## 4 Experiments and Results
### Results and Analysis
#### 4.2.2 The Results of Evasion Attacks  
For evasion attacks, the attacks adjusted the data to introduce malicious samples during the testing phase. This was achieved by performing gradient-based operations to fool the DL model, stopping it from detecting any strange behavior. As a result, a drop in the accuracy of the model and in other performance metrics was recorded. The BIM and FGSM attacks affected the performance of the model for all datasets and fooled the DL model, as shown in Tables 6 and 7. In the case of subject 1 and subject 2, we created two scenarios; these are named \"Before Attack\" and \"After BIM Attack\", as shown in Table 6. For both scenarios, we used the same parameters to report the results. In the case of subject 1, Table 6 shows that before the attacks, the achieved accuracy was 97.59%, with a loss of 0.1%. However, a severe accuracy drop to 79% was reported after the BIM attack. A similar scenario can be seen for subject 2, showing a similar drop in all performance metrics. Figure 3: The variations in the data from adversarial Data Poisoning Attack 2 (epsilon): (**a**) subject 1, (**b**) subject 2. Figure 2: The variations in the adversarial Data Poisoning Attack 1 results (epsilon): (**a**) subject 1, (**b**) subject 2. As seen in Figure 4a, we applied different epsilon values, which represent the amounts of BIM adversarial attack content for the subject 1 dataset (0.00001, 0.00100, 0.00200, and 3.00000). The figure shows the achieved accuracy values of 71%, 59%, 52%, and 15%, respectively. In Figure 4b, we applied the same epsilon values, which resulted in different accuracy values of 42%, 38%, 38%, and 38%, respectively. In Figure 4, we applied a different approach by depicting the accuracy value before and after the attacks, along with the variations in the epsilon values. It is clear that a sharp drop was recorded, which increased along with the increase in the amount of adversarial content. In a similar way, Table 7 shows the results of the proposed model before and after the FGSM attacks, which can be considered a type of evasion attack. As is reported, for both subjects, the model exhibited a sharp drop in all metrics after the attacks. Figure 5a shows the similarly applied different epsilon values, which represent the amounts of FGSM adversarial attack content for the subject 1 dataset (0.00001, 0.00100, 0.00200, and 3.00000), and shows the achieved accuracy values of 63%, 63%, 63%, and 61%, respectively. Figure 5b shows the similarly applied same epsilon values, which resulted \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Subject No.**} & \multicolumn{2}{c}{**With Attack or**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Loss**} & \multirow{2}{*}{**Recall**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**F1-Score**} \\  & \multicolumn{2}{c}{**Without**} & & & & & \\ \hline \multirow{3}{*}{**Subject 1**} & Before Attack & 97.59\% & 0.1\% & 99.40\% & 95.56\% & 97.59\% \\  & After BIM & 79\% & 0.4\% & 50\% & 31\% & 73\% \\ \hline \multirow{3}{*}{**Subject 2**} & Before Attack & 99.99\% & 0.01\% & 99.93\% & 99.87\% & 99.90\% \\  & After BIM & 55\% & 0.2\% & 51\% & 78\% & 37\% \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The BIM attack results. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Subject No.**} & \multicolumn{2}{c}{**With Attack or**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Loss**} & \multirow{2}{*}{**Recall**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**F1-Score**} \\  & \multicolumn{2}{c}{**Without**} & & & & & \\ \hline \multirow{3}{*}{**Subject 1**} & Before Attack & 97\% & 0.1\% & 99\% & 95\% & 97\% \\  & After FGSM & 63\% & 0.5\% & 50\% & 50\% & 33\% \\ \hline \multirow{3}{*}{**Subject 2**} & Before Attack & 99\% & 0.01\% & 99.93\% & 99.87\% & 99.90\% \\  & After FGSM & 71\% & 0.3\% & 53\% & 49\% & 53\% \\ \hline \hline \end{tabular}
\end{table} 
Table 7: FGSM attack results.