## 3 Effect of Adversarial Training on Network Performance
### Performance of an Adversarially Trained ResNet18 Network  
Since the result can be dependent on the neural network model, we conducted the same experiment on the ResNet18 network. While the LeNet5 model has 648,226 trainable parameters, the ResNet18 model is a much larger size with 11,175,370 parameters. In general, the ResNet18 model is known to perform better in learning complex features from images. In this experiment, both the defender and the attacker create adversarial examples from their own ResNet18 networks, and the same data augmentation strategy is applied as in the LeNet5 case. Since ResNet18 takes more epochs to converge compared to LeNet5, the network is trained for 100 epochs and the result is taken from test accuracy measured between 40 to 100 epochs of training. The result is in Table 3. We can observe similar patterns observed in the LeNet5 result. When an undefended network is tested using FGSM, JSMA and C&W samples, the accuracy is significantly lower compared to testing with clean images. When the network is trained with adversarial samples created using a particular algorithm, the network becomes robust to the adversarial examples generated using the same method. Multiple combinations of adversarial samples can be used for adversarial training, which provides robustness to more adversarial samples while maintaining the accuracy for clean test data. Compared with LeNet5, the ResNet18 model achieves higher robustness when the network is undefended. For example, the accuracy of FGSM samples tested on the LeNet5 model is approximately 50%, while the result on the ResNet18 is 70%. The accuracy of adversarial examples is also increased for other methods as well. Thus, we can say that, when adversarial training is not used, model structure and number of parameters could affect robustness of the network. However, when adversarial training is used, the accuracy of adversarial examples is comparable for LeNet5 and ResNet18 networks. In many cases, adversarial training is more effective than the model architecture. For example, when a network is adversarially trained with FGSM images, LeNet5 achieves higher accuracy than ResNet18 in classifying FGSM adversarial samples. \begin{table}
\begin{tabular}{l l c c c c c c c c} \hline \hline  & & \multicolumn{4}{c}{**Maximum**} & \multicolumn{4}{c}{**Median**} \\ \cline{3-10}  & & **Clean** & **FGSM** & **JSMA** & **C\&W** & **Clean** & **FGSM** & **JSMA** & **C\&W** \\ \hline \multirow{6}{*}{
\begin{tabular}{} \end{tabular} } & Clean & 99.42 & 50.23 & 64.07 & 55.28 & 99.23 & 42.01 & 61.06 & 46.07 \\ \cline{2-10}  & FGSM & 99.40 & 99.31 & 63.90 & 75.67 & 99.24 & 99.27 & 60.34 & 65.08 \\ \cline{2-10}  & JSMA & 99.42 & 50.35 & 96.75 & 81.20 & 99.30 & 48.46 & 96.35 & 75.02 \\ \cline{2-10}  & C\&W & 99.37 & 74.12 & 69.00 & 99.57 & 99.22 & 61.17 & 63.30 & 99.31 \\ \cline{2-10}  & FGSM + JSMA & 99.40 & 99.32 & 96.29 & 90.05 & 99.28 & 99.26 & 95.15 & 84.94 \\ \cline{2-10}  & FGSM + C\&W & 99.43 & 99.32 & 65.27 & 99.65 & 99.24 & 99.26 & 62.96 & 99.42 \\ \cline{2-10}  & JSMA + C\&W & 99.43 & 73.98 & 96.70 & 98.99 & 99.35 & 70.71 & 95.83 & 98.58 \\ \cline{2-10}  & FGSM + JSMA + C\&W & 99.36 & 99.30 & 95.82 & 98.81 & 99.27 & 99.21 & 94.92 & 98.39 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Test accuracy of LeNet5 measured between 20 and 50 epochs. The network is trained with data augmentation including random rotation, random translation and random erasing.