On the Robustness of Kolmogorov-Arnold Networks: An Adversarial Perspective
Authors: Tal Alter
Raz Lapid
Moshe Sipper
Venue: Accepted by TMLR ()

Abstract: Kolmogorov-Arnold Networks (KANs) have recently emerged as a novel paradigm for function approximation by leveraging univariate spline-based decompositions inspired by the Kolmogorov–Arnold theorem. Despite their theoretical appeal---particularly the potential for inducing smoother decision boundaries and lower effective Lipschitz constants---their adversarial robustness remains largely unexplored. In this work, we conduct the first comprehensive evaluation of KAN robustness in adversarial settings, focusing on both fully connected (FCKANs) and convolutional (CKANs) instantiations for image classification tasks. Across a wide range of benchmark datasets (MNIST, FashionMNIST, KMNIST, CIFAR-10, SVHN, and a subset of ImageNet), we compare KANs against conventional architectures using an extensive suite of attacks, including white-box methods (FGSM, PGD, C\&W, MIM), black-box approaches (Square Attack, SimBA, NES), and ensemble attacks (AutoAttack). Our experiments reveal that while small- and medium-scale KANs are not consistently more robust than their standard counterparts, large-scale KANs exhibit markedly enhanced resilience against adversarial perturbations. An ablation study further demonstrates that critical hyperparameters---such as number of knots and spline order---significantly influence robustness. Moreover, adversarial training experiments confirm the inherent safety advantages of KAN-based architectures. Overall, our findings provide novel insights into the adversarial behavior of KANs and lay a rigorous foundation for future research on robust, interpretable network designs.

Published in Transactions on Machine Learning Research (03/2025)
On the Robustness of Kolmogorov-Arnold Networks: An Adversarial Perspective
Tal Alter"
talatte@post.bgu.cco
Ben- Cen-Gurion University of the Negev, Beer-Shevo, 8410501, Israel
Raz Lapid*
wus.lapiddkdeeepkepp.
Ben-Gurion University of the Negeu, Beer-Sheva, 8410501, Isruel & DeepKeep, Tel-Aviv Israel
Moshe Sipper
sipper@bgu.ac..
Ben-Gurion University of the Negev, Beer-Shevo, 8410501, Israel
Reviewed on OpenReview: https: // openreview. netteeettteeeeee forum? id=uafaghImPN
Abstract
Kolmogorov-Aruold Networks (KANs) have recently emerged as a novel paradigm for func- tion approximation by leveraging univariate aaline-based decompositions inspired by the Kolmogorov-Aroold theorem. Despite their theoretical appeal-particularly the potential for inducing smoother decision boundaries and lower effective Lipschitz constants their adversarial robustness remains largely unexplored. In this work, we conduct the first com- prehensive evaluation of KAN robustness in adversarial settings, focusing on both fully con- nected (FCKANs) and convolutional (CKANs) instantiations for image classification tasks. Across a wide range benchmark datasets (MNIST, MNshi KMNIST, CTFAR-10, SVHN, and a subset of ImageNet), we compare KANs against conventional architectures us- ing extensive suite of attacks, including white-boxx methods (FGSM, PGD, C&WW MIM), black-boo box approaches (Square Attack, SimBA, NES), and ensemble attacks (AutoAttack). Our experiments reveal that while small- and medium-scale KANs are not consistently more robust than their standard counterparts, large-scale KANs exhibit markedly enhanced re- silience against adversarial perturbations. An ablation study further demonstrates that critical hyperparameters- such as number of knots and spline order sigi---niniiianlll influence robustness. Morcover, adversarial training experiments confirm the inherent safety advan- lages of KAN-based archilectures. Overall, our findings provide novel insights into the adversarial behavior of KANs and lay a rigorous foundation for future research robust, interpretable network designs.
1 Introduction
In the rapidly evolving field of deep learning, the robustness of neural networks against adversarial attacks has emerged as cornerstone of research, driven by the ubiquiiy of their application, often in sensitive areas. As result, multitude of methods have been developed to detect and mitigate ad adversarial attacks, underscoring the critical need for robust defenses in real-world scenarios. These methods span several areas, including adversarial training (Madry et al., 2017; Bai et al., 2021; Shafahi et al., 2019; Andriushchenko & Flammarion, 2020), defensive distillation (Papernot et al., 2016; Papernot & McDaniel, 2016; Carlini & Wagner, 2016), fcature squeezing (Xu ct al., 2017), input transformations (Guo et al., 2017; Harder et al., 2021), and using auxiliary models for detection purposes (Zheng & Hong, 2018; Pinhasov el al., 2024; Lapid et al,, 2024a). The proliferation of these techniques reflects the ongoing efforts within the research community to fortify neural networks against incrcasingly sophisticated attacks.
"Equal contribution

---

Published in Transactions on Machine Learning Research (03/2025)
Fully connected neural networks (FCNNs) and convolutional neural networks (CNNs)-foumdationn foundational models in deep learning haae been extensively studied for their vulnerability and defense mechanisms against adversarial attacks (Dey et al., 2017; Wang et al., 2020; Mohammed et al., 2020; Kerlirzin & Vallet, 1993; Kalina et al., 2022). Recently, the introduction of Kolmogorov-Arnold Networks (KANs) has opened new avenues in function approximation, with theoretical promises of enhanced performance and efficiency (Liu et al., 2024; Bozorgasl & Chen, 2024; Genet Inzirillo, 2024; Vaca-Rubio et al., 2024; Kiamari et al., 2024).
Many studies have compared the performance of KANs across range of tasks. For example, Yu et al. (2024) found that FCNNs generally perform better in areas such machine learning and computer vision. Conversoly, KANs excel in representing symbolic formulas.
Another interesting comparison was done by Zeng et al. (2024), locusing on the performance of KANs and FCNNs in handling irregular or noisy functions. They found that KANs exhibited superior performance both for regular and irregular functions. However, in cases involving functions with jump discontinuities or singularities, FCNNs demonstrated greater efficacy.
Dong et al. (2024) studied KANs for time-series classification. They concluded that KANs exhibit significant robustness advantages, attributed to their lower Lipschitz constants. Note that they focused on time-scries problems, while we focus herein on image-related tasks; further, they deployed a single attack algorithm (Projected Gradient Descent, PGD; Madry et al. (2017)), whereas we will deploy seven attack algorithms.
This paper delves into the robustness of KANs when faced with adversarial attacks under white-box and -NIiST, KMNIST, FashionMNIST,, CIFAR-10, SVHN, and
black-box box conditions. Using multiple subset of ImageNet-on analysís not only sheds light the robustness of KANs but also contributes to the broader understanding of neural network safety in adversarial settings.
The next section provides a comprehensive overview of the architectures employed in this study, along with a detailed discussion of their robustness. In Section 3 we describe the experimental setup and evaluation protocols used to assess our proposed approach. Section then presents the experimental results, reporting how the different architectures perform under a variety of adversarial attacks. Finally, we conclude our st study and outline future research directions in Section 5.
2 Background
2.1 Model Architectures
Our study evaluates two primary types of layers used in artificial neural networks: fully connected layers and convolutional layers. Fully connected layers are the foundational building blocks of feedforward neural networks, where each neuron is connected to every neuron in the next layer. FCNNs classical feedforward networks that learn floating-point weights for these connections (Cybenko, 1989). In contrast, FCKANs, in- spired by the Kolmogorov-Arnok theorem (Kolmogorov, 1961), decompose functions into simpler univariate components, learning these components instead of conventional weights, as detailed by Liu et al. (2024).
Convolutional layers extend the capabilitics of fully connectod layers by leveraging spatial hicrarchics data such as images. These layers are the first and main layers introduced in CNNs (LeCun et al., 1998), where they typically learn floating-point. weights for their convolutional filters. CKANs (Drokin, 2024) apply their unique decomposition principle to learn univariate functions for the filters rather than conventional weights. For more detailed descriptions, please refer to the cited literature.
2.2 Robustness in Neural Networks
Robustness in neural networks refers to their ability to maintain performance when subjected to various forms of perturbations, such as noise, adversarial attacks, or distributional shifts. robust neural network should not only perform well on the training and validation datasets but also generalize effectively to unseen data, including those with slight modifications corruptions.
2

---

Published in Transactions on Machine Learning Research (03/2025)
Mathematically, robustness can be defined as follows: Consider neural network fo : R" R",, parameter- ized by 0, and let E IR" be input to the network. The network is said to be robust to perturbations if, for small perturbation, E IR,, the output of the network remains unchanged, that is:
ll - fa(x + +61l c.
for some small > 0 and for all ||o]| S where 7) represents the maximum allowable perturbation norm.
Adversarial robustness in particular has gained significant attention in recent years. Adversarial attacks involve making small-often peperopptillc-ppruuurtttttt
to input data that can cause a ncural network to produce incorrect outputs with high confidence (Goodfellow et al., 2014). These attacks exploit the vulnerability of neural networks to specific input manipulations, raising concerns about their reliability real-world applications (Szegedy al., 2013). For example, the Fast Gradient Sign Method (FGSM) demonstrates how slight changes to image pixels deceive classifier into misclassification (Goodfellow et al., 2014). Additionally, the Carlini-Wagner (C&W) attack shows that even robust defenses can be circunvented through optimized perturbations (Carlini & Wagner, 2017).
Such examples underscore the critical need for developing networks with enhancod robustness against adver- sarial attacks. Numerous other attack methodologies further highlight this necessity, revealing the extensive landscape of adversarial vulnerability in neural networks (Goodfellow et al., 2014; Lapid et al., 2024b; Szegedy et al., 2013; Taman et al,, 2023; Wei et al., 2022; Lapid et al., 2022; Chen et al., 2024; Carlini & Wagner, 2017: Lapid & Sipper, 2023; Andriushchenko et al., 2020; Lapid et al., 2024c).
Several techniques have been proposed to enhance the robustness of neural networks, including adversarial training, regularization methods, and architectural modifications. Adversarial training involves training the network on adversarially perturbed examples, thereby improving its ability to withstand attacks (Madry et al., 2017). Regularization methods such as dropout (Srivastava et al., 2014) and weight decay- incorporating atten-
prevent overfitting and improve gencralization. Architectural modifications--uut tion mechanisms (Vaswani et al., 2017) and leveraging alternative network structures also contribute to robustness.
The upshot is that robustness is a critical aspect noural network performance, particularly in the context of adversarial attacks and other perturbations. By understanding and improving the robustness of neural networks, we can develop more reliable and secure models for various applications.
2.3 Theoretical Motivation for KAN
Although the primary thrust of our work is empirical, there are several theoretical underpinnings sug- gesting why KANs may enjoy enhanced adversarial robustness compared to classical neural architectures. In particular, two concepts are worthy of discussion: (1) the functional decomposition principle from Kol- Argolov-Arnold theory, and (2) connections to Lipschitz constants and their role in adversarial vulnerability.
2.3.1
Kolmogorov-Arnol Function Decomposition
KANs draw inspiration from the Kolmogorov Superposition Theorem (Kolmogoror, 1961; Arnold, 2009), which states that any continuous multivariate function can be decomposed into finite sum of compositions of continuous univariate functions. In a neural-nctwork instantiation, this translates to lcarning univariato spline-based transformations, followed by mixing via simpler aggregations. Concretely, one approximates a target function f: R R. by expressing it di and viz).
composition of univariate mappings (often denoted
Such a decomposition imposes inherent structure on the learned function. Instead of learning a fully un- constrained, high-dimensional parameter space, KANs learn univariate blocks (or "knots") that are each individually simpler. This structure may yield smoother Icarned docision boundarics, potentially mitigating the local sensitivity that conventional fully connected or convolutional layers can exhibit (Cisse et al., 2017: Ross & Doshi- Velez, 2018).
3

---

Published in Transactions on Machine Learning Research (03/2025)
2.3.2 Lipschitz Perspective and Adversarial Vulnerability
A prominent explanation for adversarial vulnerability involves the Lipschitz constant of the model's decision function: networks with larger Lipschitz constants are typically more sensitive to small local perturba- tions (Cisse al., 2017; Goodfellow et al., 2014). Formally, function f is L-Lipschitz if:
- = L || - z'|l for all n, x' E IR..
(1)
When L is large, small input perturbations can lead to disproportionally large changes in the output (Good- fellow et al., 2014), facilitating adversarial attacks.
In KANs, the piecewise or univariate spline dccomposition can, in principle, distribute the function's 's com- plexity across multiple univariate components. This might help control or lower effective Lipschitz constants, each univariate block need not learn steep extreme gradients. Instead, the overall function is composed of smaller, potentially smoother parts. Empirically, this could translate into fewer local minimas where tiny perturbations trigger large output changes.
2.4 Adversarial Attack Types
Adversarial attacks techniques used to evaluate the robustness of neural networks by introducing small perturbations to input data, causing the model to misclassify the input (Szegedy et al., 2013; Goodfellow et al., 2014). These allacks are broadly categorized into white-box attacks and black-box attacks, based on the adversary's level of access to the model.
White-Box Attacks. In white-box attacks, the adversary has full knowledge of the target model, inchuding architecture, weights, and gradients (Goodfellow et al., 2014; Madry al., 2017). This access allows the adversary to compute perturbations directly by exploiting the model's vulnerabilities. White-box attacks represent the strongost adversarial threat model, as they assume complete transparency of the system.
Black-Box Attacks. In black-box altacks, the adversary has no direct access to the model's internal parameters or gradients (Ilyas et al., 2018; Tu et al., 2019). Instead, the adversary generates adversarial examples by querying the model or leveraging transferability across architectures (Szegedy et al., 2013). Black-box attacks are more practical in real-world scenarios, as they mimic situations where the adversary does not have access to proprietary models or data.
Ensemble-Based Attacks. In addition to individual white-box and black-box atlacks, musemble-based attacks combine multiple adversarial strategies to evaluate model robustness more reliably (Croce & Hein, 2020).
3 Experimental Setup
Do KANs offer enhanced safety compared to classical neural network architectures, when confronted with adversary?
To address this question we conduct an experimental evaluation of KANs. While it may appear uncon- ventional to begin with experiments, direct assessment of the safety of KANs is most effectively achieved through targeted attacks and subsequent analyses. We evaluate the robustness of FCKANs, CKANs, FC- NNs and CNNs under white-bon box and black-box adversarial attacks. Both fully connected and convolutional architectures are tested across multiple datascts, and the results are analyzed compare the robustness of the two architectures.
3.1 Classifier Models
We utilized six models for each architecture (fully connected and convolutional), categorized into small, modium, and large configurations. The configurations for fully connected models are detailed in Table 1, while those for convolutional models are provided in Table 2. All the KAN models were configured with a uniform setting of num knots and spline order 3.
4

---

Published in Transactions on Machine Learning Research (03/2025)
Table Model configurations for fully connected architectures.
Model
PaPaamss
Hidden Layers
FCKA JCKANamall Namall
508, 160
64
FCNN small
508,810
[640]
FCKA M.KNNNe Nmedium
4,730,880
[256, 1024
FONN medium
5,043,210
[1024, 4096]
FCKAN
35,676,160
[128, 128, 256, 256, 256, 512, 512, 512, 1024, 1024, 1024]
FCNN 33,678,986
[128, 256, 256, 512, 512, 1024, 1024, 2048, 2048, 4096, 4096]
Model configurations for convolutional urchitectures. All convolutional layers use a kernel size of 3 x 3, stride of 1, and padding of 1. Max pooling is applied after the last convolutional layer, followed by two fully connected layers with hidden dimensions [1024, 512].
Table 2:
(a) Grayscale Datasets
(b) Multi-Channel Datasets
Model
Output Channels
# #Params
Model
Output Channels
# Params
CKAN
[32, 64, 128 33, 64, 128]
27,056,17 173
CKAN
32, 64, 128] [32, 64, 128)
34,925.677
CNN
26,316,810
CNN
34,181,708
664 64, 64, 128, 128, 128, 256]
588554,961
CKAN
(64, 64, 64, 128, 128, 128, 256) CNNuelion
74,203.909
moNmodi
664, 64, 128, 128, 256, 256, 256
53,648,586
(64, 64, 128, 128, 256, 256, 256]
69,378.378
CKANiagge
661 61, 64, 128, 128, 128, 256, 512]
120,552, 018
CKAN
064, 64, 64, 128, 128, 128, 256, 512]
152,0119 086
CNN
64, 128, 256, 256, 250, 512, 512, 512)
110,744,074
CNNNarg
61. 128, 256, 256, 256, 512, 512, 512]
140
All the models were trained using the AdamW (Loshchilov & Hutter, 2017) optimizer for 20 epochs. The fully connected models were trained on the MNIST (Deng, 2012), FashionMNIST (Xiao et al., 2017), and KMNIST (Prabhu, 2019) datasets with a learning rate of 1 x 10 weight decay of 5 x 10-4, and batch size of 64. The convolutional models were trained on the MNIST, SVHN (Netzer et al., 2011), and CIFAR-10 (Krizhevsky, 2009) datascts using a learning rate of x 10-4, weight decay of 1 x 10-4, and a batch size of 32.
In addition the standard datasets, we trained convolutional architecutres on a 10-image subset of ImageNet (Deng et al., 2009) to evaluate their performance input resolutions varied based on model size: Small CKAN & CNN models trained on 224 x 224 images, Medium CKAN & CNN models trained on 160 x 160 images, and Large CKAN & CNN models trained on 112 x 112 images. The learning rate, optimizer, and weight decay were kept consistent with other convolutional models, but the batch size was reduced to 4.
roghutosol images. Due to memory constraints, the
3.2 Adversarial Attacks
We evaluated the robustness of our models against four distinct white-box attacks. The evaluation began with FGSM (Goodfellow et. al., 2014), a foundational attack used as initial test of model resilience. Subsequently, we assessed the models using more advanced iterative attacks, including PGD (Madry et al., 2017), C&W (Carlini & Wagner, 2017), and the Momentum Iterative Method (MIM) (Dong et al., 2018).
Furthermore, we evaluated the robustness of all the models against three different. black-box attack method- ologics: transfer-based attacks (Section B.2.1), simple black-box attack (SimBA, (Tu et al., 2019)), square at- tack (Andriushchenko al., 2020), and natural evolutionary strategies attack (NES, (Ilyas et al., 2018)). We also added AutoAttack (Croce& & Hein, 2020), an ansemble of adversarial attacks including PGD, FAB, Square Attack, and verification-based attack, which provides a comprehensive robustness evaluation. White-box attacks and AutoAttack were evaluated on all test sets, while black-box attacks were evaluated on random sample of 1, 1,000 images from the corresponding test set. Transferability metrics were calculated using 5,000 images from the test sets.
The hyperparameter configurations for these experiments are provided in Table 3. For the grayscale datasets (MNIST, FashionMNIST. and KMNIST), an value of 32/255 was utilized, whereas for the multi-channel
5

---

Published in Transactions on Machine Learning Research (03/2025)
datasets (CIFAR-10, SVHN, and ImageNet), an value of 8/255 employed. All experiments were conducted with batch size of 16, except for NetgeNet, which was trained with batch size of 4. Furthermore, in our implementation of AutoAttack, we adhered to the default hyperparameter settings, as specified in the original AutoAttack paper (Croce & Hcin, 2020).
Table 3: Hyperparameters used in experiments with white-box attacks, black- box attacks and ensemble-based attacks. k: number of iterations; a: step size (learning rate) for perturbations; confidence parameter in the C&W attack; μr: momentum factor in MIM; a: standard deviation of the noise in NES; n: number of samples used in NES to estimate gradients. For more details see Appendix B.
Table 4: Ablation study con- figurations: Varying number of knots and spline order.
Config
Knots
Spline Order
A B
Attack Type
Attack
Params
(Grayscale Datasets)
Params (Multi-channel Datasets)
C
PGD
40, 0.01
b= 30,
0.01
D
Whiteebox
C&W
10, x 0.01,
30, =0.01, c=
MTM
p.
p-1
E
3
Square SimBA
3000
8 2000
Black-box
5000
3000
NES
300,
0.025, 0.0625, 40 E 200,
0.01, 0.01
3.3 Ablation Study: Impact of KAN Hyperparameters on Robustness
To investigate how KAN hyperparameters affect adversarial robustness, we performed an ablation study focusing on two key factors: number of knots and spline order. These parameters directly influence the expressiveness and smoothness function approximation in KANs, which may affect their susceptibility to adversarial alfacks. We systematically varied these hyperparameters across all sizes of FCKAN models to assess their impact on adversarial robustness. Each model was trained and evaluated using the same attack scttings as described in Section 3.2. The five configurations tested are delineated in Table 4.
3.4 Adversarial training
To enhance model robustness, we conducted adversarial training using PGD allack. Adversarial training is defense strategy where models are trained on adversarially perturbed examples to improve their resilience against future attacks. We applied adversarial training to all the sizes of both fully connected and conv architectures, selecting different datasets for each. The FCKANs and FCNNs were trained on KMNIST data set. The CKANs and CNNs were trained on the CIFAR-10 dataset. Fach model was trained for 20 epochs, using batch size of 16. To asses the effectiveness of adversarial training, we evaluated the trained models against all the white-bon and black-box attacks listed Table 3.
4 Results
4.1
Fully Connected Models
In the context of iterative white-box adversarial attack methods (PGD, C&W, MIM), small and medium FCKANs demonstrated lower robustness compared to small and medium FCNNs, as shown in Table 5. Across all examined datasets, small and medium FCKANs were notably vulnerable to these attacks. In contrast, small and medium FCNNs demonstrated greasurabe-albee limited- of robustness. Nonetheless, even these models remain highly suscoptible to adversarial exploitation, rendering them far from secure practice.
This trend, in which small and medium FCNNs generally outperform FCKANs in robustness under iterative white-box attacks, and for which FCKANs often failed to classify any adversarial images generated by these methods (exeept for the small FCKAN on MNIST), begins to shift when considering larger configurations. For large models, the robustness of FCKANs improves significantly, surpassing that of large FCNNs under the C&W attack across all datascts. Not only do large FCKANs outperform large FCNNs under the C&W attack, but they also show substantial improvement over their smaller and mediun-sized counterparts. Across all iterative adversarial attacks and datasets, large FCKANs exhibited considerably greater resilience than

---

Published in Transactions on Machine Learning Research (03/2025)
Table White-box attacks, black-box attacks, and ensemble attacks on fully connected models, evaluated across MNIST, MNSS, and KMNIST datasets. Robust accuracy is given for each corresponding attack. The "Acc" column refers to the clean accuracy of model. Boldface values indicate the most robust model in each experiment.
White-Box
Black- Box
Cnsemble-Basee Auto Attack
Dataset
Model
Ace
FGSM
PCD
C&W
MIM
Square
SimBA
NES
ICKANamal
6.96
0.00
0.01
0.00
0.09
0.00
0.00
0.00
96.02
FCNN
1.40
0.52
0.65
0.62
2.38
0.19
2.08
0.30
97.94
MNIST
FCKAN
9.51
0.00
0.00
0.00
0.00
0.19
0.00
0.00
97.62
modicum
10.80
0.77
0.87
1.05
3.27
18.35
19.94
0.25
98.31
FCKAN
37.83
1.61
2.27
0.41
24.20
38.78
0.00
0.00
94.54
FCNN
9.57
4.78
0.15
4.76
2.38
5.75
5.25
0.05
97.47
FashionMNIST
FCKAN Nsamal
4.84
0.00
0.00
0.00
0.00
0.00
0.00
0.00
86.83
FCNNamoll
0.95
0.23
0.44
0.32
3.86
0.39
3.67
0.14
88.20
FCKAN
ICKANmciius Nmeciiu
3.78
0.00
0.00
0.00
0.00
0.00
0.00
0.00
86.72
FCNN medicam
5.23
0.12
0.11
0.18
1.58
11.30
11.80
0.01
89.14
FCKAN
16.68
0.05
0.09
0,00
19.64
29.06
0.00
0.00
83.24
FCNN
1.48
0.11
0.00
0.11
0.19
2.48
2.67
0.00
88.53
FCKAN
2.80
0.00
0.00
0.00
0.00
0.00
81.71
KMNIST
FCNN.mall
3.09
1.16
1.52
1.41
7.24
0.89
5.55
0.90
90.28
FCKANmocius
7.65
0.00
0.00
0.00
0.00
1.48
1.68
0.00
87.47
FCNN medium
11.74
1.11
1.35
6.54
8.82
17.85
0.37
91.15
FCKA Aaaage
25.90
0.53
0.04
78.92
FCNN1age
7.14
0.70
0.29
1.05
3.86
1.38
2.67
0.06
89.28
small and medium FCKANs. In contrast, large FCNNs often demonstrated lower robustness than their smaller variants.
Further evidence of the robustness of large FCKANs under white-box iterative attacks is shown in Figure 1. The figure illustrates that the loss function, which increases as the discrepancy between the predicted and true labels is maximized, remains consistently lower for large FCKANs compared to other models. This indicates that deceiving large FCKANs is more challenging. Additionally, while the losses of other models tend to converge during attacks, the loss of large FCKANs maintains linear trajectory, further underscoring their resilience.
A particularly notable observation is the superior performance of large FCKANs compared to large FCNNs under the FGSM white-box adversarial attack, with a pronounced gap favoring FCKANs across all datasets. This further supported by Figure 2, which illustrates the clear advantage of large FCKANs. While the differences robustness between small and medium FCNNs and FCKANs are less definitive, the superiority of large FCKANs over large FCNNs is both clear and substantial, firmly establishing FCKANs as the more robust architecture in larger configurations.
When considering black-box attacks (Square, SimBA, and NES), the performance dynamics shift. Small FCNNs outperform FCKANs on all datasets, where small FCKANs failed to classify any image generated with those attacks. When considering the medium models, although FCKANs successfully classified a small number of images (especially on the KMNIST dataset), medium FCNNs stiill performed better than medium FCKANs across all datascts. However, for larger models, FCKANs demonstrate marked improvement robustness against SimBA and Square black-box attacks, significantly surpassing FCNNs. In contrast, similar to the small and medium sizes under the NES attack, FCKANs failed to classify any adversarial image. The fact that FCKANs failed under the NES attack could result from the gradient approxination for these architectures being much more accurate than for the FCNN architecture.
All the FCNN models, except the large FCNN on FashionMNISTT, successfully classify at least one image generated with AutoAttack, while none of the FCKAN models, across all datasets, successfully classify an image generated with that attack. This may be due the structural properties of FCKANs, which, while beneficial for robustness against certain attacks, might also introduce vulnerabilities that AutoAttack
7

---

Published in Transactions on Machine Learning Research (03/2025)
FCNN-Large
FCNN-M
FCNN-Small
FCKAN-Large
FCKAN-Medlum
FCKAN-Small
PGD Attack
MIM Attack
CW Attack
20
MNIST
LO65
10
10
Fashion MNIST
70
KMNIST
30
20
Los5
20 Iteration
lteration
Iteration
Figure 1: Comparative loss dynamics FCNNs and FCKANs under PGD, MIM, and C&W attacks on the MNIST, MNIH and KMNIST datasets (from top to bottom, respectively). Each line represents the mean loss across batches, per iteration, with shaded areas indicating the standard deviation.
FCNN-Medium
FCNN-Large
TCKAN-Mediun
FCKAN-Large
MNIST
KMNIST
FashionMNIST
100
Accuracy (%6
40
40
20
20
0-
16
255
755
255
255
755
255
Epsilon
Epsilon
Epsilon
Figure Robust accuracy of FCNNmedum, FCNNaagge FCKAN meduumy and FCKANaage as function of FGSM attack strength, with varying values. Each bar represents a different model, and robustness is measured as the accuracy of model against adversarial examples generated with specific values. The x-axis indicates the values used for FGSM attacks, while the y-axis shows the corresponding robust accuracy of the models.
effectively exploits. Specifically, AutoAttack's adaptive nature could be particularly well-suited to finding perturbations that significantly degrade FCKAN performance.
In our analysis of the transferability adversarial white-box attacks (Table 6) we observed that across all datasets, the large FCKAN consistently exhibited the lowest percentage of misclassified images among all six models. This suggests that fooling the large FCKAN is the most challenging task. Moreover, except for the small and medium models the KMNIST dataset, FCKANs consistently demonstrated greater resistance to adversarial attacks than their FCNN counterparts for each model size (small, medium and large), highlighting the superior robustness of FCKANs at every scale.
Qualitative results corresponding to these attacks are presented in Appendix A.
4.2 Convolutional Models
In the context of iterative white-box adversarial attacks, CKANs and CNNs exhibit contrasting behaviors across datasets. As observed in Table 7, both CKANs and CNNs exhibit, poor performance the multi-
8

---

Published in Transactions on Machine Learning Research (03/2025)
Table 6: Maximum transferability our fully connected models, for FashionMNISSI, KMNIST, and MNIST. Each row represents the model that generates the adversarial example and each column represents the model that evaluates those examples. value in row i, column j represents the maximum transferability between row-ý model and column-j model across four attacks-FGSMM FGSM, PGD, C&W, MIM-calculated using Equation 12. Unlike robustness tables, the values here indicate the percentage images misclassified. The Average' row shows the average transferability for the attacking model. Boldfaced values denote the lowest transferability, where lower value indicates better robustness.
PushionMNIST
FCKAN small
FCKAN
FCKAN FCNN
FCNNmedum
FCNN
YCKAN AOKANalalll Semall
57.32
38.97
59.98
56.23
48.76
PCKAN meddium
40.55
28.11
39.89
39.99
35.81
FCKAN Maazge
32.34
29.91
31.90
26.03
27.18
VCNNamall
81.34
81.57
59.43
98.46
90.64
FONN coedtom.
64.82
68.91
45.16
90.19
85.33
FCNNuaze
57.13
39.45
75.18
82.21
Average (1)
35.23
59.40
42.22
50.42
60.58
57.54
KMNIST
FCKAN
FCKAN
FCKAN
FCNN FCNNamall
FCNNDeg
FCKAN Aemal
29.58
21.11
21.00
13.77
19.71
FCKAN meddium
32.87
17.47
16.19
10.94
17.43
FCKAN lazger
19.59
11.82
7.99
4.69
11.30
FCNN
70.68
62.29
45.95
89.77
71.58
FCNNmediion
51.04
42.42
30.76
83.49
59.40
FCNN Large
45.75
35.72
31.89
50.22
43.74
Average (1)
43.98
35.89
32.58
35.88
MNIST
FCKAN sanall
FCKAN JCKANaaddian
FCKAN
FCN
FCNN
FCNN
PCKAN small
28.10
22.94
55.10
30.55
32.32
FCK ANeaeam
35.33
17.71
38.83
22.67
26.74
FCK ANaage
22.78
08.94
18.50
08.36
14.56
FCNN smalll
81.35
68.48
48.68
95.84
88.31
PCNN
meddmmm mediuu
64.17
54.40
33.83
95.48
84.39
FCNN
58.89
44.78
31.77
78.42
72.29
Average (1)
52.50
40.94
30.98
57.26
45.94
49.26
channel datasets (CIFAR-10, SVHN and ImageNet), demonstrating significant vulnerability to adversarial perturbations. On CIFAR-10, none of the models succossfully classify any images generated by those attacks. On the SVHN dataset, the medium and large models manage to classify small number of adversarially generated images. For TmageNet, the CKAN models failed to classify any images, exhibiting the same behavior observed on CIFAR-10. However, CNNs on medium and large scales did not fail completely, showing some level of robustness compared to their CKAN coutnerparts.
Conversely, for the simple dataset (MNIST), CKANs exhibit significantly better robustness than CNNs across all model sizes. Notably, medium and large CKAN models demonstrate remarkable resilience, successfully classifying significant proportion of adversarial images. In contrast, CNNs perform poorly under these conditions, managing to classify only negligible number of adversarial images.
This disparity is further corroborated by Figure 3, which reveals faster loss convergence on complex datasets (CIFAR-10, SVHN and ImageNet) compared to MNIST during the attack process. The rapid convergence of the loss implies that adversarial attacks "fool" models more easily on these complex datasets.
For the non-iterative white-box attack (FGSM), the results are more definitive. On CIFAR-10, CKANs exhibit. greater robustness than CNNs for medium-sized models, whereas CNNs perform better for large

---

Published in Transactions on Machine Learning Research (03/2025)
Table 7: White-box, black-bor box, and ensemble attack on convolutional models, evaluated across MNIST, CIFAR-I0 10, SVHN, and ImageNet datasets. The table reports robust accuracy for each attack, while the Acc column indicates the model's accuracy on clean, unperturbed inputs. Boldface values indicate the most robust model in each experiment. (For ImageNet NES attacks, denoted by x, results could not be fully evaluated as in llyas et al. (2018) due to computational constraints at our university.)
White-Bor
Black- Box SimBA
Ensemble- Based
Dataset
Model
Acc
FGSM
PGD
C&W
MIM
Square
NES
Auto Attack
CKANsmall
72.36
4.52
5.70
8,98
38.39
34.82
49.90
1.13
99.47
CNNamall
68.20
0.74
0.98
2.26
27.38
9.82
33.73
0.02
99.23
MNIST
CKAN medium
86.33
29.88
33.12
42.72
57.93
41.76
66.07
14.78
99.55
CNN gundiuum
28.36
0.00
0.00
0.00
0.39
7.24
8.92
0.00
99.36
CKAN
84.72
31.28
34.32
39.64
56.84
36.21
58.92
18.89
99.52
CNNaagee
55.87
0.01
0.13
0.19
5.15
2.38
5.45
0.00
99.49
CKAN 1
0.01
0.00
0.00
0.00
0.00
2.48
0.99
0.00
74.70
CIFAR-10
CNN senall
0.01
0.00
0.00
2:28
0.69
73.03
CKAN meddim
0.57
0.00
0.00
0.00
0.39
4.26
1.88
0.00
80.72
CNN Naueiiiu
0.27
0.00
0.00
0.00
0.09
2.28
0.79
0.00
76.43
CKAN lurge
0.85
0.00
0.00
0.00
0.19
4.06
1.98
0.00
82.82
CNNgar
1.94
0.00
0.00
0.00
1.48
4.46
2.38
0.00
79.26
CKAN
1.04
0.00
0.00
0.00
7.44
10.41
7.44
0.00
92.34
CNN
0.43
0.00
0.00
0.00
4.76
5.15
2.87
0.00
90.69
SVHN
CKAN merdiom
6.74
0.02
0.02
0.02
16.96
16.36
13.59
0.01
94.37
CNN aacciium
5.00
0.05
0.05
0.04
14.78
9.52
8.03
0.03
93.44
CKAN largo
8.33
0.09
0.10
0.09
19.84
16,26
13.09
0.06
94.41
CNNaagge
6.67
0.04
0.05
0.04
14.08
8.23
7.83
0.02
92.72
CKAN Amalll
0.20
0.00
0.00
0.00
59.40
70.60
76.20'
0.00
76.20
CNN sanall
1.60
0.00
0.00
0.00
58.80
74.60
79.80*
0.00
79.80
Imagen
CKAN mediium
4.00
0.00
0.00
0.00
45.00
64.60
78.20*
0.00
78.20
CNN Neveitum
3.00
0.20
0.20
0.20
41.80
63.60
77.40'
0.20
77.40
CKANiapp
6.40
0.00
0.00
0.00
22.20
37.20
72.80"
0.80
72.80
CNNaage
11.20
1.20
1.00
47.00
73.40*
73.40
models. On ImageNet, small and large CNNs achieve greater robustness than CKANs. However, similar to CIFAR-10, the medium CKAN model demonstrales greater robustness than its CNN counterpart. On the SVHN dataset, CKANs demonstrate slightly higher robustness across all model sizes, although the gap between CKANs and CNNs is relatively small. On the MNIST dataset, which is less complex, CKANs show significantly higher robustness than CNNs, with a noticeable gap favoring CKANs. As shown in Figure 4, this gap is not consistently large across different values.
When analyzing black-box attacks, for MNIST, CIFAR-10, and SVHN CKANs consistently demonstrated superior robustness compared to CNNs across most datasets and model sizes. CKANs outperformed CNNs in nearly all scenarios, except. for the black-box attacks on large models for the CIFAR-10 dataset, where CNNs exhibited slightly better robustness, and on the small models for the CIFAR-10 dataset, where both of the configurations failed to classify any adversarial image generated with the Square attack. For ImageNet, all models performed well under black-box attacks. However, for large models, CNNs significantly outperformed CKANs in terms of robustness.
In the case of AutoAttack the MNIST dataset, CKANs performed exceptionally well against that attack. This suggests that fooling large CKAN model is particularly challenging when dealing with grayscale images, potentially due to the unique structural properties of CKANs, which enhance their resistance to adversarial perturbations in such domains. In contrast, AutoAttack successfully "fooled" most of the models in the other datasets. On CIFAR-IN 10, none the models successfully classified even a single adversarial image generated by this attack. On SVHN and ImageNet, the medium CNN outperformed the medium CKAN, while the large CKAN performed better than the large CNN. The small models, similar the CIFAR-10 models, failed to classify even single image.
10

---

Published in Transactions on Machine Learning Research (03/2025)
CNN Large
CNN-Medium
CNN-Sma
CKAN-Large
CKAN-Medium
CKAN-Small
PGD Attack
MIM Attack
CW Attack
40-
MNIST
10-
30-
20-
2.0
20-
10
10
20
0
10
20
-20
20
100
CIFAR-10
75-
75-
50-
25-
25-
80-
5VHN
10-
20
2--
10
15
20
25
30
5
19
13
20
23
30
16
13
20
ImageNet
30-
20
20
10-
20
15 15
20
15 15
Iteratio
Iteration
Iteration
Figure 3: Comparative loss dynamics of CNNs and CKANs under PGD, MIM, and C&W attacks on the MNIST, CIFAR-10, SVHM and ImageNet datasets. Each line represents the mean loss across batches, per iteration, with shaded areas indicating the standard deviation. For the MNIST, CIFAR-10 AND SVHN datasets, the shaded areas represent the original standard deviation, whereas for ImageNet, they represent the logarithm the original std
CNN-Medium
CNN-Large
CKAN-Medium
CKAN-Large
MNIST
10
SVHN
ImageNet
100
100
100
100
Accuracy (4)
80
80
80
80
60
60-
40
20
20
755
255
255
255
255
255
255
755
Epsilon
Epsilon
Epsilon
Epsilon
Figure Robust accuracy CNN CeNmmdium: CNNNarge: CKANmedinn: and CKAN as a function of FGSM attack strength, with varying values. Each bar represents different model, and robustness is measured as the accuracy of the model against adversarial examples generated with specific values. The x-axis indicates the values used for FGSM attacks, while the y-axis shows the corresponding robust accuracy of the models.
In our analysis of the transferability of ad advesariial white-box attacks (Table 8), we observed that the results vary across datasets and model configurations, with no clear overall trend. On the MNIST dataset, fooling the modium CKAN proves to be the most challenging task. On the SVHN dataset, the large CKAN is the hardest modle fool. Conversely, on the CIFAR-10 dataset, the large CKAN is the easiest model fool, right after the medium CNN model. Similar to the transferability results for the fully connected models.
11

---

Published in Transactions on Machine Learning Research (03/2025)
CKANs consistently demonstrated greater resistance to adversarial attacks than their CNN counterparts for each model size, with the exception of the large size on the CIFAR-10 dataset.
Table Maximum transferability our convolutional models for MNIST, CIFAR-10, and SVHM. Each row repre- sents the model that generates the adversarial example, while each columnn represents the model that evaluates those examples. The value in row i, column j represents the maximum transferability between row- model and column-j model across four attacks-FCCi values here indicate the percentage images misclassified. The Average' row shows the average transferability for the attacking model. Boldface values denoting the lowest transferability, where lower value indicates better robustness.
PGD, C&W, MTM-cot calc-aalee using Equation 12. Unlike robustness tables, the
MNIST
CKAN small
CKANiarge
CNN
CNN
CNNNaa
CKAN small
2.94
3.26
4.70
20.6
4.80
CKAN modiam
5.30
17.78
3.32
18.95
12.01
CKANaage
3.75
14.95
2.51
15.16
9.93
CNNsmall
3.43
1.71
1.55
33.47
6.72
CeN
3.82
2.78
3.48
7.80
46.28
CNNNaagee
3.35
4.49
5.28
5.64
6.98
Average (1)
3.93
5.37
6.27
4.79
19.03
15.94
CIFAR-10
CKAN
small small
CKAN large
CNN
CNN medion
CNN LaNgere
CKAN amall
53.39
45.62
62.95
60.19
35.45
CKAN NAAN modium
70.25
93.48
79.12
90.40
68.52
CKAN
62.80
92.13
75.85
89.65
73.39
CNN
70.47
71.27
69.74
85.70
59.78
CNNmedium
63.23
82.31
82.52
82.50
78.68
CNNtagge
47.53
68.93
76.86
65.07
84.74
Average (4)
62.85
73.60
73.64
73.09
82.13
63.16
SVHN
CKA Namall
CKANmedumm
CKA IKKANarre Jarge
CNNemall
CNN medium
CNNiarge
IKANsmall
63.08
58.62
72.23
58.73
57.70
CKAN Mediimm
77.44
83.76
69.97
75.40
75.40
CKA NJagge
76.54
86.43
69.42
76.23
75.67
CNNamall
68.52
55.79
52.85
03.33
62.15
CNN medium
72.11
74.21
71.98
78.26
85.87
CNNiarge
70.93
74.52
72.70
78.62
85.89
Average (4)
73.10
70.80
67.98
73.70
71.91
71.35
Our experiments indicate that smaller KANs do not consistently outperform conventional neural networks in adversarial settings. By contrast, once the KAN architecture is scaled, the decomposition advantage becomes pronounced. These findings cohere with the theoretical conjecture stated in Section 2.3.1, namely, that having sufficient capacity allows KANs to learn smoother local transformations, distributing the learned decision boundary in a way that reduces susceptibility to adversarial perturbations.
While we do not claim a fully rigorous theory of adversarial robustness for KANs, these lines of reasoning provide plausible explanations for our empirical results, motivating further research on KAN-based Lipschitz regularization and other theoretical investigations.
4.3 Ablation Study: Impact of KAN Hyperparameters
To evaluate the impact of KAN hyperparameters on adversarial robustness, we analyzed the five configura- tions tested in ablation study (Section 3.3).
12

---

Published in Transactions on Machine Learning Research (03/2025)
The results in Figure 5 reveal an interesting phenomenon. In small models, across all datasets, the model with the highest spline order consistently achieves better robustness against adversarial attacks, except for FGSM, where model with spline order of 5 performs best. This trend remains stable in medium-sizzd models, where we observe that the model with the lowest spline order (3) performs significantly worsc at correctly predicting adversarial examples.
N. knots
of knots 3 spline order 7
N. knots 5 spline order
N. of knots of knots 7 spline order
spline order
spline order
Medium
Large
15
40
10.0
MNIST
10
7.5
5.0
10
0.0
PGD
C&W
Square
Auto
FGSM
C6W
Square
SimBA
AuEo
FGSM
PGD
Square SirBA
Auto
40
FashionMNiis
30
20-
2-
F63M
PGD
C&W Square
SimBA
Auto
FGSM
PGD
CGW
Square SimBA Auto
FGSM
PGD
CGW Square SimBA Auto
30
KMNIST
FGSM
PSD
C&W
Square SimBA
Auto
FGSM
PGD
CGW
Square SimBA
Auto
FGSM
P6D
CGW Square SimBA
Auto
Figure Robust accuracy of FCKANs under different adversarial attacks, varying the number knots and spline order.
However, when moving to large models, this trend shifts. In this case, models with the lowest spline order demonstrate strong adversarial robustness. Notably, for iterative white-box attacks, the model with knots and spline order of 3 exhibits remarkable stability, showing strong resistance to these attacks.
4.4 Adversarial training
Examining the results in Table 9 for the fully connected models, and Table 10 for the convolutional models, we can clearly see that, although the standard FCNNs and CNNs achieved higher accuracy on clean test-set images (except for the large models), they perform worse than their KAN-bases counterparts (FCKANs and FCKANs) when predicting adversarially perturbed images. This trend holds across all attack types, indicating that FCKAN and CKAN models are inherently more robust to adversarial perturbations compared to traditional neural networks. Furthermore, this improved robustness may stem from the ability of FCKANs and CKANs to better adapt to adversarial perturbations after exposure to adversarial examples during training. Their structured functional representations might enable them to generalize more effectively to unscen adversarial examples compared to FCNNs and CNNs, which struggle adjust beyond the specific perturbations encountered during training.
5 Concluding Remarks
The introduction KANss opens new avenues in adversarial machine learning, presenting both challenges and opportunitics for improving model safety. In this study, we explored several key aspocts of KANs, focusing on their behavior in convolutional and fully connected layers, which have not been extensively investigated before.
13

---

Published in Transactions on Machine Learning Research (03/2025)
Table 9: Adversarial attack results on fully connected models trained on KMNIST. Values represent robust accuracy (%) after each attack. The highest robust accuracy per row is boldfaced.
Model
FGSM
PGD
C&&
MIM
Square
SimBA
NES
Clean Acc
FCKAN
68.5
62.14
60.87
62.41
55.75
54.16
60.61
79.21
FONN
54.63
49.12
47.78
49.71
52.97
47.42
57.73
85.50
PCKANeddium
77.12
72.38
71.73
72.85
71.03
69.44
74.20
88.95
FCNN modium medNum
72.73
65.95
66.60
67.33
70.63
63.69
73.01
95.22
FCKANare
64.72
57.82
57.21
58.55
53.17
51.88
56.54
74.87
FaNNe
48.05
41.92
41.7
43.21
46.42
40.87
50.09
74.08
Table 10: Adversarial attack results on convolutional models trained on CTFAR-10. Values represent robust accuracy (%) after each attack. The highest robust accuracy per row is boldfaced.
Model
FGSM
PGD
C&W
MIM
Square
SimBA
NES
Clean Acc
CKANamall
35.81
31.29
29.64
31.48
50.19
35.61
51.78
64.31
CNNsmall
30.28
23.68
23.80
23.96
46.62
26.88
46.82
65.97
CKANmediue
39.58
34.61
33.44
34.96
52.28
39.58
54.06
65.80
CNN medium
28.55
21.48
21.61
21.55
44.24
27.18
44.14
66.27
CKAN
40.56
35.56
34.77
35.73
52.38
40.57
51.88
66.60
CNNtagg
31.74
25.02
24.73
25.12
45.23
28.57
47.22
66.42
First, we assessed the inherent robustness of FCKANs and CKANs against both white-box and black- box adversarial attacks. Our findings indicate that while FCKANs exhibit vulnerability levels similar to traditional FCNNs in smaller configurations, they demonstrate significant improvements in robustness network size increases. This suggests that FCKANs could be particularly effective in scenarios where larger models are feasible and robustness is priority. In contrast to the trends observed for FCKANs and FCNNs, CKANs consistently cxhibit greater robustness than CNNs of comparable sizes across most attacks. This highlights a distinct advantage of CKANs in adversarial settings, even when network sizes remain constant.
Our ablation study further highlights the impact of key hyperparameters, specifically the number of knots and spline order, adversarial robustness. We found that models with higher spline order tend to be more resilient to adversarial perturbations, especially in smaller and medium-sized configurations. However, for large-scale models, lower spline order configurations demonstrated stronger robustness under iterative white- box attacks, suggesting that the interplay between network complexity and attack resilience is non-trivial. These findings indicate that optimizing KAN hyperparameters could be a promising avenue for enhancing robustness.
Moreover, our adversarial training experiments demonstrate that FCKANs and CKANs benefit significantly from exposure to adversarial examples during training. Notably, adversarially trained KAN models consis- tently outperformed their standard counterparts in robustness across all tested attacks. However, even after adversarial training, the performance gap between KANs and conventional architectures persisted in some settings, suggesting that additional regularization techniques or training strategies could further enhance their resilience.
While these results provide valuable insights, they also raise important open questions. Future work should explore whether alternative training methodologies such as certified defenses, Lipschitz regularization, hybrid adversarial training can further improve KAN robustness.
Despite their theoretical advantages, KANs are not inherently immune to adversarial perturbations. How- ever, their structured functional decomposition offers a unique framework that may be leveraged for more robust and interpretable deep learning models. As adversarial machine learning research advances, contin- ued investigation into the interplay between KAN structure, optimization, and adversarial robust will be crucial for their practical adoption in security-critical applications.
14

---

Published in Transactions on Machine Learning Research (03/2025)
References
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. Advances in Newral Information Processing Systems, 33:16048 16059, 2020.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query- efficient black-box adversarial attack via random search. In European conference on computer vision, pp. 484-501. Springer, 2020.
Vladimir 1 Arnold.
On functions of three variables. Collected Works: Representations of Functions, Celestial Mechanics ond KAM Theory, 1957-1965, pp. 5-8, 2009.
Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial robustness. Xio preprint arXan:2102.01955 2021.
Zavareh Bozorgasl and Hao Chen. Wav-kan: Wavelet kolmogorov-arnold networks. arXiv preprint arXiv:2405.1288 2024.
Nicholas Carlini and David Wagner. Defensive distillation is not robust to adversarial examples. arXiv preprinl ar xrix::1077.4431, 2016.
Nicholas Carlini and David Wagner. Towards evaluating the robust of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. Teee, 2017.
Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content-basod unrestricted adversarial attack. Advances in Neural Information Processing Systems, 36, 2024.
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In International conference on machine learning, pp. 854- 863. PMLR, 2017.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. arXiv preprint Xrxi::2003. 01690v2, 2020.
George Cybenko. Approximation by superpositions of sigmoidal function. Mathematics of control, signals and systemss 2(4):303-311 1989.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. 2009 IEFE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 248- 255, 2009.
Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web). IEEE signal processing magazine, 29(6):141-144 2012.
Prasenjit Dey, Kaustuv Nag, Tandra Pal, and Nikhil R Pal. Regularizing multilayer perceptron for robust- ness. IEEE Transactions on Systems, Man, and Cybernetics: Systems, 48(8):1255 1266, 2017.
Chang Dong, Liangwei Zheng, and Weitong Chen. Kolmogorov-arrold networks (kan) for time series classi- fication and robust analysis, 2024. URL https://arxiv http://aaxxvv.o//bb//////e wtt.//s/////////a/// 07314.
Yinpeng Dong, Pangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 9185-9193, 2018.
Ivan Drokin. Kolmogorov-arnold convolutions: Design principles and empirical studies. arXio preprint arXiv:2407.01092, 2024.
Remi Genet and Hugo Inzirillo. 0rX1:22405.07344 2024.
arxiv preprint Tkan: Temporal kolmogorov-amoodd networks.
15

---

Published in Transactions on Machine Learning Research (03/2025)
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint or Xie: 12.66772, 2014.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. arXiv preprint arXi::1711.0011 2017.
Paula Harder, Franz-Josef Pfreundt, Margret Keuper, and Janis Keuper. Spectraldefense: Detecting adver- sarial attacks enns in the fourier domain. In 2021 International Joint Conference on Neural Networks (IJCNN), pp. 1-8. IEEE, 2021.
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-bor adversarial attacks with limited queries and information. arXiv preprint or Xiv: 100: 804.884...00 08598, 2018.
Jan Kalina, Jifí Tumpach, and Martin Holeña. On combining robustness and regularization in training multilayer perceptrons over small data. In 2022 International Joint Conference on Neural Networks (IJCNN), pp. 1-8. IEEE, 2022.
P Kerlirzin and F Vallet. Robustness in multilayer perceptrons. Neural computation, 5(3):473 482, 1993.
Mehrdad Kiamari, Mohammad Kiamari, and Bhaskar Krishnamachari. Gkan: Graph kolmogorov-aroold networks. arXiv preprint ar Xix:24406 06470, 2024.
Andrei Nikolaevich Kolmogorov. On the representation of continvuous functions of several variables by su- perpositions of continuuus functions of smaller number of variables. American Mathematical Society, 1961.
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical Report TR-2009, University of Toronto, Toronto, Canada, 2009.
Raz Lapid and Moshe Sipper. see dead people: Gray-box adversarial attack on image-to-text models. Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 277-289. Springer, 2023.
Raz Lapid, Zvika Haramaty, and Moshe Sipper. An evolutionary, gradient-free, query-efficient, black-box algorithm for generating adversarial instances in deep convolutional neural networks. Algorithms, 15(11): 407, 2022.
Raz Lapid, Almog Dubin, and Moshe Sipper. Fortify the guardian, not the treasure: Resilient adversarial detectors. Mathematics, 12(22):3451, 2024a.
Raz Lapid, Ron Langberg, and Moshe Sipper. Open sesame! universal black-box jailbreaking of large language models. In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models, 2024b. URL
Raz Lapid, Eylon Mizrahi, and Moshe Sipper. Patch of invisibility: Naturalistic black adversarial attacks object detectors. In 6th Workshop on Machine Learning for Cybersecurity, part of ECMLPKDD 2024. 2024c.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to docu- ment recognition. Proceedings of the IEEE, 86(11):2278 22222,,227-2222, 1998.
Ziming Liu, Yixuan Wang, Sachin Vaidya, Fabian Ruehle, James Halverson, Marin Soljačié, Thomas Y Hou, and Max Tegmark. Kan: Kolmogorov-arnold networks. arXiv preprint arXiv:2404.199766 2024.
llya Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv preprint 2017.
Alcksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arxio preprint 1 00083, 2017.
16

---

Published in Transactions on Machine Learning Research (03/2025)
Abdulrahman Jassam Mohammed, Muhanad Hameed Arif, and Ali Adil Ali. A multilayer perceptron artifi- cial neural network approach for improving the accuracy of intrusion detection systems. TA ES International Journal of Artificial Intelligence, 944):609, 2020.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupercised Feature Learning, 2011.
Nicolas Papernot and Patrick McDaniel. On the effectiveness of defensive distillation. or preprint arXiv:1607.05I1 2016.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and pricacy (SP), pp. 582-597. IEEE, 2016.
Ben Pinhasov, Raz Lapid, Rony Ohayon, Moshe Sipper, and Yehudit Aperstein. XAI-based detection of adversarial attacks on doopfake detectors. Transactions on Machine Learning Research, 2024. ISSN 2835- 8856. URL
Vinay Uday Prabhu. Kannada-mnist: new handwritten digits dataset for the kannada language. arXiv preprinl Xiv: 10t::1908.111 01242, 2019.
Andrew Ross and Finale Doshi-Veles Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. In Proceedings of the A AATI conference on artificial intelligence, volume 32, 2018.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in neural information processing systems, 32, 2019.
Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, llya Sutskever, and Ruslan Salakhutdinov. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research, 15(1): 1929-19999 1958, 2014.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arxiv preprint XrXiv:1312. 6199, 2013.
Snir Vitrack Tamam, Raz Lapid, and Moshe Sipper. Foiling explanations in deep neural networks. Thans- actions on Machine Learning Research, 2023. ISSN 2835-8856. URL httpps////penreeieeeeeeee//e id=wvLQMHtyL..
Jiawei Tu, Bo Li, Daniel Kushner, and Dawn Song. Simple black-box adversarial attacks. In 2019 IEEE/CV Conference on Computer Vision and Pattern Recognition Workshops (CVPRW). IEEE, 2019.
Cristian J Vaca-Rubio, Luis Blanco, Roberto Pereira, and Marius Caus. Kolmogorov-arnold networks (kans) for time series analysis. arXiv preprint arXiv:2405.0877 2024.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkorcit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
Meng Wang, Yiqin Lu, and Jiancheng Qin. A dynamic mlp-based ddos attack detection method using feature selection and foodback. Computers & Security, 88:101645, 2020.
Zhipeng Wei, Jingjing Chen, Micah Goldblum, Zuxuan Wu, Tom Goldstein, and Yu- Yu-Gang Jiang, Towards transferable adversarial attacks on vision transformers. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 2668 9668-2676, 2022.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist novel image dataset for benchmarking machine learning algorithms. Xiv preprint arxiv 1x8x:x178.0000 777.07747, 2017.
17

---

Published in Transactions on Machine Learning Research (03/2025)
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arviv preprint 1rXix:1704.000 01155, 2017.
Runpeng Yu, Weihao Yu, and Xinchao Wang. Kan or mlp: A fairer comparison. arXiv:2407.16674 2024.
Chen Zeng, Jiahui Wang, Haoran Shen, and Qiao Wang. Kan versus mlp on irregular or noisy functions. arXiv:2488.0700 2024.
Zhihao Zheng and Pengyu Hong. Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural wetworks. Advances in neural information processing systems, 31, 2018.
18

---

Published in Transactions on Machine Learning Research (03/2025)
A Image Samples of Attacks
This section provides visual examples of adversarial attacks applied to single MNIST image, demonstrating the unique perturbation patterns across different model architect ures and sizes. These visualizations compare FCNNs with FCKAÑs and CNNs with CKANs under white-box and black-box attack scenarios.
Fully Connected Models. Figure and Figure depict adversarial images and their corresponding perturbations for FCNNs and FCKANs under white-box and black-box attacks, respectively. The results highlight distinct perturbation behaviors, underscoring the unique adversarial behaviors of KANs.
Convolutional Models. Figure 8 and Figure 9 illustrate adversarial images and perturbations for CNNs and CKANs under white-box and black-box attacks, showcasing architectural influences on adversarial pat- terns. Similarly, Figure 10 illustrates adversarial images and perturbations for the ImageNct dataset under white-box attacks, showcasing the impact of different architectures on adversarial behavior.
FGSM Attack
PGD
CW Attack
MIM Attack
Square Attack
SimBA Attack
NES Attack
FONN- argo
3
3
3
3
3
B
FOCAN-1 Largn- Largn
3
3
3
3
3
3
3
FCM--Medium
3
3
3
3
3
3
3
FOXAN-MModuum
3
3
3
3
3
3
3
FENA-Small Small
3
3
3
3
3
3
3
FOCAN-S Small
3
3
3
3
3
3
3
Figure 6: Visualization of the adversarial images on a single MNIST image using fully connected models. Rows rep- resent model types and sizes: FCNNarge, FCKANarge. FCNNmedium, FCKANmedium, FCNNemall, and FCKAN
19

---

Published in Transactions on Machine Learning Research (03/2025)
FGSM Attack
PGD Attack
CW Attack
MIM Attack
Square Attack
SimBA Attack
NES Attack
FONN- arge
FOXAN- arge
FCNN- (CNN-Medium
FOCAN- Modium
FCMN-Small
FOXAN-Small
Figure 7: Visualization of the pertubations on a single MNIST image using fully connected models. Rows represent model types and sizes: ICNNe FCKAN FCNN FCKAN FCNN small, and FCKAN
FGSM Attack
CW Attack
Square Attack
SimBA Attack
Attack
CANN- Chil-Large
CXAN- Lagg
3
3
3
CNN- MNN-Aedium
3
3
3
3
3
3
3
CXAN-ModUm Mad-MMdium
3
3
3
CAN-Small
3
3
3
3
3
3
CXAN--mall
3
3
3
3
3
Figure& 8: Visualization of the adversarial images a single MNIST image using convolutional models. Rows represent
model types and sizes: CNNaage, CKANiarge, CNNmedium, CKANmedium, CNNsmall, and CKANenall.
20

---

Published in Transactions on Machine Learning Research (03/2025)
FGSM Attack
PGD Attack
CW Attack
MIM Attack
Square Attack
SimBA SimBA-Attack Attack
NCS Attack
CNNV arrgo
ANN-SSmall
CKAN- Small
Figure 9: Visualization the pertubations on a single MNIST image using MNIST image using convolutional models.
Rows represent model types and sizes: CNNtarges CKANaagge CNN medeiumm:: CKANmedium CNNamail and CKAN
B Adversarial Attacks
In this appendix we provide formal mathematical definition of the white-box and black box adversarial attacks.
B.1 White-Box Attacks
In the context of white-box, attacks, the adversary generates an adversarial example Fady from the original input x, using specific technique, denoted as A. The selection of A plays critical role in determining the attack's success rate, which is defined as the percentage of samples that the classifier C misclassifics. The literature presents wide array of techniques for cralting white-box attacks. In the following sections, we provide a detailed description of each attack method evaluated in this study.
B.1.1 Fast Gradient Sign Method (FGSM)
The Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2014) generates adversarial examples by adding perturbations the direction of the gradient of the loss function. Specifically, an adversarial example Tadv is computed follows:
Tadv = x + e sign (V, 0))
(2)
where L is the loss function associated with a classifier parameterized by 0, V.C(E, y; 0) represents the gradient of the loss with respect to the input z, and a small perturbation. Notably, Equation 2, only the sign of the gradient is used, with the magnitude of the perturbation controlled by c. It crucial highlight that FGSM a single-step attack; the adversary computes the gradient by backpropagating through the model once and directly applies this gradient to perturb the input x.
21

---

Published in Transactions on Machine Learning Research (03/2025)
FGSM Attack
PGD Attack
CW Attack
MIM Attack
FGSM Altack
PGD Attack
CW Attack
MIM Attack
CNN-Large
Y
CKAN-Large
CKAN-Medium CNN- Mw--Medlum
CNN- EwN-Small
CKAN-Small
Figure 10: Visualization of the adversarial images and the perturbations generated by white-box attacks three images from our subset of ImageNet using convolutional models. Rows represent model types and sizes: CNN CKANLarge CNNMedium, CKAN Medium, CNNsmall, and CKANsmal). The first four images each row represent the adversarial images, while the last four images represent the perturbations.
B.1.2 Projected Gradient Descent (PGD)
The Projected Gradient Descont (PGD) method (Madry et al., 2017) is an iterative extension of the FGSM, designed to generate more robust adversarial examples. The PGD allack iteratively perturbs the input æ by repeatedly applying gradient updates and projecting the perturbed image back onto an e-ball around the original input. The adversarial example Fadv after iterations is computed
k+1
llB,()) (a + sign ( y; 0)))
(3)
adv
where (.) denotes the projection onto the e-ball centered at x, is the step size, and k indicates the iteration number.
Unlike FGSM, which performs single gradient step, PGD) iteratively refines the adversarial perturbation over multiple steps, thereby producing stronger adversarial examples. The projection step ensures that the perturbation remains within the allowable e-ball, maintaining the proximity of the adversarial example to the original input.
B.1.3 Carlini & Wagner (C&W)
The Carlini & Wagner (C&W) is powerful optimization-basel adversarial attack designed to generate adversarial examples by minimizing a specially crafted loss function while ensuring that the perturbation remains imperceptible. When employing the lx norm, the attack seeks to find minimal perturbation 8 such that the resulting adversarial example Fadv is formulated as follows:
mislcads the classifier. The optimization problem
L(6, | lx + c. f(x 8),
22

---

Published in Transactions on Machine Learning Research (03/2025)
where 2)) is the objective function to minimize, subject to:
Jadv = clip(= + 6,0,
(5)
where (Tadv) is loss function that is specifically designed to ensure the misclassification of the adversarial example Tadv- The term || represents the maximum perturbation applied to any individual pixel, and is a constant that balances the trade-off between minimizing the perturbation and maximizing the loss. The clipping function ensures that the perturbed image remains within the valid input space (i.e., pixel values between 0 and 1).
The attack is typically solved through iterative optimization procedure, where the perturbation d and the adversarial image Tadv are updated at each iteration, as follows:
8 clip(= I., c), k+1 a adv
(6)
= adv + a sign V Va 8²)).
where a is the step size, and & indicates the iteration number.
B.1.4 Momentum Iterative Method (MIM)
The Momentum Iterative Method (MIM) (Dong al., 2018) is an enhancement of the basic iterative methods for generating adversarial examples, incorporating momentum to stabilize the gradient updates and avoid poor local maxima. The MIM attack iteratively updates the adversarial example Tadv by accumulating momentum term, which helps to amplify gradients that consistently point in the same direction across iterations. The adversarial example A+1 after & iterations is computed as:
adv
V vi
ghtz = =.
(7)
Co advs y: 0)1l
x adv
x+1 = [T)) (r + a sign 1))
(8)
where g denotes the accumulated gradient at iteration k, μ is the momentum factor, a the step size, and (.) represents the projection onto the c-ball centered x.
By integrating the momentum term, MIM not only improves the convergence of the altack, but also enhances its effectiveness by consistently updating the perturbation in directions that contribute most to the increase in the loss function. This makes MIM particularly potent in generating adversarial examples that can transfer across different models.
B.2 Black-Bot Attacks
In black-box attack the adversary does have direct access to the internal parameters or architecture of the target model. Instead, the attack relies on querying the model gather information about its predictions or confidence scores. Adversarial examples Fady crafted based these outputs, without explicit. knowledge of the model's gradients or weights. Below, we describe the specifie black-box allack methodologies used in this study.
B.2.1 Transfer-based Attacks
Transfer-based attacks leverage the phenomenon of transferability, where adversarial examples generated for one model are also misclassifiod by other models. This concopt of adversarial example transfcrability was first introduced by Szegedy al. (2013).
Let A denote the white-box adversarial attack method, and let fa represent the model under attack. The attack can be formalized as:
Ajo (x,y) Xadv:
(9)
23

---

Published in Transactions on Machine Learning Research (03/2025)
where (x, y) corresponds to the imput-label pairs.
Let G6 denote the target model, which is employed to evaluate the effectiveness of the generated ad- versarial examples. An adversarial example Xadv considered to have successfully transferred via a given atlack if and only if the following conditions hold:
(A (x, (x, # and fa(x) = (x) =
(10)
To quantify the transferability of adversarial examples between fo and Is for specific attack, we define the transferability metric as:
1
m
(x,, u)) + yb
T0.00
otherwise
(11)
m72
where is the number of samples.
To identify the most effective attack in terms of transferability between the generator model and the evaluator model, we calculated the overall transferability metric, ntotal as follows:
f0.90"
total
fs.95
max FGSM WWW.MMMCCWWWRR
(12)
B.2.2 Square Attack
The Square Attack (Andriushchenko et al., 2020) is query-efficient black-box adversarial allack via random search that operates by iteratively applying random perturbations to the input image. The target is to minimize the following loss:
L [(f(dad)), v) = (F(ddd)) - max (Zadv)) key
(13)
At each iteration, the attack selects random patch of the image and applies perturbations to in the form of square grid. The perturbations are scaled by predefined value, ensuring that they stay within the specified &oo norm constraint. The adversarial example is updated iteratively as follows:
A+1 Fadv
A Asqurrss
(14)
where Asquare represents the perturbation applied to the selected patch. The key advantages of the Square Attack are its simplicity and effeetiveness, making it strong bascline for black-box adversarial evaluation. Additionally, its random search mechanism ensures good exploration of the input space, increasing the chances of finding adversarial examples.
B.2.3 Simple Black-Boo Attack (SimBA) in DCT Space
The Simple Black-Box Autack (SimBA) (Tu et. al., 2019) query-efficient method for crafting adversarial examples. Unlike gradient-based attacks, SimBA perturbs the input image in random manner (e.g., DCT or Fourier space) and evaluates the effect of the perturbation on the model's confidence score. If the perturbation reduces the confidence of the correct label, it is retained; otherwise, it is discarded.
In the DCT (Discrete Cosine Transform) space, SimBA exploits the frequency-domain representation of images to prioritize perturbations on low-frequency components. This ensures that the adversarial examples remain perceptually similar to the original images while efficiently reducing the model's confidence in its predictions.
The SimBA attack updates the adversarial example ileratively as follows:
k+1 adv
Fadv
APCT,
(15)
24

---

Published in Transactions on Machine Learning Research (03/2025)
where Aper represents the perturbation in the DCT basis. The step size of the perturbation is controlled by the parameter.
SimBA's simplicity and efficiency make it widely-used black-box attack, particularly in scenarios where query limits are enforced.
B.2.4 Natural Evolution Strategy (NES)
The Natural Evolution Strategy (NES) (Ilyas et al., 2018) is a gradient-free optimization method that estimates the gradient of a loss function by sampling noise vectors and using finite differences to approximate the effect of perturbations. The method is particularly suited for black-box attacks, where access to model gradients unavailable. It iteratively updates the adversarial example by approximating the gradient of the loss with respoct the input.
For given input x, the adversarial perturbation is computed by estimating the gradient using a set of n random noise vectors ui *N(0,)) I), sampled from standard normal distribution. The update rule is follows:
4
[Caaddv + ou, v) [(x - o4, 8) u.
(16)
2on
Using this gradient estimate &k the adversarial example Zadv is updated iteratively as follows:
k+1 4 adv = -1) (radv + a sign( (++)
(17)
25


Reviews:
[{"review_id": "SwfDgWW4u7", "reviewer": "Reviewer_rVMj", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The paper tests a wide range of attack methods, covering both black-box and white-box settings.\n2. The paper is well-written, with clear and concise explanations, making it easy to follow. \n\nWeaknesses:\n1. The datasets used for testing are all with low resolution and relatively simple. It is necessary to include more challenging datasets, such as ImageNet for a more comprehensive evaluation.\n2. Symbols that appear for the first time should be explained in the main text for clarity, such as Table 3.\n3. When calculating average of attack transferability in Table 7, the case where i=j (the same model) should not be included.\n4. The current analysis only involves classification accuracy without analyzing the reasons why KAN’s robustness may be better or worse than that of fully connected or convolutional networks.\n5. The paper should show or discuss how to enhance the robustness of KAN.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a systematic evaluation of the robustness of Kolmogorov-Arnold Networks (KANs) against adversarial attacks in both white-box and black-box settings, using five dataset and comparing the classification accuracy with FCNNs and CNNs.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See comments in weaknesses.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "0Z2p5pKGyd", "reviewer": "Reviewer_wqTz", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- Novelty: This is the first extensive study analyzing the adversarial robustness of KANs.\n- Comprehensive Experimental Setup: The authors systematically evaluate multiple architectures (FCKANs, CKANs, FCNNs, CNNs) on multiple datasets, employing a variety of adversarial attacks.\n- Strong Comparative Analysis: The inclusion of both white-box and black-box attacks ensures a thorough evaluation of adversarial robustness.\n\n\nWeaknesses:\n- Limited Theoretical Justification: While empirical results support the claim that large KANs are more robust, the paper lacks a strong theoretical explanation for why would KANs exhibit superior robustness. What is the motivation of KANs to be more robust than traditional neural networks? I would expect the paper should start with that some theoretical motivation (maybe from lipschitz point of view) even if this paper is purely empirical.\n- Dataset Limitations: The study primarily focuses on standard image classification benchmarks. Evaluating robustness on more complex datasets, such as ImageNet, could strengthen the conclusions.\n- Ablation Studies: Further investigation into hyperparameter choices (e.g., spline order, number of knots) and their impact on robustness would provide deeper insights.\n- Attack settings- It is not clear if the attack settings used in this paper for KANs are optimally set. It seems they are adopted from traditional networks. For the study to be more informative, it is important for the attacks to be tuned specifically for KANs and CKANs respectively.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper provides an in-depth analysis of the adversarial robustness of Kolmogorov-Arnold Networks (KANs), focusing on image classification tasks. The key contributions of this work are:\n\n- A comprehensive evaluation of KANs under adversarial conditions, including both white-box and black-box attacks such as such as Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Carlini-Wagner (C&W), Momentum Iterative Method (MIM), Square Attack, Simple Black-Box Attack (SimBA), and Natural Evolution Strategies (NES).\n- Comparative analysis of KANs against traditional fully connected neural networks (FCNNs) and convolutional neural networks (CNNs) across multiple benchmark datasets (MNIST, KMNIST, FashionMNIST, CIFAR-10, and SVHN).\n- Experimental insights on the robustness of small, medium, and large KAN architectures, demonstrating that larger KANs exhibit superior robustness compared to their standard neural network counterparts.\n- An extensive discussion on the transferability of adversarial attacks, illustrating that KANs demonstrate lower attack transferability, particularly in their larger configurations.\n- A structured analysis of robustness trends, highlighting that KANs remain vulnerable to adversarial perturbations, albeit with greater resistance in larger models.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Provide a theoretical justification for why large KANs demonstrate superior robustness. A discussion on potential factors (e.g., lower Lipschitz constants, function decomposition) would strengthen the contributions.\n- Extend the analysis to additional datasets, particularly more complex or real-world datasets, to validate the generalizability of the findings.\n- Ablation studies on KAN hyperparameters (e.g., number of knots, spline order) and their impact on adversarial robustness.\n- Tune attack hyperparameters specifically for the KANs and CKANs.\n- Effect of adversarial training: Investigate whether adversarial training techniques can further improve KAN robustness.\n- If the authors can provide some insight into provable robustness certificates for KANs, that would significantly strengthen the papers contribution.\n- Visualization of adversarial perturbations, showcasing how perturbations affect KANs differently compared to FCNNs and CNNs.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "dX8HfAim4s", "reviewer": "Reviewer_YvaH", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n\n- Studying the adversarial robustness of KAN is essential for advancing the understanding in this area. The findings presented in this paper have the potential to influence future works and development efforts significantly.\n\n- Comprehensive evaluations are highly valued and contribute significantly to the impact of the findings.\n\n- The observation that large-scale KANs exhibit greater robustness is particularly intriguing.\n\n---\n\nWeaknesses:\n\n- The evaluations in this study were conducted exclusively using standard training, which may limit the novelty of the empirical observations. While the finding that larger models exhibit greater robustness is intriguing, it is not entirely novel. Similar trends have been observed in existing benchmarks, such as RobustBench [1]. Nevertheless, the observations in this paper suggest that KANs also adhere to these established patterns.\n\n- The differences observed in the experiments are marginal. For instance, in Table 4, the results for CW attacks, particularly given that these models were trained using standard training methods. Such findings cannot conclusively indicate that larger KANs are more adversarially robust. The reviewer suggests extending the evaluation to include adversarial training to provide more definitive insights.\n\n- The paper lacks theoretical or empirical analysis explaining why larger KANs exhibit greater robustness. Providing such explanations would significantly enhance the contribution and deepen the understanding of the observation. \n\n- Based on Figures 1 and 3, the results indicate that small variants of KANs demonstrate robustness comparable to the large configurations, while the mid-sized configurations are less robust. What could be the underlying reason for this pattern?\n\n- The evaluated attacks are well-established for convolutional models. However, these attacks might overestimate the robustness of KANs. While it is understandable that only a limited range of attacks has been explored for KANs, the reviewer suggests expanding the evaluation to include ensemble-based attacks, such as AutoAttack [2]. \n\n---\n\n[1] Croce, Francesco, et al. \"RobustBench: a standardized adversarial robustness benchmark.\" Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2).\n\n[2] Croce, Francesco, and Matthias Hein. \"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.\" International conference on machine learning. PMLR, 2020.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper investigates the adversarial robustness of Kolmogorov-Arnold Networks (KAN) against both white-box and black-box attacks. To this end, this paper conducts a comprehensive empirical evaluation of KANs with various configurations, employing standard training methods. The results reveal that small and medium-sized KANs exhibit lower robustness compared to convolutional networks. However, the findings also indicate that larger KANs demonstrate superior robustness when compared to convolutional networks.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The primary suggested changes are outlined in the weaknesses section.\n\nThe term safety is more appropriate than security in this context. Authors may consider using the term safety consistently throughout the paper.", "broader_impact_concerns": "No ethical concerns require attention.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The recommendation is based on the reviewers' comments, the action editor's evaluation, and the authors’ response. 

This paper studies the (adversarial) robustness of Kolmogorov-Arnold Networks (KANs), a new family of machine learning models. The novelty in the exploration of KAN's robustness is acknowledged, and the results also provide new insights. The authors’ rebuttal has successfully addressed the major concerns of most of the reviewers. Therefore, I recommend acceptance of this submission. I also expect the authors to include the new results and suggested changes during the rebuttal phase to the final version.
Decision: Accept (poster)