## 5 Results and Discussion
### Detection Experiments for Various Attacks Based on KL Divergence  
While human eyes cannot discern the differences between normal samples and adversarial examples, in the high-dimensional space, neural networks can distinguish them with a high probability. To restore adversarial examples closer to normal samples, thus enabling the classifier to classify correctly, adversarial examples undergo transformations when passing through the AE. Disturbances are eliminated in the low-dimensional latent space. The divergence of adversarial examples through the AE is then altered, achieving the reconstruction of regular signals. Figure 6 showcases the differences in KL divergence values between adversarial examples generated by various attacks and the original samples. The term \"frequency\" in the figure refers to the number of samples falling within specific KL divergence intervals. From Figure 6, gradient-based attacks like FGSM, PGD, and BIM yield adversarial examples with a significant overlap in KL divergence value distribution with the original samples. Especially, PGD-generated adversarial examples concentrate in almost the same KL divergence value range as the original samples. By contrast, optimization-based attacks such as CW and Deepfool produce adversarial examples with discernible KL divergence value distribution differences from the original samples. Gradient method-based adversarial examples might show apparent waveform differences from the original signal since they are adjusted in the loss gradient direction of the model. Although humans can easily observe this difference, it might not be the primary feature that the AE emphasizes. Hence, the AE might face challenges in recovery and may only reconstruct waveforms resembling adversarial examples. Consequently, calculating KL divergence values for samples proves more apt for detecting adversarial examples generated by optimization-based attacks than those generated by gradient-based attacks. The method based on KL divergence is utilized for adversarial example detection evaluation. To verify its efficacy, two notable adversarial attacks based on optimization techniques, namely CW and Deepfool, were chosen, and the adversarial examples generated by them were tested. As shown in Figure 7, the KL divergence thresholds were set in a range, with the values 0.00001, 0.0001, 0.0005, 0.002, 0.01, 0.05, and 0.2. Under these thresholds, the observed detection rates for adversarial examples from CW ranged from 6.09% to 91.81% and for Deepfool from 5.72% to 98.63%. The false-positive rates, representing genuine samples incorrectly classified as adversarial, for CW varied from 0.07% to 14.46%, and for Deepfool ranged between 0.04% and 14.90%. Analyzing the data, as the threshold decreased, the detection rates of the adversarial examples generated by both CW and Deepfool witnessed a considerable decline. Specifically, at the highest threshold of 0.2, the detection rates for CW and Deepfool were 6.09% and 5.72%, respectively, indicating a low detection performance. However, at the lowest threshold of 0.00001, the rates reached 91.81% and 98.63%, respectively, showcasing a significant improvement in detection capabilities. Furthermore, it is evident that, although the detection rate of Deepfool remained consistently higher than CW's across all thresholds, their overall trends were largely analogous. This highlights the effectiveness of KL divergence as a detection measure for both types of attack methods. Moreover, the false-positive rates are equally important for understanding the trade-off between detection performance and misclassification of genuine samples. While the  
Figure 6: Multiple adversarial example detection based on Kullback–Leibler divergence. (**a**) FGSM; (**b**) PGD; (**c**) BIM; (**d**) CW; (**e**) Deepfool. detection rates are higher at lower thresholds, the false-positive rates also tend to increase, indicating a trade-off that needs consideration when setting the threshold.