# Enhancing CT Segmentation Security against Adversarial Attack: Most Activated Filter Approach
## 3 Experiments
### Implementation Details
#### 3.2.3. Adversarial Attack Detector  
The adversarial attack detectors described in this study, along with the baseline models are implemented.  
* **Ours:** Random forest [20] is utilized to distinguish between adversarial attacks based on clean and corrupted features, as shown within the green box in Figure 2. The source code of the framework proposed by this paper is available at the following URL: [[https://github.com/hyerica-bdml/adv_detection_ct_segmentation](https://github.com/hyerica-bdml/adv_detection_ct_segmentation)]([https://github.com/hyerica-bdml/adv_detection_ct_segmentation](https://github.com/hyerica-bdml/adv_detection_ct_segmentation)), accessed on 1 September 2023.
* **MagNet [11]:** This approach employs an auto-encoder to capture the distribution of genuine samples. During training, the method aims to minimize the reconstruction  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Component** & **Operation** & **In Channels** & **Out Channels** \\ \hline Up 4 & Upsample + DoubleConv & 128 & 64 \\ \hline Output & Conv2d & 64 & 14 or 2 \\ \hline \hline \end{tabular}  
* Each DoubleConv module comprises two convolutional layers, with each layer being followed by batch normalization and ReLU activation. 2 Additionally, each MaxPool operation halves the spatial dimensions.
* Furthermore, the output is concatenated with that of the corresponding Down layer.  
\end{table}
Table 1: _Cont._error between the original and reconstructed samples. Subsequently, it evaluates the distance between the input and its reconstruction to identify an adversarial sample if the reconstruction error exceeds a predetermined threshold. However this method is not specialized for medical domain but verified for MNIST [21] and CIFAR [22]. In this work, the method is reimplemented using PyTorch [23], based on the original source code, which was written in TensorFlow [24] ([[https://github.com/[PERSON]/MagNet/blob/master/defensive_models.py](https://github.com/[PERSON]/MagNet/blob/master/defensive_models.py)]([https://github.com/[PERSON]/MagNet/blob/master/defensive_models.py](https://github.com/[PERSON]/MagNet/blob/master/defensive_models.py)), accessed on 1 September 2023).
* **[PERSON] [10]:** This approach employs a deep segmentation model specialized for the medical domain to approximate the distribution of authentic samples, functioning in a manner similar to an auto-encoder. While this bears similarities to MagNet [11], a key distinction lies in the input processing. Unlike MagNet, which takes raw input, this method first transforms the input into the frequency domain via discrete Fourier transform (DFT). Since the transformed image includes both real and imaginary values, the absolute value of the complex number is taken to yield a real value. Subsequently, this value is log-scaled and divided by 10 to normalize it to the range of 0 to 1. The adversarial samples are then identified by calculating the difference between the reconstructed output from the auto-encoder and the original input, using a hyper-parameterized threshold for the final decision.
* **Park_spatial [10]:** Consistent with the original approach outlined in [PERSON] [10], the use of DFT has been excluded in the implementation. For both Park and Park_spatial, the hyper-parameters are sourced from the MagNet implementation, as these were not provided in [PERSON]'s original paper.  
Table 2 provides an overview of the methods' key features.