# How Resilient Are Kolmogorov-Arnold Networks in Classification Tasks? A Robustness Investigation
## 5 Results and Discussion
### KAN-Convolution and Convolution Layer Models
 } & BIM & 0.01 & 81.77 & 2.08 & 0.27 & 88.80 & 2.08 & 0.28 & 84.64 & 1.30 & 0.28 & 83.07 & 1.04 & 0.27 \\  & BIM & 0.1 & 73.44 & 11.46 & 2.47 & 71.09 & 19.79 & 2.51 & 73.18 & 12.76 & 2.51 & 72.92 & 11.72 & 2.48 \\  & BIM & 1 & 5.73 & 77.86 & 13.80 & 6.51 & 84.38 & 13.94 & 5.47 & 80.47 & 14.00 & 4.43 & 79.69 & 13.85 \\  & FGSM & 0.01 & 16.93 & 66.67 & 13.35 & 63.54 & 27.86 & 13.35 & 47.66 & 40.89 & 13.35 & 26.82 & 58.07 & 13.35 \\  & FGSM & 0.1 & 11.72 & 71.88 & 13.43 & 13.54 & 77.34 & 13.44 & 14.32 & 71.88 & 13.44 & 11.20 & 73.18 & 13.43 \\  & FGSM & 1 & 0 & 83.59 & 20.36 & 0 & 90.89 & 21.27 & 0 & 85.94 & 21.24 & 0 & 84.11 & 20.46 \\  & PGD & 0.01 & 15.63 & 67.97 & 13.35 & 62.24 & 29.17 & 13.35 & 45.31 & 42.97 & 13.35 & 24.48 & 60.42 & 13.35 \\  & PGD & 0.1 & 8.59 & 75.00 & 13.39 & 23.18 & 67.71 & 13.40 & 20.05 & 66.15 & 13.40 & 9.38 & 74.74 & 13.39 \\  & PGD & 1 & 1.82 & 81.77 & 16.59 & 1.30 & 89.58 & 16.63 & 1.30 & 84.64 & 16.68 & 2.34 & 82.92 & 16.59 \\  & CW & - & 17.71 & 65.89 & 11.23 & 67.19 & 23.70 & 4.63 & 46.61 & 39.32 & 7.20 & 27.60 & 56.51 & 10.04 \\  & None & - & 83.59 & - & - & 90.89 & - & - & 85.94 & - & - & 84.11 & - & - \\ \hline \multirow{9}{*}{ \begin{tabular}{} \end{tabular}  } & BIM & 0.01 & 49.48 & 3.91 & 0.27 & 28.13 & 2.34 & 0.27 & 57.03 & 2.60 & 0.27 & 61.98 & 2.86 & 0.27 \\  & BIM & 0.1 & 25.26 & 28.39 & 2.45 & 16.93 & 13.54 & 2.47 & 39.84 & 20.83 & 2.46 & 38.54 & 26.56 & 2.47 \\  & BIM & 1 & 0 & 53.39 & 13.66 & 8.07 & 25.00 &  
to 0.1, the accuracy dropped across all models, with KANC-KAN at 12.76% and ConvNet-MLP at 32.81%. In the FGSM at \(\epsilon\) = 0.01, ConvNet-MLP led with 71.61% accuracy, followed by KANC-MLP at 63.80%. At \(\epsilon\) = 0.1, both models saw declines, with KANC-KAN at 53.65% and ConvNet-MLP at 47.66%. The SAR values remained low at \(\epsilon\) = 0.01 but increased with stronger attacks, indicating moderate protection. Under PGD at \(\epsilon\) = 0.01, ConvNet-MLP achieved 69.53%, while KANC-MLP reached 61.46%. With \(\epsilon\) = 0.1, the accuracies fell, with KANC-KAN at 19.27% and ConvNet-MLP at 40.10%, and the SAR values again increased. For the CW attack, KANC-MLP showed the highest accuracy at 56.77%, closely followed by ConvNet-KAN at 57.81%. KANC-KAN and ConvNet-MLP achieved 44.53% and 48.70%, respectively. Overall, the SAR values remained high, indicating that adversarial training is less effective against optimization-based attacks than randomized smoothing. Our analysis underscores the effectiveness of randomized smoothing as the most potent defense for enhancing adversarial robustness, particularly for KANC-MLP and ConvNet-KAN models. While adversarial training does offer some benefits, it is less effective than randomized smoothing against high-intensity attacks like BIM and PGD. The KANC-KAN model, while consistent, is less effective under stronger attacks. These findings strongly suggest that by combining randomized smoothing with adversarial training, hybrid strategies may offer the most robust protection against adversarial attacks. The training performance of the ConvNet_KAN, ConvNet_MLP, KANC_KAN, and KANC_MLP models is depicted in Figure 9, which shows loss during the training phase, respectively, over 100 epochs. Figure 9 illustrates the loss values over training epochs. Initially, all models showed a sharp decrease in loss, especially in the early epochs, before stabilizing at lower values. ConvNet_KAN with randomized smoothing demonstrated the fastest loss reduction and achieves the lowest final loss, indicating superior optimization and convergence. The other models followed similar loss reduction trends but converged slightly slower, with KANC_KAN and ConvNet_MLP showing comparable final loss values.