## 5 Results and Discussion
### Sample Restoration Experiment Based on Autoencoder  
A good reconstructor should be capable of reconstructing adversarial examples into their corresponding normal samples while retaining the essential features of normal samples. This improvement aims to enhance the recognition accuracy of adversarial examples without compromising the classifier's accuracy in identifying normal samples. As illustrated in Figure 8, the recognition rate of original samples was 86.36%, while the reconstructed recognition rate was 85.55%. It is evident that the reconstructed samples generated by the reconstructor from the original samples preserved their fundamental characteristics effectively. However, due to the nature of gradient-based attacks such as FGSM, PGD, and BIM, they severely disrupted the data's feature distribution during adversarial example generation. Even if the reconstructor could restore them within the normal sample's divergence distribution range, the classifier struggled to perform well. Under the settings of \(C=0\) and \(C=0.5\) for CW attacks, the recognition accuracy of adversarial examples generated by CW attacks was 16.55% and 15.55%, respectively. After the reconstruction, the classifier's recognition accuracy improved by 43.54% and 26.27%, respectively. For adversarial examples generated by Deepfool attacks, the recognition accuracy increased from 3.82% to 36.27% after the reconstruction by the reconstructor. It is evident that the reconstructor has a more pronounced effect on the reconstruction of adversarial examples generated by optimization-based attacks such as CW and Deepfool. Building upon this, further investigation was conducted into the reconstructor's capability to handle adversarial examples generated by CW and Deepfool attacks under different parameters. Figure 9a illustrates the recognition rates of adversarial examples generated by CW attacks under various attack parameters, denoted as \(C\), and the corresponding recognition rates of the reconstructed samples. By analyzing the data in Figure 9a, it is evident that as the parameter \(C\) increased, the recognition rate of the reconstructed samples gradually decreased. It decreased from 60.09% at \(C=0\) to 29.36% at \(C=1\), resulting \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack Types** & **Detection Rate** & **Parameters** & **Detection Method** & **Threshold** \\ \hline FGSM & 91.45\% & \(\varepsilon=0.2\) & reconstruction error & 0.0006 \\ \hline PGD & 81\% & \(\varepsilon=0.2\) & reconstruction error & 0.0006 \\ \hline BIM & 71\% & \(\varepsilon=0.2\) & reconstruction error & 0.0006 \\ \hline CW & 99.09\% & confidence = 0 & KL divergence & 0.0002 \\ \hline Deepfool & 99.90\% & overshoot = 0.005 & KL divergence & 0.0002 \\ \hline \multicolumn{4}{c}{overall detection rate} & \multicolumn{2}{c}{88.488%} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Assessment of adversarial example detection capabilities. in a decrease of 30.73%. Similarly, Figure 9 presents the recognition rates of adversarial examples generated by Deepfool attacks under different attack parameters, known as overshoot, and the corresponding recognition rates of the reconstructed samples. Consistently, the data from Figure 9 indicate that as the overshoot parameter increased, the recognition rate of the reconstructed samples progressively decreased. The value decreased from 36.27% with an overshoot of 0.00001 to 27.73% when the overshoot reached 0.1, marking a reduction of 8.54%. This restoration in reconstruction efficacy is attributed to the higher attack intensity associated with larger attack parameters in CW and Deepfool attacks, leading to more severe disruption of the data distribution during adversarial example generation, thus causing a decline in the reconstructor's restoration effectiveness. The experimental results indicate a significant improvement in the classifier's recognition rate when dealing with adversarial examples that have been reconstructed by the AE. This outcome could stem from two potential reasons.