# How Resilient Are Kolmogorov-Arnold Networks in Classification Tasks? A Robustness Investigation
## 5 Results and Discussion
### KAN and MLP Models
In contrast, the CW attack had a relatively less  
\begin{table}
\begin{tabular}{c c c|c c c|c c c|c c c|c c c|c c c|c c} \hline \hline \multirow{2}{*}{**TT**} & \multirow{2}{*}{**AT**} & \multirow{2}{*}{\(\epsilon\)} & \multicolumn{8}{c}{**GTSRB**} & \multicolumn{8}{c}{**BTSRB**} & \multicolumn{8}{c}{**CTSRD**} \\  & & & & \multicolumn{3}{c}{**KAN**} & \multicolumn{3}{c}{**MLP**} & \multicolumn{3}{c}{**KAN**} & \multicolumn{3}{c}{**MLP**} & \multicolumn{3}{c}{**KAN**} & \multicolumn{3}{c}{**MLP**} \\ \cline{3-19}  & & & **Acc** & **SAR** & **DeC** & **Acc** & **SAR** & **DeC** & **Acc** & **SAR** & **DeC** & **Acc** & **SAR** & **DeC** & **Acc** & **SAR** & **DeC** \\ \hline \multirow{9}{*}{**CTSRB**} & N & - & 79.11 & - & 0 & 82.19 & - & 0 & 88.73 & - & 0 & 90.08 & - & 0 & 97.16 & - & 0 & 97.57 & - & 0 \\  & FGSM & 0.01 & 27.03 & 53.11 & 14.82 & 35.34 & 48.74 & 14.82 & 45.12 & 44.33 & 13.49 & 60.79 & 30.60 & 13.49 & 34.63 & 62.61 & 10.73 & 49.55 & 48.09 & 10.73 \\  & FGSM & 0.1 & 11.22 & 68.04 & 14.90 & 16.78 & 66.03 & 14.90 & 25.00 & 63.77 & 13.57 & 36.63 & 53.61 & 13.57 & 9.49 & 87.75 & 10.94 & 11.11 & 86.54 & 10.94 \\  & FGSM & 1 & 0.24 & 78.88 & 21.83 & 1.24 & 80.95 & 21.82 & 0.16 & 88.57 & 21.62 & 0.40 & 89.68 & 21.38 & 0.24 & 96.92 & 20.02 & 0.57 & 97.00 & 20.13 \\  & BIM & 0.01 & 77.28 & 21.0 & 0.28 & 80.54 & 1.69 & 0.28 & 87.38 & 1.35 & 0.28 & 89.21 & 0.87 & 0.28 & 96.92 & 0.24 & 0.28 & 96.95 & 10.5 & 0.28 \\  & BIM & 0.1 & 60.30 & 20.18 & 2.55 & 66.00 & 16.43 & 2.55 & 7.50 & 13.93 & 2.53 & 79.11 & 11.11 & 2.53 & 74.70 & 26.23 & 2.40 & 78.51 & 19.14 & 2.40 \\  & BIM & 1 & 5.33 & 73.79 & 15.54 & 85.67 & 73.74 & 15.50 & 18.85 & 69.88 & 14.22 & 25.33 & 66.63 & 14.19 & 53.55 & 91.81 & 11.46 & 65.7 & 91.00 & 11.42 \\  & PGD & 0.01 & 26.05 & 53.99 & 14.82 & 34.12 & 49.91 & 14.82 & 44.37 & 45.08 & 13.49 & 61.03 & 30.40 & 13.49 & 33.98 & 63.26 & 10.73 & 48.34 & 49.31 & 10.73 \\  & PGD & 0.1 & 11.95 & 67.27 & 14.86 & 17.82 & 65.08 & 14.86 & 30.52 & 58.33 & 13.53 & 44.76 & 45.60 & 13.53 & 15.09 & 82.16 & 10.85 & 19.55 & 78.10 & 10.84 \\  & PGD & 1 & 2.16 & 76.95 & 17.87 & 4.89 & 77.30 & 17.85 & 10.32 & 78.41 & 16.79 & 12.06 & 78.10 & 16.89 & 1.70 & 95.46 & 15.19 & 2.51 & 95.05 & 15.20 \\  & CW & - & 26.87 & 52.24 & 11.39 & 34.66 & 47.54 & 9.85 & 44.92 & 43.81 & 9.72 & 60.52 & 29.56 & 8.22 & 36.90 & 60.26 & 7.07 & 52.39 & 45.17 & 5.82 \\ \hline \multirow{9}{*}{**CTSRB**} & None & - & 79.02 & - & 0 & 82.23 & - & 0 & 88.69 & - & 0 & 90.04 & - & 0 & 97.16 & - & 0 & 97.57 & - & 0 \\  & FGSM & 0.01 & 27.53 & 52.57 & 14.82 & 35.50 & 48.63 & 14.82 & 45.36 & 44.05 & 13.49 & 60.87 & 30.56 & 13.49 & 35.69 & 61.56 & 10.73 & 49.80 & 47.85 & 10.73 \\  & FGSM & 0.1 & 11.31 & 67.84 & 14.90 & 16.87 & 65.95 & 14.90 &severe impact on both models, with KAN maintaining an accuracy of 26.87% on GTSRB and MLP achieving 34.66%. Adversarial training, incorporating adversarial examples, improved the robustness of both the KAN and MLP. This approach enhanced their resilience, though the improvement varied by dataset and attack type. For the FGSM attack (\(\epsilon=0.01\)), the KAN achieved 27.53% accuracy on GTSRB, while MLP reached 35.50%. As \(\epsilon\) increased to 1, both models' accuracies fell, with MLP still leading at 1.25% compared to the KAN's 0.21%. The successful adversarial rate (SAR) remained high for all attack types, indicating that adversarial training helps but does not fully protect against stronger attacks such as BIM and PGD. With the BIM (\(\epsilon=1\)), MLP scored 8.55% accuracy, compared to the KAN's 5.32%. Under PGD (\(\epsilon=1\)), MLP had 4.71% accuracy, while the KAN lagged at 2.23%. Overall, adversarial training improved both models' robustness, but it was insufficient against high-intensity attacks. Randomized smoothing was assessed as a certification-based defense mechanism that adds noise during inference to enhance model robustness. This approach proved especially effective for the Multilayer Perceptron (MLP).