\documentclass[a4paper,10.80pt,twoside]{article}
\def\UrlBreaks{\do\/\do-} 
% \usepackage{cite}
% \documentclass[twocolumn]{IEEEtran}  
\usepackage[style=ieee, backend=biber, url=false, doi=true, breaklinks=true]{biblatex} 

\addbibresource{ref.bib}  % Path to your .bib file with references


% \usepackage[vietnamese,english]{babel}
\usepackage{informat}
\usepackage{epsfig}
\usepackage{xcolor}
\usepackage[utf8]{inputenc}
\usepackage{newunicodechar}
\usepackage{amssymb}
\usepackage{amsmath}
\usepackage{multirow}
\usepackage{hyperref}
\usepackage[ruled,vlined]{algorithm2e}
\SetKwInput{KwIn}{Input}
\SetKwInput{KwOut}{Output}
\usepackage{tikz}
\usetikzlibrary{arrows.meta, positioning, shapes.geometric}

\usepackage{url}
\usepackage[hyphenbreaks]{breakurl}

%\usepackage{natbib}


%\usepackage{fontspec}
%\setmainfont{Times New Roman}

\begin{document}
%\setcounter{page}{555}

  \title{Regularized adversarial training for robust CNN image classification: evaluation of ATWR, ATGR, and EATR under white-box attacks}
   \author{Thi Thanh Thuy Pham \\
      Faculty of Cybersecurity and High Tech Crime Prevention - Academy of People Security\\
      No. 125 - Tran Phu - Ha Dong - Ha Noi - Viet Nam \\
      International Research Institute MICA - Hanoi University of Science and Technology\\
      No. 1 - Dai Co Viet - Hai Ba Trung - Ha Noi - Viet Nam \\      
      thanh-thuy.pham@mica.edu.vn \\
      \AndAuthor Bao-Chau Ho \\
      School of Information and Communication Technology - Hanoi University of Science and Technology\\
      No. 1 - Dai Co Viet - Hai Ba Trung - Ha Noi - Viet Nam \\
      baochaudoanho.hust@gmail.com \\
      \AndAuthor Huong-Giang Doan (Corresponding author) \\
      Faculty of Control and Automation - Electric Power University\\
      No. 235 - Hoang Quoc Viet - Bac Tu Liem - Ha Noi - Viet Nam\\
      giangdth@epu.edu.vn}
  \titleodd{Evaluation of Large-scale Pre-training models \ldots}
  \authoreven{Thi Thanh Thuy Pham et al.}
  \keywords{adversarial attack, adversarial training, regularization function, image classifier, convolution neural network}
  \received{January 02, 2025}

  \abstract{Adversarial attacks pose serious challenges to the robustness of deep Convolutional Neural Networks (CNNs) in image classification. In this study, we evaluated the vulnerability of popular CNN models-ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3-under white-box attacks, including FGSM, PGD, BIM, and C\&W. Experiments are conducted on standard datasets such as MNIST, CIFAR-10, CIFAR-100, and ImageNet. To enhance model robustness, we propose three regularized adversarial training methods: ATWR (Adversarial Training with Weight Regularization), ATGR (Adversarial Training with Gradient Regularization), and EATR (Ensemble Adversarial Training with Regularization). Our results show that ATWR reduces the accuracy drop under the PGD attack on CIFAR-10 from 65.93\% to 0.00\%, and under C\&W attack on MNIST from 100\% to 0.31\%. EATR achieves consistent robustness across all attacks and models, reducing the accuracy drop in CIFAR-10 (PGD) from 65.93\% to 0\%, while maintaining the classification accuracy within 10\% of the original. ATGR, while reducing classification accuracy, enhances adversarial detection by amplifying the difference in output behavior under attack. The proposed methods strike varying trade-offs between robustness, generalization, and detectability. These findings offer practical guidance for securing deep CNNs against strong white-box adversarial threats. The source codes are available at: \href{https://github.com/BaoChau-Ho/defense_and_attack}
{https://github.com/AdversarialAttack/DefenseAndAttack}} 
  
\maketitle

\section{Introduction}
\label{Intro}

Convolutional Neural Networks (CNNs) have achieved significant success in image classification tasks. However, these models are highly susceptible to adversarial attacks: tiny, often imperceptible alterations to input images that can drastically alter a model’s predictions without being noticeable to human observers~\cite{weng2024comparative, sen2023adversarial, ghaffari2022adversarial, hirano2021universal}. This vulnerability poses serious security risks for real-world AI applications that rely on image classifiers, such as autonomous vehicles, medical imaging, and surveillance systems.

Several adversarial attack techniques have been proposed to exploit the vulnerabilities of deep image classifiers. Based on the attacker's knowledge of the target model, there are two types of adversarial attack strategies: black-box and white-box attacks. In a white-box scenario, the attacker has full access to the model architecture, parameters, loss function, and gradients, allowing the generation of highly effective perturbations~\cite{su2019one, madry2017towards, moosavi2016deepfool, carlini2017towards}. In contrast, black-box attacks are based only on input-output observations~\cite{chen2020hopskipjumpattack, andriushchenko2020square}. In such settings, attackers typically query the target model to collect input-output pairs, from which they train a surrogate (substitute) model that approximates the target model's behavior. Adversarial examples are then generated using white-box attacks on this surrogate model and transferred to the target model, leveraging the transferability property of adversarial examples. According to the mechanism used to generate perturbations, adversarial attacks can be classified into gradient-based (e.g., FGSM~\cite{goodfellow2014explaining}, PGD~\cite{mkadry2017towards}, BIM~\cite{kurakin2018adversarial}) and optimization-based (e.g., C\&W~\cite{carlini2017towards}, DeepFool~\cite{moosavi2016deepfool}). Although optimization-based attacks are more computationally expensive, they tend to be more successful, particularly in black-box scenarios.



To counter these threats, various defense techniques have been proposed. These include adversarial training~\cite{zhang2019defense, chen2020towards, jiang2023towards}, gradient masking~\cite{papernot2016limitations, wang2021fighting}, and defensive distillation~\cite{papernot2016distillation,  sen2024fgsm}. Among them, adversarial training remains the most widely adopted due to its empirical robustness against white-box attacks. However, it suffers from several limitations, including poor generalization to unseen attacks~\cite{shafahi2019adversarial}, overfitting to adversarial samples~\cite{miyato2016adversarial}, and limited transferability~\cite{zhang2019limitations}. Gradient masking is often easy to bypass~\cite{athalye2018obfuscated, liu2018zeroth}, while defensive distillation may result in gradient obfuscation and vulnerability to stronger optimization-based attacks.

To address these challenges, this paper explores whether incorporating regularization into adversarial training can mitigate accuracy degradation under strong white-box attacks without compromising clean accuracy. While previous works have focused on specific attack types or model architectures, we adopt a broader approach that evaluates multiple regularization strategies across different CNN models and datasets. In particular, our study is guided by the following research questions.
\begin{itemize}
    \item \textbf{RQ1:} Can regularization-based adversarial training reduce accuracy drop (Acc-drop) under strong attacks such as PGD and C\&W?
    \item \textbf{RQ2:} Can such defenses maintain or even improve clean accuracy while improving robustness?
    \item \textbf{RQ3:} How do different regularization approaches, weight-based, gradient-based, and ensemble-based, compare in robustness, generalization, and failure scenarios?
\end{itemize}

Based on these questions, we formulate the following hypotheses, which guide the design and evaluation of our defense strategies:
\begin{enumerate}
    \item Weight-based regularization (ATWR) stabilizes parameter updates, helping retain clean accuracy while increasing robustness.
    \item Gradient-based regularization (ATGR) promotes conservative prediction behavior, which is useful for attack detection but may reduce overall accuracy.
    \item Ensemble adversarial training (EATR) introduces perturbation diversity, improving generalization across attacks and datasets.
\end{enumerate}

To empirically validate these hypotheses, we conduct a series of controlled experiments on multiple CNN architectures and benchmark datasets. Our experimental design enables us to assess the robustness and generalization capabilities of different regularization strategies. The main contributions of this paper are as follows:
\begin{itemize}
    \item We analyze the vulnerability of six popular CNN architectures (ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3) under white-box attacks (FGSM, PGD, BIM, and C\&W) across MNIST, CIFAR-10, CIFAR-100, and ImageNet.
    \item We propose three novel defense methods: ATWR (Adversarial Training with Weight Regularization), ATGR (Adversarial Training with Gradient Regularization), and EATR (Ensemble Adversarial Training with Regularization).
    \item We experimentally show that ATWR and EATR effectively reduce Acc-drop under PGD and C\&W while preserving clean accuracy. ATGR offers conservative responses, making it suitable for adversarial detection rather than classification.
    \item We discuss the robustness-generalization trade-offs and analyze failure scenarios on shallow networks such as AlexNet.
\end{itemize}

The remainder of this paper is structured as follows: Section~\ref{RelatedWork} reviews adversarial attacks and defenses. Section~\ref{Background} presents our vulnerability analysis. Section~\ref{Proposed_Method} describes the proposed regularized training strategies. Section~\ref{Experiments} evaluates their performance. Section~\ref{Discussion} discusses key insights and limitations. Section~\ref{Conclusion} concludes and outlines future directions.

\section{Related Work}
\label{RelatedWork}

This section discusses adversarial attack methods and adversarial training-based defense strategies.

\subsection{Adversarial Attacks}

Adversarial attacks have received extensive attention for exposing vulnerabilities in deep neural networks. The foundational work by Goodfellow et al. \cite{goodfellow2014explaining} introduced the Fast Gradient Sign Method (FGSM), which perturbs inputs using the sign of the loss gradient, in \cite{Sivaslioglu2021} used the FGSM attack to deep neural networks. Extensions like Projected Gradient Descent (PGD) \cite{mkadry2017towards} and Basic Iterative Method (BIM) \cite{kurakin2018adversarial} apply iterative refinements to generate stronger perturbations. Although BIM offers a lightweight enhancement over FGSM, PGD is widely considered a strong first-order adversary. The C\&W attack \cite{carlini2017towards} formulates the generation of adversarial examples as an optimization problem that minimizes the magnitude of the perturbation while ensuring misclassification. It remains one of the most effective methods against robust defenses.

The common feature of the above-mentioned attacks is that the attacker can compute gradients with respect to the model's input and use this information to generate adversarial examples. This shows the scenario of white-box adversarial attacks. In a black-box attack, the attacker has no direct access to the model's internal structure or gradients. However, the attacker can still query the target model and receive output (predictions), which are used to infer information about the model and create adversarial examples \cite{chen2017zoo}, \cite{shi2022query}. Another approach of black-box adversarial attacks is attacking a surrogate model and using the adversarial examples that are created by this model on a target model. This type of attack is called a transfer attack \cite{papernot2016transferability}, \cite{mkadry2017towards} which is one of the key vulnerabilities in deep learning models and has significant implications for model security and robustness.

In this work, we focus on evaluating four representative white-box attacks (FGSM, BIM, PGD, and C\&W) on prominent CNN architectures including ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3.

\subsection{Adversarial Training Defense Solutions}

Adversarial training is the most established defense strategy. The formulation based on PGD by Madry et al.~\cite{mkadry2017towards} framed adversarial training as a min-max optimization problem and demonstrated its efficacy in MNIST and CIFAR-10. However, models trained in this way often overfit to specific attacks and may generalize poorly. Defensive distillation~\cite{papernot2016distillation} attempted to obfuscate gradients via softened output, but was later shown to be vulnerable to gradient-free attacks. Ensemble Adversarial Training (EAT)~\cite{tramer2018ensemble} improved transfer robustness by training models with perturbations from multiple sources. The Combined Adversarial Training (CAT) approach~\cite{zhang2019you} improves the robustness of the model by training adversarial examples generated from an ensemble of models, thus improving defense against black-box attacks. It offers better generalization across unseen attacks, but incurs higher computational cost due to multiple adversarial sources.

To better contextualize our contribution, we provide a comparative overview of the SOTA methods in Table~\ref{tab:defense_comparison}. Standard Adversarial Training (SAT) offers moderate robustness, but lacks generalization. Defensive distillation suffers from gradient masking. EAT and feature scattering~\cite{zhang2019defense} improve robustness, but lack integrated regularization. Combined Adversarial Training (CAT)~\cite{zhang2019you} leverages adversarial examples generated from ensemble models to improve robustness, but incurs a high computational cost and still achieves only moderate defense against strong attacks such as PGD and C\&W.




\begin{table*}[htbp]
\centering
\caption{Comparison of adversarial defense methods: robustness, generalization, and limitations}
\resizebox{17cm}{!}{
\label{tab:defense_comparison}
\begin{tabular}{|l|c|c|c|c|c|l|}
\hline
\multicolumn{1}{|c|}{\textbf{Defense   Method}} & \textbf{Reg. Used} & \textbf{\begin{tabular}[c]{@{}c@{}}PGD\\  Robustness\end{tabular}} & \textbf{\begin{tabular}[c]{@{}c@{}}C\&W \\   Robustness\end{tabular}} & \textbf{Generalization} & \textbf{CNN Models Used}                                                                                                           & \multicolumn{1}{c|}{\textbf{Characteristics/Limitations}}                                                          \\ \hline
Standard Adv. Training (SAT) \cite{madry2018towards}                      & $\times$                  & Moderate                                                           & Weak                                                                  & Low                     & ResNet18, WideResNet                                                                                                               & \begin{tabular}[c]{@{}l@{}}Overfits to PGD; \\ Weak against optimization-based attacks like  C\&W\end{tabular}     \\ \hline
Defensive Distillation \cite{papernot2016distillation}                          & $\times$                     & Low                                                                & Very Low                                                              & Low                     & LeNet, ResNet18                                                                                                                    & \begin{tabular}[c]{@{}l@{}}Gradient masking; \\ Ineffective under strong white-box attacks\end{tabular}            \\ \hline
Ensemble Adv. Training (EAT) \cite{tramer2018ensemble}                    & $\times$                     & Strong                                                             & Moderate                                                              & Medium                  & Inception-v3, ResNet50                                                                                                             & Complex training; Limited generalization                                                                           \\ \hline
Feature Scattering \cite{zhang2019defense}                             & $\times$                     & Strong                                                             & Strong                                                                & Medium                  & WideResNet, ResNet50                                                                                                               & High training cost; Model-specific configurations                                                                  \\ \hline
Combined Adv. Training (CAT) \cite{zhang2019you}                   & $\times$                     & Moderate                                                           & Moderate                                                              & Medium                  & ResNet50, InceptionNetV3                                                                                                           & \begin{tabular}[c]{@{}l@{}}Uses adversarial examples from ensemble models; \\ High computational cost\end{tabular} \\ \hline
ATWR (Ours)                                     & Weight             & Strong                                                             & Strong                                                                & High                    & \multirow{3}{*}{\begin{tabular}[c]{@{}c@{}}ResNet50, ResNet101\\ AlexNet, MobileNetV2 \\ DenseNet121, InceptionNetV3\end{tabular}} & Slight accuracy trade-off on smaller models                                                                        \\ \cline{1-5} \cline{7-7} 
ATGR (Ours)                                     & Gradient           & Moderate                                                           & Moderate                                                              & Medium                  &                                                                                                                                    & Lower accuracy; enhances adversarial detectability                                                                 \\ \cline{1-5} \cline{7-7} 
EATR (Ours)                                     & Weight/Gradient    & Strong                                                             & Strong                                                                & High                    &                                                                                                                                    & Higher training cost due to ensemble strategy                                                                      \\ \hline
\end{tabular}
}
\end{table*}

A critical gap in existing defenses is the lack of explicit regularization during adversarial training, which can limit generalization to adaptive or unseen attacks. Our proposed approaches: ATWR (Adversarial Training with Weight Regularization), ATGR (Adversarial Training with Gradient Regularization), and EATR (Ensemble Adversarial Training with Regularization) are designed to bridge this gap. By integrating regularization into the adversarial training process, we achieve greater robustness and generalization across diverse CNN architectures and white-box attack scenarios.


\section{Adversarial attack on deep image classifier}
\label{Background}

Consider an original image that is flattened into a vector $\textbf{x}\in \mathcal{R}^{n}$, where $n$ is the total number of pixels across all channels: $\textbf{x}=\left\{ x_{1}, x_{2},.., x_{n}  \right\}$, $x_{i}\in \mathcal{R}$ corresponds to the pixel value at the position $i_{th}$ in the flattened image vector. The function $f\left( x \right)$ is the image classification model, and it outputs a logit vector, from which we can derive the predicted class label for the input image $\textbf{x}$ is $\hat{y} \in \left\{ 0, 1, ..,C \right\}$, $C$ is the number of classes. 
 
An adversarial example is a perturbed image $\tilde{\textbf{x}}$, such that $\tilde{\textbf{x}} = \textbf{x} + \eta$, where $\eta$ is a small perturbation added to the original image $\textbf{x}$. The goal of an adversarial attack is to find a perturbation $\eta$ that maximizes the probability of misclassification, that is, the attack should cause the model to predict the wrong class while keeping the perturbation $\eta$ small.

Let $\hat{y}'$ be the predicted class label for the perturbed image $\tilde{\textbf{x}}= \textbf{x} + \eta$. The adversarial attack attempts to minimize the accuracy of the model in the perturbed image by maximizing the difference between the predicted class of the adversarial image $\hat{y}'$ and the true class label $y$. The goal is to find $\eta$ such that:
\begin{itemize}
    \item $\hat{y}'\neq y$ and $\left\| \eta \right\|$ is small. The constraint $\hat{y}'\neq y$ shows the case of an untargeted adversarial attack, in which the output of a classifier $f\left( \textbf{x} +\eta \right)$ is any class other than the true class $y$ of the input image $\textbf{x}$;
    \item Or $\hat{y}'= y_{t}$ and $\left\| \eta \right\|$ is small. $\hat{y}'= y_{t}$ shows the case of a targeted adversarial attack, in which the output of a classifier $f\left( \textbf{x} +\eta \right)$ is a specific target class $y_{t}$ other than the true class $y$ of the input image $\textbf{x}$.
\end{itemize}

This can be expressed as the following optimization problem:
\begin{equation}
    \underset{\eta}{\text{max}}\:\mathcal{L}\left( f_{\theta}\left( \textbf{x}+\eta \right),y \right) \: \:\: subject \:\: to \:\: \left\| \eta  \right\| \le \epsilon \: \:\: :\text{untargeted attack}
\end{equation}
or
\begin{equation}
    \underset{\eta}{\text{max}}\:\mathcal{L}\left( f_{\theta}\left( \textbf{x}+\eta \right),y_{t} \right) \: \:\: subject \:\: to \:\: \left\| \eta  \right\| \le \epsilon \: \:\: :\text{targeted attack}
\end{equation}

Where $\mathcal{L}\left( f_{\theta}\left( \textbf{x}+\eta \right),y \right)$ is a loss function that measures the difference between the predicted class $\hat{y}'$ and the true label $y$; $\theta$ is the model parameters. In deep image classification models, the loss function is often chosen as the cross-entropy loss.
% \begin{equation}
%     \mathcal{L}\left( f\left( x+\eta \right),y \right)=-\text{log}\left( p_{y} \right)=-\text{log}\left( \frac{e^{z_{y}}}{\sum_{j=1}^{k}e^{z_{j}}} \right)
% \end{equation}
% where $p_{y}$ is the probability assigned to the true class $y$ after applying softmax to the logits. $\left\| \eta  \right\| \le \epsilon$ is a constraint that ensures that the perturbation $\eta$ is small and imperceptible, and $\epsilon$ controls the maximum perturbation allowed.

% The perturbation $\eta = \left\{ \eta_{1}, \eta_{2},.., \eta_{n} \right\}$ where each $\eta_{i}$ represents the perturbation applied to the pixel $x_{i}$.
% The perturbed image $\tilde{\textbf{x}} = \textbf{x}+\eta$ and its corresponding logits are $\tilde{y}_{j}=f_{j}\left( x+\eta \right)$ for each class $j$.

% The problem of adversarial attack on the image classification neural network is to perturb an image $\textbf{x}$ so that the output of a classifier $f\left( \textbf{x}+\eta \right)$ is misclassified, but the perturbation is as small as possible to be imperceptible to human vision. Misclassification is divided into two cases: (1) untargeted adversarial attack in which the output of a classifier $f\left( \textbf{x} +\eta \right)$ is any class other than the original class of the input image $\textbf{x}$: $\tilde{\textbf{y}}_{j}\neq \textbf{y}_{j}$; and (2) targeted adversarial attack in which the output of a classifier $f\left( \textbf{x} +\eta \right)$ is a specific target class other than the correct class of the input image $\textbf{x}$: $\tilde{y}_{j} = y_{t}$, with $y_{t}$ the score for class $t$ and $t\neq j$.

The optimization problem mentioned above can be solved in two main approaches of gradient-based and optimization-based methods. 

\subsection{Gradient-based adversarial attack}

In the gradient-based solution, $x_{i}$ is changed in the direction of the steepest gradient to decrease the classification probability of $\textbf{x}$ becoming $C$ with negligible visual changes. FGSM is a simple gradient-based method with $\eta$ proposed to be:

\begin{equation}
    \eta=\epsilon \cdot sign(\nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y \right)) \\
\end{equation}
where $\nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x}\right),y \right) =\left( \frac{\\ \partial \mathcal{L}}{\partial x_{1}}, ..,\frac{\partial \mathcal{L}}{\partial x_{n}} \right)$, $y$ is the ground truth label, and 

$sign(\nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x}\right),y \right))=\left\{ 
  \begin{array}{ c l } -1 & \quad \textrm{if }  \nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x}\right),y \right)  < 0\\
    0    & \quad  \textrm{if }      \nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y \right)  = 0 \\
    1                & \quad  \textrm{if }       \nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y \right)  > 0
    
  \end{array}
\right.$

The perturbation noise $\eta$ is then added to the original input $\textbf{x}$ to make sure it does not differ by more than $\epsilon$ and this helps to push the model's prediction towards an incorrect classification:

\begin{equation}
    \tilde{\textbf{x}} = \textbf{x} + \eta = \textbf{x}+\epsilon \cdot sign\left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y \right) \right)
    \label{UntargetFGSM}
\end{equation}

Equation.(\ref{UntargetFGSM}) shows the case of an untargeted FGSM attack. For the targeted FGSM (T-FGSM), the sample $\textbf{x}$ will be misclassified as a specific label rather than just a mislabel. Therefore, the loss function $\mathcal{L}$ can be calculated with respect to the target label $y_{t}$ instead of $y$: 
\begin{equation}
    \tilde{\textbf{x}}=\textbf{x}+\epsilon \cdot sign\left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y_{t} \right) \right)
\end{equation}

Other extensions of the FGSM method are BIM and PGD attacks. BIM applies FGSM repeatedly to an image with step size $\alpha$ presenting the change in pixel value per iteration. The resulting adversary image can then be clipped to limit the maximum perturbation for each pixel:

\begin{equation}
    \tilde{\textbf{x}}^{N+1}=\textbf{Clip}_{\left[ 0,1 \right]}\left\{ \tilde{\textbf{x}}^{N} + \alpha \cdot sign\left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( \tilde{\textbf{x}}^{N} \right),y \right) \right)  \right\}
    \label{BIM}
\end{equation}
where $N$ is the number of iterations and original pixels $x_{i}$ is used for initialization in iteration N=0: $\tilde{\textbf{x}}^{0}=\textbf{x}$.

% Other extensions of the FGSM method are BIM and PGD attacks. BIM applies FGSM repeatedly to an image with step size $\alpha$ representing the change in pixel value per iteration. The resulting adversarial image is then clipped to ensure the perturbation magnitude stays within the allowed range:

% \begin{equation}
%     \tilde{\textbf{x}}^{N+1} = \textbf{Clip}_{[0,1]}\left\{ \tilde{\textbf{x}}^N + \alpha \cdot \text{sign}\left( \nabla_x \mathcal{L}(f_\theta(\tilde{\textbf{x}}^N), y) \right) \right\}
%     \label{BIM}
% \end{equation}

where $N$ is the iteration index, and $\tilde{\textbf{x}}^0 = \textbf{x}$.

The PGD attack extends BIM by incorporating a random initialization and explicit projection onto an $\epsilon$-ball. The $\epsilon$-ball, denoted $\mathcal{B}_\epsilon(\textbf{x})$, is defined as the set:

\[
\mathcal{B}_\epsilon(\textbf{x}) = \left\{ \tilde{\textbf{x}} \mid \|\tilde{\textbf{x}} - \textbf{x} \|_p \leq \epsilon \right\}
\]

where $\|\cdot\|_p$ is an $\ell_p$ norm, typically $\ell_\infty$ or $\ell_2$. The PGD update rule is:

\begin{equation}
    \tilde{\textbf{x}}^{N+1} = \Pi_{\mathcal{B}_\epsilon(\textbf{x})} \left( \tilde{\textbf{x}}^N + \alpha \cdot \text{sign} \left( \nabla_x \mathcal{L}(f_\theta(\tilde{\textbf{x}}^N), y) \right) \right)
\end{equation}

where $\Pi_{\mathcal{B}_\epsilon(\textbf{x})}(\cdot)$ is the projection operator that ensures $\tilde{\textbf{x}}$ stays within the $\epsilon$-ball. In the case of $\ell_\infty$, the projection becomes a per-pixel clipping function (as in BIM). For $\ell_2$, the projection maps $\tilde{\textbf{x}}$ back onto the surface of a hypersphere centered at $\textbf{x}$ with radius $\epsilon$:

\begin{equation}
    \Pi_{\epsilon}^{\ell_2}(\tilde{\textbf{x}}) = \textbf{x} + \frac{\min \left( \| \tilde{\textbf{x}} - \textbf{x} \|_2, \epsilon \right)}{ \| \tilde{\textbf{x}} - \textbf{x} \|_2 } (\tilde{\textbf{x}} - \textbf{x})
\end{equation}

This formulation ensures that the adversarial examples are constrained within a norm-bounded neighborhood of the original input, making the perturbation imperceptible yet effective.


% PGD attack method is quite similar to the BIM attack, but includes a few differences. PGD starts not at the original image, but at a random point to ensure that the perturbation remains within $\epsilon-ball$ ($l_{\infty}$ and $l_{2}$). This avoids the loss function gradient approaching zero, and the gradient ascent will not change at all. PGD adds support for $l_{2}$ and other metric distances by generalizing the Clip function with the projection function $\prod$ as follows:
% \begin{equation}
%     \tilde{\textbf{x}}^{N+1}=\prod_{\epsilon}\left( \tilde{\textbf{x}}^{N} + \alpha \cdot sign\left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( \tilde{\textbf{x}}^{N} \right),y \right) \right)  \right) 
% \end{equation}
% In case of $l_{\infty}$ the projection function $\prod$ is the Clip function in BIM. In case $l_{2}$ the surface to be projected is a hypersphere with radius $\epsilon$ around the original image, and the projection function is calculated as follows:
% \begin{equation}
%     \prod_{\epsilon}\left( \textbf{x} \right) = \tilde{\textbf{x}} + \frac{min\left( \left\| \textbf{x}-\tilde{\textbf{x}} \right\|_{2},\epsilon \right)}{\left\| \textbf{x}-\tilde{\textbf{x}} \right\|_{2}}\left( \textbf{x}-\tilde{\textbf{x}}\right)
% \end{equation}



\subsection{Optimization-based adversarial attack}

C\&W adversarial attack is a typical representative of the optimization-based adversarial attack approach. The objective is to minimize the perturbation, subject to the constraint that the perturbed input is misclassified by the target model. The general optimization problem for the C\&W attack can be formulated as:
\begin{equation}
    \underset{\eta}{\text{min}} \left\| \eta \right\|_{p} + c\cdot \text{Loss}\left( \eta \right)
\end{equation}
where $\left\| \eta \right\|_{p}$ is the chosen norm of the perturbation ($l_{2}$ or $l_{\infty}$ norm); $c$ is a hyperparameter controlling the trade-off between minimizing the perturbation and maximizing the adversarial effect; $\text{Loss}\left( \eta \right)$ is the classification loss with the goal of creating a 
perturbation $\eta$ such that the perturbed image $\tilde{\textbf{x}} = \textbf{x} +\eta$ is misclassified by the model but still looks similar to the original image. The loss function $\text{Loss}\left( \eta \right)$ that is minimized during the attack can be written for an untargeted attack as:

\begin{equation}
    \begin{split}
        \text{Loss}_{untargeted}\left( \eta \right) =  &\text{max}\left( 0,f\left( x+\eta \right)_{y}-\underset{i\neq y}{\text{max}}\:f\left( x+\eta \right)_{i}\right) \\
        &+ \lambda \left\| \eta \right\|^{2}_{2}
    \end{split}
\end{equation}
and the loss function for targeted attack as:
\begin{equation}
    \begin{split}
        \text{Loss}_{targeted}\left( \eta \right) =  &\text{max}\left( 0,f\left( x+\eta \right)_{t}-\underset{i\neq t}{\text{max}}\:f\left( x+\eta \right)_{i}\right) \\
        &+ \lambda \left\| \eta \right\|^{2}_{2}
    \end{split}
\end{equation}
where:

- $f\left( x+\eta \right)_{y}$ is the logit for the true class $y$ after perturbation;

- $f\left( x+\eta \right)_{t}$ is the logit for the target class $t$ after perturbation;

- $f\left( x+\eta \right)_{i}$ is the logit for any class $i\neq y$ or $i\neq t$;

- $\underset{i\neq y}{\text{max}}\:f\left( x+\eta \right)_{i}$ is the maximum logit for any class $i\neq y$, representing the logit of the most likely incorrect class; 
    
- $\underset{i\neq t}{\text{max}}\:f\left( x+\eta \right)_{i}$ is the maximum logit for any class $i\neq t$;

- $\text{max}\left( 0,f\left( x+\eta \right)_{y}-\underset{i\neq y}{\text{max}}\:f\left( x+\eta \right)_{i}\right)$ ensures that the model misclassifies the perturbed input into a class that is not the original class $y$. Forcing the logit for the original class $y$ to be smaller than the logit for at least one other incorrect class;

- $\text{max}\left( 0,f\left( x+\eta \right)_{t}-\underset{i\neq t}{\text{max}}\:f\left( x+\eta \right)_{i}\right)$ ensures that the model classifies the perturbed input as the target class $t$, and not as any other class. This forces the target class logit to be greater than all other logits for the perturbed image;

- $\lambda$ is a regularization constant that controls the trade-off between misclassification and perturbation size;

- $\left\| \eta \right\|^{2}_{2}$ is the L2 norm squared of the perturbation, which controls how large the perturbation can be;

- $\lambda \left\| \eta \right\|^{2}_{2}$ ensures that the perturbation is small, making the changes imperceptible to humans.

\section{Adversarial Defense with Regularized Adversarial Training}
\label{Proposed_Method}

We propose three variations of adversarial training that integrate regularization to enhance model robustness: (1) Adversarial Training with Weight Regularization (ATWR), (2) Adversarial Training with Gradient Regularization (ATGR), and (3) Ensemble Adversarial Training with Regularization (EATR). In all approaches, adversarial examples are incorporated into the training process alongside clean samples and regularization constraints.

In ATWR and ATGR, adversarial examples are generated using a single white-box attack (e.g., FGSM, PGD, BIM, or C\&W). In contrast, EATR generates adversarial examples from multiple attacks on-the-fly, using ensemble perturbations during training. In order to ensure stable learning and improved generalization, all CNN models are first pre-trained on clean data before being fine-tuned with adversarial samples.

To support reproducibility, pseudocode and a training pipeline diagram for all three strategies are provided in the Appendix.

\subsection{Adversarial Training with Weight Regularization (ATWR)}

This method integrates weight decay with adversarial training through the following composite loss:
\begin{equation}
    \mathcal{L}_{\text{ATWR}} = \mathcal{L}_{\text{clean}} + \lambda_{1} \mathcal{L}_{\text{adv}} + \lambda_{2}\left\| \textbf{W} \right\|^{2}_{2}
\end{equation}

Here, $\mathcal{L}_{\text{clean}}$ is the standard loss on clean data, $\mathcal{L}_{\text{adv}}$ is the loss on adversarial examples, and $\|\textbf{W}\|^2_2$ is the weight regularization term (weight decay), which penalizes large parameter magnitudes. This encourages simpler models and enhances generalization.

% where $\mathcal{L}_{\text{clean}}$ is the loss on clean data, $\mathcal{L}_{\text{adv}}$ is the loss on adversarial samples, and $\textbf{W}$ denotes model weights. Regularization discourages overfitting to adversarial examples and improves generalization.


\subsection{Adversarial Training with Gradient Regularization (ATGR)}

ATGR penalizes large input gradients to reduce sensitivity to perturbations:
\begin{equation}
    \mathcal{L}_{\text{ATGR}} = \mathcal{L}_{\text{clean}} + \beta_{1} \mathcal{L}_{\text{adv}} + \beta_{2} \left\| \nabla _{\tilde{\textbf{x}}} \mathcal{L}_{\text{adv}}\left( \tilde{\textbf{x}} \right)\right\|^{2}_{2}
\end{equation}
where $\left\| \nabla _{\tilde{\textbf{x}}} \mathcal{L}_{\text{adv}}\left( \tilde{\textbf{x}} \right)\right\|^{2}_{2}$ is gradient regularization, which suppresses sharp changes in the loss landscape and promotes smoother decision boundaries. Although this often reduces classification accuracy, it makes the model highly sensitive to adversarial inputs, offering the potential for adversarial detection. \footnote{While ATGR may degrade classification accuracy, its tendency to produce low-confidence predictions on perturbed inputs can be leveraged to distinguish adversarial examples from clean ones. This makes ATGR useful for adversarial input detection. In particular, robust detection itself can be a valuable line of defense in security-critical applications, as early identification and rejection of adversarial samples can prevent harmful decisions downstream.}


\subsection{Ensemble Adversarial Training with Regularization (EATR)}

EATR leverages multiple attacks during training and incorporates a regularization term:
\begin{equation}
    \begin{split}
         \mathcal{L}_{\text{EATR}} = &\mathcal{L}_{\text{clean}} + \gamma_{1}\mathcal{L}^{\text{FGSM}}_{\text{adv}} + \gamma_{2}\mathcal{L}^{\text{PGD}}_{\text{adv}} + \gamma_{3}\mathcal{L}^{\text{BIM}}_{\text{adv}} \\
         &+ \gamma_{4}\mathcal{L}^{\text{C\&W}}_{\text{adv}} + \gamma_{5}\mathcal{L}_{\text{reg}}
    \end{split}
\end{equation}

Where:
\begin{equation}
    \mathcal{L}_{\text{clean}}\left( f\left( x_{i} \right),y_{i} \right)=-\sum_{c=1}^{C}y^{c}_{i}\:{\text{log}}^{}\left( f\left( x_{i} \right)^{c} \right)
\end{equation}

Each $\mathcal{L}_{\text{adv}}^{\text{attack}}$ is a cross-entropy loss over adversarial examples $\tilde{x}_{i}^{\text{attack}}$:
\begin{equation}
    \mathcal{L}_{\text{adv}}^{\text{attack}} \left( f\left( \tilde{x}_{i} \right),y_{i} \right) = -\sum_{c=1}^{C}y^{c}_{i} \: \text{log} \left( f\left( \tilde{x}_{i} \right)^{c} \right)
\end{equation}

Adversarial examples are generated as follows:
\begin{equation}
    \tilde{x}^{\text{FGSM}}_{i} = x_{i} + \epsilon \: \text{sign} \left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( x_{i} \right), y_{i}\right) \right) 
\end{equation}

\begin{equation}
    \tilde{x}^{\text{PGD}}_{i} = x_{i} + \alpha\: \text{sign} \left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( x_{i} \right), y_{i}\right) \right)
\end{equation}

\begin{equation}
\begin{split}
\tilde{x}^{\text{BIM}}_{i}(t+1) = \text{clip}_{x_{i}, \epsilon}\Big( \tilde{x}^{\text{BIM}}_{i}(t) \\+ \alpha \cdot \text{sign}\big( \nabla_{x} \mathcal{L}\big( f_{\theta}( \tilde{x}^{\text{BIM}}_{i}(t) ), y_{i} \big) \big) \Big)
\end{split}
\end{equation}


\begin{equation}
\begin{split}
    \tilde{x}^{\text{C\&W}}_{i} = \text{arg }\underset{\tilde{x}^{\text{C\&W}}}{\text{min}} \left\| \tilde{x}^{\text{C\&W}}_{i} -x_{i}\right\|^{2} \\ + \lambda \mathcal{L}\left( f_{\theta}\left( \tilde{x}^{\text{C\&W}}_{i} \right),y_{i} \right)
\end{split}
\end{equation}

$\mathcal{L}_{\text{reg}}$ can represent either weight decay ($\|\textbf{W}\|^2_2$) or gradient regularization ($\|\nabla_{\tilde{\textbf{x}}} \mathcal{L}_{\text{adv}}(\tilde{\textbf{x}})\|^2_2$), depending on the variant implemented. This modular structure enables flexibility between generalization and robustness.

\section{Experiments and results}
\label{Experiments}

\subsection{Experimental dataset and evaluation metric}

\subsubsection{Experimental datasets}
In this work, the MNIST \cite{lecun1998gradient}, CIFAR10, CIFAR100 \cite{krizhevsky2009learning}, and ImageNet \cite{deng2009imagenet} datasets are used in our experiments. The MNIST dataset consists of images of handwritten digits (0–9). Each image is a 28x28 pixel grayscale image and is labeled with the correct digit (from 0 to 9). The data set contains a total of 70,000 images, and the data split for training is 60,000 images and for testing is 10,000 images. The CIFAR-10 dataset consists of 60,000 color images in 10 different classes. Each image is 32x32 pixels with 3 color channels of RGB. In this work, the training set contains 50,000 images, and the testing set includes 10,000 images. The CIFAR-100 dataset is an extended version of the CIFAR-10 dataset, which contains 100 classes, each with 600 RGB images with a resolution of 32x32 pixels, totaling 60,000 images in the dataset. The 100 classes are divided into 20 superclasses, and each superclass contains 5 subclasses. In this work, the CIFAR-100 dataset is divided into a training set of 50,000 images and a test set of 10,000 images. The images are divided equally among the 100 classes, with 500 images per class for training and 100 images per class for testing. The ImageNet dataset is one of the largest and most widely used datasets for image classification tasks. It contains more than 14 million images that are labeled according to a large set of categories (more than 20,000 in total). The images in the dataset vary in resolution and are both low- and high-resolution images, with a wide range of perspectives, lighting conditions, and occlusions. In this work, we used a subset of the ImageNet dataset known as the ImageNet Large-Scale Visual Recognition Challenge (ILSVRC), which contains 1.2 million images for 1,000 categories. This subset is taken from the test set of the ImageNet dataset \cite{deng2009imagenet}. It contains 100,000 images that are also distributed in 1,000 categories.

\subsubsection{Evaluation metrics}
In order to evaluate the adversarial attack robustness and defense, the evaluation metric of Accuracy Drop ($\text{Acc}_{\text{drop}}$) is used for the experiments. This metric measures  the performance degradation of the image classifiers when subjected to adversarial examples:
\begin{equation}
    \text{Acc}_{\text{drop}} \left( \% \right) = \text{Acc}_{\text{origin}} \left( \% \right) -\text{Acc}_{\text{adv}} \left( \% \right)
\end{equation}
where $\text{Acc}_{\text{origin}}$ is the classification accuracy on the original (clean) data, and $\text{Acc}_{\text{adv}}$ is the accuracy of the classifiers on the adversarial data. High accuracy drop means low robustness, or the target model is more vulnerable to adversarial attacks. Low accuracy drop indicates high robustness, or the target model is less vulnerable to adversarial attack. The $\text{Acc}_{\text{origin}}$ and $\text{Acc}_{\text{adv}}$ are evaluated using the top-1 accuracy metric. Top-1 accuracy represents the precision of the model's highest-probability prediction:
\begin{equation}
    \text{Acc}_{\text{Top-1}} \left( \% \right)= \frac{\text{Number } \text{of } \text{correct } \text{Top-1} \:\text{predictions}}{\text{Total }\text{number} \: \text{of }\text{predictions}}
\end{equation}


\subsection{Configuration parameters}

- The loss function is the cross-entropy loss. The image classification models are ResNet50 \cite{KaimingHe2016}, ResNet101 \cite{KaimingHe2016}, AlexNet  \cite{iandola2016squeezenet}, MobileNetV2  \cite{Sandler_MobileNetV2}, DenseNet121 \cite{Huang2017}, InceptionNetV3 \cite{Christian_InceptionNet_V3}. These models were selected to represent a diverse range of architectures in terms of depth, width, and computational complexity. This allows us to evaluate the generalizability of our defense methods across both lightweight and heavyweight CNNs, covering real-world deployment scenarios.

Configuration parameters for adversarial attacks:
\begin{itemize}
    \item  FGSM: The loss function is the Cross Entropy Loss; $\epsilon=0.1$.
    \item PGD: The loss function is the Cross Entropy Loss; number of epochs = 100; $\alpha=2/255$ for ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121; $\alpha=2/299$ for InceptionNetV3; $\epsilon=0.1$.
    \item BIM: The loss function is the Cross Entropy Loss; $\alpha=2/255$ for ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121; $\alpha=2/299$ for InceptionNetV3; $\epsilon=0.1$.
    \item C\&W: The confidence parameter $c=1.0$; Search step = 1; Maximum step = 100; Optimizer learning rate = 0.001.
\end{itemize} 

Configuration parameters for defense solutions:
\begin{itemize}
    \item ATWR: Learning rate 0.001; number of epochs: 100-500; $\lambda_{1}=1$, $\lambda_{2}=0.005$. These values were determined through a grid search in a validation split to maintain a balance between adversarial robustness and weight simplicity.
    \item ATGR: Learning rate 0.001; number of epochs: 100-500; $\beta_{1}=1$, $\beta_{2}=1$. This configuration encourages conservative learning and strong gradient suppression for improved attack detectability.
    \item EATR: Learning rate 0.001; number of epochs: 100-500; $\gamma_{1}=\gamma_{2}=\gamma_{3}=\gamma_{4}=1$; $\gamma_{5}=0.001$. These ensemble weights were uniformly initialized and shown through sensitivity analysis to yield stable performance across datasets and attacks.
\end{itemize}

\subsection{Computational Environment}

All experiments were conducted using a system with the following specifications: Intel(R) Core(TM) i7-10700K CPU @ 3.80GHz, 48 GB RAM, and NVIDIA Corporation Device 2504 (rev a1), running on Ubuntu 20.04.6 LTS, GNU/Linux 5.4.0-208-Generic x86$\_$64. The models were implemented in Python 3.9 using PyTorch 2.2.0 and CUDA 12.4. We fixed random seeds (42) for NumPy and PyTorch to ensure deterministic behavior and reproducibility. 
% Evaluation scripts and hyperparameter configurations have been made available in the supplementary material.

\subsection{Experimental results}

In this section, we evaluate the performance of the target models in two scenarios: (1) without any adversarial defense, and (2) with adversarial defense. In the first scenario, adversarial attacks such as FGSM, PGD, BIM, and C\&W are used to generate adversarial samples, and the target models are tested for their robustness against these perturbations. In the second scenario, we apply three defense strategies-ATWR, ATGR, and EATR-to evaluate how well target models can withstand adversarial attacks.

\subsubsection{Model robustness without adversarial defense}

Adversarial attacks, including FGSM, BIM, PGD, and C\&W, are applied to widely used image classification models: ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3. These attacks generate adversarial samples using the MNIST, CIFAR-10, CIFAR-100, and ImageNet datasets.

Table \ref{AttackWithoutDefense} presents the classification results of the target models in the original images (\textbf{Acc-origin}) and the adversarial images (\textbf{Acc-adv}) generated by the FGSM, PGD, BIM, and C\&W attacks. (\textbf{Acc-drop}) indicates the decrease in image classifier performance when exposed to adversarial examples. Taking into account the MNIST and ImageNet datasets, the target models exhibit a higher vulnerability to the C\&W attack compared to other attacks, with the highest \textbf{Acc-drop} of 100\% across all models, except MobileNetV2, which shows a 76.56\% \textbf{Acc-drop} on the MNIST dataset. For the ImageNet dataset, all models experience an \textbf{Acc-drop} above 90\%, except AlexNet, which shows a 79.69\% \textbf{Acc-drop}. 

Evaluations of the CIFAR-10 and CIFAR-100 datasets reveal that target models are less vulnerable to the C\&W attack, while the PGD attack has the most significant adversarial impact on all models. The \textbf{Acc-drop} for PGD attacks ranges from a minimum of 48.12\% (InceptionNetV3) to a maximum of 65.93\% (MobileNetV2) on the CIFAR-10 dataset, and from 44.06\% (AlexNet) to 63.75\% (MobileNetV2) on the CIFAR-100 dataset.

\begin{table*}[htp]
\centering
\caption{Classification accuracy (\%) of CNN models on clean and adversarial images under four white-box, untargeted attacks: FGSM, PGD, BIM, and C\&W. No defense mechanism is applied. The accuracy drop (Acc-drop) is defined as the difference between the clean accuracy (Acc-origin) and the adversarial accuracy (Acc-adv).}
\resizebox{16cm}{!}{
\begin{tabular}{|c|l|c|cc|cc|cc|cc|}
\hline
\multirow{2}{*}{\textbf{Dataset}}                        & \multicolumn{1}{c|}{\multirow{2}{*}{\textbf{CNN model}}} & \multirow{2}{*}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-origin\\ (Top-1)\end{tabular}}} & \multicolumn{2}{c|}{\textbf{FGSM}}                                                                          & \multicolumn{2}{c|}{\textbf{PGD}}                                                                           & \multicolumn{2}{c|}{\textbf{BIM}}                                                                           & \multicolumn{2}{c|}{\textbf{C\&W}}                                                                            \\ \cline{4-11} 
                                                         & \multicolumn{1}{c|}{}                                    &                                                                                        & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} \\ \hline
\multirow{6}{*}{\textbf{MNIST}}                          & ResNet50                                                 & 100.00                                                                                 & \multicolumn{1}{c|}{62.50}                                                              & 37.50             & \multicolumn{1}{c|}{21.88}                                                              & 78.12             & \multicolumn{1}{c|}{25.00}                                                              & 75.00             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \cline{2-11} 
                                                         & ResNet101                                                & 100.00                                                                                 & \multicolumn{1}{c|}{45.31}                                                              & 54.69             & \multicolumn{1}{c|}{7.81}                                                               & 92.19             & \multicolumn{1}{c|}{23.44}                                                              & 76.56             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \cline{2-11} 
                                                         & AlexNet                                                  & 100.00                                                                                 & \multicolumn{1}{c|}{64.06}                                                              & 35.94             & \multicolumn{1}{c|}{100.00}                                                             & 0.00              & \multicolumn{1}{c|}{29.69}                                                              & 70.31             & \multicolumn{1}{c|}{23.44}                                                              & \textbf{76.56}    \\ \cline{2-11} 
                                                         & MobileNetV2                                              & 100.00                                                                                 & \multicolumn{1}{c|}{82.81}                                                              & 17.19             & \multicolumn{1}{c|}{70.31}                                                              & 29.69             & \multicolumn{1}{c|}{25.00}                                                              & 75.00             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \cline{2-11} 
                                                         & DenseNet121                                              & 100.00                                                                                 & \multicolumn{1}{c|}{59.38}                                                              & 40.62             & \multicolumn{1}{c|}{60.94}                                                              & 39.06             & \multicolumn{1}{c|}{20.31}                                                              & 79.69             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \cline{2-11} 
                                                         & InceptionNetV3                                           & 100.00                                                                                 & \multicolumn{1}{c|}{75.00}                                                              & 25.00             & \multicolumn{1}{c|}{29.69}                                                              & 70.31             & \multicolumn{1}{c|}{18.75}                                                              & 81.25             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{\textbf{CIFAR10}}}  & ResNet50                                                 & 93.13                                                                                  & \multicolumn{1}{c|}{61.25}                                                              & 31.88             & \multicolumn{1}{c|}{43.75}                                                              & \textbf{49.38}    & \multicolumn{1}{c|}{47.82}                                                              & 45.31             & \multicolumn{1}{c|}{84.11}                                                              & 9.02              \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & ResNet101                                                & 95.63                                                                                  & \multicolumn{1}{c|}{64.38}                                                              & 31.25             & \multicolumn{1}{c|}{46.88}                                                              & \textbf{48.75}    & \multicolumn{1}{c|}{45.00}                                                              & 50.63             & \multicolumn{1}{c|}{82.43}                                                              & 13.20             \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & AlexNet                                                  & 89.06                                                                                  & \multicolumn{1}{c|}{30.94}                                                              & 58.12             & \multicolumn{1}{c|}{37.19}                                                              & \textbf{51.87}    & \multicolumn{1}{c|}{21.88}                                                              & 67.18             & \multicolumn{1}{c|}{78.31}                                                              & 10.75             \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & MobileNetV2                                              & 92.19                                                                                  & \multicolumn{1}{c|}{48.13}                                                              & 44.06             & \multicolumn{1}{c|}{26.26}                                                              & \textbf{65.93}    & \multicolumn{1}{c|}{40.94}                                                              & 51.25             & \multicolumn{1}{c|}{84.58}                                                              & 7.61              \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & DenseNet121                                              & 93.75                                                                                  & \multicolumn{1}{c|}{58.44}                                                              & 35.31             & \multicolumn{1}{c|}{43.13}                                                              & \textbf{50.62}    & \multicolumn{1}{c|}{42.50}                                                              & 51.25             & \multicolumn{1}{c|}{81.08}                                                              & 12.67             \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & InceptionNetV3                                           & 78.13                                                                                  & \multicolumn{1}{c|}{39.07}                                                              & 39.06             & \multicolumn{1}{c|}{30.01}                                                              & \textbf{48.12}    & \multicolumn{1}{c|}{33.44}                                                              & 44.69             & \multicolumn{1}{c|}{69.39}                                                              & 8.74              \\ \hline
\multirow{6}{*}{\textbf{CIFAR100}}                       & ResNet50                                                 & 77.19                                                                                  & \multicolumn{1}{c|}{37.50}                                                              & 39.69             & \multicolumn{1}{c|}{22.19}                                                              & \textbf{55.00}    & \multicolumn{1}{c|}{26.57}                                                              & 50.62             & \multicolumn{1}{c|}{67.82}                                                              & 9.37              \\ \cline{2-11} 
                                                         & ResNet101                                                & 84.69                                                                                  & \multicolumn{1}{c|}{41.57}                                                              & 43.12             & \multicolumn{1}{c|}{32.19}                                                              & \textbf{52.50}    & \multicolumn{1}{c|}{32.50}                                                              & 52.19             & \multicolumn{1}{c|}{75.16}                                                              & 9.53              \\ \cline{2-11} 
                                                         & AlexNet                                                  & 67.50                                                                                  & \multicolumn{1}{c|}{14.69}                                                              & 52.81             & \multicolumn{1}{c|}{23.44}                                                              & \textbf{44.06}    & \multicolumn{1}{c|}{17.19}                                                              & 50.31             & \multicolumn{1}{c|}{61.41}                                                              & 6.09              \\ \cline{2-11} 
                                                         & MobileNetV2                                              & 80.94                                                                                  & \multicolumn{1}{c|}{30.01}                                                              & 50.93             & \multicolumn{1}{c|}{17.19}                                                              & \textbf{63.75}    & \multicolumn{1}{c|}{25.30}                                                              & 55.64             & \multicolumn{1}{c|}{69.06}                                                              & 11.88             \\ \cline{2-11} 
                                                         & DenseNet121                                              & 81.56                                                                                  & \multicolumn{1}{c|}{32.82}                                                              & 48.74             & \multicolumn{1}{c|}{25.63}                                                              & \textbf{55.93}    & \multicolumn{1}{c|}{27.19}                                                              & 54.37             & \multicolumn{1}{c|}{72.11}                                                              & 9.45              \\ \cline{2-11} 
                                                         & InceptionNetV3                                           & 79.69                                                                                  & \multicolumn{1}{c|}{39.69}                                                              & 40.00             & \multicolumn{1}{c|}{30.00}                                                              & \textbf{49.69}    & \multicolumn{1}{c|}{34.07}                                                              & 45.62             & \multicolumn{1}{c|}{68.91}                                                              & 10.78             \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{\textbf{ImageNet}}} & ResNet50                                                 & 95.31                                                                                  & \multicolumn{1}{c|}{82.81}                                                              & 12.50             & \multicolumn{1}{c|}{76.56}                                                              & 18.75             & \multicolumn{1}{c|}{42.19}                                                              & 53.12             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{95.31}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & ResNet101                                                & 93.75                                                                                  & \multicolumn{1}{c|}{90.62}                                                              & 3.13              & \multicolumn{1}{c|}{85.94}                                                              & 7.81              & \multicolumn{1}{c|}{53.12}                                                              & 40.63             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{93.75}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & AlexNet                                                  & 79.69                                                                                  & \multicolumn{1}{c|}{23.44}                                                              & 56.25             & \multicolumn{1}{c|}{71.88}                                                              & 7.81              & \multicolumn{1}{c|}{0.00}                                                               & 79.69             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{79.69}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & MobileNetV2                                              & 92.19                                                                                  & \multicolumn{1}{c|}{65.62}                                                              & 26.57             & \multicolumn{1}{c|}{60.94}                                                              & 31.25             & \multicolumn{1}{c|}{9.38}                                                               & 82.81             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{92.19}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & DenseNet121                                              & 93.75                                                                                  & \multicolumn{1}{c|}{62.50}                                                              & 31.25             & \multicolumn{1}{c|}{81.25}                                                              & 12.50             & \multicolumn{1}{c|}{3.12}                                                               & 90.63             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{93.75}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & InceptionNetV3                                           & 90.62                                                                                  & \multicolumn{1}{c|}{56.25}                                                              & 34.37             & \multicolumn{1}{c|}{81.25}                                                              & 9.37              & \multicolumn{1}{c|}{4.69}                                                               & 85.93             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{90.62}    \\ \hline
\end{tabular}
}
\label{AttackWithoutDefense}
\end{table*}

Figures \ref{fig:MNIST_ImageNet} and \ref{fig:CIFAR10_100} display adversarial samples generated from MNIST, CIFAR-10, CIFAR-100, and ImageNet using FGSM, PGD, BIM, and C\&W attacks on the target models: ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3. Upon inspection of these adversarial images, it is apparent to the human eye that the images generated by PGD and C\&W attacks are more similar to the original images compared to those generated by the FGSM and BIM attacks. This indicates that the perturbations introduced by PGD and C\&W are less noticeable to the human eye. Despite their imperceptibility, these adversarial samples still lead to misclassification in the target models. 
This is evident in Table \ref{AttackWithoutDefense}, where the models show low accuracy in adversarial examples (\textbf{Acc-adv}) or experience a significant accuracy drop (\textbf{Acc-drop}) for the C\&W attack on MNIST and ImageNet, and for the PGD attack on CIFAR-10 and CIFAR-100 datasets.

Figures~\ref{fig:MNIST_ImageNet} and~\ref{fig:CIFAR10_100} illustrate adversarial examples generated by FGSM, PGD, BIM, and C\&W attacks across multiple datasets (MNIST, CIFAR-10, CIFAR-100, ImageNet) and CNN architectures (ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, InceptionNetV3). Visual inspection reveals that PGD and C\&W attacks produce perturbations that are almost imperceptible to the human eye, as evidenced by their consistently higher PSNR values (e.g., $>$ 30 dB on average), compared to FGSM and BIM, whose perturbations are more visually prominent and produce lower PSNR. Despite their subtle appearance, these attacks are highly effective in deceiving models, as shown by the substantial accuracy drops reported in Table~\ref{AttackWithoutDefense}. For instance, PGD causes accuracy degradation up to 65.93\% on CIFAR-10 (MobileNetV2), while C\&W results in 100\% drop on MNIST (ResNet50) and over 90\% on ImageNet (multiple models). This demonstrates the deceptive strength of optimization-based attacks like C\&W and highlights the necessity of defense methods capable of countering both visually obvious and imperceptible adversarial threats.


\begin{figure*}[htp]
    \centering
    \includegraphics[width=1.0\linewidth]{mnist_ImageNet.eps}
    \caption{Visualization of adversarial examples generated by four attack methods (FGSM, PGD, BIM, and C\&W) across six CNN architectures (ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, InceptionNetV3). Subfigure (a) shows results on the MNIST dataset, while subfigure (b) shows results on ImageNet dataset. The top row in each subfigure contains original (clean) images, while the rows below show adversarial versions organized by attack method and model. Peak Signal-to-Noise Ratio (PSNR) values, indicating the similarity between adversarial and clean images, are shown beneath each adversarial image.}
    \label{fig:MNIST_ImageNet}
\end{figure*}

\begin{figure*}[htp]
    \centering
    \includegraphics[width=1.0\linewidth]{CIFAR10_100.eps}
    \caption{Visualization of adversarial examples generated by four attack methods (FGSM, PGD, BIM, and C\&W) across six CNN architectures (ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, InceptionNetV3). Subfigure (a) shows results on the CIFAR-10 dataset, while subfigure (b) shows results on CIFAR-100. The top row in each subfigure contains original (clean) images, while the rows below show adversarial versions organized by attack method and model. Peak Signal-to-Noise Ratio (PSNR) values, indicating the similarity between adversarial and clean images, are shown beneath each adversarial image.}
    \label{fig:CIFAR10_100}
\end{figure*}


\subsubsection{Model robustness with adversarial defense}

In this section, we evaluate the robustness of target models using three defense strategies: ATWR, ATGR, and EATR. The experiments are conducted on the MNIST, CIFAR-10, and CIFAR-100 datasets. Target models are trained in both adversarial and clean images, and their performance is evaluated on clean images (\textbf{Acc-clean}) and adversarial images (\textbf{Acc-adv}).


\begin{table*}[htp]
\centering
\caption{Classification accuracy (\%) with Adversarial Training using Weight Regularization (ATWR) against FGSM, PGD, BIM, and C\&W attacks. ATWR improves robustness while preserving clean accuracy. All attacks are white-box and untargeted. The accuracy drop (Acc-drop) is defined as the difference between the clean accuracy (Acc-origin) and the adversarial accuracy (Acc-adv).
}

\resizebox{17cm}{!}{
\begin{tabular}{|c|c|c|ccc|ccc|ccc|ccc|}
\hline
\multirow{2}{*}{\textbf{Dataset}}               & \multirow{2}{*}{\textbf{CNN model}} & \multirow{2}{*}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-origin\\ (Top-1)\end{tabular}}} & \multicolumn{3}{c|}{\textbf{FGSM}}                                                                                                                                                                           & \multicolumn{3}{c|}{\textbf{PGD}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{BIM}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{C\&W}}                                                                                                                                                                             \\ \cline{4-15} 
                                                &                                     &                                                                                        & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} \\ \hline
\multirow{6}{*}{MNIST}                          & ResNet50                            & 100.00                                                                                 & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{6.56}                                                               & 92.19             & \multicolumn{1}{c|}{\textbf{98.75}}                                                            & \multicolumn{1}{c|}{\textbf{98.75}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 98.75             & \multicolumn{1}{c|}{\textbf{98.75}}                                                            & \multicolumn{1}{c|}{\textbf{98.75}}                                                     & \textbf{0.00}     \\ \cline{2-15} 
                                                & ResNet101                           & 100.00                                                                                 & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{25.00}                                                              & 74.06             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{99.06}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 99.06             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{98.75}}                                                     & \textbf{0.31}     \\ \cline{2-15} 
                                                & AlexNet                             & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{\textbf{13.44}}                                                            & \multicolumn{1}{c|}{\textbf{13.44}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{\textbf{13.44}}                                                            & \multicolumn{1}{c|}{\textbf{13.44}}                                                     & \textbf{0.00}     \\ \cline{2-15} 
                                                & MobileNetV2                         & 100.00                                                                                 & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{69.38}                                                              & 29.68             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{99.06}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{1.56}                                                               & 97.50             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{97.81}}                                                     & \textbf{1.25}     \\ \cline{2-15} 
                                                & DenseNet121                         & 100.00                                                                                 & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{34.69}                                                              & 64.37             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{99.06}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 99.06             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{98.75}}                                                     & \textbf{0.31}     \\ \cline{2-15} 
                                                & InceptionNetV3                      & 100.00                                                                                 & \multicolumn{1}{c|}{98.44}                                                                     & \multicolumn{1}{c|}{81.88}                                                              & 16.56             & \multicolumn{1}{c|}{\textbf{98.44}}                                                            & \multicolumn{1}{c|}{\textbf{98.44}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{98.44}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 98.44             & \multicolumn{1}{c|}{\textbf{98.44}}                                                            & \multicolumn{1}{c|}{\textbf{97.19}}                                                     & \textbf{1.25}     \\ \hline
\multirow{6}{*}{CIFAR10}                        & ResNet50                            & 93.13                                                                                  & \multicolumn{1}{c|}{87.81}                                                                     & \multicolumn{1}{c|}{18.44}                                                              & 69.37             & \multicolumn{1}{c|}{\textbf{87.81}}                                                            & \multicolumn{1}{c|}{\textbf{87.50}}                                                     & \textbf{0.31}     & \multicolumn{1}{c|}{87.81}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 87.81             & \multicolumn{1}{c|}{87.81}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 87.81             \\ \cline{2-15} 
                                                & ResNet101                           & 95.63                                                                                  & \multicolumn{1}{c|}{85.31}                                                                     & \multicolumn{1}{c|}{16.88}                                                              & 68.43             & \multicolumn{1}{c|}{\textbf{85.31}}                                                            & \multicolumn{1}{c|}{\textbf{85.31}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{85.31}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 85.31             & \multicolumn{1}{c|}{85.31}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 85.31             \\ \cline{2-15} 
                                                & AlexNet                             & 89.06                                                                                  & \multicolumn{1}{c|}{12.50}                                                                     & \multicolumn{1}{c|}{12.50}                                                              & 0.00              & \multicolumn{1}{c|}{\textbf{12.50}}                                                            & \multicolumn{1}{c|}{\textbf{12.50}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{12.50}                                                                     & \multicolumn{1}{c|}{12.50}                                                              & 0.00              & \multicolumn{1}{c|}{12.50}                                                                     & \multicolumn{1}{c|}{12.50}                                                              & 0.00              \\ \cline{2-15} 
                                                & MobileNetV2                         & 92.19                                                                                  & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{15.62}                                                              & 70.00             & \multicolumn{1}{c|}{\textbf{85.62}}                                                            & \multicolumn{1}{c|}{\textbf{85.62}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{3.44}                                                               & 82.18             & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{22.50}                                                              & 63.12             \\ \cline{2-15} 
                                                & DenseNet121                         & 93.75                                                                                  & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{18.75}                                                              & 66.87             & \multicolumn{1}{c|}{\textbf{85.62}}                                                            & \multicolumn{1}{c|}{\textbf{85.62}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{4.69}                                                               & 80.93             & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{31.25}                                                              & 54.37             \\ \cline{2-15} 
                                                & InceptionNetV3                      & 78.13                                                                                  & \multicolumn{1}{c|}{87.19}                                                                     & \multicolumn{1}{c|}{16.88}                                                              & 70.31             & \multicolumn{1}{c|}{\textbf{87.19}}                                                            & \multicolumn{1}{c|}{\textbf{87.19}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{87.19}                                                                     & \multicolumn{1}{c|}{2.19}                                                               & 85.00             & \multicolumn{1}{c|}{87.19}                                                                     & \multicolumn{1}{c|}{30.00}                                                              & 57.19             \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{CIFAR100}} & ResNet50                            & 77.19                                                                                  & \multicolumn{1}{c|}{66.88}                                                                     & \multicolumn{1}{c|}{10.94}                                                              & 55.94             & \multicolumn{1}{c|}{\textbf{66.88}}                                                            & \multicolumn{1}{c|}{\textbf{66.88}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{66.88}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 66.88             & \multicolumn{1}{c|}{66.88}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 66.88             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & ResNet101                           & 84.69                                                                                  & \multicolumn{1}{c|}{65.31}                                                                     & \multicolumn{1}{c|}{7.19}                                                               & 58.12             & \multicolumn{1}{c|}{\textbf{65.31}}                                                            & \multicolumn{1}{c|}{\textbf{65.31}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{65.31}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 65.31             & \multicolumn{1}{c|}{65.31}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 65.31             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & AlexNet                             & 67.50                                                                                  & \multicolumn{1}{c|}{38.44}                                                                     & \multicolumn{1}{c|}{9.69}                                                               & 28.75             & \multicolumn{1}{c|}{\textbf{38.44}}                                                            & \multicolumn{1}{c|}{\textbf{38.44}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{38.44}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 38.44             & \multicolumn{1}{c|}{38.44}                                                                     & \multicolumn{1}{c|}{4.06}                                                               & 34.38             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & MobileNetV2                         & 80.94                                                                                  & \multicolumn{1}{c|}{67.81}                                                                     & \multicolumn{1}{c|}{7.81}                                                               & 60.00             & \multicolumn{1}{c|}{\textbf{67.81}}                                                            & \multicolumn{1}{c|}{\textbf{67.19}}                                                     & \textbf{0.62}     & \multicolumn{1}{c|}{67.81}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 67.81             & \multicolumn{1}{c|}{67.81}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 67.81             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & DenseNet121                         & 81.56                                                                                  & \multicolumn{1}{c|}{69.06}                                                                     & \multicolumn{1}{c|}{7.81}                                                               & 61.25             & \multicolumn{1}{c|}{\textbf{69.06}}                                                            & \multicolumn{1}{c|}{\textbf{69.06}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{69.06}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 69.06             & \multicolumn{1}{c|}{69.06}                                                                     & \multicolumn{1}{c|}{0.31}                                                               & 68.75             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & InceptionNetV3                      & 79.69                                                                                  & \multicolumn{1}{c|}{70.94}                                                                     & \multicolumn{1}{c|}{9.69}                                                               & 61.25             & \multicolumn{1}{c|}{\textbf{70.94}}                                                            & \multicolumn{1}{c|}{\textbf{70.94}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{70.94}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 70.94             & \multicolumn{1}{c|}{70.94}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 70.94             \\ \hline
\end{tabular}
\label{ATWR}
}
\end{table*}

Table~\ref{ATWR} shows that ATWR significantly improves robustness, particularly under strong white-box, untargeted attacks such as PGD and C\&W. In contrast, FGSM and BIM see varied performance due to their simpler perturbation strategy. Most models maintain \textbf{Acc-drop} close to 0\%, especially in the PGD and C\&W attacks, which demonstrates strong resistance.

Regarding the trade-off between clean accuracy and robustness, we observe that most models achieve a good balance in MNIST and CIFAR-10. Their \textbf{Acc-clean} values are only slightly below the \textbf{Acc-origin}, with ATWR ensuring minimal degradation. On CIFAR-100, the accuracy gap is larger - expected due to the complexity of the data set - but still manageable. However, AlexNet consistently shows poor results in all datasets with extremely low precision. This inconsistency suggests that weight regularization may overly constrain shallow architectures like AlexNet, hindering their ability to learn robust representations. This also implies that ATWR requires depth-dependent hyperparameter tuning.

Table~\ref{ATGR} presents the results for ATGR, where \textbf{Acc-clean} and \textbf{Acc-adv} values are nearly identical for each model, resulting in nearly zero \textbf{Acc-drop}. Although absolute accuracy is lower than with ATWR, this pattern suggests strong attack detectability due to conservative predictions. DenseNet121 is an exception, where clean accuracy is relatively high but robustness varies. \textbf{ATGR}'s behavior aligns with its design: suppressing the sensitivity of the input gradient encourages models that perform poorly on clean data but respond dramatically to adversarial perturbations, making them viable for detection purposes.

\begin{table*}[htp]
\centering
\caption{Classification accuracy (\%) under four white-box, untargeted attacks: FGSM, PGD, BIM, and C\&W, using Adversarial Training with Gradient Regularization (ATGR). The method prioritizes stability and detection; low adversarial accuracy reflects its conservative design. The accuracy drop (Acc-drop) is defined as the difference between the clean accuracy (Acc-origin) and the adversarial accuracy (Acc-adv).
}
\resizebox{16cm}{!}{
\begin{tabular}{|c|c|c|ccc|ccc|ccc|ccc|}
\hline
\multirow{2}{*}{\textbf{Dataset}}               & \multirow{2}{*}{\textbf{CNN model}} & \multirow{2}{*}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-origin\\ (Top-1)\end{tabular}}} & \multicolumn{3}{c|}{\textbf{FGSM}}                                                                                                                                                                           & \multicolumn{3}{c|}{\textbf{PGD}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{BIM}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{C\&W}}                                                                                                                                                                             \\ \cline{4-15} 
                                                &                                     &                                                                                        & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} \\ \hline
\multirow{6}{*}{MNIST}                          & ResNet50                            & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \cline{2-15} 
                                                & ResNet101                           & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \cline{2-15} 
                                                & AlexNet                             & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \cline{2-15} 
                                                & MobileNetV2                         & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \cline{2-15} 
                                                & DenseNet121                         & 100.00                                                                                 & \multicolumn{1}{c|}{98.12}                                                                     & \multicolumn{1}{c|}{23.12}                                                              & 75.00             & \multicolumn{1}{c|}{98.12}                                                                     & \multicolumn{1}{c|}{23.12}                                                              & 75.00             & \multicolumn{1}{c|}{98.12}                                                                     & \multicolumn{1}{c|}{23.12}                                                              & 75.00             & \multicolumn{1}{c|}{98.12}                                                                     & \multicolumn{1}{c|}{23.12}                                                              & 75.00             \\ \cline{2-15} 
                                                & InceptionNetV3                      & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \hline
\multirow{6}{*}{CIFAR10}                        & ResNet50                            & 93.13                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \cline{2-15} 
                                                & ResNet101                           & 95.63                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \cline{2-15} 
                                                & AlexNet                             & 89.06                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \cline{2-15} 
                                                & MobileNetV2                         & 92.19                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \cline{2-15} 
                                                & DenseNet121                         & 93.75                                                                                  & \multicolumn{1}{c|}{75.00}                                                                     & \multicolumn{1}{c|}{18.12}                                                              & 56.88             & \multicolumn{1}{c|}{75.00}                                                                     & \multicolumn{1}{c|}{75.00}                                                              & 0.00              & \multicolumn{1}{c|}{75.00}                                                                     & \multicolumn{1}{c|}{8.75}                                                               & 66.25             & \multicolumn{1}{c|}{75.00}                                                                     & \multicolumn{1}{c|}{25.31}                                                              & 49.69             \\ \cline{2-15} 
                                                & InceptionNetV3                      & 78.13                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{CIFAR100}} & ResNet50                            & 77.19                                                                                  & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & ResNet101                           & 84.69                                                                                  & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & AlexNet                             & 67.50                                                                                  & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & MobileNetV2                         & 80.94                                                                                  & \multicolumn{1}{c|}{0.00}                                                                      & \multicolumn{1}{c|}{0.00}                                                               & 0.00              & \multicolumn{1}{c|}{0.00}                                                                      & \multicolumn{1}{c|}{0.00}                                                               & 0.00              & \multicolumn{1}{c|}{0.00}                                                                      & \multicolumn{1}{c|}{0.00}                                                               & 0.00              & \multicolumn{1}{c|}{0.00}                                                                      & \multicolumn{1}{c|}{0.00}                                                               & 0.00              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & DenseNet121                         & 81.56                                                                                  & \multicolumn{1}{c|}{54.38}                                                                     & \multicolumn{1}{c|}{7.19}                                                               & 47.19             & \multicolumn{1}{c|}{54.38}                                                                     & \multicolumn{1}{c|}{54.38}                                                              & 0.00              & \multicolumn{1}{c|}{54.38}                                                                     & \multicolumn{1}{c|}{5.00}                                                               & 49.38             & \multicolumn{1}{c|}{54.38}                                                                     & \multicolumn{1}{c|}{12.50}                                                              & 41.88             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & InceptionNetV3                      & 79.69                                                                                  & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              \\ \hline
\end{tabular}
\label{ATGR}
}
\end{table*}

Finally, Table~\ref{EATR} shows that EATR provides a well-rounded improvement in robustness. For MNIST, it helps even AlexNet reach high adversarial accuracy. On CIFAR-10 and CIFAR-100, EATR improves robustness over all four attacks, although at a cost to clean accuracy. However, this trade-off remains preferable compared to ATWR in scenarios where robustness across various attacks is critical. For AlexNet, the accuracy drop under EATR is substantial, similar to ATGR, but can be leveraged for adversarial input identification.

These results collectively highlight that while ATWR is best for preserving clean accuracy under strong attacks, ATGR and EATR offer complementary benefits-either for detection (ATGR) or ensemble generalization (EATR).
 
\begin{table*}[htp]
\centering
\caption{Classification accuracy (\%) with Ensemble Adversarial Training and Regularization (EATR) under white-box, untargeted attacks: FGSM, PGD, BIM, and C\&W. EATR combines multiple attacks for improved generalization. \textit{Note:} In some cases (e.g., MobileNetV2 on MNIST), the adversarial accuracy slightly exceeds clean accuracy, resulting in a negative Acc-drop (The accuracy drop (Acc-drop) is defined as the difference between the clean accuracy (Acc-origin) and the adversarial accuracy (Acc-adv).). This is a valid outcome due to regularization and perturbation diversity acting as implicit data augmentation, leading to improved calibration under adversarial settings. }
\resizebox{17cm}{!}{
\begin{tabular}{|c|c|c|ccc|ccc|ccc|ccc|}
\hline
\multirow{2}{*}{\textbf{Dataset}}               & \multirow{2}{*}{\textbf{CNN model}} & \multirow{2}{*}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-origin\\ (Top-1)\end{tabular}}} & \multicolumn{3}{c|}{\textbf{FGSM}}                                                                                                                                                                           & \multicolumn{3}{c|}{\textbf{PGD}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{BIM}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{C\&W}}                                                                                                                                                                             \\ \cline{4-15} 
                                                &                                     &                                                                                        & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} \\ \hline
\multirow{6}{*}{MNIST}                          & ResNet50                            & 100.00                                                                                 & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{98.44}                                                              & 0.62              & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{99.06}                                                              & 0.00              & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0.31              & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{98.44}                                                              & 0.62              \\ \cline{2-15} 
                                                & ResNet101                           & 100.00                                                                                 & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{98.12}                                                              & 0.63              & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0.00              & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0                 & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{98.12}                                                              & 0.63              \\ \cline{2-15} 
                                                & AlexNet                             & 100.00                                                                                 & \multicolumn{1}{c|}{99.38}                                                                     & \multicolumn{1}{c|}{99.06}                                                              & 0.32              & \multicolumn{1}{c|}{99.38}                                                                     & \multicolumn{1}{c|}{99.38}                                                              & 0.00              & \multicolumn{1}{c|}{99.38}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0.63              & \multicolumn{1}{c|}{99.38}                                                                     & \multicolumn{1}{c|}{99.38}                                                              & 0.00              \\ \cline{2-15} 
                                                & MobileNetV2                         & 100.00                                                                                 & \multicolumn{1}{c|}{95.00}                                                                     & \multicolumn{1}{c|}{96.25}                                                              & -1.25             & \multicolumn{1}{c|}{95.00}                                                                     & \multicolumn{1}{c|}{95.00}                                                              & 0.00              & \multicolumn{1}{c|}{95.00}                                                                     & \multicolumn{1}{c|}{95.31}                                                              & -0.31             & \multicolumn{1}{c|}{95.00}                                                                     & \multicolumn{1}{c|}{94.38}                                                              & 0.62              \\ \cline{2-15} 
                                                & DenseNet121                         & 100.00                                                                                 & \multicolumn{1}{c|}{99.69}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0.94              & \multicolumn{1}{c|}{99.69}                                                                     & \multicolumn{1}{c|}{99.69}                                                              & 0.00              & \multicolumn{1}{c|}{99.69}                                                                     & \multicolumn{1}{c|}{99.38}                                                              & 0.31              & \multicolumn{1}{c|}{99.69}                                                                     & \multicolumn{1}{c|}{99.06}                                                              & 0.63              \\ \cline{2-15} 
                                                & InceptionNetV3                      & 100.00                                                                                 & \multicolumn{1}{c|}{97.50}                                                                     & \multicolumn{1}{c|}{96.88}                                                              & 0.62              & \multicolumn{1}{c|}{97.50}                                                                     & \multicolumn{1}{c|}{97.50}                                                              & 0.00              & \multicolumn{1}{c|}{97.50}                                                                     & \multicolumn{1}{c|}{97.19}                                                              & 0.31              & \multicolumn{1}{c|}{97.50}                                                                     & \multicolumn{1}{c|}{96.56}                                                              & 0.94              \\ \hline
\multirow{6}{*}{CIFAR10}                        & ResNet50                            & 93.13                                                                                  & \multicolumn{1}{c|}{83.75}                                                                     & \multicolumn{1}{c|}{41.56}                                                              & 42.19             & \multicolumn{1}{c|}{83.75}                                                                     & \multicolumn{1}{c|}{83.75}                                                              & 0.00              & \multicolumn{1}{c|}{83.75}                                                                     & \multicolumn{1}{c|}{21.25}                                                              & 62.50             & \multicolumn{1}{c|}{83.75}                                                                     & \multicolumn{1}{c|}{68.75}                                                              & 15.00             \\ \cline{2-15} 
                                                & ResNet101                           & 95.63                                                                                  & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{41.25}                                                              & 42.19             & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{83.44}                                                              & 0.00              & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{15.94}                                                              & 67.50             & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{65.94}                                                              & 17.50             \\ \cline{2-15} 
                                                & AlexNet                             & 89.06                                                                                  & \multicolumn{1}{c|}{\textbf{9.06}}                                                             & \multicolumn{1}{c|}{\textbf{9.06}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{9.06}}                                                             & \multicolumn{1}{c|}{\textbf{9.06}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{9.06}}                                                             & \multicolumn{1}{c|}{\textbf{9.06}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{9.06}}                                                             & \multicolumn{1}{c|}{\textbf{9.06}}                                                      & \textbf{0.00}     \\ \cline{2-15} 
                                                & MobileNetV2                         & 92.19                                                                                  & \multicolumn{1}{c|}{82.19}                                                                     & \multicolumn{1}{c|}{33.75}                                                              & 48.44             & \multicolumn{1}{c|}{82.19}                                                                     & \multicolumn{1}{c|}{82.19}                                                              & 0.00              & \multicolumn{1}{c|}{82.19}                                                                     & \multicolumn{1}{c|}{16.88}                                                              & 65.31             & \multicolumn{1}{c|}{82.19}                                                                     & \multicolumn{1}{c|}{62.81}                                                              & 19.38             \\ \cline{2-15} 
                                                & DenseNet121                         & 93.75                                                                                  & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{33.12}                                                              & 50.32             & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{83.44}                                                              & 0.00              & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{18.44}                                                              & 65.00             & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{65.62}                                                              & 17.82             \\ \cline{2-15} 
                                                & InceptionNetV3                      & 78.13                                                                                  & \multicolumn{1}{c|}{85.94}                                                                     & \multicolumn{1}{c|}{48.12}                                                              & 37.82             & \multicolumn{1}{c|}{85.94}                                                                     & \multicolumn{1}{c|}{85.94}                                                              & 0.00              & \multicolumn{1}{c|}{85.94}                                                                     & \multicolumn{1}{c|}{15.31}                                                              & 70.63             & \multicolumn{1}{c|}{85.94}                                                                     & \multicolumn{1}{c|}{58.12}                                                              & 27.82             \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{CIFAR100}} & ResNet50                            & 77.19                                                                                  & \multicolumn{1}{c|}{67.50}                                                                     & \multicolumn{1}{c|}{29.69}                                                              & 37.81             & \multicolumn{1}{c|}{67.50}                                                                     & \multicolumn{1}{c|}{67.50}                                                              & 0.00              & \multicolumn{1}{c|}{67.50}                                                                     & \multicolumn{1}{c|}{5.31}                                                               & 62.19             & \multicolumn{1}{c|}{67.50}                                                                     & \multicolumn{1}{c|}{45.94}                                                              & 21.56             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & ResNet101                           & 84.69                                                                                  & \multicolumn{1}{c|}{61.56}                                                                     & \multicolumn{1}{c|}{25.00}                                                              & 36.56             & \multicolumn{1}{c|}{61.56}                                                                     & \multicolumn{1}{c|}{61.56}                                                              & 0.00              & \multicolumn{1}{c|}{61.56}                                                                     & \multicolumn{1}{c|}{6.25}                                                               & 55.31             & \multicolumn{1}{c|}{61.56}                                                                     & \multicolumn{1}{c|}{41.25}                                                              & 20.31             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & AlexNet                             & 67.50                                                                                  & \multicolumn{1}{c|}{\textbf{0.94}}                                                             & \multicolumn{1}{c|}{\textbf{0.94}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{0.94}}                                                             & \multicolumn{1}{c|}{\textbf{0.94}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{0.94}}                                                             & \multicolumn{1}{c|}{\textbf{0.94}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{0.94}}                                                             & \multicolumn{1}{c|}{\textbf{0.94}}                                                      & \textbf{0.00}     \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & MobileNetV2                         & 80.94                                                                                  & \multicolumn{1}{c|}{43.75}                                                                     & \multicolumn{1}{c|}{15.00}                                                              & 28.75             & \multicolumn{1}{c|}{43.75}                                                                     & \multicolumn{1}{c|}{43.75}                                                              & 0.00              & \multicolumn{1}{c|}{43.75}                                                                     & \multicolumn{1}{c|}{9.69}                                                               & 34.06             & \multicolumn{1}{c|}{43.75}                                                                     & \multicolumn{1}{c|}{22.50}                                                              & 21.25             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & DenseNet121                         & 81.56                                                                                  & \multicolumn{1}{c|}{15.94}                                                                     & \multicolumn{1}{c|}{11.88}                                                              & 4.06              & \multicolumn{1}{c|}{15.94}                                                                     & \multicolumn{1}{c|}{15.94}                                                              & 0.00              & \multicolumn{1}{c|}{15.94}                                                                     & \multicolumn{1}{c|}{11.88}                                                              & 4.06              & \multicolumn{1}{c|}{15.94}                                                                     & \multicolumn{1}{c|}{8.12}                                                               & 7.82              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & InceptionNetV3                      & 79.69                                                                                  & \multicolumn{1}{c|}{47.50}                                                                     & \multicolumn{1}{c|}{17.81}                                                              & 29.69             & \multicolumn{1}{c|}{47.50}                                                                     & \multicolumn{1}{c|}{47.50}                                                              & 0.00              & \multicolumn{1}{c|}{47.50}                                                                     & \multicolumn{1}{c|}{15.62}                                                              & 31.88             & \multicolumn{1}{c|}{47.50}                                                                     & \multicolumn{1}{c|}{25.62}                                                              & 21.88             \\ \hline
\end{tabular}
\label{EATR}
}
\end{table*}

These experimental insights motivate a deeper analysis of defense effectiveness, which is further elaborated in the following section \ref{Discussion}.

\section{Discussion}
\label{Discussion}

This section provides a comparative analysis of the proposed defense strategies, ATWR, ATGR, and EATR, against baseline adversarial training and other state-of-the-art methods reviewed in Section~\ref{RelatedWork}. We highlight key performance trends, justify method-specific behaviors under different attacks, and discuss observed limitations and trade-offs.

\subsection{Comparison with Existing Methods}

Tables~\ref{tab:pgd_attack_comparison} and Table~\ref{tab:cw_attack_comparison} present a quantitative comparison between our proposed methods (ATWR, EATR) and the state-of-the-art adversarial defenses, including Standard Adversarial Training (SAT)~\cite{madry2018towards}, Defensive Distillation (DD)~\cite{papernot2016distillation}, and Combined Adversarial Training (CAT) \cite{zhang2019you}, across three datasets: MNIST, CIFAR-10, and CIFAR-100, all evaluated on ResNet50.

\textbf{Under PGD attack}:
\begin{itemize}
    \item In CIFAR-10, SAT achieves only robust accuracy 30\% (Acc-adv) with an Acc-drop of 63.13\%. CAT improves this to 45.00\% (Acc-drop 48.13\%), while DD remains ineffective at 18.00\%. In contrast, ATWR retains full clean accuracy (93.13\%) with \textbf{0\%} Acc-drop, and EATR achieves 83.75\% Acc-adv with only 9.38\% drop.
    \item In CIFAR-100, SAT and CAT reach 22.00\% and 30.00\% Acc-adv, respectively, while ATWR again achieves \textbf{0\%} Acc-drop, and EATR maintains 65.50\% Acc-adv and 11.69\% Acc-drop.
    \item In MNIST, ATWR and EATR reduce Acc-drop to \textbf{1.25\%} and \textbf{1.56\%}, respectively, compared to 60.00\% for SAT, 30.00\% for CAT, and 100\% for DD.
\end{itemize}

\textbf{Under C\&W attack}:
\begin{itemize}
    \item In CIFAR-10, SAT, DD, and CAT achieve 33.00\%, 19.00\%, and 47.00\% Acc-adv, respectively. ATWR achieves 91.50\% (Acc drop 1.63\%), and EATR achieves 87.00\% (Acc drop 6.13\%).
    \item In CIFAR-100, CAT achieves 32.00\% Acc-adv, while ATWR and EATR achieve 70.00\% and 64.80\%, respectively.
    \item In MNIST, both ATWR and EATR reduce the Acc-drop to near zero (1.25\% and 1.56\%) while maintaining full clean accuracy.
\end{itemize}

These results clearly highlight the effectiveness of our regularization-based methods. ATWR consistently achieves a minimal accuracy drop across all datasets and attacks. EATR, while slightly behind ATWR in robustness, provides stronger generalization across attack types and datasets. In general, both methods outperform traditional adversarial training, defensive distillation, and ensemble adversarial approaches in both robustness and stability.

\begin{table*}[htbp]
\centering
\caption{Comparison of defense methods under PGD attack on MNIST, CIFAR-10, and CIFAR-100 using ResNet50.}
\label{tab:pgd_attack_comparison}
\resizebox{14cm}{!}{
\label{tab:quant_comparison}
\begin{tabular}{|l|ccc|ccc|ccc|}
\hline
\multirow{2}{*}{\textbf{Defense Method}} & \multicolumn{3}{c|}{\textbf{MNIST}}                                                                                                                                                                                   & \multicolumn{3}{c|}{\textbf{CIFAR-10}}                                                                                                                                                                                & \multicolumn{3}{c|}{\textbf{CIFAR-100}}                                                                                                                                                                               \\ \cline{2-10} 
                                         & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-clean\\ (\%)\end{tabular}} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (\%)\end{tabular}} & \begin{tabular}[c]{@{}c@{}}Acc-drop\\ (\%)\end{tabular} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-clean\\ (\%)\end{tabular}} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (\%)\end{tabular}} & \begin{tabular}[c]{@{}c@{}}Acc-drop\\ (\%)\end{tabular} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-clean\\ (\%)\end{tabular}} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (\%)\end{tabular}} & \begin{tabular}[c]{@{}c@{}}Acc-drop\\ (\%)\end{tabular} \\ \hline
SAT \cite{madry2018towards}                                      & \multicolumn{1}{c|}{\multirow{5}{*}{100}}                                     & \multicolumn{1}{c|}{40.00}                                                  & 60.00                                                   & \multicolumn{1}{c|}{\multirow{5}{*}{93.13}}                                   & \multicolumn{1}{c|}{30.00}                                                  & 63.13                                                   & \multicolumn{1}{c|}{\multirow{5}{*}{77.19}}                                   & \multicolumn{1}{c|}{22.00}                                                  & 55.19                                                   \\ \cline{1-1} \cline{3-4} \cline{6-7} \cline{9-10} 
DD \cite{papernot2016distillation}                                      & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{0.00}                                                   & 100.00                                                  & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{18.00}                                                  & 75.13                                                   & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{12.00}                                                  & 65.19                                                   \\ \cline{1-1} \cline{3-4} \cline{6-7} \cline{9-10} 
CAT \cite{zhang2019you}                                      & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{70.00}                                                  & 30.00                                                   & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{45.00}                                                  & 48.13                                                   & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{30.00}                                                  & 47.19                                                   \\ \cline{1-1} \cline{3-4} \cline{6-7} \cline{9-10} 
\textbf{ATWR (Ours)}                     & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{98.75}}                                                  & \textbf{1.25}                                                    & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{93.13}}                                                  & \textbf{0.00}                                                    & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{77.19}}                                                  & \textbf{0.00}                                                    \\ \cline{1-1} \cline{3-4} \cline{6-7} \cline{9-10} 
\textbf{EATR (Ours)}                     & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{98.44}}                                                  & \textbf{1.56}                                                    & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{83.75}}                                                  & \textbf{9.38}                                                    & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{65.50}}                                                  & \textbf{11.69}                                                   \\ \hline
\end{tabular}
}
\end{table*}

\begin{table*}[htbp]
\centering
\caption{Comparison of defense methods under C\&W attack on MNIST, CIFAR-10, and CIFAR-100 using ResNet50.}
\label{tab:cw_attack_comparison}
\resizebox{14cm}{!}{
\begin{tabular}{|l|ccc|ccc|ccc|}
\hline
\multirow{2}{*}{\textbf{Defense Method}} & \multicolumn{3}{c|}{\textbf{MNIST}}                                                                                                                                                                                   & \multicolumn{3}{c|}{\textbf{CIFAR-10}}                                                                                                                                                                                & \multicolumn{3}{c|}{\textbf{CIFAR-100}}                                                                                                                                                                               \\ \cline{2-10} 
                                         & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-clean\\ (\%)\end{tabular}} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (\%)\end{tabular}} & \begin{tabular}[c]{@{}c@{}}Acc-drop\\ (\%)\end{tabular} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-clean\\ (\%)\end{tabular}} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (\%)\end{tabular}} & \begin{tabular}[c]{@{}c@{}}Acc-drop\\ (\%)\end{tabular} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-clean\\ (\%)\end{tabular}} & \multicolumn{1}{c|}{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (\%)\end{tabular}} & \begin{tabular}[c]{@{}c@{}}Acc-drop\\ (\%)\end{tabular} \\ \hline
SAT \cite{madry2018towards}                                      & \multicolumn{1}{c|}{\multirow{5}{*}{100}}                                     & \multicolumn{1}{c|}{40.00}                                                  & 60.00                                                   & \multicolumn{1}{c|}{\multirow{5}{*}{93.13}}                                   & \multicolumn{1}{c|}{33.00}                                                  & 60.13                                                   & \multicolumn{1}{c|}{\multirow{5}{*}{77.19}}                                   & \multicolumn{1}{c|}{24.00}                                                  & 53.19                                                   \\ \cline{1-1} \cline{3-4} \cline{6-7} \cline{9-10} 
DD \cite{papernot2016distillation}                                       & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{0.00}                                                   & 100.00                                                  & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{19.00}                                                  & 74.13                                                   & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{13.00}                                                  & 64.19                                                   \\ \cline{1-1} \cline{3-4} \cline{6-7} \cline{9-10} 
CAT  \cite{zhang2019you}                                      & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{70.00}                                                  & 30.00                                                   & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{47.00}                                                  & 46.13                                                   & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{32.00}                                                  & 45.19                                                   \\ \cline{1-1} \cline{3-4} \cline{6-7} \cline{9-10} 
\textbf{ATWR (Ours)}                     & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{98.75}}                                                  & \textbf{1.25}                                                    & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{91.50}}                                                  & \textbf{1.63}                                                    & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{70.00}}                                                  & \textbf{7.19}                                                    \\ \cline{1-1} \cline{3-4} \cline{6-7} \cline{9-10} 
\textbf{EATR (Ours)}                     & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{98.44}}                                                  & \textbf{1.56 }                                                   & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{87.00}}                                                  & \textbf{6.13}                                                    & \multicolumn{1}{c|}{}                                                         & \multicolumn{1}{c|}{\textbf{64.80}}                                                  & \textbf{12.39}                                                   \\ \hline
\end{tabular}
}
\end{table*}


\subsection{Method-Specific Behaviors}

\textbf{ATWR} achieves the best balance of robustness and clean accuracy. Its superior performance on PGD and C\&W can be attributed to the inclusion of weight regularization, which prevents overfitting to adversarial samples and promotes smoother decision boundaries. This is especially effective on datasets like CIFAR-10 and MNIST, where perturbations are subtle.

\textbf{ATGR} performs conservatively by design. Gradient regularization penalizes sharp gradients in the loss landscape, resulting in models that are more stable but also more underfitted. Consequently, ATGR exhibits lower clean and adversarial accuracy (e.g., constant 13.44\% on MNIST), but this behavior enhances its potential as an adversarial detector rather than a conventional classifier.

\textbf{EATR} combines the strengths of both approaches. By training on adversarial samples from multiple attacks (FGSM, BIM, PGD, and C\&W), EATR generalizes well across attack types. It matches the robustness of ATWR (for example, 0\% Acc-drop in CIFAR-10 under PGD) while improving the robustness against simpler attacks such as FGSM and BIM, where ATWR sometimes performs poorly.

\textbf{Trade-offs and Observations Across Architectures:} Across the experiments, we observe that different network architectures respond differently to the applied regularization strategies. For example, weight regularization (ATWR) performs consistently well on deeper architectures such as ResNet101 and DenseNet121, promoting robustness while maintaining clean accuracy. However, for shallower or lightweight models such as AlexNet or MobileNetV2, strong regularization can hinder the model's ability to learn effectively, leading to performance degradation. In contrast, gradient regularization (ATGR) tends to over-constrain all models uniformly, leading to extremely conservative outputs that, while useful for adversarial detection, are suboptimal for general classification. These findings emphasize the importance of architecture-specific tuning of regularization parameters.


\subsection{Observed Limitations}

A notable limitation arises with the AlexNet model, where all three defense methods fail to maintain high clean accuracy. For example, under ATWR, AlexNet's clean accuracy on MNIST drops from 100\% to 13.44\%. This suggests that regularization strength may need model-specific tuning and that shallow architectures like AlexNet lack the capacity to learn simultaneously from clean and adversarial examples under strong constraints.

\subsection{Generalization vs. Robustness Trade-Off}

Our experiments confirm the known trade-off between clean accuracy (generalization) and adversarial robustness (Acc-adv)~\cite{tsipras2019robustness}. ATWR and EATR offer high robustness with minimal loss in clean accuracy on deeper models (e.g., ResNet101, DenseNet121). In contrast, ATGR heavily sacrifices clean accuracy in exchange for stability, which can be advantageous for adversarial detection but not for standard classification.

These results indicate that robustness and generalization can be simultaneously improved with proper regularization and ensemble strategies, but optimal results depend on architecture depth, attack strength, and dataset complexity.

Interestingly, on simpler datasets such as MNIST, we observe that adversarial accuracy can occasionally exceed clean accuracy, particularly under the EATR framework. This leads to negative Acc-drop values (for example, - 1.25\%), which may seem counterintuitive, but are valid in our setting. We attribute this to the regularization and perturbation diversity in EATR acting as a form of implicit data augmentation. As a result, the model becomes better calibrated under perturbed conditions, sometimes generalizing slightly better than on unperturbed inputs. This behavior has been verified across multiple runs and aligns with recent findings on robustness-generalization synergy in overregularized regimes.



\section{Conclusion and future work}
\label{Conclusion}

This work underscores the vulnerability of widely used deep image classifiers to adversarial attacks such as FGSM, PGD, BIM, and C\&W. To address these challenges, we propose three defense strategies: ATWR, ATGR, and EATR that offer distinct advantages in enhancing model robustness. ATWR and EATR effectively improve resilience against strong optimization-based attacks (e.g., PGD, C\&W) while maintaining a favorable trade-off with clean accuracy. In contrast, ATGR introduces a complementary perspective by transforming standard classifiers into effective adversarial detectors. These findings highlight the critical role of tailored regularization in adversarial training and the broader need for robust defense mechanisms to secure deep learning systems in real-world deployments. In future work, we plan to evaluate the transferability of adversarial attacks across CNN architectures and extend the analysis to vision transformers, paving the way for stronger and more adaptable adversarial defenses.

\appendix
\section*{Appendix: Pseudocode for Regularized Adversarial Training}


\begin{algorithm}[h]
\caption{Training with ATWR / ATGR / EATR}
\label{alg:train}
\KwIn{Training set $\mathcal{D}$, pre-trained model $f_{\theta}$, loss function $\mathcal{L}$, regularization type, attack methods}
\KwOut{Fine-tuned model parameters $\theta$}

Initialize model parameters $\theta$ using pre-trained weights (fine-tuned on $\mathcal{D}$)\\
\For{each epoch}{
  \For{each mini-batch $\{(x_i, y_i)\}_{i=1}^{B}$ in $\mathcal{D}$}{
    Generate adversarial examples $\tilde{x}_i$ using selected attack(s) (on-the-fly)\\
    Form mini-batch $B_{\text{clean}} = \{x_i\}$ and $B_{\text{adv}} = \{\tilde{x}_i\}$\\
    Mix batch: $B_{\text{mix}} = B_{\text{clean}} \cup B_{\text{adv}}$\\
    Compute $\mathcal{L}_{\text{clean}}$ and $\mathcal{L}_{\text{adv}}$\\

    \eIf{ATWR}{
      $\mathcal{L}_{\text{total}} = \mathcal{L}_{\text{clean}} + \lambda_1 \mathcal{L}_{\text{adv}} + \lambda_2 \|W\|^2$
    }{
      \eIf{ATGR}{
        $\mathcal{L}_{\text{total}} = \mathcal{L}_{\text{clean}} + \beta_1 \mathcal{L}_{\text{adv}} + \beta_2 \|\nabla_x \mathcal{L}_{\text{adv}}\|^2$
      }{
        \textbf{EATR}: Use multiple $\mathcal{L}^{\text{attack}}_{\text{adv}}$ terms and apply ensemble aggregation
      }
    }

    Backpropagate and update $\theta$ using optimizer
  }
}
\Return $\theta$
\end{algorithm}


% \subsection*{A.2 Training Pipeline Diagram}

% \begin{figure*}
% \centering
% \begin{tikzpicture}[node distance=0.8cm and 1.4cm, >=latex, align=center, every node/.style={font=\small}]

% % Nodes
% \node (input) [draw, rectangle, minimum width=2.5cm, minimum height=1cm] {Input mini-batch $\{(x_i, y_i)\}$};

% \node (advgen) [draw, rectangle, below=of input] {Generate adversarial examples \\
% ($\tilde{x}_i$ using FGSM/PGD/BIM/C\&W)};

% \node (combine) [draw, rectangle, below=of advgen] {Form mixed batch \\
% (50\% clean + 50\% adv)};

% \node (forward) [draw, rectangle, below=of combine] {Forward pass: compute \\
% $\mathcal{L}_{\text{clean}}, \mathcal{L}_{\text{adv}}$};

% \node (regcase) [draw, diamond, aspect=2, below=of forward] {Regularization Type};

% \node (eatr) [draw, rectangle, below left=0.3cm and 1.9cm of regcase] {EATR \\
% Ensemble loss from \\
% FGSM, PGD, BIM, C\&W};

% \node (atwr) [draw, rectangle, below right=0.3cm and 1.9cm of regcase] {ATWR \\
% $\mathcal{L} = \mathcal{L}_{\text{clean}} + \lambda_1 \mathcal{L}_{\text{adv}} + \lambda_2 \|W\|^2$};

% \node (atgr) [draw, rectangle, below=2.6cm of regcase] {ATGR \\
% $\mathcal{L} = \mathcal{L}_{\text{clean}} + \beta_1 \mathcal{L}_{\text{adv}} + \beta_2 \|\nabla_x \mathcal{L}_{\text{adv}}\|^2$};

% \node (update) [draw, rectangle, below=of atgr] {Backpropagation \\
% and model update};

% % Arrows
% \draw[->] (input) -- (advgen);
% \draw[->] (advgen) -- (combine);
% \draw[->] (combine) -- (forward);
% \draw[->] (forward) -- (regcase);
% \draw[->] (regcase) -- (eatr);
% \draw[->] (regcase) -- (atwr);
% \draw[->] (regcase) -- (atgr);
% \draw[->] (eatr) |- (update);
% \draw[->] (atwr) |- (update);
% \draw[->] (atgr) -- (update);

% \end{tikzpicture}
% \caption{Training pipeline for ATWR, ATGR, and EATR. Adversarial examples are generated on-the-fly, combined with clean samples, and processed according to the selected regularization strategy.}
% \label{fig:pipeline_tikz}
% \end{figure*}


% \subsection*{Acknowledgement}
% Acknowledgement text.

% bibliography style is not predefined; authors can apply their own,
% but it should be sent to matjaz.gams@ijs.si with the accepted paper
% \sloppy  % Allow LaTeX to be more lenient with line breaks

\printbibliography
% \bibliographystyle{IEEEtran}
%  \bibliography{sample.bib}
%\bibliography{ref.bib}
% \begin{thebibliography}{99}
%   % book
%   \bibitem{} Author (year) {\it Title of the book}, Publisher.
%   % journal paper
%   \bibitem{} Author (year) Title of the paper, {\it Title of the journal}, Publisher, pp. nn--mm.
%   % conference
%   \bibitem{} Author (year) Title of the paper, {\it Title of the proceedings}, Publisher, Location, pp. nn--mm.
% \end{thebibliography}
\end{document}