# Enhancing CT Segmentation Security against Adversarial Attack: Most Activated Filter Approach
## 3 Experiments
### Experimental Results
#### 3.4.3 Comparative Evaluation of Adversarial Attack Detection of Ours against Baselines
Particularly, at low epsilon values, all baseline methods yield a PPV of NaN, suggesting that the attack detectors from these methods classify all samples as non-adversarial. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Attack**} & \multirow{2}{*}{**Method**} & \multirow{2}{*}{**NITR**EPS**} & \multicolumn{2}{c}{**0.01**} & \multicolumn{2}{c}{**0.02**} & \multicolumn{2}{c}{**0.1**} \\ \cline{5-8}  & & & **PPV** & **Sensitivity** & **PPV** & **Sensitivity** & **PPV** & **Sensitivity** \\ \hline \multirow{8}{*}{SMIA} & \multirow{3}{*}{Ours} & 5 & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** \\  & & 10 & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** \\  & & 15 & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** \\ \cline{2-8}  & \multirow{3}{*}{MagNet} & 5 & 0.2857 & 0.0088 & 0.0000 & 0.0000 & 0.0000 & 0.0000 \\  & & 10 & 0.1667 & 0.0044 & 0.0000 & 0.0000 & 0.0000 & 0.0000 \\  & & 15 & 0.0000 & 0.0000 & 0.0000 & 0.0000 & 0.0000 & 0.0000 \\ \cline{2-8}  & \multirow{3}{*}{Park} & 5 & 0.3636 & 0.0175 & 0.0000 & 0.0000 & 0.5000 & 0.0307 \\  & & 10 & 0.2222 & 0.0088 & 0.0000 & 0.0000 & 0.8056 & 0.1272 \\  & & 15 & 0.2222 & 0.0088 & 0.0000 & 0.0000 & 0.9565 & 0.6754 \\ \cline{2-8}  & \multirow{3}{*}{Park\_spatial} & 5 & 0.3600 & 0.0395 & 0.1111 & 0.0088 & 0.4667 & 0.0614 \\  & & 10 & 0.2000 & 0.0175 & 0.0000 & 0.0000 & 0.7867 & 0.2588 \\ \cline{2-8}  & & 15 & 0.1579 & 0.0132 & 0.0000 & 0.0000 & 0.9249 & 0.8640 \\ \hline \hline \end{tabular} Bold entries signify the highest performance under specific adversarial attack conditions.  
\end{table} 
Table 7: _Cont._  
Figure 8: (**a**) Proposed method in this work; (**b**) Baseline based on the previous work [10]. Confusion matrices for (**a**) our method and (**b**) Park_spatial, which achieved the second-best performance on SMIA tests with an epsilon of 0.1 and 15 iterations for CT segmentation model. 4.4 Visualization of Comparisons of Genuine Samples and Adversarial Samples Using Histogram Equalization  
Randomly selected genuine CT samples, alongside their adversarial versions, are displayed in Figures 9-11. The adversarial samples were generated using FGSM, BIM, and SMIA attack methods, each with an epsilon of 0.01. While BIM and SMIA used 5 iterations, FGSM did not. These samples represent the most challenging scenarios for human visual detection. Despite the modest epsilon value, as indicated in Table 3, the adversarial attacks have a subtle but pronounced effect. Such slight modifications can lead to major diagnostic inaccuracies potentially impacting patient care. To address this, histogram equalization as feature post-processing is applied. The visual representations underscore that while genuine and adversarial samples might appear similar to the naked eye, post-processing brings forth distinct feature differences when employing the most sensitive filters from 2 and 52. Perturbations, especially noticeable in the background of the adversarial samples, are frequently highlighted by these filters. Conversely, features processed with filters from 22 and 0, deemed less sensitive in prior analyses, fail to offer a stark visual contrast.