# Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
## 5 Results and Discussion
### Deeper Clusterization  
Once the previous attacks are analyzed, other clusters are searched in the already defined clusters \(c_{0}\) and \(c_{1}\) in order to develop a more guided and precise attack. Supposing \(n\in\{0,1\}\), the goal is to find and misclassify a new subcluster \(c_{n}^{0}\subsetneq c_{n}\) while the others, \(c_{n}^{1}:=c_{n}\setminus c_{n}^{0}\) and \(c_{|n-1|}\), are well-classified. Notice that,  
\[c_{n}=c_{n}^{0}\cup c_{n}^{1} \tag{4}\]  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \(k\) & \(r_{c_{1}}^{(k,m_{sub},c_{1})}\) & \(r_{c_{0}}^{(k,m_{sub},c_{1})}\) & \(r_{c_{1}}^{(k,m_{sum},c_{1})}\) & \(r_{c_{0}}^{(k,m_{sum},c_{1})}\) \\ \hline
961 & 0.006 & 1 & 0.003 & 1 \\
1024 & 0.013 & 1 & 0.003 & 1 \\
1089 & 0.011 & 1 & 0.001 & 1 \\
2916 & 0 & 1 & 0.005 & 1 \\
3025 & 0 & 1 & 0.007 & 1 \\
3600 & 0 & 1 & 0.023 & 1 \\
3721 & 0.001 & 1 & 0.007 & 1 \\
3844 & 0.001 & 1 & 0.006 & 1 \\
4624 & 0 & 1 & 0.087 & 1 \\
4761 & 0 & 1 & 0.114 & 1 \\ \hline \hline \end{tabular}
\end{table}
Table 3: This table shows the best results obtained in the analysis \((k,m_{f},c_{1})\).  
and  
\[c_{|n-1|}=\left\{\begin{array}{ll}c_{0}&\text{si }n=1\\ c_{1}&\text{si }n=0\end{array}\right. \tag{5}\]  
The first method to detect \(c_{n}^{0}\) is by visualization implemented through the PCA algorithm [33], which may help us find possible subclusters inside \(c_{0}\) and \(c_{1}\). The proposed visualization is applied to the complete set of data to check if clusters \(c_{0}\) and \(c_{1}\) are distinguishable (Figure 8). The color of the visualization represents the mean distance of specific input data to the other samples. For visualization generation, the Hamming and the Euclidean distances are tested in the plots.  
Figure 8a with the Euclidean distance shows possible separation between two cluster that may coincide with the Figure 8c, where the color is labeled by model classes. Meanwhile, if the Hamming distance is used (Figure 8b), no differentiated subsets are found. For this reason, the visualization based on Euclidean distance is implemented to try to find subclusters in each \(c_{n}\) (Figure 9).  
Plots in Figure 9 show possible subclusters in \(c_{0}\) and \(c_{1}\), respectively. If darker samples are grouped in a concrete zone, this could be interpreted as desired subclusters. Thus, two algorithms based on Euclidean distance are implemented to isolate those possible subsets: K-means [34] and DBSCAN [35]. However, neither K-means nor DBSCAN can separate those possible subclusters successfully. Every generated \(c_{n}^{0}\) did not have any particular influential weight compared to \(c_{n}^{1}\). In other words, the values obtained in \(R(k,m_{f},c_{n}^{0})\) and \(R(k,m_{f},c_{n}^{1})\) with \(n\) in \(\{0,1\}\) were less than 0.5, i.e., the attacks were not successfully pursued, requiring further research and a more complex approach.  
Figure 8: The projection of the feature vectors generated by the PCA algorithm: (a) colors the dots using Euclidean distance, while (b) colors the dots by Hamming distance. In addition, (c) shows how the elements of each class are distributed, where the blue ones are labeled by zero and the red ones are labeled by one.  
Figure 7: The monitoring of (a) \(R(k,m_{sub},c_{1})\) and (b) \(R(k,m_{sum},c_{1})\) during the noise addition process.