## 4 Experimental Results
### Results
#### 4.3.3 Adversarial Attacks  
Deep networks are fooled by adding a small unrecognizable perturbation to the input data, and the perturbed data mislead the network to degrade the performance; this whole mechanism is referred to as an adversarial attack [54, 55]. A simple way to prevent an attack is to generate an unseen input sample [56]. For adversarial attacks, we assume that the attacker has complete information about the model, i.e., a white box attack. We use different pre-trained (all models trained by us) ResNet models for cifar10, cifar100, and fashionMNIST. In this section, we evaluate the robustness of the proposed approach due to directly dealing with the input data following the previous methods [36]. In order to check the robustness, we compare our three strategies with the baseline and random erasing performance against two adversarial attacks, namely, the fast gradient sign method (FGSM) [54] and the FGSM variant, fast gradient magnitude (FGM) [54, 57], was proposed to alleviate the issue of noise perceptibility [57]. These two attacks, FGSM and FGM, were used to check robustness using different datasets and models. In all adversarial experiments, we used the baseline, random erasing, and the model trained by the three proposed strategies against these attacks using different values of epsilon [54], i.e., [0.05, 0.1, 0.15, 0.2, 0.25, 0.3]. In Figures 4-6, the x-axis values and y-axis values show epsilon and accuracy, respectively. For the CIFAR10 dataset, we check the robustness against three strategies and compare it with the baseline and random erasing using different trained models of ResNet. In Figure 4, it can be seen that in the case of ResNet20 and ResNet44, interestingly, RSMDA(C) was more robust against both attacks than the others, while in the case of ResNet20 and ResNet56, RSMDA(R) was the winner. Overall, the proposed approach beats the baseline and random erasing. For the CIFAR100 dataset, we repeat the same experiment pattern to check the behavior of the robustness using a dataset with a large number of classes. We checked the robustness using the CIFAR100 dataset. The pattern was very much different than what we discussed in the cifar10 case. As shown in Figure 5, RSMDA(RC) was more robust using the ResNet20 and ResNet56 models, and RSMDA(C) was more successful using ResNet32 and ResNet44. In all of the models' cases, the proposed approach shows more robustness compared to the baseline and random erasing. \begin{table}
\begin{tabular}{l l l} \hline \hline
**PyramidNet-200 (\(\bar{\mathbf{\lambda}}=\) 240)** & **Top-1** & **Top-5** \\
**(Params: 26.8 M)** & **Err (\%)** & **Err (\%)** \\ \hline + Cutout + Manifold Mixup (\(\alpha=1.0\)) & 15.09 & 3.35 \\ + ShakeDrop [53] & 15.08 & 2.72 \\ + RSMDA(R) & 15.03 & 3.01 \\ + CutMix & 14.47 & 2.97 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._ \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Model** & **Params** & **Top-1 Err(\%)** & **Top-5 Err (\%)** \\ \hline PyramidNet-110 (\(\bar{\mathbf{\lambda}}=\) 64) [46] & 1.7M & 19.85 & 4.66 \\ PyramidNet-110+ RSMDA & 1.7M & 19.29 & 4.42 \\ PyramidNet-110+ CutMix & 1.7M & 17.97 & 3.83 \\ \hline ResNet-110 & 1.1M & 23.14 & 5.95 \\ ResNet-110+ RSMDA & 1.1M & 22.87 & 5.93 \\ ResNet-110+ CutMix & 1.1M & 20.11 & 4.43 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Lighter architectures on CIFAR-100. First best and second best performances are highlighted in blue and red color, respectively. To check the behavior of the robustness of the grayscale dataset, we use the trained models on fashionMNIST against these adversarial attacks. We repeated the same stream of experiments, as shown in Figure 6. Surprisingly, the fashionMNIST case showed very different behavior from what was discussed in the cifar10 and cifar100 cases. In Figure 6, the overall RSMDA(RC) is more robust using the ResNet20 and ResNet44 models, and RSMDA(R) is more robust with ResNet32. The proposed approach also showed more robustness with the grayscale dataset.