# How Resilient Are Kolmogorov-Arnold Networks in Classification Tasks? A Robustness Investigation
## 5 Results and Discussion
### KAN-Convolution and Convolution Layer Models  
The Table 3 provides a detailed comparison of the performance metrics for various attack and defense methods on the BTSRD dataset--KANC-KAN, ConvNet-MLP, ConvNet-KAN, and KANC-MLP--under identical conditions. During standard training, KANC-KAN and ConvNet-MLP achieved accuracies of 83.59% and 90.89%, respectively, but were highly vulnerable to adversarial attacks as \(\epsilon\) increased. For the BIM attack (\(\epsilon\) = 0.01), ConvNet-MLP led with 88.80% accuracy, followed by KANC-KAN at 81.77%. As \(\epsilon\) rose to 0.1, all accuracies dropped significantly, with KANC-KAN at 73.44% and ConvNet-MLP at 71.09%. The SAR values increased with higher \(\epsilon\), indicating greater susceptibility to attacks. Under the FGSM attack (\(\epsilon\) = 0.01), ConvNet-MLP score 63.54%, while KANC-KAN only reached 16.93%. At \(\epsilon\) = 0.1, all models struggled, with KANC-KAN at 11.72% and ConvNet-MLP at 13.54%. For the PGD attack (\(\epsilon\) = 0.01), ConvNet-MLP (62.24%) and ConvNet-KAN (45.31%) outperformed KANC-KAN (15.63%). As \(\epsilon\) increased to 0.1, all models' accuracies plummeted. With the CW attack, KANC-KAN and KANC-MLP performed poorly (17.71% and 27.60%, respectively), while ConvNet-MLP achieved 67.19%. Despite some differences in performance, the SAR values remained high across all models, reflecting their vulnerability to optimization-based attacks. Figure 8: Comparison of loss trends for KAN_Mixer and MLP_Mixer models under standard, randomized smoothing, and adversarial training across BTSD, CTSD, and GTSRB datasets (best viewed in color). Randomized smoothing significantly enhanced the adversarial robustness of the models, especially at lower \(\epsilon\) values. For the BIM with \(\epsilon\) = 0.01, KANC-MLP led with 61.98% accuracy, followed by ConvNet-KAN at 57.03% and KANC-KAN at 49.48%. The SAR values remained low, indicating the effective mitigation of adversarial perturbations. However, as \(\epsilon\) increased to 0.1, all models saw a notable drop in accuracy--KANC-KAN and KANC-MLP around 25%, as well as ConvNet-MLP at 16.93%. For the FGSM at \(\epsilon\) = 0.01, ConvNet-MLP topped with 71.61%, followed closely by KANC-KAN at 66.93%. The SAR values indicate effectiveness against lower-strength attacks, but the performance declined at \(\epsilon\) = 0.1, with KANC-KAN at 53.91% and ConvNet-MLP at 48.96%. Under PGD with \(\epsilon\) = 0.01, KANC-MLP and ConvNet-KAN achieved 61.98% and 60.68% accuracy, respectively, while KANC-KAN followed at 59.64%. As \(\epsilon\) rose to 0.1, all models lost accuracy, though KANC-KAN and KANC-MLP performed slightly better. For the CW attack, KANC-MLP achieve 60.94% accuracy, followed by ConvNet-KAN at 53.39% and KANC-KAN at 49.22%. ConvNet-MLP lagged at 29.17%, but low SAR values across all models suggest effective defense against optimization-based attacks. Adversarial training enhances model robustness by incorporating adversarial examples into the training process, although its effectiveness varies by model and attack type. For the BIM with \(\epsilon\) = 0.01, ConvNet-KAN and KANC-MLP achieved the highest accuracies at 59.64% and 57.55%, respectively, while KANC-KAN lagged at 44.01%. With \(\epsilon\) increased  
\begin{table}
\begin{tabular}{c c c|c c c|c c c|c c c|c c c} \hline \hline \multirow{2}{*}{**Training Type**} & \multirow{2}{*}{**AT**} & \multirow{2}{*}{\(\epsilon\)} & \multicolumn{4}{c}{**KANC\_KAN**} & \multicolumn{4}{c}{**ConvNet\_MLP**} & \multicolumn{4}{c}{**ConvNet\_KAN**} & \multicolumn{4}{c}{**KANC\_MLP**} \\ \cline{3-19}  & & & **Acc** & **SAR** & **DoC** & **Acc** & **SAR** & **DoC** & **Acc** & **SAR** & **DoC** & **Acc** & **SAR** & **DoC** \\ \hline \multirow{9}{*}{\ \begin{tabular}{} \end{tabular}