# How Resilient Are Kolmogorov-Arnold Networks in Classification Tasks? A Robustness Investigation
## 4 Methodology
### Evaluation Metrics  
The models were evaluated based on several metrics to assess their performance and robustness against adversarial attacks. Accuracy, Success Attack Rate (SAR), and Degree of Change (DoC) were the primary metrics used. Accuracy measures the percentage of correct predictions in the test dataset, while SAR measures the percentage of adversarial attacks that have successfully attacked and misclassified the model based on the total number of adversarial attacks. In contrast, DoC measures the average magnitude of perturbations introduced by the adversarial attack. The results were recorded for standard, randomized smoothing, and adversarial training conditions. The standard training models were evaluated on clean and adversarially perturbed data (FGSM, PGD, CW, and BIM attacks). In adversarial training, the models trained with adversarial examples were evaluated on clean and adversarial data to assess the effectiveness of adversarial training. Lately, in randomized smoothing training, the defense technique augments training by adding Gaussian noise to the input data. This smooths the model's decision boundary, making it less sensitive to small perturbations and increasing its robustness against adversarial attacks.  
Figure 6: Illustration of various neural network architectures integrating KAN-based building blocks for constructing KAN convolutional (KANConv) layers and KAN classification heads.  
Accuracy metric measures the percentage of correct predictions on the test dataset:  
\[\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+\text{ FN}} \tag{22}\]  
where TP denotes True Positives, TN denotes True Negatives, FP denotes False Positives, and FN denotes False Negatives.  
The Success Attack Rate (SAR) of adversarial attacks quantifies the effectiveness of an attack by measuring the proportion of inputs where the model's prediction changes from correct on clean data to incorrect on adversarial data. It is defined as follows:  
\[\text{SAR}=\frac{1}{N}\sum_{i=1}^{N}\left[\mathbb{I}\left(\hat{y}_{i}^{\text{ clean}}=y_{i}\right)\cdot\mathbb{I}\left(\hat{y}_{i}^{\text{adv}}\
eq y_{i} \right)\right]\times 100\% \tag{23}\]  
where \(N\) is the total number of samples, \(y_{i}\) is the true label of the \(i\)th sample, \(\hat{y}_{i}^{\text{clean}}\) is the model's prediction on the clean input, \(\hat{y}_{i}^{\text{adv}}\) is the model's prediction on the adversarial input, and \(\mathbb{I}(\cdot)\) is the indicator function, which equals 1 if the condition is true and 0 otherwise.  
The Degree of Change (DoC) measures the average magnitude of perturbations introduced by the adversarial attack, quantifying how much the adversarial images differ from the original images. It is calculated as the average \(L_{2}\) norm of the difference between the original and adversarial images:  
\[\text{DoC}=\frac{1}{N}\sum_{i=1}^{N}\left\|\mathbf{x}_{i}^{\text{adv}}- \mathbf{x}_{i}\right\|_{2} \tag{24}\]  
where \(\mathbf{x}_{i}\) is the original (clean) input image of the \(i\)th sample, \(\mathbf{x}_{i}^{\text{adv}}\) is the adversarially perturbed image of the \(i\)th sample, and \(\|\cdot\|_{2}\) denotes the \(L_{2}\) norm (Euclidean distance).