss functions used are based on two main problems of feed forward neural networks and are provided in the table below.

Note: The average of all calculated loss values for each training batch is the cost function.

Problem	Loss Function	Equation	Description
Classification Problems	cross entropy		They are used for classification tasks.
Regression Problems	Quadratic		This is also known as mean squared error (MSE). It calculates the average square difference between the network's predicted value and the target values.

Back Propagation:

Now before we dive into backpropagation, think of what happens when you are corrected. When you are corrected, you simply take the instruction and try to adjust your result to suit the correction. This is not different from backpropagation at a first-principles level. After a loss function and cost function are calculated, the weights of the model are adjusted to minimize the error between the predicted and actual output.

Note: This process happens iteratively and not only once. It is a continuous process during the training of the feed forward neural network. Looking at the math behind backpropagation, you will observe that it uses the chain rule, giving rise to its iterative nature.

Applications of FeedForward Neural Networks

Now that you have finally understood how a feedforward network works, it is not enough. Knowing its areas of application gives you a good context to explore the consequences of its limitations and malfunctions in production. This is where you apply your skills as a security researcher to find vulnerabilities and get noticed.

Hint: After reading the application of feedforward neural networks, you will understand why some feedforward neural networks are built with high-cost non-linear functions and why some aren't. All these design choices are based on application context.

Finance: FFNNs are applied in finance to model complex data and relationships. Since the network processes information strictly in one direction, they excel at mapping input features to specific financial outcomes for classification, regression, and risk assessment tasks. In this area, the activation functions (non-linear functions) used are based on the specificity of the task.

Activation Function	Typical Use Case in Finance	Job Examples	Reason for Usage
Sigmoid	Binary classification, probabilities	- Default risk prediction (Will a borrower default? Yes/No) - Fraud detection (Fraudulent/Legitimate transaction)	Probabilistic interpretation, outputs between 0 and 1, suitable for yes/no or risk likelihoods
Tanh	Hidden layers, regression with centered data	- Estimating credit scores (scaled between -1 and 1) - Modeling log returns in asset pricing	Zero-centered output facilitates better convergence and modeling of data centered around zero
ReLU	Hidden layers in deep models	- Stock price prediction (predicting future prices) - Feature extraction from market data (e.g., technical indicators)	Efficiency, mitigates vanishing gradient, allows deep network training
Leaky ReLU / Parametric ReLU	Deep networks, avoiding dying ReLU	- Complex risk modeling with deep architectures - Multi-factor asset pricing models	Prevents neurons from becoming inactive, ensuring continuous learning
ELU	Deep networks, faster convergence	- High-frequency trading models - Deep risk assessment models	Smoother activation functions improve convergence and training speed
Softmax	Multi-class classification	- Market regime classification (Bull, Bear, Sideways) - Portfolio allocation strategies with multiple asset classes	Converts output logits into probability distributions over multiple classes
Swish / Mish	Advanced models, potential accuracy gains	- Deep reinforcement learning for trading strategies - Complex financial time series forecasting	Non-monotonic, smooth functions that can improve gradient flow and model accuracy

From the table above, you observe that different non-linear functions are used in financial industry models based on different problems. You can observe that even costly activation functions are still used. This is based on the criticality of task accuracy.

Health Care and Medicine: In health care, feed forward neural networks are used to analyze complex medical data, classify patient risk, and predict health outcomes.

Applications of feed forward neural network can quickly be summarized below:

Use Case	Description	Examples	Outcome
Disease Diagnosis	Classify whether a patient has a disease based on symptoms, lab tests, or images	Detecting cancer (e.g., breast cancer from mammograms), diagnosing diabetic retinopathy	Early detection, improved accuracy
Medical Imaging Analysis	Analyze images like X-rays, MRIs, CT scans to identify abnormalities	Tumor detection, fracture identification	Faster diagnosis, reduced human error
Patient Risk Stratification	Predict risk levels for patients to prioritize care	Heart attack risk prediction, ICU patient deterioration	Better resource allocation, proactive treatment
Drug Discovery	Predict interactions, efficacy, or toxicity of compounds	Virtual screening of drug candidates	Accelerated development process

Different activation functions are used in feed forward neural networks in the medical industry based on different scenarios below. You will observe that certain activation functions are used for certain tasks even though there are more costly functions. For instance, Softmax, which is a high-cost activation function, is used in multi-classification of tumor types. This is the tradeoff for the need for high accuracy in tumor classification. The consequences of not predicting the correct tumor are critical, hence an efficient and near-accurate activation function cannot be used in this scenario.

Activation Function	Role in Healthcare Applications	Example Scenario	Benefit
Sigmoid	Output probabilities for binary decisions (e.g., disease vs. no disease)	Diagnosing presence or absence of a condition	Probabilistic interpretation, suitable for risk scores
Tanh	Model centered data, useful in hidden layers for features like lab values	Feature extraction from structured patient data	Zero-centered output aids convergence
ReLU	Fast training, deep feature extraction	Image feature detection in radiology scans	Efficient learning in deep architectures
Leaky ReLU / Parametric ReLU	Prevent dead neurons in deep models	Deep models for complex image or signal data	Ensures neurons stay active during training
ELU	Faster convergence and stability	Deep neural networks for high-dimensional medical data	Improved training stability
Softmax	Multi-class classification for multiple disease types	Classifying tumor types or disease subtypes	Probabilities over multiple categories

Retail: In the commerce industry, feed forward neural networks are heavily applied to market-related data. Although we are impressed by the latest neural network models, that doesn't mean older ones aren't used extensively. Having knowledge of its wide applications widens your audit scope and target. Vulnerabilities aren't only found in big tech LLMs; they can be found in retail business systems as well.

Use Case	Description	Examples	Outcome
Customer Purchase Prediction	Predict whether a customer will buy a product based on browsing history, demographic data, and previous purchases	Recommender systems, targeted marketing	Increased sales, personalized marketing
Sales Forecasting	Predict future sales volumes based on historical data, seasonality, and trends	Weekly/monthly sales prediction	Inventory optimization, supply chain efficiency
Customer Segmentation	Classify customers into segments based on behavior, preferences, and demographics	High-value vs. casual shoppers	Tailored marketing campaigns, improved customer engagement
Churn Prediction	Predict which customers are likely to stop using a service or product	Subscription service retention	Customer retention strategies, proactive engagement
Fraud Detection	Identify fraudulent transactions using transaction data	Credit card fraud detection	Reduced losses, increased trust
Pricing Optimization	Determine optimal pricing strategies based on demand, competitor prices, and customer sensitivity	Dynamic pricing models	Revenue maximization, competitive advantage

Based on the extensive applications, knowing the type of activation function used in the neural network and when it is applied is very important as a security researcher. Below is a table of non-linear functions and situations where they are applied.

Activation Function	Role in Retail Applications	Example Scenario	Benefit
Sigmoid	Output probability of purchase or churn	Predicting likelihood of customer buying a product	Probabilistic interpretation for decision-making
Tanh	Hidden layers in customer segmentation models	Extracting features from customer data	Zero-centered outputs improve training stability
ReLU	Deep feature extraction in sales forecasting or recommendation models	Analyzing high-dimensional browsing data	Fast training, handles complex patterns efficiently
Leaky ReLU / Parametric ReLU	Prevents dying neurons in deep models analyzing transaction data	Detecting fraudulent activity	Ensures consistent learning during training
ELU	Stabilizes training in large, deep models for demand forecasting	Predicting seasonal sales fluctuations	Faster convergence, better performance
Softmax	Multi-class classification for customer segments or product categories	Classifying customer types or product groups	Probabilities for multiple classes, facilitating targeted marketing

Zealynx Security Brief

Monthly vulnerability spotlights, exploit breakdowns, and security insights. Join security-conscious devs.

No spam. Unsubscribe anytime.

Autonomous Systems: First of all, autonomous systems are designed to achieve specific goals by perceiving the environment, reasoning, and taking actions independently without step-by-step human instructions. They work by four main factors: perception, reasoning, acting, and learning. These systems are complex. Although they are not completely made up of feed forward networks, FFNNs are applied in certain components and functional operations as described in the tables below.

Application of FFNN in Autonomous Agents	Description	Example Use Cases	Outcomes
Perception and Sensor Data Processing	FFNNs process sensor inputs (vision, lidar, radar) to interpret the environment	Object detection, obstacle recognition	Accurate environment understanding for navigation
Decision Making and Control	Neural networks help make real-time decisions based on processed data	Path planning, maneuvering	Smooth, adaptive autonomous operation
Behavior Prediction	Forecasting the actions of other agents (vehicles, pedestrians)	Traffic flow prediction, collision avoidance	Increased safety and efficiency
Localization and Mapping	Estimating position and building environmental maps	SLAM (Simultaneous Localization and Mapping)	Precise navigation in unstructured environments
Learning from Experience	Reinforcement learning models trained with FFNNs for adaptive behavior	Route optimization, task learning	Improved autonomy over time

The table below lists activation functions used in autonomous agent systems and their specific use cases. From studying the applications, you will understand that different activation functions are used based on the nature of the problem. Hence, it is not all about getting the most efficient activation function and throwing it at a problem.

Non-linear Activation Functions in Autonomous Agents	Use Cases	Description & Examples	Benefits
ReLU	Fast processing of sensor data and feature extraction	Recognizing objects in camera feed	Efficient training, handling complex environmental features
Leaky ReLU / Parametric ReLU	Preventing dead neurons in deep perception models	Continuous feature extraction in noisy data	Maintains learning capability during training
Tanh	Normalizing input for stable decision-making	Combining multi-sensor data for localization	Zero-centered outputs for balanced learning
Sigmoid	Probabilistic outputs in decision modules	Probability of collision or safe maneuver	Clear decision thresholds
ELU	Stabilizing deep network training	Large-scale environment understanding	Faster convergence, better generalization
Softmax	Multi-class decision outputs	Classifying possible maneuvers (left, right, stop)	Probabilistic interpretation for safe choices

Manufacturing: In the manufacturing industry, feedforward neural networks are applied in production-based AI systems to increase output and smooth production processes. The table below clearly describes applications in this sector.

Application Area	Description	Use Cases	Benefits
Quality Inspection	Automated detection of defects in products using image data	Visual inspection of manufactured parts	Increased accuracy, faster inspection
Predictive Maintenance	Predicting equipment failures to prevent downtime	Vibration analysis, sensor data modeling	Reduced maintenance costs, increased uptime
Process Optimization	Enhancing manufacturing processes through predictive modeling	Parameter tuning for welding, machining	Improved process efficiency, quality consistency
Supply Chain and Demand Forecasting	Forecasting demand to optimize inventory and production	Sales data analysis, trend prediction	Cost reduction, better resource allocation

Activation functions, otherwise known as non-linear functions, are applied in manufacturing systems based on the use case and problem they want to solve. The following examples of activation functions are shown below with their applications.

Activation Function	Use Cases in Manufacturing	Description & Examples	Benefits
ReLU	Image-based defect detection, sensor data modeling	Fast training, handling complex data	Efficient learning of non-linear features
Leaky ReLU / Parametric ReLU	Robustness in noisy sensor data for predictive maintenance	Prevents dead neurons	Maintains gradient flow during training
Tanh	Feature normalization in process modeling	Balances positive/negative data	Zero-centered outputs for stable training
Sigmoid	Probabilistic classification in defect detection	Defect/no defect classification	Probabilistic outputs for decision thresholds
ELU	Stabilizing deep process models	Faster convergence in complex models	Improved learning stability
Softmax	Multi-class defect classification	Classifying defect types	Probabilistic multi-class outputs

Security Approaches, Vulnerabilities, Measures and Mitigiations for Feed Forward Neural Network

I know you expect to hear general model poisoning answers, which is still correct. However, you have to understand that you build attack vectors from components of this neural network. Every mathematical limitation in the neural network activation function opens a hidden vulnerability that input edge cases can exploit during fuzzing.

First of all, you have to understand that the performance of a model starts with hardware. Using less powerful hardware to train a feedforward network with the same model will likely not give you the same performance as training on more powerful hardware. Hence, when trying to audit an AI model, the following should be considered.

Training Hardware History: This should be studied to possibly diagnose numerical precision and stability problems. Remember, floats are hard to compute. Multiple rounded computations in training reduce accuracy, which is directly proportional to the model's overall performance.
Data Quality Used in Training: Reviewing the data quality used is also a good way to understand the models and build filters (classifiers) for inputs to prevent poisoning.

Now, it is understood that most companies won't like to disclose information like this. Most times, you might just be asked to explore the model's limitations without an information reference point. In that case, you can quickly base your assumptions on common and general vulnerabilities in feed forward neural networks.

Mitigations

Adversarial Training: This is a technique to defend a model's robustness against adversarial inputs. Based on the fact that there are open-sourced data sets of malicious inputs available, adversarial training is carried out on AI models to reduce the chances of exploitation. This is basically retraining the AI models with malicious inputs so they can ignore malicious inputs.
Defensive Distillation: This technique is used to smooth out the model's decision boundaries. This is a way of preventing adversarial attacks.
Output Quantization/Randomization: These techniques are adopted to manipulate the system outputs returned to the user to prevent information leakage, model extraction, membership inference attacks, and reverse engineering of API models.

Output Quantization: This involves deliberately reducing the precision and granularity of the data a system outputs. Instead of providing the exact, continuous value, the system groups the output into discrete bins or rounds them to fewer decimal places. This is done by rounding the confidence score of 0.98765432 to 0.99 before returning it to the user. Note that the confidence score is just an illustration. Numbers can vary; it's an example scenario. Top-K Truncation is also carried out as the system only returns a few most likely classes, still narrowing attack success. The last and most extreme form is hard-labelling. In hard labelling, the system drops probabilities entirely and only returns the final categorical decisions without their probability. This means if it is 80% spam, it returns spam. This method starves the attacker of the exact high-fidelity data needed to reverse engineer the model.

Output Randomization This involves introducing deliberate controlled noise (stochasticity) into the result before it is returned to the user. This is achieved through additive noise - adding small random variables to the true output y to disrupt attack boundaries; temperature sampling - making token prediction more probabilistic over the expected deterministic nature for a set of inputs; and differential privacy - randomizing the core mathematical engine so the inclusion or exclusion of a single data point does not alter the output, protecting the model's privacy.

Conclusion

From the lesson above, you have a thorough understanding of how Feed Forward Neural Networks works, it working principles and why all types of feed forward neural networks doesn't use the same equations for activation functions. You also understand why not all output share the same boundary range in feed forward neural networks. Finally, you have finally understood the security vulnerabilities and mitigations used to guard feed forward neural network from exploits. If you completed the article, I want to say a big congratulations. You are building a solid foundation for AI Security. You don't just know terms and random prompts, you understand neural network internals which is a valuable long-term foundational skills.

FAQ

1. What is a Feed Forward Neural Network?

A Feed Forward Neural Network is a neural network where data flows from the input layer through hidden layers to the output layer with no cycles. It relies on weighted connections and activation functions to compute predictions.

2. What are the main training steps for a FFNN?

The article describes three core training steps: forward propagation to compute outputs, loss/cost calculation to measure prediction error, and backpropagation to adjust weights and reduce that error over iterations.

3. Why is the input layer a security concern?

The input layer is vulnerable because it accepts parsed numerical representations of text, images, or video. Malicious or adversarial inputs can be crafted before the model even begins deeper computation.

4. How can the output layer leak sensitive information?

The output layer often publishes softmax probabilities or logits. Detailed output scores can be exploited by model inversion and membership inference attacks to recover training data or determine whether a sample was seen during training.

5. What defenses are discussed in the article?

The article mentions adversarial training, defensive distillation, and output quantization/randomization as mitigations to improve model robustness and reduce output leakage.

6. Why do activation function choices matter?

Activation functions trade off cost, compute, and performance. The article explains that functions like ReLU, sigmoid, tanh, and GELU are chosen based on task needs, convergence speed, and resource constraints.

Glossary

Feed Forward Neural Network - A neural network where data flows forward from input to output without cycles.
Input Layer - The first layer where raw data is converted into numerical vectors for the network.
Hidden Layer - Intermediate layers where computations happen and features are transformed.
Output Layer - The final layer producing predictions, often using softmax for classification.
Forward Propagation - The process of passing inputs through the network to compute outputs.
Loss/Cost Calculation - Measurement of the error between predicted outputs and actual targets.
Backpropagation - The process of computing gradients and updating weights to reduce error.
Activation Function - A non-linear function applied at each neuron, such as ReLU, sigmoid, tanh, or GELU.
Softmax - A function that converts raw scores into a probability distribution over classes.
Model Inversion - An attack that tries to reconstruct training data from model outputs.
Membership Inference - An attack that determines whether a given sample was part of the training set.
Adversarial Training - A defense that trains the model on malicious examples to increase robustness.
Defensive Distillation - A defense that trains a student model on softened teacher outputs to smooth decision boundaries.
Output Quantization/Randomization - Techniques that coarsen or perturb model outputs to reduce information leakage.

Working auditors in your corner, all year

Zealynx Insiders: weekly live sessions, 1:1 advisory, pair-auditing, and Krait runs on your code, from the firm behind 42 audits. Founders get a two-day audit session on the $500/year plan.

No spam. Unsubscribe anytime.