# Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
## 5 Results and Discussion  
In this work, with the goal of avoiding an excessive number of options, the parameters \(\epsilon\) and \(s\) are fixed at 0.01 and 500, respectively. Therefore,  
\[(k,m_{f},c_{n},\epsilon,s)=(k,m_{f},c_{n},0.01,500):=(k,m_{f},c_{n}) \tag{3}\]  
As mentioned in Section 4, in this case, the classes are taken as clusters. That is why the investigation is divided into two main analyses, \((k,m_{f},c_{0})\) and \((k,m_{f},c_{1})\), where \(c_{0}\) refers to the cluster of class 0 and \(c_{1}\) refers to the cluster of class 1.  
The experiment begins by analyzing \((k,m_{f},c_{0})\). Table 2 shows the results from varying \(k\) and \(m_{f}\). Concerning \(k\), all integers between (26, 14,400) are tested, but the results shown in the table are selected according to the highest values of \(R(k,m_{sum},c_{0})\) and \(R(k,m_{sub},c_{0})\). The five highest results of each are shown.  
Therefore, Table 2 shows that in both strategies, \((k,m_{sum},c_{0})\) and \((k,m_{sub},c_{0})\), the accuracy of \(c_{0}\) is successfully reduced. However, the summation method achieves better results by misclassifying \(c_{0}\) and keeping the accuracy of \(c_{1}\) unmutated. Moreover, \(R(k,m_{f},c_{0})\) was monitored (Figure 6) during the noise incorporation process. Figure 6 shows how \(R(k,m_{f},c_{0})\) evolved when noise was added to the weights. It can be noticed how the initial modification has a high impact, while as more noise is added, there is less impact on the accuracy. It even reaches the point where new noise no longer impacts the predictions.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \(k\) & \(r_{c_{0}}^{(k,m_{sub},c_{0})}\) & \(r_{c_{1}}^{(k,m_{sub},c_{0})}\) & \(r_{c_{0}}^{(k,m_{num},c_{0})}\) & \(r_{c_{1}}^{(k,m_{num},c_{0})}\) \\ \hline
961 & 0.077 & 1 & 0.09 & 1 \\
1089 & 0.068 & 1 & 0.101 &In the case of analyzing \((k,m_{f},c_{1})\), Table 3 shows the best results obtained from \((k,m_{sub},c_{1})\) and \((k,m_{sum},c_{1})\) for different values of \(k\). The top five were selected from each one according to \(R(k,m_{f},c_{1})\).  
Table 3 shows that the attack manages to successfully reduce the accuracy of \(c_{1}\) in both strategies, \((k,m_{sum},c_{1})\) and \((k,m_{sub},c_{1})\). However, in this case, the subtraction method achieves better results by misclassifying \(c_{1}\) while keeping the accuracy of \(c_{0}\) unchanged. Moreover, \(R(k,m_{f},c_{1})\) was monitored (Figure 7) during the noise incorporation process. Figure 7 shows how \(R(k,m_{f},c_{1})\) evolved when the noise was being added to the weights. It can be noticed how the initial modification has a high impact, while as more noise is added, it has less impact on accuracy. It even reaches the point where new noise no longer impacts the predictions.  
Comparing both \((k,m_{f},c_{0})\) and \((k,m_{f},c_{1})\), the results are similar. However, in \((k,m_{f},c_{0})\), \(m_{sum}\) performs the best, while in \((k,m_{f},c_{1})\), \(m_{sub}\) has the best results. Moreover, there exists a small gap between the results of \((k,m_{f},c_{0})\) and \((k,m_{f},c_{1})\). Thus, the attack is more successful when misclassifying \(c_{1}\). This may be because the model classifies class 0 images better than class 1 images. Such knowledge could help the attacker decide what cluster to attack.