## 5 Experiments
### The Effect of Dimensionality Reduction  
To study the effect of dimensionality reduction, we show the clean and adversarial accuracy on MNIST of three configurations: (1) None: no reduction applied where we apply clustering on the initial dimensions of the data. (2) T-SNE: we apply t-SNE reduction to two dimensions. (3) PCA: we apply PCA reduction to two dimensions.  
From Table 3, it is evident that dimensionality reduction techniques, PCA and t-SNE, have substantially enhanced both the clean and adversarial accuracy across all models compared with when no dimensionality reduction was employed. This suggests that the process of dimensionality reduction can help in condensing the information contained in adversarial examples in a manner that facilitates better model performance.  
Moreover, it is interesting to observe that models preprocessed with t-SNE consistently outperformed those preprocessed with PCA across all clustering methods. This may suggest that t-SNE, with its nonlinear dimensionality reduction properties, is able to capture the complex structure of adversarial examples more effectively than PCA, which is a linear dimensionality reduction technique.  
\begin{table}
\begin{tabular}{l c c c} \hline \hline
**Model** & **Clean Accuracy \%** & **FGSM Accuracy \%** & **PGD Accuracy \%** \\ \hline Original model (clean data only) & 83.53 & 10.5 & 1.1 \\ AT baseline & 73.3 & 46.0 & 41.9 \\ K-means + AT & 75.6 & 49.5 & 44.4 \\ K-means\_ASC + AT & 75.5 & 49.9 & 44.5 \\ Agglomerative clustering + AT & 73.5 & 46.7 & 42.1 \\ Agglomerative clustering\_ASC + AT & 73.7 & 46.9 & 42.4 \\ DBSCAN + AT & 75.1 & 48.5 & 42.9 \\ DBSCAN\_ASC + AT & 75.3 & 48.9 & 43.5 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison of model robustness under FGSM and PGD attacks on CIFAR-10.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**Clean Accuracy**} & \multicolumn{3}{c}{**Adversarial Accuracy**} \\ \cline{2-7}  & **None** & **PCA** & **t-SNE** & **None** & **PCA** & **t-SNE** \\ \hline Original model (clean data only) & 98.5 & 98.2 & 98.3 & 17.2 & 18.4 & 20.9 \\ AT baseline & 89.1 & 89.3 & 89.0 & 81.8 & 81.9 & 81.7 \\ K-means + AT & 93.7 & 93.6 & 93.8 & 88.3 & 88.9 & 89.0 \\ K-means\_ASC + AT & 94.1 & 94.2 & 94.1 & 89.0 & 88.9 & 89.3 \\ Agglomerative clustering + AT & 92.5 & 92.54 & 92.6 & 87.9 & 88.0 & 88.1 \\ Agglomerative clustering\_ASC + AT & 92.7 & 92.8 & 92.8 & 88.2 & 88.6 & 88.7 \\ DBSCAN + AT & 95.4 & 95.6 & 95.5 & 91.7 & 91.9 & 92.0 \\ DBSCAN\_ASC + AT & 96.3 & 96.5 & 96.5 & 92.1 & 92.8 & 92.9 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Comparison of model performance after dimensionality reduction.  
Of all the models, the one using our proposed ASC algorithm with t-SNE preprocessing exhibited the highest clean and adversarial accuracy. This reconfirms the superiority of ASC in handling adversarial examples and highlights the synergistic effect of combining it with appropriate dimensionality reduction techniques.  
In conclusion, our results highlight the importance of considering the dimensionality of data in adversarial training. They also underscore the effectiveness of combining our proposed ASC algorithm with t-SNE dimensionality reduction for achieving high robustness against adversarial attacks. The utilization of dimensionality reduction techniques serves a dual purpose in our context. Specifically, it expedites the computational efficiency of clustering algorithms while also improving both the clean and adversarial accuracies of the model.