## 5 Conclusions and Future Work  
In this research, poisoning attacks on DNNs, including three new poisoning attacks, are studied and discussed deeply. We found that the poisoning attacks on non-DNN models may not perform well on DNN models. However, because DNNs are usually more complex and bigger than non-DNN models, the poisoning attacks on DNNs are usually hard to detect even if they should successfully attack DNN models under a relatively high poisoning rate. In this paper, we also discovered a new paralysis attack, known as the Category Diverse attack, which has a stronger paralysis effect than TensorFlowClog. It leads to serious accuracy drops compared to TenserClog under the same truncation coefficient. We also found that the standard deviation standardization can make the attack more imperceptible. In order to resist these new poisoning attacks, we proposed Data Washing algorithms developed based on autoencoders and integrated detections algorithms. Data  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Statistic** & **Algorithm** & **CP Attack [4]** & **Gaussian** \\  & **Cifar10 [36]** & **Cifar10 [36]** \\ \hline Accuracy & 0.9978 & 1.0 \\ \hline Precision & 0.8197 & 1.0 \\ \hline Recall & 1.0 & 1.0 \\ \hline F1 Score & 0.9009 & 1.0 \\ \hline \hline \end{tabular}
\end{table}
Table 10: Detection performance of IDA algorithm for “other attacks”. (Note that reconstruction error threshold is 2.5).  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Statistic** & **Algorithm** & **FC Attack ImageNet** & **FC Attack Cifar10** \\ \hline Accuracy & 0.9991 & 0.9970 \\ \hline Precision & 0.9901 & 1.0000 \\ \hline Recall & 1.0000 & 0.9700 \\ \hline F1 Score & 0.9950 & 0.9848 \\ \hline \hline \end{tabular}
\end{table}
Table 8: IDA detection algorithm performance for FC attacks against ImageNet and Cifar datasets. (Note that target attack detection threshold is 0.5.).  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Statistic** & **Algorithm** & **Original** & **CP Attack** & **0.1 Gaussian** \\  & **Cifar10** & **Cifar10** & **Cifar10** \\ \hline Mean & 1.0319 & 2.9455 & 4.4168 \\ \hline Standard deviation & 0.0485 & 0.0132 & 0.1720 \\ \hline \hline \end{tabular}
\end{table}
Table 9: Mean and standard deviation values of reconstruction error for attacks on Cifar10 dataset.  
Washing algorithms greatly reduce the effect of paralysis attacks and our experiments show that our algorithm makes the false positive rate of target attack drop to nearly zero. Integrated Detection algorithms can accurately detect three attacks through threshold-based schemes and collision tables, and our experiments also confirmed the excellent detection performance of our IDA algorithm. Based on the research conducted in this study, DNNs are expected to have a more powerful ability to resist poisoning attacks.  
Formal analysis, Y.-C.P.; Investigation, Y.-C.P. and C.-G.L.; Methodology, Y.-C.P. and C.-G.L.; Project administration, I.-H.L., J.-S.L. and Y.-C.P.; Writing--original draft, Y.-C.P.; Writing--review & editing, C.-G.L. All authors have read and agreed to the published version of the manuscript.  
The authors gratefully acknowledge the support of the Ministry of Science and Technology of the Taiwan under Grant MOST 108-2221-E-006-110-MY3, MOST 109-2221-E-041-001-, and MOST 111-2218-E-006-010-MBK.  
Not applicable.  
The software code and data used to support the findings of this study are available from the corresponding author upon request.  
The authors declare that they have no conflict of interest.