While machine learning models have demonstrated strong performance in many domains, these models have shown profound vulnerabilities when they are exposed to adversarial threats. While adversarial attacks fall into various categories, the most prominent category in research studies is evasion. In evasion attacks, the adversary generates perturbed versions of samples, which might not be observable by human eyes. These samples generally fool the machine learning models with high confidence. This phenomenon poses a significant security violation against machine learning models. In this paper, we investigate the certified and empirical robustness of various Kolmogorov-Arnold network architectures against strong evasion attacks. At first, we provide the mathematical foundations for randomized smoothing and interval bound propagation, and report the ℓ2-certified robustness of the models under randomized smoothing. After that, we systematically evaluate the robustness of various defended and undefended KAN models under FGSM, PGD, and C&W attacks in order to find out the optimal defense strategies and architectures.
Figures & tables
Figure 1: A simple KAN architecture consisting of four Splines at the first hidden layer and two Splines at the second hidden layer.
Figure 2: Step-by-step process of experimental methodology.
Table 1: The parameters of each adversarial attack.
Model
Common
AT
RS
IBP
epochs
bs
lr
ϵ
α
Iterations
σ
M
ϵmax
WE
RE
λmax
KANICE
200
128
1e−3
8/255
2/255
10
0.25
64
4/255
10
80
0.5
KAN-Mixers
50
64
0.0001282
8/255
2/255
10
0.25
64
4/255
5
40
0.5
PoolKANNeXt
30
128
0.0037
8/255
2/255
10
0.25
64
4/255
5
20
0.5
Table 2: Training hyperparameters.
Model
Dataset
CA@ 2552
CA@ 2554
CA@ 2558
MR
KANICE
CIFAR-10
60.85
60.19
59.01
0.46
KAN-Mixers
CIFAR-10
66.84
66.27
65.46
0.75
PoolKANNeXt
CIFAR-10
80.33
80.10
79.78
1.18
KANICE
SVHN
92.70
92.45
91.93
0.91
KAN-Mixers
SVHN
91.38
90.92
90.03
0.71
PoolKANNeXt
SVHN
92.36
92.24
92.05
1.10
Table 3: ℓ2 -certified robustness of different KAN architectures under randomized smoothing at certification thresholds of 2/255, 4/255, and 8/255 - certified accuracy (CA) and mean radius.
Table 4: Standard accuracy and robust accuracy of different KAN models under FGSM attacks.
Figure 3: Robust accuracy of KAN models against FGSM across different perturbation sizes on the CIFAR-10 and SVHN datasets.
Table 5: Robust accuracy of different KAN models under PGD and C&W attacks including multi-step (MS) and adaptive (A) PGD.
Figure 4: Box plots of robust accuracy across defense strategies under FGSM and PGD attacks on CIFAR-10 and SVHN.
Historically originating from Hilbert's 13th problem, the Kolmogorov-Arnold representation theorem (KART) has recently experienced a major revitalisation through its applications to neural networks, specifically Kolmogorov-Arnold Networks (KANs). While the exact representation is well established, its stability under continuous adversarial perturbations of the hidden layer remains a critical open question. In this paper, we investigate the robustness of KART against bounded adversarial translations. We provide an explicit, self-contained, and constructive proof of an approximate representation using fixed, piecewise linear inner functions. Crucially, our construction employs a single outer function that remains invariant for all summands and is independent of the specific adversarial translation, provided its maximum bound is known a priori.
Sviatoslav V. Dzhenzher
Moscow Institute of Physics and Technology 141701, Institutskii lane, 9, Dolgoprudny, Russia.
The efficient-KAN literature---covering Chebyshev, wavelet, and radial-basis-function variants of the original Kolmogorov-Arnold Network---has been benchmarked almost entirely on clean data. We show that this choice conceals a large capability difference between architectures: ChebyKAN's test MSE (evaluated against clean ground truth) increases by a factor of 10.6x when training data is corrupted with sigma=0.1 noise, versus 7.9x for vanilla KAN, 1.7x for a standard MLP, and just 1.4x for our proposed ER-KAN. ER-KAN combines three design choices targeting the noisy, data-scarce setting: shared Gaussian RBF bases across all edges in a layer (providing locality and efficient parameterisation), curriculum noise injection during training (explicitly teaching noise robustness), and entropy-weighted adaptive regularisation (preventing overfitting at small N). The result is a 595-parameter network that matches MLP accuracy at moderate noise while degrading far more gracefully as noise grows. We evaluate on eight analytic functions (N in {50, 200, 500}, sigma in {0, 0.03, 0.1}), on a damped harmonic oscillator physics-informed neural network where ER-KAN achieves 4.2x lower solution MSE than MLP, and on a Burgers' equation PINN where all models fail to converge---a genuine limitation we report rather than suppress. We introduce the noise degradation ratio as a simple complementary metric and recommend it become a standard reporting requirement for efficient-KAN papers.
Here we investigate the stability of the Kolmogorov--Arnold representation theorem (KART) under adversarial reparameterisations of the hidden layer for multivariate discontinuous and unbounded functions. Our results provide a rigorous mathematical foundation for the structural robustness of modern deep learning architectures, such as Kolmogorov--Arnold Networks (KANs), under adversarial configurations.
Sviatoslav V. Dzhenzher
Moscow Institute of Physics and Technology 141701, Institutskii lane, 9, Dolgoprudny, Russia.