\documentclass[a4paper,10.80pt,twoside]{article}
\def\UrlBreaks{\do\/\do-} 
% \usepackage{cite}
% \documentclass[twocolumn]{IEEEtran}  
\usepackage[style=ieee, backend=biber, url=false, doi=true, breaklinks=true]{biblatex} 

\addbibresource{ref.bib}  % Path to your .bib file with references


\usepackage[vietnamese,english]{babel}
\usepackage{informat}
\usepackage{epsfig}
\usepackage{xcolor}
\usepackage[utf8]{inputenc}
\usepackage{newunicodechar}
\usepackage{amssymb}
\usepackage{amsmath}
\usepackage{multirow}
\usepackage{hyperref}

\usepackage{url}
\usepackage[hyphenbreaks]{breakurl}

%\usepackage{natbib}


%\usepackage{fontspec}
%\setmainfont{Times New Roman}

\begin{document}
%\setcounter{page}{555}

  \title{Experimental study of adversarial attack and defense on deep CNN image classifiers}
   \author{Thi Thanh Thuy Pham \\
      Faculty of Cybersecurity and High Tech Crime Prevention - Academy of People Security\\
      No. 125 - Tran Phu - Ha Dong - Ha Noi - Viet Nam \\
      International Research Institute MICA - Hanoi University of Science and Technology\\
      No. 1 - Dai Co Viet - Hai Ba Trung - Ha Noi - Viet Nam \\      
      thanh-thuy.pham@mica.edu.vn \\
      \AndAuthor Bao-Chau Ho \\
      School of Information and Communication Technology - Hanoi University of Science and Technology\\
      No. 1 - Dai Co Viet - Hai Ba Trung - Ha Noi - Viet Nam \\
      baochaudoanho.hust@gmail.com \\
      \AndAuthor Huong-Giang Doan (Corresponding author) \\
      Faculty of Control and Automation - Electric Power University\\
      No. 235 - Hoang Quoc Viet - Bac Tu Liem - Ha Noi - Viet Nam\\
      giangdth@epu.edu.vn}
  \titleodd{Evaluation of Large-scale Pre-training models \ldots}
  \authoreven{Thi Thanh Thuy Pham et al.}
  \keywords{Adversarial Attack, Adversarial Training, Regularization Function, Image Classifier, Convolution Neural Network}
  \received{January 02, 2025}

  \abstract{Adversarial attacks reveal vulnerabilities in machine learning systems that threaten the security and reliability of critical applications. Although these attacks are well documented, their specific impact on deep CNN image classifiers remains underexplored. This study evaluates the robustness of widely used deep CNN image classifiers against common adversarial attacks such as FGSM, PGD, BIM, and C\&W. The extensive experiments implemented with standard datasets show that these models are more severely affected by PGD and C\&W attacks. The perturbed images generated by these attacks not only deceive the deep CNN image classifiers but are also difficult for human vision to distinguish from the original images. In order to strengthen the models against these attacks, we propose three novel defense techniques: ATWR (Adversarial Training with Weight Regularization), ATGR (Adversarial Training with Gradient Regularization), and EATR (Ensemble Adversarial Training with Regularization). Unlike other adversarial training-based defense methods, in addition to training the models on a mixture of clean and adversarial samples, we also integrate regularization techniques into the training steps. This allows ATWR and EATR to effectively defend against PGD and C\&W attacks while maintaining a balance between robustness and generalization. In contrast, ATGR adopts a more conservative strategy, improving attack detection but reducing performance on both clean and adversarial examples. The source codes are available at: \href{https://github.com/BaoChau-Ho/defense_and_attack}
{https://github.com/AdversarialAttack/DefenseAndAttack}
  
  
  %https://github.com/BaoChau-Ho/defense\_and\_attack.
  } 
  
  % \abstractSi{}.

  \maketitle

\section{Introduction}
\label{Intro}

Convolutional Neural Networks (CNNs) have achieved significant success in image classification tasks. However, these models are highly susceptible to adversarial attacks: tiny, often imperceptible alterations to input images that can drastically alter a model’s predictions without being noticeable to human observers \cite{weng2024comparative}, \cite{ sen2023adversarial}, \cite{ ghaffari2022adversarial}, \cite{hirano2021universal}. This vulnerability poses serious security risks for real-world AI applications that rely on image classifiers, such as autonomous vehicles, medical imaging, and surveillance systems. 

Several adversarial attack techniques have been proposed to exploit the vulnerabilities of deep image classifiers. Based on the attacker's knowledge of the target model, there are two types of adversarial attack strategies: black-box or white-box attacks. In a white-box scenario, the attacker has knowledge of the model architecture, the model parameters, the loss function, and the model gradients. With this information, attackers can generate adversarial examples to fool target models \cite{su2019one}, \cite{madry2017towards}, \cite{moosavi2016deepfool}, \cite{carlini2017towards}. In black-box adversarial attacks, the attacker does not have access to the model's architecture, parameters, or gradients. Instead, they can only interact with the model by submitting input samples and observing the outputs (predictions) of the target model \cite{chen2020hopskipjumpattack}, \cite{andriushchenko2020square}. According to the approach used to generate adversarial examples, we have two types of adversarial attacks based on gradients, such as the Fast Gradient Sign Method (FGSM) \cite{goodfellow2014explaining}, Project Gradient Descent (PGD) \cite{mkadry2017towards} and Basic Iterative Method (BIM) \cite{kurakin2018adversarial} and based on optimization like Carlini \& Wagner (C\&W) \cite{carlini2017towards} or DeepFool \cite{moosavi2016deepfool}. Unlike gradient-based methods, which update the input based on a gradient in a single step, optimization-based methods iteratively adjust the input to find the minimal perturbation that causes the model to misclassify the input image. Compared with gradient-based adversarial attacks,  optimization-based attacks are more sophisticated and computationally expensive but are often more effective, especially in black-box settings. 

In order to mitigate the impact of adversarial attacks on machine learning models and enhance their robustness, various defense strategies have been developed. The popular recommended defense methods include Adversarial Training \cite{ zhang2019defense}, \cite{chen2020towards}, \cite{jiang2023towards}, Gradient Masking \cite{papernot2016limitations}, \cite{wang2021fighting}, Defensive Distillation \cite{sen2023adversarial}, \cite{papernot2016distillation}, \cite{sen2024fgsm}. Adversarial training is a robust defense solution against adversarial perturbations, particularly against white-box attacks. By training on both clean and adversarial examples, adversarial training directly improves the model's ability to resist attacks. However, adversarial training can be vulnerable to more sophisticated attacks that were not included during training, such as adaptive attacks \cite{shafahi2019adversarial}. Overfitting is also a security risk for the adversarial training method. The model may be overfitted to adversarial examples in the training set, potentially reducing its generalizability \cite{miyato2016adversarial}. In addition, this defense solution has limited transferability. The robustness achieved through adversarial training might not transfer to other models or even different adversarial attacks \cite{zhang2019limitations}, \cite{shafahi2019adversarially}. Gradient masking techniques are often easy to implement by obfuscating the gradients. However, this method is ineffective against strong attacks like boundary attack or zeroth order optimization. They can make the model vulnerable to indirect or black-box attacks.  Once an adversarial attack is designed to overcome gradient masking, the defense becomes ineffective \cite{athalye2018obfuscated}, \cite{liu2018zeroth}. In the defensive distillation method, a two-step training process is implemented. First, a large, standard neural network (called the teacher model) is trained in the usual way using clean data, then a new student model is created and trained on the softened probabilities produced by the teacher model. This aims at reducing the model's sensitivity to small perturbations in the input data. The defensive distillation method has the drawbacks: It is ineffective against strong attacks like C\&W; often leads to gradient masking; vulnerable to transfer attacks; and increased complexity in training \cite{papernot2016distillation}, \cite{ilyas2019adversarial}.

This research examines the vulnerabilities of popular deep CNN image classifiers and proposes practical defense methods. Despite their widespread use, research on adversarial attacks and defenses remains limited. We analyze well-known white-box attacks—FGSM, PGD, BIM, and C\&W—on popular deep CNN models like ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3. Our experiments on widely used datasets (MNIST, CIFAR-10, CIFAR-100, and ImageNet) provide valuable insights for both research and practical applications. The main contributions of our research are as follows:
\begin{itemize}
    \item We conducted extensive experiments on several standard datasets to evaluate the vulnerabilities of deep CNN image classifiers. Through these, we found that these models are more severely affected by PGD and C\&W than other attacks. The perturbed images created by these attacks not only mislead the deep CNN image classifiers but are also challenging for the human eye to differentiate from the original images. This is crucial to develop robust defense solutions for deep CNN image classifiers against these powerful attacks. 
    
    \item We propose three novel defense methods against adversarial attacks: ATWR (Adversarial Training with Weight Regularization), ATGR (Adversarial Training with Gradient Regularization) and EATR (Ensemble Adversarial Training with Regularization). Unlike other adversarial training-based defense methods, in addition to training the models on a mixture of clean and adversarial samples, we integrate regularization techniques into the training process. Through extensive experiments on standard datasets, we demonstrate that ATWR and EATR not only provide strong defense against powerful attacks like PGD and C\&W but also strike a balance between robustness and generalization. In contrast, ATGR adopts a more conservative strategy, reducing performance on both clean and adversarial examples, but improving adversarial attack detection. 
\end{itemize}

The remainder of this paper is structured as follows: Section 2 provides a brief overview of related works. Section 3 presents the analysis of adversarial attacks on deep image classifiers. In Section 4, we examine the proposed defense solutions based on regularized adversarial training. Section 5 outlines the experimental evaluations of adversarial attacks and defenses. Finally, Section 6 concludes the paper and discusses potential directions for future research.

\section{Related work}
\label{related}


% \cite{martins2020adversarial}
In this section, related work on popular adversarial attacks and adversarial training defense solutions is discussed. 

\subsection{Adversarial attacks}

Adversarial attacks have been extensively studied for their ability to reveal vulnerabilities in machine learning models, particularly deep neural networks. The work \cite{goodfellow2014explaining} is widely recognized as the foundational work for adversarial attacks. In this work, FGSM was introduced as a method to generate adversarial examples by gradient of the model loss function. The extension versions of FGSM named PGD \cite{mkadry2017towards} and BIM \cite{kurakin2018adversarial} are then proposed. PGD and BIM are designed to generate adversarial examples by applying gradient-based updates to the input image. Although they share similarities, there are key differences in how the perturbations are generated and applied. PGD is a more powerful and robust attack, while BIM is a simpler and faster attack with fewer iterations and slightly weaker performance. One of the most effective and well-known optimization-based adversarial attack methods is C\&W attack, which was introduced in \cite{carlini2017towards}.  Unlike gradient-based methods such as FGSM, BIM, or PGD, the C\&W attack formulates the generation of adversarial examples as an optimization problem. This approach minimizes the perturbation needed to make the network misclassify the input, while also ensuring that the perturbation remains within a desired norm. This attack is known to be highly effective against various defenses, including adversarial training.

The common feature of the above-mentioned attacks is that the attacker can compute gradients with respect to the model's input and use this information to generate adversarial examples. This shows the scenario of white-box adversarial attacks. In a black-box attack, the attacker has no direct access to the model's internal structure or gradients. However, the attacker can still query the target model and receive outputs (predictions), which are used to infer information about the model and craft adversarial examples \cite{chen2017zoo}, \cite{shi2022query}. Another approach of black-box adversarial attacks is attacking a surrogate model and using the adversarial examples that are created by this model on a target model. This type of attack is called a transfer attack \cite{papernot2016transferability}, \cite{mkadry2017towards} which is one of the key vulnerabilities in deep learning models and has significant implications for model security and robustness.

In this work, we explore the white-box attacks of FGSM, BIM, PGD, and C\&W on the popular deep image classification models of ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3.  


\subsection{Adversarial training defense solutions}

Adversarial training is one of the most effective and well-known defense methods against adversarial attacks on DNNs. In \cite{goodfellow2014explaining}, the authors suggested a standard adversarial training defense to mitigate the impact of adversarial samples from FGSM attack on a logistic regression model and deep RBF networks. Although adversarial training can improve robustness, the paper highlights that adversarial examples remain a significant challenge for DNNs. Training with adversarial examples improves robustness to perturbations similar to those used in the training process but may not generalize well to unseen types of adversarial attacks. The work in \cite{mkadry2017towards} presents an adversarial training framework that uses PGD for robust training. This work formalized adversarial training and showed its importance in making models more resilient to adversarial perturbations. The experiments were carried out on the MNIST dataset with a simple CNN model and the CIFAR10 dataset with a basic RestNet architecture \cite{he2016deep}. In \cite{tramer2017ensemble} the Combined Adversarial Training (CAT) approach is introduced as a novel defense mechanism against adversarial attacks. This method involves training a model using adversarial examples that are generated by an ensemble of models, rather than just a single model. The paper provides empirical evidence showing that models trained with adversarial examples generated by an ensemble of models perform better in terms of defense against various state-of-the-art attack methods, including FGSM, PGD, and C\&W attacks. In addition, CAT is also a stronger defense against transfer attacks. Extensive experiments were conducted on the CIFAR-10 and ImageNet datasets with static pre-trained models of Inceptionv3, ResNet50. The adversarial samples crafted from these will then be transferred to three different holdout models of Inceptionv4, ResNet50, and ResNet101. The experiments show that combined adversarial training outperforms single-model adversarial training in terms of robustness, achieving higher accuracy on both clean and adversarially perturbed test examples. The experiments also include comparisons with other defense methods, such as standard adversarial training, and demonstrate that combined adversarial training offers superior protection against strong attacks.

In this work, we approach the defense solution of regularized adversarial training. Regularization techniques such as weight regularization and gradient regularization are integrated into the adversarial training phase to generate efficient defense strategies for deep image classifiers. In addition, we propose an ensemble adversarial training with regularization. This combines the strengths of multiple adversarial attack strategies and regularization techniques to build a more robust and generalized model capable of handling a variety of adversarial threats.

\section{Adversarial attack on deep image classifier}
\label{Background}

Consider an original image that is flattened into a vector $\textbf{x}\in \mathcal{R}^{n}$, where $n$ is the total number of pixels across all channels: $\textbf{x}=\left\{ x_{1}, x_{2},.., x_{n}  \right\}$, $x_{i}\in \mathcal{R}$ corresponds to the pixel value at the position $i_{th}$ in the flattened image vector. The function $f\left( x \right)$ is the image classification model, and it outputs a logit vector, from which we can derive the predicted class label for the input image $\textbf{x}$ is $\hat{y} \in \left\{ 0, 1, ..,C \right\}$, $C$ is the number of classes. 
 
An adversarial example is a perturbed image $\tilde{\textbf{x}}$, such that $\tilde{\textbf{x}} = \textbf{x} + \eta$, where $\eta$ is a small perturbation added to the original image $\textbf{x}$. The goal of an adversarial attack is to find a perturbation $\eta$ that maximizes the probability of misclassification, that is, the attack should cause the model to predict the wrong class while keeping the perturbation $\eta$ small.

Let $\hat{y}'$ be the predicted class label for the perturbed image $\tilde{\textbf{x}}= \textbf{x} + \eta$. The adversarial attack attempts to minimize the accuracy of the model in the perturbed image by maximizing the difference between the predicted class of the adversarial image $\hat{y}'$ and the true class label $y$. The goal is to find $\eta$ such that:
\begin{itemize}
    \item $\hat{y}'\neq y$ and $\left\| \eta \right\|$ is small. The constraint $\hat{y}'\neq y$ shows the case of an untargeted adversarial attack, in which the output of a classifier $f\left( \textbf{x} +\eta \right)$ is any class other than the true class $y$ of the input image $\textbf{x}$;
    \item Or $\hat{y}'= y_{t}$ and $\left\| \eta \right\|$ is small. $\hat{y}'= y_{t}$ shows the case of a targeted adversarial attack, in which the output of a classifier $f\left( \textbf{x} +\eta \right)$ is a specific target class $y_{t}$ other than the true class $y$ of the input image $\textbf{x}$.
\end{itemize}

This can be expressed as the following optimization problem:
\begin{equation}
    \underset{\eta}{\text{max}}\:\mathcal{L}\left( f_{\theta}\left( \textbf{x}+\eta \right),y \right) \: \:\: subject \:\: to \:\: \left\| \eta  \right\| \le \epsilon \: \:\: :\text{untargeted attack}
\end{equation}
or
\begin{equation}
    \underset{\eta}{\text{max}}\:\mathcal{L}\left( f_{\theta}\left( \textbf{x}+\eta \right),y_{t} \right) \: \:\: subject \:\: to \:\: \left\| \eta  \right\| \le \epsilon \: \:\: :\text{targeted attack}
\end{equation}

Where $\mathcal{L}\left( f_{\theta}\left( \textbf{x}+\eta \right),y \right)$ is a loss function that measures the difference between the predicted class $\hat{y}'$ and the true label $y$; $\theta$ is the model parameters. In deep image classification models, the loss function is often chosen as the cross-entropy loss.
% \begin{equation}
%     \mathcal{L}\left( f\left( x+\eta \right),y \right)=-\text{log}\left( p_{y} \right)=-\text{log}\left( \frac{e^{z_{y}}}{\sum_{j=1}^{k}e^{z_{j}}} \right)
% \end{equation}
% where $p_{y}$ is the probability assigned to the true class $y$ after applying softmax to the logits. $\left\| \eta  \right\| \le \epsilon$ is a constraint that ensures that the perturbation $\eta$ is small and imperceptible, and $\epsilon$ controls the maximum perturbation allowed.

% The perturbation $\eta = \left\{ \eta_{1}, \eta_{2},.., \eta_{n} \right\}$ where each $\eta_{i}$ represents the perturbation applied to the pixel $x_{i}$.
% The perturbed image $\tilde{\textbf{x}} = \textbf{x}+\eta$ and its corresponding logits are $\tilde{y}_{j}=f_{j}\left( x+\eta \right)$ for each class $j$.

% The problem of adversarial attack on the image classification neural network is to perturb an image $\textbf{x}$ so that the output of a classifier $f\left( \textbf{x}+\eta \right)$ is misclassified, but the perturbation is as small as possible to be imperceptible to human vision. Misclassification is divided into two cases: (1) untargeted adversarial attack in which the output of a classifier $f\left( \textbf{x} +\eta \right)$ is any class other than the original class of the input image $\textbf{x}$: $\tilde{\textbf{y}}_{j}\neq \textbf{y}_{j}$; and (2) targeted adversarial attack in which the output of a classifier $f\left( \textbf{x} +\eta \right)$ is a specific target class other than the correct class of the input image $\textbf{x}$: $\tilde{y}_{j} = y_{t}$, with $y_{t}$ the score for class $t$ and $t\neq j$.

The optimization problem mentioned above can be solved in two main approaches of gradient-based and optimization-based methods. 

\subsection{Gradient-based adversarial attack}

In the gradient-based solution, $x_{i}$ is changed in the direction of the steepest gradient to decrease the classification probability of $\textbf{x}$ becoming $C$ with negligible visual changes. FGSM is a simple gradient-based method with $\eta$ proposed to be:

\begin{equation}
    \eta=\epsilon \cdot sign(\nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y \right)) \\
\end{equation}
where $\nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x}\right),y \right) =\left( \frac{\\ \partial \mathcal{L}}{\partial x_{1}}, ..,\frac{\partial \mathcal{L}}{\partial x_{n}} \right)$, $y$ is the ground truth label, and 

$sign(\nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x}\right),y \right))=\left\{ 
  \begin{array}{ c l } -1 & \quad \textrm{if }  \nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x}\right),y \right)  < 0\\
    0    & \quad  \textrm{if }      \nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y \right)  = 0 \\
    1                & \quad  \textrm{if }       \nabla _{x\textbf{}}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y \right)  > 0
    
  \end{array}
\right.$

The perturbation noise $\eta$ is then added to the original input $\textbf{x}$ to make sure it does not differ by more than $\epsilon$ and this helps to push the model's prediction towards an incorrect classification:

\begin{equation}
    \tilde{\textbf{x}} = \textbf{x} + \eta = \textbf{x}+\epsilon \cdot sign\left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y \right) \right)
    \label{UntargetFGSM}
\end{equation}

Equation.(\ref{UntargetFGSM}) shows the case of an untargeted FGSM attack. For the targeted FGSM (T-FGSM), the sample $\textbf{x}$ will be misclassified as a specific label rather than just a mislabel. Therefore, the loss function $\mathcal{L}$ can be calculated with respect to the target label $y_{t}$ instead of $y$: 
\begin{equation}
    \tilde{\textbf{x}}=\textbf{x}+\epsilon \cdot sign\left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( \textbf{x} \right),y_{t} \right) \right)
\end{equation}

Other extensions of the FGSM method are BIM and PGD attacks. BIM applies FGSM repeatedly to an image with step size $\alpha$ presenting the change in pixel value per iteration. The resulting adversary image then be clipped to limit the maximum perturbance for each pixel:

\begin{equation}
    \tilde{\textbf{x}}^{N+1}=\textbf{Clip}_{\left[ 0,1 \right]}\left\{ \tilde{\textbf{x}}^{N} + \alpha \cdot sign\left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( \tilde{\textbf{x}}^{N} \right),y \right) \right)  \right\}
    \label{BIM}
\end{equation}
where $N$ is the number of iterations and original pixels $x_{i}$ is used for initialization in iteration N=0: $\tilde{\textbf{x}}^{0}=\textbf{x}$.

PGD attack method is quite similar to the BIM attack, but includes a few differences. PGD starts not at the original image, but at a random point to ensure that the perturbation remains within $\epsilon-ball$ ($l_{\infty}$ and $l_{2}$). This avoids the loss function gradient approaching zero, and the gradient ascent will not change at all. PGD adds support for $l_{2}$ and other metric distances by generalizing the Clip function with the projection function $\prod$ as follows:
\begin{equation}
    \tilde{\textbf{x}}^{N+1}=\prod_{\epsilon}\left( \tilde{\textbf{x}}^{N} + \alpha \cdot sign\left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( \tilde{\textbf{x}}^{N} \right),y \right) \right)  \right) 
\end{equation}
In case of $l_{\infty}$ the projection function $\prod$ is the Clip function in BIM. In case $l_{2}$ the surface to be projected is a hypersphere with radius $\epsilon$ around the original image, and the projection function is calculated as follows:
\begin{equation}
    \prod_{\epsilon}\left( \textbf{x} \right) = \tilde{\textbf{x}} + \frac{min\left( \left\| \textbf{x}-\tilde{\textbf{x}} \right\|_{2},\epsilon \right)}{\left\| \textbf{x}-\tilde{\textbf{x}} \right\|_{2}}\left( \textbf{x}-\tilde{\textbf{x}}\right)
\end{equation}

\subsection{Optimization-based adversarial attack}

C\&W adversarial attack is a typical representative of the optimization-based adversarial attack approach. The objective is to minimize the perturbation, subject to the constraint that the perturbed input is misclassified by the target model. The general optimization problem for the C\&W attack can be formulated as:
\begin{equation}
    \underset{\eta}{\text{min}} \left\| \eta \right\|_{p} + c\cdot \text{Loss}\left( \eta \right)
\end{equation}
where $\left\| \eta \right\|_{p}$ is the chosen norm of the perturbation ($l_{2}$ or $l_{\infty}$ norm); $c$ is a hyperparameter controlling the trade-off between minimizing the perturbation and maximizing the adversarial effect; $\text{Loss}\left( \eta \right)$ is the classification loss with the goal of creating a 
perturbation $\eta$ such that the perturbed image $\tilde{\textbf{x}} = \textbf{x} +\eta$ is misclassified by the model but still looks similar to the original image. The loss function $\text{Loss}\left( \eta \right)$ that is minimized during the attack can be written for an untargeted attack as:

\begin{equation}
    \begin{split}
        \text{Loss}_{untargeted}\left( \eta \right) =  &\text{max}\left( 0,f\left( x+\eta \right)_{y}-\underset{i\neq y}{\text{max}}\:f\left( x+\eta \right)_{i}\right) \\
        &+ \lambda \left\| \eta \right\|^{2}_{2}
    \end{split}
\end{equation}
and the loss function for targeted attack as:
\begin{equation}
    \begin{split}
        \text{Loss}_{targeted}\left( \eta \right) =  &\text{max}\left( 0,f\left( x+\eta \right)_{t}-\underset{i\neq t}{\text{max}}\:f\left( x+\eta \right)_{i}\right) \\
        &+ \lambda \left\| \eta \right\|^{2}_{2}
    \end{split}
\end{equation}
where:

- $f\left( x+\eta \right)_{y}$ is the logit for the true class $y$ after perturbation;

- $f\left( x+\eta \right)_{t}$ is the logit for the target class $t$ after perturbation;

- $f\left( x+\eta \right)_{i}$ is the logit for any class $i\neq y$ or $i\neq t$;

- $\underset{i\neq y}{\text{max}}\:f\left( x+\eta \right)_{i}$ is the maximum logit for any class $i\neq y$, representing the logit of the most likely incorrect class; 
    
- $\underset{i\neq t}{\text{max}}\:f\left( x+\eta \right)_{i}$ is the maximum logit for any class $i\neq t$;

- $\text{max}\left( 0,f\left( x+\eta \right)_{y}-\underset{i\neq y}{\text{max}}\:f\left( x+\eta \right)_{i}\right)$ ensures that the model misclassifies the perturbed input into a class that is not the original class $y$. Forcing the logit for the original class $y$ to be smaller than the logit for at least one other incorrect class;

- $\text{max}\left( 0,f\left( x+\eta \right)_{t}-\underset{i\neq t}{\text{max}}\:f\left( x+\eta \right)_{i}\right)$ ensures that the model classifies the perturbed input as the target class $t$, and not as any other class. This forces the target class logit to be greater than all other logits for the perturbed image;

- $\lambda$ is a regularization constant that controls the trade-off between misclassification and perturbation size;

- $\left\| \eta \right\|^{2}_{2}$ is the L2 norm squared of the perturbation, which controls how large the perturbation can be;

- $\lambda \left\| \eta \right\|^{2}_{2}$ ensures that the perturbation is small, making the changes imperceptible to humans.
   

\section{Adversarial defense with regularized adversarial training}
\label{Proposed_Method}

In this work, we propose three variations of adversarial training with regularization: (1) Adversarial Training with Weight Regularization (ATWR), (2) Adversarial Training with Gradient Regularization (ATGR), and (3) Ensemble Adversarial Training with Regularization (EATR). In each approach, adversarial examples are integrated into the model's training process, along with regularization techniques. In solutions (1) and (2), the model is trained using adversarial examples generated from a single attack method, while in (3), the model is trained on adversarial examples generated from multiple attack methods.

\subsection{Adversarial Training with Weight Regularization-ATWR}
In this method, we incorporate weight regularization and adversarial training into a single loss function as follows:
\begin{equation}
    \mathcal{L}_{\text{ATWR}} = \mathcal{L}_{\text{clean}} + \lambda_{1} \mathcal{L}_{\text{adv}} + \lambda_{2}\left\| \textbf{W} \right\|^{2}_{2}
\end{equation}
where $\mathcal{L}_{\text{clean}}$ is the loss on clean data: $\mathcal{L}_{\text{clean}}=\mathcal{L}\left( f_{\theta} \left( x\right),y\right)$; 
$\mathcal{L}_{\text{adv}}$ is the loss on adversarial samples: $\mathcal{L}_{\text{adv}}=\mathcal{L}\left( f_{\theta} \left( x+\eta \right),y\right)$; $\textbf{W}$ represents the weights in the model. The adversarial samples are generated by a single attack method (FGSM, PGB, BIM, or C\&W); $\lambda_{1}$, $\lambda_{2}$ are hyperparameters controlling the importance of adversarial loss and regularization loss, respectively. 

The target model is trained not only on clean data but also on adversarial samples that are generated using a specific attack method. This allows the model to learn to classify both clean and adversarial inputs correctly, making it more resilient to adversarial perturbations. The weight regularization term encourages the model to maintain smaller and simpler weights, preventing overfitting to the adversarial examples and helping the model generalize better on unseen data.

\subsection{Adversarial Training with Gradient Regularization-ATGR}

In this strategy, gradient regularization is incorporated to make the model less sensitive to input perturbations. The loss function for gradient regularization-based adversarial training can be written as:
\begin{equation}
    \mathcal{L}_{\text{ATGR}} = \mathcal{L}_{\text{clean}} + \beta_{1} \mathcal{L}_{\text{adv}} + \beta_{2} \left\| \nabla _{\tilde{\textbf{x}}} \mathcal{L}_{\text{adv}}\left( \tilde{\textbf{x}} \right)\right\|^{2}_{2}
\end{equation}
where $\left\| \nabla _{\tilde{\textbf{x}}} \mathcal{L}_{\text{adv}}\left( \tilde{\textbf{x}} \right)\right\|^{2}_{2}$ is the gradient regularization term that penalizes large gradients; $\beta_{1}$, $\beta_{2}$ are the hyperparameters controlling the strength of the adversarial and gradient regularization terms, respectively. The adversarial samples are generated by a single attack method (FGSM, PGB, BIM, or C\&W).

By adjusting the hyperparameters, particularly the regularization strength and the weighting of the adversarial loss, we can intentionally degrade the model's performance on both clean and adversarial data. This results in a model that may not perform well on standard classification tasks but can be highly effective for adversarial attack detection. The idea is that such a model, being overly conservative or underfitted, will struggle to make accurate predictions, which can make it more sensitive to the presence of adversarial input, thereby enabling it to identify adversarial attacks more effectively.

\subsection{Ensemble Adversarial Training with Regularization-EATR}

In EATR, adversarial examples are generated from multiple attack methods (FGSM, PGD, BIM, C\&W). The losses are combined from both clean and adversarial examples, and a regularization term is added to encourage the model to learn simpler and more generalizable representations. The total loss is the sum of the clean loss, adversarial losses from multiple attacks, and the regularization term as follows:
\begin{equation}
    \begin{split}
         \mathcal{L}_{\text{EATR}} = &\mathcal{L}_{\text{clean}} + \gamma_{1}\mathcal{L}^{\text{FGSM}}_{\text{adv}} + \gamma_{2}\mathcal{L}^{\text{PGD}}_{\text{adv}} + \gamma_{3}\mathcal{L}^{\text{BIM}}_{\text{adv}} \\
         &+ \gamma_{4}\mathcal{L}^{\text{C\&W}}_{\text{adv}} + \gamma_{5}\mathcal{L}_{\text{reg}}
    \end{split}
\end{equation}
where $\gamma_{1}$, $\gamma_{2}$, $\gamma_{3}$, $\gamma_{4}$, and $\gamma_{5}$ are hyperparameters that control the contribution of each loss function; $\mathcal{L}_{\text{clean}}$ is the standard cross-entropy loss for the original (clean) samples: 
\begin{equation}
    \mathcal{L}_{\text{clean}}\left( f\left( x_{i} \right),y_{i} \right)=-\sum_{c=1}^{C}y^{c}_{i}\:{\text{log}}^{}\left( f\left( x_{i} \right)^{c} \right)
\end{equation}
with $f\left( x_{i} \right)$ is the model’s output logits for the input $x_{i}$, and 
$y^{c}_{i}$ is the true class. $\mathcal{L}_{\text{adv}}^{\text{attack}}$ is adversarial loss for each attack (FGSM, PGD, or C\&W). It is the cross-entropy loss calculated over the adversarial samples:
\begin{equation}
    \mathcal{L}_{\text{adv}}^{\text{attack}} \left( f\left( \tilde{x}_{i} \right),y_{i} \right) = -\sum_{c=1}^{C}y^{c}_{i} \: \text{log} \left( f\left( \tilde{x}_{i} \right)^{c} \right)
\end{equation}
where $\tilde{x}_{i}$ could be any of the adversarial examples generated from the different attacks:
\begin{equation}
    \tilde{x}^{\text{FGSM}}_{i} = x_{i} + \epsilon \: \text{sign} \left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( x_{i} \right), y_{i}\right) \right) 
\end{equation}

\begin{equation}
    \tilde{x}^{\text{PGD}}_{i} = x_{i} + \alpha\: \text{sign} \left( \nabla _{x}\mathcal{L}\left( f_{\theta}\left( x_{i} \right), y_{i}\right) \right)
\end{equation}

\begin{equation}
    \begin{split}
             \tilde{x}^{\text{BIM}}_{i}\left( t+1 \right) &= \\
             &\text{clip}_{x_{i}, \epsilon}\left( \tilde{x}^{\text{BIM}}_{i} \left( t \right) + \alpha \: \text{sign}\left( \nabla _{x} \mathcal{L} \left( f_{\theta}\left( \tilde{x}^{\text{BIM}}_{i} \left( t \right)\right),y_{i} \right)\right)  \right)
    \end{split}
\end{equation}



\begin{equation}
    \tilde{x}^{\text{C\&W}}_{i} = \text{arg }\underset{\tilde{x}^{\text{C\&W}}}{\text{min}} \left\| \tilde{x}^{\text{C\&W}}_{i} -x_{i}\right\|^{2} + \lambda \mathcal{L}\left( f_{\theta}\left( \tilde{x}^{\text{C\&W}}_{i} \right),y_{i} \right)
\end{equation}
$\mathcal{L}_{\text{reg}}$ can be weight decay ($\left\| \textbf{W} \right\|^{2}_{2}$) or gradient regularization ($\left\| \nabla _{\tilde{\textbf{x}}} \mathcal{L}_{\text{adv}}\left( \tilde{\textbf{x}} \right)\right\|^{2}_{2}$).


\section{Experiments and results}
\label{Experiments}

\subsection{Experimental dataset and evaluation metric}

\subsubsection{Experimental datasets}
In this work, the MNIST \cite{lecun1998gradient}, CIFAR10, CIFAR100 \cite{krizhevsky2009learning}, and ImageNet \cite{deng2009imagenet} datasets are used in our experiments. The MNIST dataset consists of images of handwritten digits (0–9). Each image is a 28x28 pixel grayscale image and is labeled with the correct digit (from 0 to 9). The data set contains a total of 70,000 images, and the data split for training is 60,000 images and for testing is 10,000 images. The CIFAR-10 dataset consists of 60,000 color images in 10 different classes. Each image is 32x32 pixels with 3 color channels of RGB. In this work, the training set contains 50,000 images, and the testing set includes 10,000 images. The CIFAR-100 dataset is an extended version of the CIFAR-10 dataset, which contains 100 classes, each with 600 RGB images with a resolution of 32x32 pixels, totaling 60,000 images in the dataset. The 100 classes are divided into 20 superclasses, and each superclass contains 5 subclasses. In this work, the CIFAR-100 dataset is divided into a training set of 50,000 images and a test set of 10,000 images. The images are divided equally among the 100 classes, with 500 images per class for training and 100 images per class for testing. The ImageNet dataset is one of the largest and most widely used datasets for image classification tasks. It contains more than 14 million images that are labeled according to a large set of categories (more than 20,000 in total). The images in the dataset vary in resolution and are both low- and high-resolution images, with a wide range of perspectives, lighting conditions, and occlusions. In this work, we used a subset of the ImageNet dataset known as the ImageNet Large-Scale Visual Recognition Challenge (ILSVRC), which contains 1.2 million images for 1,000 categories. The test set used in this work contains 100,000 images that are also distributed in 1,000 categories.

\subsubsection{Evaluation metrics}
In order to evaluate the adversarial attack robustness and defense, the evaluation metric of Accuracy Drop ($\text{Acc}_{\text{drop}}$) is used for the experiments. This metric measures  the performance degradation of the image classifiers when subjected to adversarial examples:
\begin{equation}
    \text{Acc}_{\text{drop}} \left( \% \right) = \text{Acc}_{\text{origin}} \left( \% \right) -\text{Acc}_{\text{adv}} \left( \% \right)
\end{equation}
where $\text{Acc}_{\text{origin}}$ is the classification accuracy on the original (clean) data, and $\text{Acc}_{\text{adv}}$ is the accuracy of the classifiers on the adversarial data. High accuracy drop means low robustness, or the target model is more vulnerable to adversarial attacks. Low accuracy drop indicates high robustness, or the target model is less vulnerable to adversarial attack. The $\text{Acc}_{\text{origin}}$ and $\text{Acc}_{\text{adv}}$ are evaluated using the top-1 accuracy metric. Top-1 accuracy represents the precision of the model's highest-probability prediction:
\begin{equation}
    \text{Acc}_{\text{Top-1}} \left( \% \right)= \frac{\text{Number } \text{of } \text{correct } \text{Top-1} \:\text{predictions}}{\text{Total }\text{number} \: \text{of }\text{predictions}}
\end{equation}


\subsection{Configuration parameters}

- The loss function is the cross-entropy loss. The image classification models are ResNet50 \cite{KaimingHe2016}, ResNet101 \cite{KaimingHe2016}, Alexnet  \cite{iandola2016squeezenet}, MobilenetV2  \cite{Sandler_MobileNetV2}, Densenet121 \cite{Huang2017}, InceptionNetV3 \cite{Christian_InceptionNet_V3}.

- Configuration parameters for adversarial attacks:
\begin{itemize}
    \item  FGSM: The loss function is the Cross Entropy Loss; $\eta$=0.01; $\epsilon=0.1$.
    \item PGD: The loss function is the Cross Entropy Loss; number of epochs = 100; $\alpha=2/225$ for ResNet50, ResNet100, AlexNet, MobileNetV2, DenseNet121; $\alpha=2/299$ for InceptionNetV3; $\epsilon=0.1$.
    \item BIM: The loss function is the Cross Entropy Loss; $\alpha=2/225$ for ResNet50, ResNet100, AlexNet, MobileNetV2, DenseNet121; $\alpha=2/299$ for InceptionNetV3; $\epsilon=0.1$.
    \item C\&W: The confidence parameter $c$ = 0.0; The search step = 1 (implies iterative updating $\tilde{\textbf{x}}$ in the direction of the gradient to minimize loss and increase the confidence of the model in misclassification); The maximum step = 100 (the maximum number of iterations allowed during the optimization process when generating adversarial examples); Optimizer learning rate = 0.001.
      
\end{itemize} 

- Configuration parameters for defense solutions:
\begin{itemize}
    \item ATWR: Learning rate 0.001; number of epochs: 100-500; $\lambda_{1}=1$, $\lambda_{2}=0.005$.
    \item ATGR: Learning rate 0.001; number of epochs: 100-500; $\beta_{1}=1$, $\beta_{2}=1$. 
    \item EATR: Learning rate 0.001; number of epochs: 100-500; $\gamma_{1}=1$, $\gamma_{2}=1$, $\gamma_{3}=1$, $\gamma_{4}=1$, $\gamma_{5}=1$.
\end{itemize}

\subsection{Experimental results}

In this section, we evaluate the performance of the target models in two scenarios: (1) without any adversarial defense, and (2) with adversarial defense. In the first scenario, adversarial attacks such as FGSM, PGD, BIM, and C\&W are used to generate adversarial samples, and the target models are tested for their robustness against these perturbations. In the second scenario, we apply three defense strategies—ATWR, ATGR, and EATR—to evaluate how well target models can withstand adversarial attacks.

\subsubsection{Model robustness without adversarial defense}

Adversarial attacks, including FGSM, BIM, PGD, and C\&W, are applied to widely-used image classification models—ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3. These attacks generate adversarial samples using the MNIST, CIFAR-10, CIFAR-100, and ImageNet datasets.

Table \ref{AttackWithoutDefense} presents the classification results of the target models in the original images (\textbf{Acc-origin}) and the adversarial images (\textbf{Acc-adv}) generated by the FGSM, PGD, BIM, and C\&W attacks. (\textbf{Acc drop}) indicates the decrease in image classifier performance when exposed to adversarial examples. Taking into account the MNIST and ImageNet datasets, the target models exhibit a higher vulnerability to the C\&W attack compared to other attacks, with the highest \textbf{Acc-drop} of 100\% across all models, except MobileNetV2, which shows a 76.56\% \textbf{Acc-drop} on the MNIST dataset. For the ImageNet dataset, all models experience an \textbf{Acc-drop} above 90\%, except AlexNet, which shows a 79.69\% \textbf{Acc-drop}. 

Evaluations of the CIFAR-10 and CIFAR-100 datasets reveal that target models are less vulnerable to the C\&W attack, while the PGD attack has the most significant adversarial impact on all models. The \textbf{Acc-drop} for PGD attacks ranges from a minimum of 48.12\% (InceptionNetV3) to a maximum of 65.93\% (MobileNetV2) on the CIFAR-10 dataset, and from 44.06\% (AlexNet) to 63.75\% (MobileNetV2) on the CIFAR-100 dataset.

\begin{table*}[htp]
\centering
\caption{Evaluation of model robustness against FGSM, PGD, BIM, and C\&W attacks across various datasets, including MNIST, CIFAR-10, CIFAR-100, and ImageNet.}
\resizebox{16cm}{!}{
\begin{tabular}{|c|l|c|cc|cc|cc|cc|}
\hline
\multirow{2}{*}{\textbf{Dataset}}                        & \multicolumn{1}{c|}{\multirow{2}{*}{\textbf{CNN model}}} & \multirow{2}{*}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-origin\\ (Top-1)\end{tabular}}} & \multicolumn{2}{c|}{\textbf{FGSM}}                                                                          & \multicolumn{2}{c|}{\textbf{PGD}}                                                                           & \multicolumn{2}{c|}{\textbf{BIM}}                                                                           & \multicolumn{2}{c|}{\textbf{C\&W}}                                                                            \\ \cline{4-11} 
                                                         & \multicolumn{1}{c|}{}                                    &                                                                                        & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} \\ \hline
\multirow{6}{*}{\textbf{MNIST}}                          & ResNet50                                                 & 100.00                                                                                 & \multicolumn{1}{c|}{62.50}                                                              & 37.50             & \multicolumn{1}{c|}{21.88}                                                              & 78.12             & \multicolumn{1}{c|}{25.00}                                                              & 75.00             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \cline{2-11} 
                                                         & ResNet101                                                & 100.00                                                                                 & \multicolumn{1}{c|}{45.31}                                                              & 54.69             & \multicolumn{1}{c|}{7.81}                                                               & 92.19             & \multicolumn{1}{c|}{23.44}                                                              & 76.56             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \cline{2-11} 
                                                         & AlexNet                                                  & 100.00                                                                                 & \multicolumn{1}{c|}{64.06}                                                              & 35.94             & \multicolumn{1}{c|}{100.00}                                                             & 0.00              & \multicolumn{1}{c|}{29.69}                                                              & 70.31             & \multicolumn{1}{c|}{23.44}                                                              & \textbf{76.56}    \\ \cline{2-11} 
                                                         & MobileNetV2                                              & 100.00                                                                                 & \multicolumn{1}{c|}{82.81}                                                              & 17.19             & \multicolumn{1}{c|}{70.31}                                                              & 29.69             & \multicolumn{1}{c|}{25.00}                                                              & 75.00             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \cline{2-11} 
                                                         & DenseNet121                                              & 100.00                                                                                 & \multicolumn{1}{c|}{59.38}                                                              & 40.62             & \multicolumn{1}{c|}{60.94}                                                              & 39.06             & \multicolumn{1}{c|}{20.31}                                                              & 79.69             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \cline{2-11} 
                                                         & InceptionNetV3                                           & 100.00                                                                                 & \multicolumn{1}{c|}{75.00}                                                              & 25.00             & \multicolumn{1}{c|}{29.69}                                                              & 70.31             & \multicolumn{1}{c|}{18.75}                                                              & 81.25             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{100.00}   \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{\textbf{CIFAR10}}}  & ResNet50                                                 & 93.13                                                                                  & \multicolumn{1}{c|}{61.25}                                                              & 31.88             & \multicolumn{1}{c|}{43.75}                                                              & \textbf{49.38}    & \multicolumn{1}{c|}{47.82}                                                              & 45.31             & \multicolumn{1}{c|}{84.11}                                                              & 9.02              \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & ResNet101                                                & 95.63                                                                                  & \multicolumn{1}{c|}{64.38}                                                              & 31.25             & \multicolumn{1}{c|}{46.88}                                                              & \textbf{48.75}    & \multicolumn{1}{c|}{45.00}                                                              & 50.63             & \multicolumn{1}{c|}{82.43}                                                              & 13.20             \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & AlexNet                                                  & 89.06                                                                                  & \multicolumn{1}{c|}{30.94}                                                              & 58.12             & \multicolumn{1}{c|}{37.19}                                                              & \textbf{51.87}    & \multicolumn{1}{c|}{21.88}                                                              & 67.18             & \multicolumn{1}{c|}{78.31}                                                              & 10.75             \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & MobileNetV2                                              & 92.19                                                                                  & \multicolumn{1}{c|}{48.13}                                                              & 44.06             & \multicolumn{1}{c|}{26.26}                                                              & \textbf{65.93}    & \multicolumn{1}{c|}{40.94}                                                              & 51.25             & \multicolumn{1}{c|}{84.58}                                                              & 7.61              \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & DenseNet121                                              & 93.75                                                                                  & \multicolumn{1}{c|}{58.44}                                                              & 35.31             & \multicolumn{1}{c|}{43.13}                                                              & \textbf{50.62}    & \multicolumn{1}{c|}{42.50}                                                              & 51.25             & \multicolumn{1}{c|}{81.08}                                                              & 12.67             \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & InceptionNetV3                                           & 78.13                                                                                  & \multicolumn{1}{c|}{39.07}                                                              & 39.06             & \multicolumn{1}{c|}{30.01}                                                              & \textbf{48.12}    & \multicolumn{1}{c|}{33.44}                                                              & 44.69             & \multicolumn{1}{c|}{69.39}                                                              & 8.74              \\ \hline
\multirow{6}{*}{\textbf{CIFAR100}}                       & ResNet50                                                 & 77.19                                                                                  & \multicolumn{1}{c|}{37.50}                                                              & 39.69             & \multicolumn{1}{c|}{22.19}                                                              & \textbf{55.00}    & \multicolumn{1}{c|}{26.57}                                                              & 50.62             & \multicolumn{1}{c|}{67.82}                                                              & 9.37              \\ \cline{2-11} 
                                                         & ResNet101                                                & 84.69                                                                                  & \multicolumn{1}{c|}{41.57}                                                              & 43.12             & \multicolumn{1}{c|}{32.19}                                                              & \textbf{52.50}    & \multicolumn{1}{c|}{32.50}                                                              & 52.19             & \multicolumn{1}{c|}{75.16}                                                              & 9.53              \\ \cline{2-11} 
                                                         & AlexNet                                                  & 67.50                                                                                  & \multicolumn{1}{c|}{14.69}                                                              & 52.81             & \multicolumn{1}{c|}{23.44}                                                              & \textbf{44.06}    & \multicolumn{1}{c|}{17.19}                                                              & 50.31             & \multicolumn{1}{c|}{61.41}                                                              & 6.09              \\ \cline{2-11} 
                                                         & MobileNetV2                                              & 80.94                                                                                  & \multicolumn{1}{c|}{30.01}                                                              & 50.93             & \multicolumn{1}{c|}{17.19}                                                              & \textbf{63.75}    & \multicolumn{1}{c|}{25.30}                                                              & 55.64             & \multicolumn{1}{c|}{69.06}                                                              & 11.88             \\ \cline{2-11} 
                                                         & DenseNet121                                              & 81.56                                                                                  & \multicolumn{1}{c|}{32.82}                                                              & 48.74             & \multicolumn{1}{c|}{25.63}                                                              & \textbf{55.93}    & \multicolumn{1}{c|}{27.19}                                                              & 54.37             & \multicolumn{1}{c|}{72.11}                                                              & 9.45              \\ \cline{2-11} 
                                                         & InceptionNetV3                                           & 79.69                                                                                  & \multicolumn{1}{c|}{39.69}                                                              & 40.00             & \multicolumn{1}{c|}{30.00}                                                              & \textbf{49.69}    & \multicolumn{1}{c|}{34.07}                                                              & 45.62             & \multicolumn{1}{c|}{68.91}                                                              & 10.78             \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{\textbf{ImageNet}}} & ResNet50                                                 & 95.31                                                                                  & \multicolumn{1}{c|}{82.81}                                                              & 12.50             & \multicolumn{1}{c|}{76.56}                                                              & 18.75             & \multicolumn{1}{c|}{42.19}                                                              & 53.12             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{95.31}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & ResNet101                                                & 93.75                                                                                  & \multicolumn{1}{c|}{90.62}                                                              & 3.13              & \multicolumn{1}{c|}{85.94}                                                              & 7.81              & \multicolumn{1}{c|}{53.12}                                                              & 40.63             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{93.75}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & AlexNet                                                  & 79.69                                                                                  & \multicolumn{1}{c|}{23.44}                                                              & 56.25             & \multicolumn{1}{c|}{71.88}                                                              & 7.81              & \multicolumn{1}{c|}{0.00}                                                               & 79.69             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{79.69}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & MobileNetV2                                              & 92.19                                                                                  & \multicolumn{1}{c|}{65.62}                                                              & 26.57             & \multicolumn{1}{c|}{60.94}                                                              & 31.25             & \multicolumn{1}{c|}{9.38}                                                               & 82.81             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{92.19}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & DenseNet121                                              & 93.75                                                                                  & \multicolumn{1}{c|}{62.50}                                                              & 31.25             & \multicolumn{1}{c|}{81.25}                                                              & 12.50             & \multicolumn{1}{c|}{3.12}                                                               & 90.63             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{93.75}    \\ \cline{2-11} 
\multicolumn{1}{|l|}{}                                   & InceptionNetV3                                           & 90.62                                                                                  & \multicolumn{1}{c|}{56.25}                                                              & 34.37             & \multicolumn{1}{c|}{81.25}                                                              & 9.37              & \multicolumn{1}{c|}{4.69}                                                               & 85.93             & \multicolumn{1}{c|}{0.00}                                                               & \textbf{90.62}    \\ \hline
\end{tabular}
}
\label{AttackWithoutDefense}
\end{table*}

Figures \ref{fig:MNIST_ImageNet} and \ref{fig:CIFAR10_100} display adversarial samples generated from MNIST, CIFAR-10, CIFAR-100, and ImageNet using FGSM, PGD, BIM, and C\&W attacks on the target models: ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3. Upon inspection of these adversarial images, it is apparent to the human eye that the images generated by PGD and C\&W attacks are more similar to the original images compared to those generated by the FGSM and BIM attacks. This indicates that the perturbations introduced by PGD and C\&W are less noticeable to the human eye. Despite their imperceptibility, these adversarial samples still lead to misclassification in the target models. 
This is evident in Table \ref{AttackWithoutDefense}, where the models show low accuracy in adversarial examples (\textbf{Acc-adv}) or experience a significant accuracy drop (\textbf{Acc-drop}) for the C\&W attack on MNIST and ImageNet, and for the PGD attack on CIFAR-10 and CIFAR-100 datasets.

The empirical analysis presented above provides a critical foundation for designing defense solutions to protect target image classification models against adversarial attacks.

\begin{figure*}[htp]
    \centering
    \includegraphics[width=1.0\linewidth]{mnist_ImageNet.png}
    \caption{Illustration of adversarial images generated from the MNIST and ImageNet datasets using FGSM, PGD, BIM, and C\&W attacks on the target models: ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3.}
    \label{fig:MNIST_ImageNet}
\end{figure*}

\begin{figure*}[htp]
    \centering
    \includegraphics[width=1.0\linewidth]{CIFAR10_100.png}
    \caption{Illustration of adversarial images generated from the CIFAR-10 and CIFAR-100 datasets using FGSM, PGD, BIM, and C\&W attacks on the target models: ResNet50, ResNet101, AlexNet, MobileNetV2, DenseNet121, and InceptionNetV3.}
    \label{fig:CIFAR10_100}
\end{figure*}


\subsubsection{Model robustness with adversarial defense}

In this section, we evaluate the robustness of target models using three defense strategies: ATWR, ATGR, and EATR. The experiments are conducted on the MNIST, CIFAR-10, and CIFAR-100 datasets. Target models are trained in both adversarial and clean images, and their performance is evaluated on clean images (\textbf{Acc-clean}) and adversarial images (\textbf{Acc-adv}).

\begin{table*}[htp]
\centering
\caption{Evaluation of the target models' robustness with the ATWR defense against FGSM, PGD, BIM, and C\&W attacks on the MNIST, CIFAR-10, and CIFAR-100 datasets.}
\resizebox{16cm}{!}{
\begin{tabular}{|c|c|c|ccc|ccc|ccc|ccc|}
\hline
\multirow{2}{*}{\textbf{Dataset}}               & \multirow{2}{*}{\textbf{CNN model}} & \multirow{2}{*}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-origin\\ (Top-1)\end{tabular}}} & \multicolumn{3}{c|}{\textbf{FGSM}}                                                                                                                                                                           & \multicolumn{3}{c|}{\textbf{PGD}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{BIM}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{C\&W}}                                                                                                                                                                             \\ \cline{4-15} 
                                                &                                     &                                                                                        & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} \\ \hline
\multirow{6}{*}{MNIST}                          & ResNet50                            & 100.00                                                                                 & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{6.56}                                                               & 92.19             & \multicolumn{1}{c|}{\textbf{98.75}}                                                            & \multicolumn{1}{c|}{\textbf{98.75}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 98.75             & \multicolumn{1}{c|}{\textbf{98.75}}                                                            & \multicolumn{1}{c|}{\textbf{98.75}}                                                     & \textbf{0.00}     \\ \cline{2-15} 
                                                & ResNet101                           & 100.00                                                                                 & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{25.00}                                                              & 74.06             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{99.06}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 99.06             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{98.75}}                                                     & \textbf{0.31}     \\ \cline{2-15} 
                                                & AlexNet                             & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{\textbf{13.44}}                                                            & \multicolumn{1}{c|}{\textbf{13.44}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{\textbf{13.44}}                                                            & \multicolumn{1}{c|}{\textbf{13.44}}                                                     & \textbf{0.00}     \\ \cline{2-15} 
                                                & MobileNetV2                         & 100.00                                                                                 & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{69.38}                                                              & 29.68             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{99.06}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{1.56}                                                               & 97.50             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{97.81}}                                                     & \textbf{1.25}     \\ \cline{2-15} 
                                                & DenseNet121                         & 100.00                                                                                 & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{34.69}                                                              & 64.37             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{99.06}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 99.06             & \multicolumn{1}{c|}{\textbf{99.06}}                                                            & \multicolumn{1}{c|}{\textbf{98.75}}                                                     & \textbf{0.31}     \\ \cline{2-15} 
                                                & InceptionNetV3                      & 100.00                                                                                 & \multicolumn{1}{c|}{98.44}                                                                     & \multicolumn{1}{c|}{81.88}                                                              & 16.56             & \multicolumn{1}{c|}{\textbf{98.44}}                                                            & \multicolumn{1}{c|}{\textbf{98.44}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{98.44}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 98.44             & \multicolumn{1}{c|}{\textbf{98.44}}                                                            & \multicolumn{1}{c|}{\textbf{97.19}}                                                     & \textbf{1.25}     \\ \hline
\multirow{6}{*}{CIFAR10}                        & ResNet50                            & 93.13                                                                                  & \multicolumn{1}{c|}{87.81}                                                                     & \multicolumn{1}{c|}{18.44}                                                              & 69.37             & \multicolumn{1}{c|}{\textbf{87.81}}                                                            & \multicolumn{1}{c|}{\textbf{87.50}}                                                     & \textbf{0.31}     & \multicolumn{1}{c|}{87.81}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 87.81             & \multicolumn{1}{c|}{87.81}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 87.81             \\ \cline{2-15} 
                                                & ResNet101                           & 95.63                                                                                  & \multicolumn{1}{c|}{85.31}                                                                     & \multicolumn{1}{c|}{16.88}                                                              & 68.43             & \multicolumn{1}{c|}{\textbf{85.31}}                                                            & \multicolumn{1}{c|}{\textbf{85.31}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{85.31}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 85.31             & \multicolumn{1}{c|}{85.31}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 85.31             \\ \cline{2-15} 
                                                & AlexNet                             & 89.06                                                                                  & \multicolumn{1}{c|}{12.50}                                                                     & \multicolumn{1}{c|}{12.50}                                                              & 0.00              & \multicolumn{1}{c|}{\textbf{12.50}}                                                            & \multicolumn{1}{c|}{\textbf{12.50}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{12.50}                                                                     & \multicolumn{1}{c|}{12.50}                                                              & 0.00              & \multicolumn{1}{c|}{12.50}                                                                     & \multicolumn{1}{c|}{12.50}                                                              & 0.00              \\ \cline{2-15} 
                                                & MobileNetV2                         & 92.19                                                                                  & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{15.62}                                                              & 70.00             & \multicolumn{1}{c|}{\textbf{85.62}}                                                            & \multicolumn{1}{c|}{\textbf{85.62}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{3.44}                                                               & 82.18             & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{22.50}                                                              & 63.12             \\ \cline{2-15} 
                                                & DenseNet121                         & 93.75                                                                                  & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{18.75}                                                              & 66.87             & \multicolumn{1}{c|}{\textbf{85.62}}                                                            & \multicolumn{1}{c|}{\textbf{85.62}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{4.69}                                                               & 80.93             & \multicolumn{1}{c|}{85.62}                                                                     & \multicolumn{1}{c|}{31.25}                                                              & 54.37             \\ \cline{2-15} 
                                                & InceptionNetV3                      & 78.13                                                                                  & \multicolumn{1}{c|}{87.19}                                                                     & \multicolumn{1}{c|}{16.88}                                                              & 70.31             & \multicolumn{1}{c|}{\textbf{87.19}}                                                            & \multicolumn{1}{c|}{\textbf{87.19}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{87.19}                                                                     & \multicolumn{1}{c|}{2.19}                                                               & 85.00             & \multicolumn{1}{c|}{87.19}                                                                     & \multicolumn{1}{c|}{30.00}                                                              & 57.19             \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{CIFAR100}} & ResNet50                            & 77.19                                                                                  & \multicolumn{1}{c|}{66.88}                                                                     & \multicolumn{1}{c|}{10.94}                                                              & 55.94             & \multicolumn{1}{c|}{\textbf{66.88}}                                                            & \multicolumn{1}{c|}{\textbf{66.88}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{66.88}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 66.88             & \multicolumn{1}{c|}{66.88}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 66.88             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & ResNet101                           & 84.69                                                                                  & \multicolumn{1}{c|}{65.31}                                                                     & \multicolumn{1}{c|}{7.19}                                                               & 58.12             & \multicolumn{1}{c|}{\textbf{65.31}}                                                            & \multicolumn{1}{c|}{\textbf{65.31}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{65.31}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 65.31             & \multicolumn{1}{c|}{65.31}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 65.31             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & AlexNet                             & 67.50                                                                                  & \multicolumn{1}{c|}{38.44}                                                                     & \multicolumn{1}{c|}{9.69}                                                               & 28.75             & \multicolumn{1}{c|}{\textbf{38.44}}                                                            & \multicolumn{1}{c|}{\textbf{38.44}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{38.44}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 38.44             & \multicolumn{1}{c|}{38.44}                                                                     & \multicolumn{1}{c|}{4.06}                                                               & 34.38             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & MobileNetV2                         & 80.94                                                                                  & \multicolumn{1}{c|}{67.81}                                                                     & \multicolumn{1}{c|}{7.81}                                                               & 60.00             & \multicolumn{1}{c|}{\textbf{67.81}}                                                            & \multicolumn{1}{c|}{\textbf{67.19}}                                                     & \textbf{0.62}     & \multicolumn{1}{c|}{67.81}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 67.81             & \multicolumn{1}{c|}{67.81}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 67.81             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & DenseNet121                         & 81.56                                                                                  & \multicolumn{1}{c|}{69.06}                                                                     & \multicolumn{1}{c|}{7.81}                                                               & 61.25             & \multicolumn{1}{c|}{\textbf{69.06}}                                                            & \multicolumn{1}{c|}{\textbf{69.06}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{69.06}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 69.06             & \multicolumn{1}{c|}{69.06}                                                                     & \multicolumn{1}{c|}{0.31}                                                               & 68.75             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & InceptionNetV3                      & 79.69                                                                                  & \multicolumn{1}{c|}{70.94}                                                                     & \multicolumn{1}{c|}{9.69}                                                               & 61.25             & \multicolumn{1}{c|}{\textbf{70.94}}                                                            & \multicolumn{1}{c|}{\textbf{70.94}}                                                     & \textbf{0.00}     & \multicolumn{1}{c|}{70.94}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 70.94             & \multicolumn{1}{c|}{70.94}                                                                     & \multicolumn{1}{c|}{0.00}                                                               & 70.94             \\ \hline
\end{tabular}
\label{ATWR}
}
\end{table*}

Upon reviewing the results in Table \ref{AttackWithoutDefense}, we observe that the C\&W attack has the most significant impact on all target models for the MNIST dataset. In contrast, for the CIFAR-10 and CIFAR-100 datasets, target models are more susceptible to the PGD attack. The evaluation results in Table \ref{ATWR} highlight the effectiveness of the ATWR defense in improving the resilience of target models against strong attacks such as PGD and C\&W. In comparison with the \textbf{Acc-drop} values in Table \ref{AttackWithoutDefense}, the \textbf{Acc-drop} values of all target models are almost 0\% for the PGD attack in the MNIST, CIFAR10, and CIFAR100 datasets, and from 0\% to 1.25\% for the C\&W attack in the MNIST dataset.

Regarding the trade-off between model accuracy and robustness against adversarial attacks, all target models, except AlexNet, achieve this balance on the MNIST and CIFAR10 datasets. The \textbf{Acc-clean} values are slightly lower than \textbf{Acc-origin} (100\%) for the MNIST dataset and approximately 10\% lower than \textbf{Acc-origin} for the CIFAR10 dataset. For CIFAR-100, the \textbf{Acc-clean} values of all target models, except AlexNet, are about 20\% lower than their \textbf{Acc-origin} counterparts. The results from the AlexNet model suggest that the weight regularization applied to the AlexNet model might be too strong or incorrectly configured, preventing it from effectively learning from both clean and adversarial images.

The results in Table \ref{ATWR} also indicate that ATWR excels in defending against more powerful and complex attacks like PGD and C\&W, which are designed to exploit subtle vulnerabilities in the model. However, for simpler attacks such as FGSM and BIM, the regularization provided by ATWR may not be fully aligned with defense needs, making it less effective.

\begin{table*}[htp]
\centering
\caption{Evaluation of the target models' robustness with the ATGR defense against FGSM, PGD, BIM, and C\&W attacks on the MNIST, CIFAR-10, and CIFAR-100 datasets.}
\resizebox{16cm}{!}{
\begin{tabular}{|c|c|c|ccc|ccc|ccc|ccc|}
\hline
\multirow{2}{*}{\textbf{Dataset}}               & \multirow{2}{*}{\textbf{CNN model}} & \multirow{2}{*}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-origin\\ (Top-1)\end{tabular}}} & \multicolumn{3}{c|}{\textbf{FGSM}}                                                                                                                                                                           & \multicolumn{3}{c|}{\textbf{PGD}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{BIM}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{C\&W}}                                                                                                                                                                             \\ \cline{4-15} 
                                                &                                     &                                                                                        & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} \\ \hline
\multirow{6}{*}{MNIST}                          & ResNet50                            & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \cline{2-15} 
                                                & ResNet101                           & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \cline{2-15} 
                                                & AlexNet                             & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \cline{2-15} 
                                                & MobileNetV2                         & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \cline{2-15} 
                                                & DenseNet121                         & 100.00                                                                                 & \multicolumn{1}{c|}{98.12}                                                                     & \multicolumn{1}{c|}{23.12}                                                              & 75.00             & \multicolumn{1}{c|}{98.12}                                                                     & \multicolumn{1}{c|}{23.12}                                                              & 75.00             & \multicolumn{1}{c|}{98.12}                                                                     & \multicolumn{1}{c|}{23.12}                                                              & 75.00             & \multicolumn{1}{c|}{98.12}                                                                     & \multicolumn{1}{c|}{23.12}                                                              & 75.00             \\ \cline{2-15} 
                                                & InceptionNetV3                      & 100.00                                                                                 & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              & \multicolumn{1}{c|}{13.44}                                                                     & \multicolumn{1}{c|}{13.44}                                                              & 0.00              \\ \hline
\multirow{6}{*}{CIFAR10}                        & ResNet50                            & 93.13                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \cline{2-15} 
                                                & ResNet101                           & 95.63                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \cline{2-15} 
                                                & AlexNet                             & 89.06                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \cline{2-15} 
                                                & MobileNetV2                         & 92.19                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \cline{2-15} 
                                                & DenseNet121                         & 93.75                                                                                  & \multicolumn{1}{c|}{75.00}                                                                     & \multicolumn{1}{c|}{18.12}                                                              & 56.88             & \multicolumn{1}{c|}{75.00}                                                                     & \multicolumn{1}{c|}{75.00}                                                              & 0.00              & \multicolumn{1}{c|}{75.00}                                                                     & \multicolumn{1}{c|}{8.75}                                                               & 66.25             & \multicolumn{1}{c|}{75.00}                                                                     & \multicolumn{1}{c|}{25.31}                                                              & 49.69             \\ \cline{2-15} 
                                                & InceptionNetV3                      & 78.13                                                                                  & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              & \multicolumn{1}{c|}{9.38}                                                                      & \multicolumn{1}{c|}{9.38}                                                               & 0.00              \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{CIFAR100}} & ResNet50                            & 77.19                                                                                  & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & ResNet101                           & 84.69                                                                                  & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & AlexNet                             & 67.50                                                                                  & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & MobileNetV2                         & 80.94                                                                                  & \multicolumn{1}{c|}{0.00}                                                                      & \multicolumn{1}{c|}{0.00}                                                               & 0.00              & \multicolumn{1}{c|}{0.00}                                                                      & \multicolumn{1}{c|}{0.00}                                                               & 0.00              & \multicolumn{1}{c|}{0.00}                                                                      & \multicolumn{1}{c|}{0.00}                                                               & 0.00              & \multicolumn{1}{c|}{0.00}                                                                      & \multicolumn{1}{c|}{0.00}                                                               & 0.00              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & DenseNet121                         & 81.56                                                                                  & \multicolumn{1}{c|}{54.38}                                                                     & \multicolumn{1}{c|}{7.19}                                                               & 47.19             & \multicolumn{1}{c|}{54.38}                                                                     & \multicolumn{1}{c|}{54.38}                                                              & 0.00              & \multicolumn{1}{c|}{54.38}                                                                     & \multicolumn{1}{c|}{5.00}                                                               & 49.38             & \multicolumn{1}{c|}{54.38}                                                                     & \multicolumn{1}{c|}{12.50}                                                              & 41.88             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & InceptionNetV3                      & 79.69                                                                                  & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              & \multicolumn{1}{c|}{0.94}                                                                      & \multicolumn{1}{c|}{0.94}                                                               & 0.00              \\ \hline
\end{tabular}
\label{ATGR}
}
\end{table*}

Table \ref{ATGR} presents the experimental results for the ATGR defense solution. It shows that the \textbf{Acc drop} for all target models, except DenseNet121, is 0\% in all adversarial attacks (FGSM, PGD, BIM, and C\&W) and datasets. For each dataset, all models (except DenseNet121) exhibit identical values for \textbf{Acc-clean} and \textbf{Acc-adv} across all adversarial attacks, with only slight reductions: 13.44\% for MNIST, 9.38\% for CIFAR-10, and 0.94\% for CIFAR-100. DenseNet121, however, achieves significantly higher \textbf{Acc-clean} scores than the other models, with 98.12\%, 75.00\%, and 54.38\% on the MNIST, CIFAR-10, and CIFAR-100 datasets, respectively. Nevertheless, its \textbf{Acc-adv} results are considerably lower than its \textbf{Acc-clean} scores, except for the PGD attack on CIFAR-10 and CIFAR-100, where both \textbf{Acc-clean} and \textbf{Acc-adv} are 75\% and 54.38\%, respectively.

Overall, ATGR tends to make target models overly conservative, resulting in reduced performance on both clean and adversarial examples. However, this conservative approach can be advantageous for developing models that are more effective in detecting adversarial attacks on deep image classifiers. When an adversarial attack detector receives an input sample and yields a notably low classification accuracy, it indicates the likely presence of an adversarial attack.


Table \ref{EATR} presents the performance of the target models with the EATR defense solution. For the MNIST dataset, while ATWR enhances the robustness of all target models (except AlexNet) against PGD and C\&W attacks (as shown in Table \ref{ATWR}), EATR improves the robustness of all target models, including AlexNet, against all adversarial attacks—FGSM, PGD, BIM, and C\&W. The \textbf{Acc-drop} values are 0\% for the PGD attack and below 1\% for the other adversarial attacks. In addition, all target models achieve a strong balance between accuracy and adversarial robustness. For the CIFAR10 and CIFAR100 datasets, the defense performance of target models against all attacks (FGSM, PGD, BIM, and C\&W) is significantly improved with EATR, while ATWR only provides notable benefits against the PGD attack. However, in the case of the AlexNet model, EATR causes a substantial drop in both \textbf{Acc-clean} and \textbf{Acc-adv}. This decrease could be advantageous for adversarial attack detection, similar to the effect of ATGR, boosting the model’s ability to identify adversarial inputs.
 
\begin{table*}[htp]
\centering
\caption{Evaluation of the target models' robustness with the EATR defense against FGSM, PGD, BIM, and C\&W attacks on the MNIST, CIFAR-10, and CIFAR-100 datasets.}
\resizebox{16cm}{!}{
\begin{tabular}{|c|c|c|ccc|ccc|ccc|ccc|}
\hline
\multirow{2}{*}{\textbf{Dataset}}               & \multirow{2}{*}{\textbf{CNN model}} & \multirow{2}{*}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-origin\\ (Top-1)\end{tabular}}} & \multicolumn{3}{c|}{\textbf{FGSM}}                                                                                                                                                                           & \multicolumn{3}{c|}{\textbf{PGD}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{BIM}}                                                                                                                                                                            & \multicolumn{3}{c|}{\textbf{C\&W}}                                                                                                                                                                             \\ \cline{4-15} 
                                                &                                     &                                                                                        & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-clean\\      (Top-1)\end{tabular}}} & \multicolumn{1}{c|}{\textbf{\begin{tabular}[c]{@{}c@{}}Acc-adv\\ (Top-1)\end{tabular}}} & \textbf{Acc-drop} \\ \hline
\multirow{6}{*}{MNIST}                          & ResNet50                            & 100.00                                                                                 & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{98.44}                                                              & 0.62              & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{99.06}                                                              & 0.00              & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0.31              & \multicolumn{1}{c|}{99.06}                                                                     & \multicolumn{1}{c|}{98.44}                                                              & 0.62              \\ \cline{2-15} 
                                                & ResNet101                           & 100.00                                                                                 & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{98.12}                                                              & 0.63              & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0.00              & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0                 & \multicolumn{1}{c|}{98.75}                                                                     & \multicolumn{1}{c|}{98.12}                                                              & 0.63              \\ \cline{2-15} 
                                                & AlexNet                             & 100.00                                                                                 & \multicolumn{1}{c|}{99.38}                                                                     & \multicolumn{1}{c|}{99.06}                                                              & 0.32              & \multicolumn{1}{c|}{99.38}                                                                     & \multicolumn{1}{c|}{99.38}                                                              & 0.00              & \multicolumn{1}{c|}{99.38}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0.63              & \multicolumn{1}{c|}{99.38}                                                                     & \multicolumn{1}{c|}{99.38}                                                              & 0.00              \\ \cline{2-15} 
                                                & MobileNetV2                         & 100.00                                                                                 & \multicolumn{1}{c|}{95.00}                                                                     & \multicolumn{1}{c|}{96.25}                                                              & -1.25             & \multicolumn{1}{c|}{95.00}                                                                     & \multicolumn{1}{c|}{95.00}                                                              & 0.00              & \multicolumn{1}{c|}{95.00}                                                                     & \multicolumn{1}{c|}{95.31}                                                              & -0.31             & \multicolumn{1}{c|}{95.00}                                                                     & \multicolumn{1}{c|}{94.38}                                                              & 0.62              \\ \cline{2-15} 
                                                & DenseNet121                         & 100.00                                                                                 & \multicolumn{1}{c|}{99.69}                                                                     & \multicolumn{1}{c|}{98.75}                                                              & 0.94              & \multicolumn{1}{c|}{99.69}                                                                     & \multicolumn{1}{c|}{99.69}                                                              & 0.00              & \multicolumn{1}{c|}{99.69}                                                                     & \multicolumn{1}{c|}{99.38}                                                              & 0.31              & \multicolumn{1}{c|}{99.69}                                                                     & \multicolumn{1}{c|}{99.06}                                                              & 0.63              \\ \cline{2-15} 
                                                & InceptionNetV3                      & 100.00                                                                                 & \multicolumn{1}{c|}{97.50}                                                                     & \multicolumn{1}{c|}{96.88}                                                              & 0.62              & \multicolumn{1}{c|}{97.50}                                                                     & \multicolumn{1}{c|}{97.50}                                                              & 0.00              & \multicolumn{1}{c|}{97.50}                                                                     & \multicolumn{1}{c|}{97.19}                                                              & 0.31              & \multicolumn{1}{c|}{97.50}                                                                     & \multicolumn{1}{c|}{96.56}                                                              & 0.94              \\ \hline
\multirow{6}{*}{CIFAR10}                        & ResNet50                            & 93.13                                                                                  & \multicolumn{1}{c|}{83.75}                                                                     & \multicolumn{1}{c|}{41.56}                                                              & 42.19             & \multicolumn{1}{c|}{83.75}                                                                     & \multicolumn{1}{c|}{83.75}                                                              & 0.00              & \multicolumn{1}{c|}{83.75}                                                                     & \multicolumn{1}{c|}{21.25}                                                              & 62.50             & \multicolumn{1}{c|}{83.75}                                                                     & \multicolumn{1}{c|}{68.75}                                                              & 15.00             \\ \cline{2-15} 
                                                & ResNet101                           & 95.63                                                                                  & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{41.25}                                                              & 42.19             & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{83.44}                                                              & 0.00              & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{15.94}                                                              & 67.50             & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{65.94}                                                              & 17.50             \\ \cline{2-15} 
                                                & AlexNet                             & 89.06                                                                                  & \multicolumn{1}{c|}{\textbf{9.06}}                                                             & \multicolumn{1}{c|}{\textbf{9.06}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{9.06}}                                                             & \multicolumn{1}{c|}{\textbf{9.06}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{9.06}}                                                             & \multicolumn{1}{c|}{\textbf{9.06}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{9.06}}                                                             & \multicolumn{1}{c|}{\textbf{9.06}}                                                      & \textbf{0.00}     \\ \cline{2-15} 
                                                & MobileNetV2                         & 92.19                                                                                  & \multicolumn{1}{c|}{82.19}                                                                     & \multicolumn{1}{c|}{33.75}                                                              & 48.44             & \multicolumn{1}{c|}{82.19}                                                                     & \multicolumn{1}{c|}{82.19}                                                              & 0.00              & \multicolumn{1}{c|}{82.19}                                                                     & \multicolumn{1}{c|}{16.88}                                                              & 65.31             & \multicolumn{1}{c|}{82.19}                                                                     & \multicolumn{1}{c|}{62.81}                                                              & 19.38             \\ \cline{2-15} 
                                                & DenseNet121                         & 93.75                                                                                  & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{33.12}                                                              & 50.32             & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{83.44}                                                              & 0.00              & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{18.44}                                                              & 65.00             & \multicolumn{1}{c|}{83.44}                                                                     & \multicolumn{1}{c|}{65.62}                                                              & 17.82             \\ \cline{2-15} 
                                                & InceptionNetV3                      & 78.13                                                                                  & \multicolumn{1}{c|}{85.94}                                                                     & \multicolumn{1}{c|}{48.12}                                                              & 37.82             & \multicolumn{1}{c|}{85.94}                                                                     & \multicolumn{1}{c|}{85.94}                                                              & 0.00              & \multicolumn{1}{c|}{85.94}                                                                     & \multicolumn{1}{c|}{15.31}                                                              & 70.63             & \multicolumn{1}{c|}{85.94}                                                                     & \multicolumn{1}{c|}{58.12}                                                              & 27.82             \\ \hline
\multicolumn{1}{|l|}{\multirow{6}{*}{CIFAR100}} & ResNet50                            & 77.19                                                                                  & \multicolumn{1}{c|}{67.50}                                                                     & \multicolumn{1}{c|}{29.69}                                                              & 37.81             & \multicolumn{1}{c|}{67.50}                                                                     & \multicolumn{1}{c|}{67.50}                                                              & 0.00              & \multicolumn{1}{c|}{67.50}                                                                     & \multicolumn{1}{c|}{5.31}                                                               & 62.19             & \multicolumn{1}{c|}{67.50}                                                                     & \multicolumn{1}{c|}{45.94}                                                              & 21.56             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & ResNet101                           & 84.69                                                                                  & \multicolumn{1}{c|}{61.56}                                                                     & \multicolumn{1}{c|}{25.00}                                                              & 36.56             & \multicolumn{1}{c|}{61.56}                                                                     & \multicolumn{1}{c|}{61.56}                                                              & 0.00              & \multicolumn{1}{c|}{61.56}                                                                     & \multicolumn{1}{c|}{6.25}                                                               & 55.31             & \multicolumn{1}{c|}{61.56}                                                                     & \multicolumn{1}{c|}{41.25}                                                              & 20.31             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & AlexNet                             & 67.50                                                                                  & \multicolumn{1}{c|}{\textbf{0.94}}                                                             & \multicolumn{1}{c|}{\textbf{0.94}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{0.94}}                                                             & \multicolumn{1}{c|}{\textbf{0.94}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{0.94}}                                                             & \multicolumn{1}{c|}{\textbf{0.94}}                                                      & \textbf{0.00}     & \multicolumn{1}{c|}{\textbf{0.94}}                                                             & \multicolumn{1}{c|}{\textbf{0.94}}                                                      & \textbf{0.00}     \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & MobileNetV2                         & 80.94                                                                                  & \multicolumn{1}{c|}{43.75}                                                                     & \multicolumn{1}{c|}{15.00}                                                              & 28.75             & \multicolumn{1}{c|}{43.75}                                                                     & \multicolumn{1}{c|}{43.75}                                                              & 0.00              & \multicolumn{1}{c|}{43.75}                                                                     & \multicolumn{1}{c|}{9.69}                                                               & 34.06             & \multicolumn{1}{c|}{43.75}                                                                     & \multicolumn{1}{c|}{22.50}                                                              & 21.25             \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & DenseNet121                         & 81.56                                                                                  & \multicolumn{1}{c|}{15.94}                                                                     & \multicolumn{1}{c|}{11.88}                                                              & 4.06              & \multicolumn{1}{c|}{15.94}                                                                     & \multicolumn{1}{c|}{15.94}                                                              & 0.00              & \multicolumn{1}{c|}{15.94}                                                                     & \multicolumn{1}{c|}{11.88}                                                              & 4.06              & \multicolumn{1}{c|}{15.94}                                                                     & \multicolumn{1}{c|}{8.12}                                                               & 7.82              \\ \cline{2-15} 
\multicolumn{1}{|l|}{}                          & InceptionNetV3                      & 79.69                                                                                  & \multicolumn{1}{c|}{47.50}                                                                     & \multicolumn{1}{c|}{17.81}                                                              & 29.69             & \multicolumn{1}{c|}{47.50}                                                                     & \multicolumn{1}{c|}{47.50}                                                              & 0.00              & \multicolumn{1}{c|}{47.50}                                                                     & \multicolumn{1}{c|}{15.62}                                                              & 31.88             & \multicolumn{1}{c|}{47.50}                                                                     & \multicolumn{1}{c|}{25.62}                                                              & 21.88             \\ \hline
\end{tabular}
\label{EATR}
}
\end{table*}

\section{Conclusion and future work}

This work highlights the vulnerabilities of popular deep image classifiers to adversarial attacks such as FGSM, PGD, BIM, and C\&W. Our proposed defense strategies, including ATWR, ATGR, and EATR, provide valuable insight into mitigating these threats. While ATWR and EATR enhance robustness against strong attacks like PGD and C\&W while maintaining a balance with accuracy, ATGR offers a unique approach by transforming models into effective adversarial attack detectors. The findings underscore the importance of robust defense strategies for ensuring the security and reliability of machine learning systems in real-world applications. In future work, transfer adversarial attacks can be assessed across CNN models and extended to vision transformer architectures. This is crucial to developing more robust defenses against adversarial threats.
% \subsection*{Acknowledgement}
% Acknowledgement text.

% bibliography style is not predefined; authors can apply their own,
% but it should be sent to matjaz.gams@ijs.si with the accepted paper
% \sloppy  % Allow LaTeX to be more lenient with line breaks

\printbibliography
% \bibliographystyle{IEEEtran}
%  \bibliography{sample.bib}
%\bibliography{ref.bib}
% \begin{thebibliography}{99}
%   % book
%   \bibitem{} Author (year) {\it Title of the book}, Publisher.
%   % journal paper
%   \bibitem{} Author (year) Title of the paper, {\it Title of the journal}, Publisher, pp. nn--mm.
%   % conference
%   \bibitem{} Author (year) Title of the paper, {\it Title of the proceedings}, Publisher, Location, pp. nn--mm.
% \end{thebibliography}
\end{document}