Results of the three different types of neural networks: a three-layer convolutional network running on the MNIST dataset, a four-layer convolutional network on the CIFAR-10 dataset and a residual network [46] with eight convolutional layers on the CIFAR-10 dataset. The term ‘feature’ in the labels represents the results obtained by attacking the features of the input images, while ‘pixel’ corresponds to attacks directed at the pixels themselves. Each neural network underwent training for a span of 50 epochs. The quantities Δx and Δp were determined through high-dimensional Monte Carlo integrations. Subfigures (a), (c), (e), (g), (i) and (k) depict the test and robust accuracy metrics, with the robust accuracy evaluated on images perturbed by the PDG adversarial attack method, using parameters ϵ = 8/255 and α = 2/255 across four iterative steps. Subfigures (b), (d), (f), (h), (j) and (l) illustrate the trade-off relationship between Δx and Δp.