## 3 Generalisation of Robustly and Adversarially Trained Models
### The Broad Testing of Robust and Adversarial Training  
We replicated robust training from [1], employing a broader testing setup. It included various attack norms, data sets, and model architectures. The motivation for this experiment stems from the work of [PERSON] et al. [18], which demonstrates that even adversarially trained models could be compromised by unseen attacks; thus, they do not generalise well. We wanted to test this statement and go further by checking the generalisation of robustly trained models. Robust training involves several steps:  
1. Select an adversarially pre-trained model and the data set for image classification. 2. For each image (named \"target\") from the data set, randomly generate a noisy image. 3. Compute the representations using an adversarially trained model for both the random and target images. At each iteration, slightly adjust the random image to minimise the distance between the vectors of the two images. After a set number of steps, this method produces a modified image with robust features only. So, image by image, compute a new, robust data set from the original. 4. Train the model regularly with the same architecture on this modified data set, ultimately resulting in a robustly trained model. 5. Test the generalisation capacity of both the adversarial and robust models: compute the accuracy under attacks that were not considered during the adversarial training phase and hence not used in the formation of the robust model. Following this approach, we performed several experiments. Firstly, we took two adversarially trained ResNet50-s [19]. The training data set for the models was CIFAR-10 [20]; the training attack was PGD with \(L_{2}\)- and \(L_{\infty}\)-norms. We tested their performance against FGSM (\(L_{1}\)-, \(L_{2}\)-, \(L_{\infty}\)-norms), PGD (\(L_{1}\)-, \(L_{2}\)-, \(L_{\infty}\)-norms), C-W (\(L_{2}\)-norm), and DeepFool (\(L_{2}\)-norm) attacks. A C-W attack refers to the [PERSON] and [PERSON] adversarial attack; a detailed description of it can be found in the original paper [21]. The performance results of the \(L_{2}\)-trained model are outlined in Table 1, and those of the \(L_{\infty}\)-trained model are presented in Table 2.  
Second, we performed the same experiment on the Inception V3 [22] model. For computational reasons, we only took one model, trained with a PGD attack with an \(L_{\infty}\)norm. The results are displayed in Table 11. Note that \(\epsilon\) for the attacks differs from the similar ones for ResNet50-s because the model has a bigger input shape (224 \(\times\) 224 vs. 32 \(\times\) 32, respectively). Thirdly, we tried to manage the entire adversarial training pipeline ourselves from scratch. Owing to computational constraints, we selected the relatively more manageable ResNet18 architecture. The models were trained on a PGD attack with five iterations and \(L_{2}\)- and \(L_{\infty}\)-norms. For data sets, we utilised CIFAR-10 and CINIC-10 [23] as the data sets, and PGD and FGSM as the test attacks. The results for CIFAR-10 and CINIC-10 are displayed in Tables 3 and 12, respectively. To save space in this subsection, we put some of the tables in Appendix A and do not specifically comment on them. However, these results make the experiment more solid, confirm the overall conclusion (written in the following), and present the same patterns of adversarial and robust training as the models in Tables 1 and 2. On examination, it is apparent that adversarial and robustly trained models demonstrate reasonable stability against some variations of PGD and FGSM attacks, for example, with an \(L_{1}\)-norm. However, all attacks with an \(L_{\infty}\)-norm significantly undermined the accuracy of the models. Hence, the model does not ensure generalisation against all attack types, primarily because a simple increase in norm or perturbation shows a drastic impact.