# Enhancing CT Segmentation Security against Adversarial Attack: Most Activated Filter Approach
## 3 Experiments
### Experimental Results
#### 3.4.3 Comparative Evaluation of Adversarial Attack Detection of Ours against Baselines
Notably, the proposed method achieves a flawless PPV and sensitivity scores in all scenarios. The confusion matrices for both the proposed method and Park_spatial, which ranked second in the SMIA tests using an epsilon of 0.1 over 15 iterations, are analyzed as depicted in Figure 8. While it is the runner-up in performance, Park_spatial fails to detect 31 out of 228 adversarial samples and incorrectly flags 16 genuine samples as adversarial. Given that the baseline methods primarily focus on capturing the reconstruction error of the input image, they perform effectively when dealing with adversarial images that exhibit extreme perturbations. This is particularly evident with images having a high step size (EPS) of 0.1 and undergoing numerous iterations, such as 15. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attack** & **Method** & **NITR**EPS & **0.01** & **0.1** & **0.5** \\ \hline \multirow{8}{*}{SMIA} & Ours & 5 & **1.0000** & **1.0000** & **1.0000** \\  & Ours & 10 & **1.0000** & **1.0000** & **1.0000** \\  & & 15 & **1.0000** & **1.0000** & **1.0000** \\  & & 15 & **1.0000** & **1.0000** & **1.0000** \\ \cline{2-6}  & \multirow{4}{*}{MagNet} & 5 & 0.4934 & 0.4890 & 0.4890 \\  & & 10 & 0.4912 & 0.4890 & 0.4890 \\  & & 15 & 0.4890 & 0.4890 & 0.4890 \\ \cline{2-6}  & \multirow{4}{*}{Park} & 5 & 0.4934 & 0.4846 & 0.5000 \\  & & 10 & 0.4890 & 0.4846 & 0.5482 \\  & & 15 & 0.4890 & 0.4846 & 0.8223 \\ \cline{2-6}  & \multirow{4}{*}{Park\_spatial} & 5 & 0.4846 & 0.4693 & 0.4956 \\  & & 10 & 0.4737 & 0.4649 & 0.5943 \\ \cline{2-6}  & & 15 & 0.4715 & 0.4649 & 0.8969 \\ \hline \hline \end{tabular} Bold entries signify the highest performance under specific adversarial attack conditions.  
\end{table} 
Table 6: _Cont._ \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Attack** & **Method** & **NITR**EPS & **0.01** & **0.02** & **0.1** \\ \cline{3-8}  & Ours & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** \\  & MagNet & & 0.3750 & 0.0132 & 0.2857 & 0.0088 & 0.0000 & 0.0000 \\  & Park & & 0.4167 & 0.0219 & 0.4167 & 0.0219 & 0.2222 & 0.0088 \\  & Park\_spatial & & 0.4667 & 0.0614 & 0.4286 & 0.0526 & 0.2381 & 0.0219 \\ \hline \multirow{8}{*}{BIM} & Ours & 5 & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** \\  & & 10 & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** \\  & & 15 & **1.0000** & **1.0000** & **1.0000** & **1.0000** & **1.0000** \\ \cline{2-6}  & \multirow{4}{*}{MagNet} & 5 & 0.3750 & 0.0132 & 0.2857 & 0.0088 & 0.0000 & 0.0000 \\  & & 10 & 0.3750 & 0.0132 & 0.3750 & 0.0132 & 0.0000 & 0.0000 \\ \cline{2-6}  & \multirow{4}{*}{Park} & 5 & 0.4167 & 0.0219 & 0.3636 & 0.0175 & 0.0000 & 0.0000 \\  & & 10 & 0.4167 & 0.0219 & 0.3636 & 0.0175 & 0.1250 & 0.0044 \\ \cline{2-6}  & \multirow{4}{*}{Park\_spatial} & 5 & 0.4483 & 0.0570 & 0.3333 & 0.0351 & 0.1111 & 0.0088 \\  & & 10 & 0.4483 & 0.0570 & 0.3600 & 0.0395 & 0.0588 & 0.0044 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Comparative analysis of PPV and sensitivity in adversarial attack detection across different methods and types of attacks using CT imaging dataset. **Comparative Analysis for a Gastrointestinal Polyp Dataset**: The detection performance of the proposed method is compared to baseline approaches using a gastrointestinal polyp dataset, which utilizes a U-Net-based target model with filter 62 selected similarly to the CT imaging dataset. Table 8 provides a comparative analysis of PPV and sensitivity between the proposed method and the baselines. It is observed that the proposed method outperforms in PPV and sensitivity in most scenarios, with the exception of FGSM attacks at epsilon values of 0.01 and 0.1. The PPVs, 0.9383 for epsilon 0.01 and 0.9881 for epsilon 0.1, stand out, despite the target model's dice scores experiencing minimal or no decline from 0.8886 for both epsilon values. Conversely, in extreme cases, the baseline methods do not succeed in detecting adversarial samples.