## 4 The Proposed Detection and Restoration Framework
### Adversarial Example Restorer Method  
The detection method based on the reconstruction error has shown efficacy against gradient-based adversarial examples in signal processing. Gradient-based methods significantly alter a signal's structure, causing adversarial waveforms to diverge from clean samples. This divergence makes it challenging to restore the original structure. Despite the minimal waveform differences between optimized CW, Deepfool adversarial examples, and their original counterparts, neural networks can discern in high-dimensional spaces what human eyes cannot. When adversarial examples traverse the AE, their latent variables adjust to resemble clean samples. In the low-dimensional latent space, perturbations dissipate, enabling the AE to reconstruct normal signals from adversarial inputs. This restoration allows convolutional neural networks to accurately classify samples. The restoration layers are represented as:  
\[x_{h_{i+1}}=\mathrm{T}\big{(}W_{h_{i}}x_{h_{i}}+b_{h_{i}}\big{)} \tag{12}\]where the matrix \(W_{h_{i}}\) and vector \(b_{h_{i}}\) represent the weights and biases of the hidden layer \(h_{i}\), respectively. Their dimensions depend on the size of the input data, such that if the input data have dimensions \(m\), then \(W_{h_{i}}\in\mathcal{R}^{m\times r}\) and \(b_{h_{i}}\in\mathcal{R}^{m}\). Conversely, if the input data dimensions are \(r\), then \(W_{h_{i}}\in\mathcal{R}^{r\times m}\) and \(b_{h_{i}}\in\mathcal{R}^{r}\). Within this context, \(x\) denotes the hidden neurons, and the function \(T(\bullet)\) acts as the restoration function. An important aspect to note is that the initial input \(x_{h_{o}}\) to the restorer corresponds to \(h_{t}\). Building on these details, the computation for the output layer can be represented by the subsequent equation:  
\[\ddot{\phi}=T(W_{r}x_{h}+b_{r}) \tag{13}\]  
where \(W_{r}\in\mathcal{R}^{r\times m}\) and \(b_{r}\in\mathcal{R}^{m}\) are the weight matrix and bias of the final hidden layer, respectively. The encoder of the AE maps the two-dimensional I/Q signal to a high-dimensional feature representation \(z\) of size \(m\times n\) using multiple fully-connected layers:  
\[z=f\big{(}W^{\prime}f(Wx+b)+b^{\prime}\big{)} \tag{14}\]  
where \(x\) is the input signal, \(W,b,W^{\prime}\), and \(b^{\prime}\) are weight matrices and bias vectors for respective layers, and \(f\) is the nonlinear activation function. The decoder, similar in structure, aims to reconstruct the input from the latent space \(z\) and feeds the output to a classifier. \[\hat{x}=g\big{(}W^{\prime\prime\prime}g\big{(}W^{\prime\prime}z+b^{\prime\prime }\big{)}+b^{\prime\prime\prime}\big{)} \tag{15}\]  
where \(z\) is the output of the encoder, \(W^{\prime\prime\prime}\) and \(b^{\prime\prime}\) represent the weight matrix and bias vector of a particular fully connected layer in the decoder, and \(W^{\prime\prime\prime}\) and \(b^{\prime\prime\prime}\) correspond to the subsequent fully-connected layer in the decoder. The function \(g\) is a nonlinear activation function. Ultimately, \(\hat{x}\) is the output of the decoder, representing the reconstructed data. An ideal decoder, in operation, should not introduce significant changes to normal samples; for adversarial examples, it should induce sufficient alterations to revert them to normal samples. However, these modifications should not exceed the divergence distribution range of normal samples. On this premise, our framework aims to enhance the classification accuracy of adversarial examples while retaining the accuracy for normal samples unchanged. To revert adversarial examples back to normal samples, we employ an AE as the decoder. Leveraging the latent variable characteristics of AE in generative models, we can amplify the divergence of the latent variables for adversarial examples, reconstructing them back to normal samples. The formula for divergence minimization can be expressed as:  
\[ \begin{split}\min D_{KL}(Q_{\phi}(z\mid X)\|P_{\theta}(z))\\ \text{s.t. }D_{KI}\leq\eta\end{split}