# Improving Adversarial Robustness of CNNs via Maximum Margin
## 5 Conclusions  
This paper proposed a novel adversarial training method AT-SVM, which inserts an SVM auxiliary classifier in CNN. The input of the SVM auxiliary classifier was linearly separable features after passing through part of the original network. It can learn the decision boundary with the largest margin in this feature space. When training the original network, a new loss function obtained by the SVM auxiliary layer was used. In addition,  
\begin{table}
\begin{tabular}{l c} \hline \hline
**Methods** & **Clean** & **AA** \\ \hline Natural & 95.63 & 0 \\ SAT & 86.91 & 47.73 \\ GAIRAT & 82.70 & 32.19 \\ AT-SVM & 86.87 & 48.09 \\ TRADES & 78.89 & 48.73 \\ AT-SVM\&TRADES & 81.04 & 49.49 \\ \hline \hline \end{tabular}
\end{table}
Table 6: AutoAttack’s test accuracy of ResNet-18 on the CIFAR-10 dataset.  
\begin{table}
\begin{tabular}{l c c c c c c} \hline \hline
**Methods** & **Clean** & **FGSM** & **MIM** & **PGD** & **PGD-b** & **Robustness** \\ \hline Natural & 96.32 & 0 & 0 & 0 & 0 \\ SAT & 91.08 & 68.06 & 62.42 & 57.49 & 57.49 & 57.49 \\ AT-SVM & 92.38 & 75.77 & 65.94 & 60.32 & 67.49 & 60.32 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Test accuracy of ResNet-18 on the SVHN dataset.  
\begin{table}
\begin{tabular}{l c c c c c c} \hline \hline
**Methods** & **Clean** & **FGSM** & **MIM** & **PGD** & **PGD-b** & **Robustness** \\ \hline Natural & 96.32 & 0 & 0 & 0 & 0 & 0 \\ SAT & 91.08 & 68.06 & 62.42 & 57.49 & 57.49 & 57.49 \\ AT-SVM & 92.38 & 75.77 & 65.94 & 60.32 & 67.49 & 60.32 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Test accuracy of ResNet-18 on the SVHN dataset.  
\begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Methods** & **Clean** & **FGSM** & **MIM** & **PGD** & **PGD-b** & **Robustness** \\ \hline SAT & 82.64 & 57.15 & 55.15 & 52.23 & 52.23 & 52.23 \\ SAT+RST & 85.21 & 60.31 & 58.17 & 54.53 & 63.84 & 54.53 \\ GAIRAT & 78.84 & 62.62 & 62.30 & 60.47 & 54.19 & 54.19 \\ GAIRAT+RST & 82.03 & 67.90 & 67.67 & 67.16 & 56.93 & 56.93 \\ AT-SVM & 83.51 & 59.35 & 58.54 & 56.38 & 59.76 & 56.38 \\ AT-SVM+RST & 81.68 & 59.72 & 59.53 & 58.34 & 60.06 & 58.34 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Test accuracy of models training with/without RST.  
we used the SVM layer to select examples close to the boundary for training. Experiments show that conventional cross-entropy loss cannot constrain the margin while our method can effectively increase the margin of the network to improve the robustness against adversarial examples.  
Conceptualization, [PERSON], [PERSON] and X.F.; methodology, [PERSON]; software, [PERSON]; validation, [PERSON], [PERSON] and [PERSON]; formal analysis, [PERSON], [PERSON] and X.F.; investigation, [PERSON]; writing--original draft preparation, [PERSON]; writing--review and editing, [PERSON]; visualization, [PERSON]; supervision, [PERSON], [PERSON] and X.F.; project administration, [PERSON]; funding acquisition, [PERSON] All authors have read and agreed to the published version of the manuscript.  
This research is partly supported by the Key Research and Development Program of Shaanxi (Program Nos. 2021 ZDLGY15-01, 2021 ZDLGY09-04, 2021 GY-004, 2022 ZDLGY06-07), and Shenzhen International Science and Technology Cooperation Project (No. GJHZ20200731095204013).  
Publicly available datasets were analyzed in this study. This data can be found here: [[https://www.cs.toronto.edu/~kriz/cifar.html](https://www.cs.toronto.edu/~kriz/cifar.html)]([https://www.cs.toronto.edu/~kriz/cifar.html](https://www.cs.toronto.edu/~kriz/cifar.html)) (accessed on 10 April 2022) and [[http://ufldl.stanford.edu/housenumbers/](http://ufldl.stanford.edu/housenumbers/)]([http://ufldl.stanford.edu/housenumbers/](http://ufldl.stanford.edu/housenumbers/)) (accessed on 10 April 2022).  
The authors declare no conflict of interest.