# Enhancing CT Segmentation Security against Adversarial Attack: Most Activated Filter Approach
## 3 Experiments
### Experimental Results
#### 3.4.1 Empirical Evidence for Initial Layer Filter Selection  
The choice to select filters from the initial layer is grounded in the following empirical observations using CT imaging dataset:  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack** & **NITR**EPS & **0.01** & **0.1** & **0.5** \\ \hline FGSM & & 0.8886 & 0.8813 & 0.6950 \\ \hline \multirow{3}{*}{BIM} & 5 & 0.8872 & 0.6950 & 0.4591 \\  & 10 & 0.8813 & 0.4591 & 0.4591 \\  & 15 & 0.8713 & 0.4591 & 0.4591 \\ \hline \multirow{3}{*}{SMIA} & 5 & 0.8872 & 0.6950 & 0.4591 \\  & 10 & 0.8813 & 0.4591 & 0.4591 \\ \cline{1-1}  & 15 & 0.8712 & 0.4591 & 0.4591 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Comparison of dice scores of gastrointestinal polyp dataset for adversarial samples generated using FGSM, BIM, and SMIA, originating from a baseline dice score of 0.8886.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack** & **NITR**EPS & **0.01** & **0.02** & **0.1** \\ \hline FGSM & & 0.4164 & 0.3924 & 0.2555 \\ \hline \multirow{3}{*}{BIM} & 5 & 0.4195 & 0.3845 & 0.2254 \\  & 10 & 0.4260 & 0.3910 & 0.2330 \\  & 15 & 0.4263 & 0.3900 & 0.2254 \\ \hline \multirow{3}{*}{SMIA} & 5 & 0.3967 & 0.3518 & 0.1707 \\  & 10 & 0.3681 & 0.2967 & 0.1168 \\ \cline{1-1}  & 15 & 0.3322 & 0.2492 & 0.0907 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Comparison of dice scores of CT segmentation for adversarial samples generated using FGSM, BIM, and SMIA, originating from a baseline dice score of 0.4524.  
The first observation arises from the box plots illustrated in Figure 5. The box plots show the variability in detection accuracy across all attack methods. These are observed in the first layer, which constitutes the initial component, and in the intermediate layers corresponding to the subsequent components of the target model. The figure reveals a notable pattern: 15 out of 64 filters in the initial layer, including filters such as 2, 6, 8, and 10, consistently exhibit high detection accuracy with minimal variance. Interestingly, while the second, third, and fourth layers show remarkable stability with some filters (25 out of 64, 81 out of 128, and 54 out of 256, respectively) achieving perfect accuracy and zero variability, the fifth and sixth layers do not exhibit this trend, indicating a lack of zero variability filters and suggesting a more varied detection accuracy in these layers. However, the filters from the intermediate layers are not chosen, as elaborated in the following discussion.  
The second consideration relates to computational overhead, where there is a significant difference in computational requirements among the layers. The initial layer requires a relatively modest computational effort, estimated at 0.06 GFLOPS. In contrast, the computation cost from the first to the fifth component increases progressively from 2.50, 6.14, 9.77, 13.40, to 17.03 GFLOPS. This indicates a substantial increase in computational load when extracting features from the deeper layers, as illustrated in Figure 6.  
These empirical findings clearly underline the merits of features from the initial layer, striking a balance between detection accuracy and computational efficiency. Based on this evidence, these features are utilized to construct adversarial attack detectors tailored for various attack methodologies.  
Figure 5: _Cont._