Abstract Deep neural networks (DNNs) remain vulnerable to adversarial examples, particularly to iterative white-box attacks such as Projected Gradient Descent (PGD). This study evaluates PGD adversarial training using a ResNet-18-inspired architecture adapted for single-channel 28 × 28 inputs. The architectural configuration replaces the conventional max-pooling stage with an identity mapping to preserve spatial information and retains residual connections throughout the feature extractor.
