# Enhancing CT Segmentation Security against Adversarial Attack: Most Activated Filter Approach
## 3 Experiments
### Experimental Results
#### 3.4.3 Comparative Evaluation of Adversarial Attack Detection of Ours against Baselines  
**Comparative analysis for a CT imaging dataset**: As outlined in Section 3.2.3, the baseline methods were developed according to the specifications detailed in their original publications. It is important to note that these baseline methods identify adversarial samples based on the reconstruction distance; that is, an adversarial sample is detected if its reconstruction distance exceeds a certain threshold. Given that only MagNet [11] provides a detailed process for determining the threshold in its original implementation, this procedure is adopted and applied uniformly across all other baseline methods to ensure consistency. Specifically, the maximum reconstruction error is calculated using the validation set, and this error value is then set as the threshold. Furthermore, the same test set was used to evaluate both the baseline methods and the proposed method in this study. Using the test set, a comparative analysis of classification accuracies for adversarial sample detection across various methods is presented in Table 6. As shown in the table, the approach from this work, which utilizes features from filter number 2 as selected in the previous section, consistently outperforms the baseline methods. Specifically, the proposed method achieves the perfect classification accuracy under different configurations, whereas the baseline methods seldom exceed a 50% accuracy rate--with the exception of SMIA under extreme settings (i.e., epsilon = 0.1 and 15 iterations) where the accuracy reaches 82.23% and 89.69% using [PERSON]'s variations. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attack** & **Method** & **NITR**EPS & **0.01** & **0.1** & **0.5** \\ \hline \multirow{4}{*}{FGSM} & Ours & **1.0000** & **1.0000** & **1.0000** \\  & MagNet & & 0.4956 & 0.4934 & 0.4890 \\  & Park & & 0.4956 & 0.4956 & 0.4890 \\  & Park\_spatial & & 0.4956 & 0.4912 & 0.4759 \\ \hline \multirow{4}{*}{BIM} & \multirow{4}{*}{Ours} & 5 & **1.0000** & **1.0000** & **1.0000** \\  & & 10 & **1.0000** & **1.0000** & **1.0000** \\  & & 15 & **1.0000** & **1.0000** & **1.0000** \\ \cline{2-6}  & \multirow{4}{*}{MagNet} & 5 & 0.4956 & 0.4934 & 0.4890 \\  & & 10 & 0.4956 & 0.4934 & 0.4890 \\  & & 15 & 0.4956 & 0.4956 & 0.4890 \\ \cline{2-6}  & \multirow{4}{*}{Park} & 5 & 0.4956 & 0.4934 & 0.4846 \\  & & 10 & 0.4956 & 0.4934 & 0.4868 \\ \cline{2-6}  & & 15 & 0.4934 & 0.4825 & 0.4693 \\ \cline{2-6}  & \multirow{4}{*}{Park\_spatial} & 5 & 0.4934 & 0.4825 & 0.4693 \\  & & 10 & 0.4934 & 0.4825 & 0.4693 \\ \cline{2-6}  & & 15 & 0.4934 & 0.4846 & 0.4671 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparative analysis of adversarial sample against CT imaging dataset detection accuracy across various methods. Note that the proposed approach in this work exclusively utilizes features from filter number 2. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attack** & **Filter** & **NITR**EPS & **0.01** & **0.02** & **0.1** \\ \hline \multirow{4}{*}{ SMIA} & \multirow{4}{*}{22} & 5 & 0.6557 & 0.7149 & 1.0000 \\  & & 10 & 0.6842 & 0.7346 & 1.0000 \\  & & 15 & 0.6886 & 0.8136 & 1.0000 \\ \cline{2-6}  & & 5 & 1.0000 & 1.0000 & 1.0000 \\ \cline{2-6}  & & 10 & 1.0000 & 1.0000 & 1.0000 \\ \cline{2-6}  & & 15 & 1.0000 & 1.0000 & 1.0000 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: _Cont._In addition, a side-by-side comparison of PPV and sensitivity among various methods is presented in Table 7, which also exploits features from filter number 2. As delineated by Equation (2) for PPV and Equation (3) for sensitivity, higher values for these metrics are preferable. A low PPV suggests that the method is prone to incorrectly labeling genuine samples as adversarial, while low sensitivity implies the method may fail to identify adversarial samples. As the table reveals, the proposed approach outperforms all other methods in both PPV and sensitivity across every configuration.