# Fast-M Adversarial Training Algorithm for Deep Neural Networks
## 6 Experiments
### Verification of Fast-M on CIFAR10
#### 6.2.3 Evaluation Comparison of Fast-M Adversarial Training  
To demonstrate the effectiveness of the Fast-M adversarial training method, this paper compares it with three other adversarial training methods: fast adversarial training (\(\epsilon=8/255\), \(\alpha=10/255\)), free adversarial training (\(m=8\), \(\epsilon=8/255\)), and PGD adversarial training (\(K=7\), \(\epsilon=8/255\), \(\alpha=2/255\)). The Fast-M method used in this paper takes \(M=4\), \(\epsilon=8/255\), and \(\alpha=8/255\). The training starts from \(\text{Epoch}=5\), with one model  
Figure 3: PGD attack accuracy of Fast-5 adversarial training with different training step sizes on CIFAR10. Figure 2: Comparison of Fast-M adversarial training on CIFAR10 with different iteration stage numbers \(M\): (**a**) accuracy for a PGD-20 attack; (**b**) training time. trained every five epochs, until \(\text{Epoch}=50\). Ten different neural network models are trained independently, and the training time is recorded. Then, the trained models are tested for their accuracy based on the original clean samples and on the samples for the PGD-20 (\(\epsilon=8/255\)) attack. The results are shown in Figure 4.  
As shown in Figure 4, both Fast-4 adversarial training and PGD-7 adversarial training achieved an accuracy of over 50% for the PGD-20 attack. Moreover, the accuracy of Fast-4 adversarial training was slightly higher than that of PGD-7 adversarial training. On the other hand, the accuracies of free adversarial training and fast adversarial training for the PGD-20 attack were both approximately 47%. It is also clear that the accuracy of fast adversarial training for the PGD-20 attack did not exceed 50%, even as the number of training rounds was increased, and remained at approximately 46%. In contrast, Fast-4 adversarial training and PGD-7 adversarial training under the same number of training rounds easily achieved 50% accuracy under the same attack. As shown in Figure 4,b, although fast adversarial training does not perform well for PGD-20 adversarial attacks, its evaluation accuracy for the original clean samples is similar to that of the other three adversarial training methods. However, its advantage is not significant, achieving an accuracy of approximately 85%, while the other three methods achieve an accuracy of 83%. The gap in accuracy between the original clean samples and PGD adversarial samples is relatively small, indicating a balance between the two. In adversarial training, neural networks are trained to simultaneously handle adversarial examples and clean examples. By minimizing the loss of adversarial examples, the network learns the features of adversarial examples to more accurately identify and classify them. However, during the adversarial training process, if not properly constrained, the neural network model may overly focus on adversarial examples. This excessive attention can lead to a decrease in classification accuracy when dealing with clean examples. Because  
Figure 4: Comparison of Fast-M adversarial training and multiple adversarial training methods on CIAFR10: (**a**) accuracy for the original clean sample; (**b**) accuracy for a PGD-20 attack; (**c**) training time. the network learns how to differentiate adversarial examples, it may overfit the features of adversarial examples and overlook the characteristics of clean examples. As shown in Figure 4c, the training times of Fast-4 adversarial training and fast adversarial training are much less than those of PGD-7 and free adversarial training (\(m=8\)) under the same number of training rounds. Furthermore, the training time of Fast-4 adversarial training is only slightly higher than that of fast adversarial training, is still within the same range, and does not increase significantly. It is worth noting that free adversarial training cannot benefit from cyclic learning as PGD adversarial training does, so its training time is similar to that of PGD-7 adversarial training in the case of \(m=8\).