Before revision:  Since adversarial attacks are the worst noise for the models, they should depend on the parameters of the models. In this study , we analyze the smoothness of the loss function of adversarial training for binary linear classification and for general cases considering the dependence .
After revision:  Since adversarial attacks are the worst noise for the models, they should depend on the parameters . Considering this dependence , we analyze the smoothness of the loss function of adversarial training for binary linear classification and for general cases considering the dependence .