## 7 Results and Discussion
### User Authentication  
The results were slightly different for the user authentication experiment which forms the second part of our user verification algorithm. Since the authentication model was different for each user and each activity, the results for different users were averaged with respect to the activities that have been chosen for this discussion. In the case of authentication, the machine learning model was more confident with the misclassifications as compared to that of identification, where the mean probability scores in the case of adversarial misclassification went up to a maximum of 0.35, whereas the probability with which the machine learning model misclassified in the authentication experiment was in the range of (0.50, 0.75), Figure 6. Although there was still a significant amount of difference in the confidence of the model for original data versus the adversarial data, this does demonstrate that the threshold value must be analysed for each model.  
Figure 5: Decline in accuracy and increase in misclassification due to adversarial attack.  
Looking at the Equal Error Rate (EER) for authentication (Figure 7), when the model was fed with adversarial data, the value of EER kept increasing across all activities, however, the high performing activities from the user identification and user authentication remained similar and the six activities (i.e. walking, jogging, typing, clapping, drinking and eating a sandwich) chosen for this discussion overall performed better.  
One of the outliers observed in the trend of EER values was the performance of the machine learning model in the case of eating a sandwich where the model performs better with respect to the scores of other activities as well as with respect to the performance of the model in the case of original data. Therefore the relative difference between the two curves of EER is the minimum for the case of eating a sandwich. It can also be observed that the course of the plot remains the same for the rest of the activities as well as for both user identification and user authentication experiments, which reinforce that  
Figure 6: Mean prediction probabilities for authentication.  
Figure 7: EER for authentication: benign vs. adversarial data.  
the proposed algorithm is a stable choice for implementation. The other difference that can be observed from authentication results is that the overall percentage drop in the performance of the model, when tested with adversarial samples, is lower as compared to the identification attempt. Thus, the model is appropriately differentiating a user from their impostor and, with the threshold value, the results can be better trusted. As in the case of user identification, the model here also produces a comparably low accuracy in the case of clapping, but the frequency of the activity in the dataset is also an important factor as compared to that of drinking, or other gait-based activities such as walking or jogging, which are usually found to occur more than clapping, or specific hand-oriented activities. Accordingly, the low accuracy in the state of clapping or the wide gap between the model's confidence scores for eating a sandwich should not be considered a limitation for this approach; nevertheless, adding more data and better tuning of the model or using a deep learning model with additional data can significantly improve these holes.