# How Resilient Are Kolmogorov-Arnold Networks in Classification Tasks? A Robustness Investigation
## 5 Results and Discussion
### KAN-Mixer vs. MLP-Mixer Models  
Table 2 shows the performance of KAN-Mixer and MLP-Mixer models under similar training conditions and datasets using various attack types, including FGSM, BIM, PGD, and CW. We evaluated the models using three key metrics, Acc, SAR, and DoC, which reflect their robustness and vulnerability. Standard training is the baseline, where no adversarial defenses are applied. In this setup, KAN-Mixer achieved 97% accuracy and MLP-Mixer 98.5% on the BTSRB dataset with clean data. However, both models suffered significant performance drops under adversarial attacks, especially at higher \(\epsilon\) values. For the FGSM attack at \(\epsilon=0.01\), KAN-Mixer shows better resistance than MLP-Mixer across most datasets but dropped to 0% accuracy on GTSRB when \(\epsilon=1\). Similarly, for the BIM and PGD attacks, both models experienced sharp accuracy declines, with MLP-Mixer nearing zero on BTSRB. The CW attack was less effective, indicated by lower SAR compared to FGSM, BIM, and PGD. While both models demonstrated some resistance, KAN-Mixer slightly outperformed MLP-Mixer overall. Adversarial training incorporates adversarial examples during training, enhancing both models' resilience to attacks compared to standard training, though the improvement varies by model and attack type. For the FGSM attack with \(\epsilon=0.01\), the MLP-Mixer achieved 83% accuracy and the KAN-Mixer achieved 89.5% on the BTSRB dataset. Although accuracy dropped as \(\epsilon\) increased, both models still outperformed their standard training counterparts. While adversarial training improved the defenses for the BIM and PGD attacks, the gain was modest; at \(\epsilon=1\), MLP-Mixer reached 15% accuracy on GTSRB and KAN-Mixer achieved 11%. Both models still showed high SAR values, indicating vulnerability to stronger attacks. For the CW attack, adversarial training was more effective, with both models exhibiting improved accuracy and lower SAR, especially the KAN-Mixer, which shows a slight advantage over the MLP-Mixer. Randomized smoothing is an effective defense method that adds noise during inference, significantly improving robustness, especially for MLP-Mixer. Under the FGSM attack with \(\epsilon=0.01\), MLP-Mixer achieved 54.5% accuracy on BTSRB with a low Success Approximation Rate (SAR) of 0.44, outperforming KAN-Mixer. As \(\epsilon\) increase, MLP-Mixer maintained an advantage, reaching 98% accuracy at \(\epsilon=1\), compared to KAN-Mixer's 72%. The SAR values for MLP-Mixer remained consistently lower, indicating its effectiveness against gradient-based attacks. MLP-Mixer also exceled under BIM and PGD attacks. For instance, it achieves 96% accuracy on BTSRB with BIM (\(\epsilon=1\)), while KAN-Mixer obtained  
Figure 7: Comparison of loss trends for KAN and MLP models under standard, randomized smoothing, and adversarial training across BTSD, CTSD, and GTSRB datasets (best view in color). 94%. Despite high SAR values indicating some vulnerability to stronger attacks, randomized smoothing provided better accuracy than standard or adversarial training. Under the CW attack, MLP-Mixer showed enhanced performance, achieving 55% accuracy on BTSRB and 39.5% on GTSRB, with KAN-Mixer trailing slightly. Overall, randomized smoothing helped both models defend against this type of attack. When comparing KAN-Mixer and MLP-Mixer across three training methods, it is clear that the choice of model and training approach affected the robustness. Randomized smoothing was the most effective, particularly for MLP-Mixer, which generally achieved higher accuracy and lower SAR values. MLP-Mixer outperformed KAN-Mixer in many scenarios, especially against FGSM and CW attacks. While adversarial training improved both models compared to standard training, MLP-Mixer still demonstrated better resistance to stronger attacks like BIM and PGD. This comparison underscores the importance of both the model choice and training methods in designing robust machine learning systems.