## 3 Generalisation of Robustly and Adversarially Trained Models
### Loss Distributions of the Adversarially Trained Models  
To illustrate the disparity between adversarial attack norms, we took three ResNet50 models from the first experiments: one model was regularly trained on CIFAR-10, while the other two were adversarially trained by PGD attacks with \(L_{2}\)- and \(L_{\infty}\)-norms, respectively. The performance of each model was evaluated using histogram plots, where the X-axis represents the cross-entropy loss between predictions and one-hot-encoded labels and the height of bars displays the number of samples in a given region. We used a CIFAR-10 test data set with 10,000 samples in total.  
To challenge these models, we used two types of PGD attacks: the \(L_{2}\)-norm of perturbation with \(\epsilon=0.5\) and the \(L_{\infty}\)-norm with \(\epsilon=0.05\). The number of steps for the \(L_{\infty}\)-norm attack was set to five, while that for the attack on \(L_{2}\) was 10. Additionally, the loss of each model on clean data was assessed.  
Each plot represents one model and includes three distributions: losses in clean and adversarially perturbed CIFAR-10 test data (10,000 samples), with \(L_{2}\)- or \(L_{\infty}\)-norm attacks. The performance of each model is presented by histogram plots. The X-axis stands for the cross-entropy loss between predictions and one-hot encoded labels (lower is better). The height of bins displays the number of samples that fell in a given region. The A-distance, which is used in domain adaptation [24], additionally illustrates the difference between the  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{4}{c}{**Attack Norm**} \\  & \multicolumn{2}{c}{\(L_{2}\)} & \multicolumn{2}{c}{\(L_{\infty}\)} \\  & \(C_{1}\) & \(C_{2}\) & \% of Misclassified & \(C_{1}\) & \(C_{2}\) & \% of Misclassified \\ \hline Regular ResNet-50 & 4.5 & 14.8 & 70 & 39.7 & 55.4 & 82 \\ \hline Adv. trained ResNet-50 (\(L_{2}\)) & 4.1 & 15.2 & 12 & 43.3 & 55.4 & 52 \\ \hline Adv. trained ResNet-50 (\(L_{\infty}\)) & 1.2 & 7.3 & 15 & 43.5 & 55.4 & 37 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Coefficients for Equation (5). Testing attacks are PGD with \(L_{2}\) and \(L_{\infty}\) perturbation norms, the testing data set is CINIC.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & \(C_{1}\) & \(C_{2}\) & \% of Misclassified \\ \hline Regular ResNet-50 & 41.9 & 55.4 & 36 \\ \hline Adv. trained ResNet-50 (\(L_{2}\)) & 40 & 55.4 & 22 \\ \hline Adv. trained ResNet-50 (\(L_{\infty}\)) & 45.6 & 55.4 & 13 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Coefficients for Equation (5). Testing attack is FGSM; the testing data set is CIFAR-10.  
however, they have a more flattened tail. For the regularly trained model, most of the examples fall into the right region, as for the attack with the \(L_{\infty}\)-norm (note the scale).  
The results indicate that adversarial attacks alter the shape of the sample distribution, with the norms of attack playing a significant role in determining the curves' appearance. The A-distance confirms this finding. Adversarial training brings the adversarial and benign distributions closer together but does not achieve complete convergence, particularly for attacks with an \(L_{\infty}\)-norm.