# Fast-M Adversarial Training Algorithm for Deep Neural Networks
## 7 Conclusions  
This paper proposes an improved Fast-M adversarial training algorithm based on the fast adversarial training method. The Fast-M adversarial training algorithm presented in this article can train a more robust neural network model in the same training time as the fast adversarial training method. The model's classification accuracy for PGD adversarial attacks can reach the same level as a neural network model trained for more time using PGD adversarial training or even slightly surpass it. Additionally, extensive comparative experiments on the MNIST, CIFAR10, and CIFAR100 datasets were conducted. The experimental results fully validate the effectiveness of the proposed method. However, compared to PGD adversarial training, it does not show a significant improvement. This may be due to the limitations imposed by the conventional FGSM adversarial perturbation. Using FGSM adversarial perturbation for adversarial training does not yield a noticeable defense effect against PGD adversarial attacks. Future research should focus on obtaining stronger adversarial samples for adversarial training without significantly increasing the required training time. Additionally, we intend to explore the utilization of approximation methods and precomputing techniques to mitigate the computational complexity associated with our proposed approach. One potential avenue involves precomputing a set of adversarial samples and reusing them during the training process, thereby further reducing the training costs. We firmly believe that this research direction holds promise in enhancing the practicality and efficiency of our method. We look forward to making significant strides in this direction, striking a better balance between the computational efficiency of adversarial training and the robustness of the trained models, thereby advancing the practical application of adversarial training.  
Conceptualization, Y.M., D.A. and Z.G.; methodology, Y.M., D.A. and Z.G.; software, Z.G.; validation, Y.M. and Z.G.; formal analysis, Z.G.; investigation, D.A. and Z.G.; resources, D.A.; data curation, Z.G.; writing--original draft preparation, Y.M. and Z.G.; writing--review and editing, Y.M., D.A. and Z.G.; visualization, Z.G.; supervision, D.A. and J.L.; project administration, D.A. and J.L.; funding acquisition, Y.M., D.A. and W.L. All authors have read and agreed to the published version of the manuscript.  
This research was funded by the National Natural Science Foundation of China under Grant 62173268, the National Postdoctoral Innovative Talents Support Program of China under Grant BX20200272, the Natural Science Basic Research Program of Shaanxi under Grant 2021 JQ-288, and the Fundamental Research Funds for the Central Universities, CHD under Grant 300102320101.  
Not applicable.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Algorithm** & **Standard** & \begin{tabular}{c} **PGD-20** \\ **(\(\mathbf{c}\) = 8/255)** \\ \end{tabular} & \
\begin{tabular}{c} **PGD-50** \\ **(\(\mathbf{c}\) = 8/255)** \\ \end{tabular} &
\begin{tabular}{c} **Training Time** \\ **(min)** \\ \end{tabular} \\ \hline Fast & 58.24\% & 0.54\% & 0.3 & 53.11 \\ Free (m = 8) & 49.13\% & 12.14\% & 11.93\% & 107.16 \\ Free (m = 8) & 56.06\% & 20.55\% & 20.26\% & 213.55 \\ PGD-7 & 55.51\% & 20.32\% & 20.06\% & 211.32 \\ PGD-10 & 54.89\% & 21.38\% & 21.15\% & 289.33 \\ Fast-3 (ours) & **59.02**\% & 20.31\% & 20.01\% & 54.39 \\ Fast-4 (ours) & 57.81\% & 21.53\% & 21.28\% & 67.05 \\ Fast-5 (ours) & 57.78\% & **22.18\%** & **21.88\%** & 80.11 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Comparison of various adversarial training algorithms on the CIFAR100 dataset using PreActResNet34 after 100 epochs of training.  
Data Availability Statement: The original contributions presented in this study are included in the article; further inquiries can be directed to the corresponding author.  
The authors declare no conflicts of interest.