## 4 The Proposed Detection and Restoration Framework
### Detection Method Based on Reconstruction Error  
Compared to supervised learning methods, the reconstruction-based detection approach eliminates the need for adversarial examples. This is because this approach does not require labeled anomalous data or prior knowledge of the features of anomalous data. Moreover, this method can capture implicit anomalies that have not appeared in the training data, which contributes to enhancing the generalization capability of the detector. Our framework utilizes an AE-based approach for detecting adversarial examples, using only regular samples during modeling. Adversarial attacks introduce minor alterations to original data, challenging accurate reconstructions by machine learning models. To address this, we use an AE to reconstruct the input and compute the reconstruction error. If this error exceeds a threshold, the data are identified as an adversarial example. The AE, represented as \(ae=d\circ e\), comprises an encoder, which compresses input data into a low-dimensional representation, and a decoder that tries to reconstruct the original data from this encoded format. When dealing with signal datasets consisting of In-phase (I) and quadrature (Q), considering their characteristics, we propose a method that combines reconstruction errors with signal features to enhance the performance of the AE. Specifically, we focus not only on the reconstruction error but also introduce a signal feature measurement to better capture the subtle perturbations in I/Q signals. To enable the model to better capture the properties of I/Q signals, we introduce an enhanced loss function that optimizes the reconstruction error separately for the I component and Q component. Specifically, our loss function is defined as follows:  
\[L(X_{\text{train}})=\frac{1}{|X_{\text{train}}|}\sum_{x\in X_{\text{train}}} \left(\|x_{I}-ae(x)_{I}\|_{2}^{2}+\|x_{Q}-ae(x)_{Q}\|_{2}^{2}\right) \tag{7}\]  
where \(x_{I}\) and \(x_{Q}\) represent the I and Q components of the input data, and \(ae(x)_{I}\) and \(ae(x)_{Q}\) represent the reconstructed outputs of the AE for the respective components. This decomposition allows us to calculate the reconstruction error separately for each component and then compute a weighted average of the errors from both components. This ensures that the model is optimized for both the I and Q components. Figure 4: Designed restoration AE. Given an input sample \(x\), the reconstruction error, derived from the I and Q channels, is defined as:  
\[E(x)=\frac{1}{N}\sum_{n=1}^{N}\Bigl{(}\|x_{I,n}-ae(x)_{I,n}\|_{2}^{2}+\|x_{Q,n}- ae(x)_{Q,n}\|_{2}^{2}\Bigr{)} \tag{8}\]  
where \(N\) is the sample count per channel. This function gauges discrepancies in both channels for each sample, ensuring comprehensive signal representation. The AE learning comprises two stages:  
* Encoder: Produces a compressed data representation. * Decoder: Reconstructs the original data from this representation. For adversarial examples, a high reconstruction error is anticipated, but it is minimal for regular test samples. A threshold \(t_{\text{re}}\) distinguishes normal samples. It is set as low as possible to detect subtle adversarial perturbations, but not so low as to misclassify regular samples. Typically, \(t_{\text{re}}\) is set based on the error distribution within a validation set. The method involves selecting a threshold. This threshold is determined by minimizing the proportion of samples whose reconstruction errors exceed it, relative to the total number of samples. This method can avoid overfitting and issues with model instability. Additionally, the threshold can be adjusted according to the specific needs of the application. The algorithmic process is outlined in Algorithm 1.