# How Resilient Are Kolmogorov-Arnold Networks in Classification Tasks? A Robustness Investigation
## 6 Conclusions  
The comparative analysis of KAN and MLP models across various datasets (BTSD, CTSD, and GTSRB) under different adversarial attack scenarios has yielded significant findings. Both models performed well on clean data, with MLP models, including MLP-Mixer, typically achieving slightly higher accuracy. However, the key discovery was their vulnerabilities under adversarial attacks, particularly at high epsilon values, where their robustness declines sharply. In contrast, the KAN-based model utilizes learnable activation functions on edges, employing nonlinear weights throughout. Each weight parameter was replaced by a univariate function, which was parametrized using spline-based interpolation and dynamic grid adaptation. This design aimed to provide superior flexibility in learning complex, nonlinear relationships, especially KAN-Mixer, demonstrating better resilience and consistently achieving higher accuracy and lower success attack rates (SARs) at moderate epsilon values. Our experiment conducted three training strategies: standard training, adversarial training, and randomized smoothing. Standard training led to substantial accuracy drops during adversarial attacks, while adversarial training offered limited improvements. However, randomized smoothing, which introduced noise during inference, proved most effective. It significantly enhanced the accuracy and robustness of MLP models like MLP-Mixer against gradient-based attacks. Finally, comparing KANConv-based models (KANConv_KAN and KANConv_MLP) with ConvNet-MLP models reveals that KANConv architectures offer a balanced approach. They generally outperformed ConvNet-MLP models in adversarial robustness. While ConvNet-MLP models performed well on clean data, they were more susceptible to adversarial perturbations, particularly at higher epsilon levels. KANConv-based models, on the other hand, maintained better accuracy and lower SAR across different attack scenarios, indicating that KANConv architectures offer a more balanced approach by combining high accuracy on clean data with solid defenses against adversarial attacks. This balance should reassuse the audience about the overall performance of KANConv architectures. In conclusion, KAN-based models, particularly KAN-Mixer and KANConv architectures, show greater resilience to adversarial attacks than MLP models. Combining advanced defenses, such as randomized smoothing, with robust architectures like KAN-based models offers promising protection in challenging environments. Further research is needed to explore these models across additional datasets and metrics to understand KAN's capabilities and limitations better.  
Conceptualization, A.D.M.I.; methodology, A.D.M.I.; software, A.D.M.I.; validation, J.-E.H.; formal analysis, A.D.M.I.; investigation, A.D.M.I. and Z.S.; resources, J.-E.H.; data curation, A.D.M.I.; writing original draft preparation, A.D.M.I. and J.-E.H.; writing review and editing, A.D.M.I. and J.-E.H.; visualization, A.D.M.I., Z.S. and J.-E.H.; supervision, J.-E.H.; project administration, J.-E.H.; funding acquisition, J.-E.H. All authors have read and agreed to the published version of the manuscript.  
This research was supported by the National Research Foundation of Korea (NRF) grant funded by the Ministry of Education (RS-2023-00237203).  
Not applicable.  
The data presented in this study can be made available upon request from the authors.