While machine learning models have demonstrated strong performance in many domains, these models have shown profound vulnerabilities when they are exposed to adversarial threats. While adversarial attacks fall into various categories, the most prominent category in research studies is evasion. In evasion attacks, the adversary generates perturbed versions of samples, which might not be observable by human eyes. These samples generally fool the machine learning models with high confidence. This phenomenon poses a significant security violation against machine learning models. In this paper, we investigate the certified and empirical robustness of various Kolmogorov-Arnold network architectures against strong evasion attacks. At first, we provide the mathematical foundations for randomized smoothing and interval bound propagation, and report the ℓ2-certified robustness of the models under randomized smoothing. After that, we systematically evaluate the robustness of various defended and undefended KAN models under FGSM, PGD, and C&W attacks in order to find out the optimal defense strategies and architectures.
Figures & tables
Figure 1: A simple KAN architecture consisting of four Splines at the first hidden layer and two Splines at the second hidden layer.
Figure 2: Step-by-step process of experimental methodology.
Table 1: The parameters of each adversarial attack.
Model
Common
AT
RS
IBP
epochs
bs
lr
ϵ
α
Iterations
σ
M
ϵmax
WE
RE
λmax
KANICE
200
128
1e−3
8/255
2/255
10
0.25
64
4/255
10
80
0.5
KAN-Mixers
50
64
0.0001282
8/255
2/255
10
0.25
64
4/255
5
40
0.5
PoolKANNeXt
30
128
0.0037
8/255
2/255
10
0.25
64
4/255
5
20
0.5
Table 2: Training hyperparameters.
Model
Dataset
CA@ 2552
CA@ 2554
CA@ 2558
MR
KANICE
CIFAR-10
60.85
60.19
59.01
0.46
KAN-Mixers
CIFAR-10
66.84
66.27
65.46
0.75
PoolKANNeXt
CIFAR-10
80.33
80.10
79.78
1.18
KANICE
SVHN
92.70
92.45
91.93
0.91
KAN-Mixers
SVHN
91.38
90.92
90.03
0.71
PoolKANNeXt
SVHN
92.36
92.24
92.05
1.10
Table 3: ℓ2 -certified robustness of different KAN architectures under randomized smoothing at certification thresholds of 2/255, 4/255, and 8/255 - certified accuracy (CA) and mean radius.
Table 4: Standard accuracy and robust accuracy of different KAN models under FGSM attacks.
Figure 3: Robust accuracy of KAN models against FGSM across different perturbation sizes on the CIFAR-10 and SVHN datasets.
Table 5: Robust accuracy of different KAN models under PGD and C&W attacks including multi-step (MS) and adaptive (A) PGD.
Figure 4: Box plots of robust accuracy across defense strategies under FGSM and PGD attacks on CIFAR-10 and SVHN.