## 4 Adversarial Attack and Defenses
### Effectiveness of the Three Defense Approaches  
Compared with the original model, GRU-DNN with MFE, PRs of the defense GRU-DNN with MFE via adversarial training and dimensionality reduction both decrease, as shown in Figure 14. The prediction similarity method detects adversarial attacks and returns the opposite class, for example, FP. This may affect the PR of the model. However, it can be seen from the experimental results in Figure 13 that the defense of GRU-DNN with MFE via prediction similarity and the original model leave little gap in PR. The PR of the prediction similarity is the closest to the original GRU-DNN with MFE among the three approaches.  
Figure 13: Dimensionality reduction encoders for GRU-DNN with MFE. (**A**) intermediate encoder; (**B**) intermediate autoencoder; (**C**) initial autoencoder.  
Additionally, the impacts of known and new adversarial attacks on the three defense approaches are investigated, as shown in Table 8. Adversarial training is the best option to differentiate among known adversarial examples. Unfortunately, if there are new adversarial attacks, it is unable to detect new adversarial attack attempts. In this case, adversarial training is therefore unreliable. For dimensionality reduction, even though it does not detect new adversarial attacks, new adversarial attacks are nevertheless distinguishable from known attacks to human eyes. Unlike the former two approaches, prediction similarity is capable of detecting new adversarial attacks with a success rate of 99.5%, which is obviously the highest among the three approaches.  
In sum, for adversarial training, dimensionality reduction and prediction similarity to improve the robustness of the GRU-DNN with MFE, the following conclusions can be drawn:  
1. Adversarial training increases the difficulty of generating new adversarial attacks. With the new adversarial examples obtained, the model has to be retrained to ensure those vulnerabilities are taken into consideration, which is an infinite recursive defense process.
2. Dimensionality reduction is effective at seeking new vulnerabilities, since the generation of new adversarial examples is detectable to the human eye. When PR remains stable, the GRU-DNN with MFE can be made more robust.  
Figure 14: PR comparison between defense models and original model.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Defense Approaches**} & \multicolumn{2}{c}{**Detection for**} & \multirow{2}{*}{\begin{tabular}{c} **Detection of New** \\ **Adversarial Attack** \\ \end{tabular} } & \multicolumn{2}{c}{**Detection of New**} \\  & & **Known** & & **Adversarial Attack** \\ \hline \multirow{3}{*}{\begin{tabular}{c} Adversarial training \\ \end{tabular} } & \multirow{3}{*}{92.0\%} & No new adversarial attack \\  & & & attempts are detected \\ \hline \multirow{3}{*}{\
\begin{tabular}{c} Dimensionality \\ reduction \\ \end{tabular} } & Intermediate encoder & 62.3\% & New adversarial attacks are not \\  & Intermediate autoencoder & 65.3\% & detected, but are known, and new \\  & Initial autoencoder & 71.7\% & attacks are distinguishable \\ \hline \hline \multirow{3}{*}{
\begin{tabular}{c} Prediction similarity \\ \end{tabular} } & \multirow{3}{*}{0\%} & The detection rate of the new \\  & & & adversarial attacks is 99.5\% \\ \hline \hline \end{tabular}
\end{table}
Table 8: Impacts of known and new adversarial attack on three defense approaches.  
3. Prediction similarity is only the addition of an external detection layer and does not necessitate the modification of the structure of GRU-DNN with MFE, such that the known adversarial examples are impossible to detect using this approach. However, it can be used as an effective input for risk assessment to detect with a high success rate when an adversarial attack is launched, thus significantly improving the robustness of the model.