# Enhancing CT Segmentation Security against Adversarial Attack: Most Activated Filter Approach
## 3 Experiments
### Experimental Results
#### 3.4.2 Comparative Analysis of Filter Efficacy in Adversarial Attack Detection  
For detecting adversarial attacks within this framework, the filter that best differentiates between genuine and adversarial samples is identified based on classification accuracy as Equation (4) on validation set. As a result, Figure 5a illustrates the classification performance used for each attack method on the validation set of CT imaging dataset. In the figure, filters 2, 6, 8, and 10, among others, are typically activated by the perturbations that can be observed. In contrast, filters 0, 12, 22, 48, and so forth show less distinct activation in response to the samples. Notably, those filters with pronounced activation consistently yield high detection accuracy.  
The significance of features associated with the most and least distinctive filters, specifically filter number 2 and filter number 22, is additionally examined. This analysis is conducted across FGSM, BIM, and SMIA for scenarios involving an epsilon of 0.01 and five iterations, excluding FGSM, as illustrated in Figure 7. The evaluation of feature importance is based on the mean decrease in impurity, a method used to assess how dependent variables impact prediction error in random forests [20]. The top 1% of features are presented according to their importance values. As indicated in the figure, the most distinctive feature predominantly concentrates on the background rather than the body, thus enabling easier distinction of adversarial samples from genuine ones. In contrast, the least distinctive feature primarily focuses on the structures surrounding the vertebrae, which may complicate the detection of attacks.  
Figure 5: Variability in accuracy across all attack methods is noted for features from the first layer (**a**), which is part of the first component, and from the intermediate layers (**b–f**), corresponding to the subsequent components of U-Net. Note that the results were obtained from a CT segmentation model.  
Figure 6: GFLOPS comparison across components, illustrating the GFLOPS for the first layer within the first component and separately for each of the first to fifth components.  
The classification accuracy for adversarial samples, based on filters determined from the validation set results, is detailed in Table 5. This table features two distinct filters for each attack method. Evidently, filter 22, which is not underscored, displays accuracy levels spanning from 62.94% to 100%. Conversely, the underscored filter 2 in the table, denoted by its selection in our proposed framework, invariably records an impeccable accuracy of 100%, underscoring its superior distinction capability. Put simply, while filter 22 identifies features activated by both genuine and adversarial samples, filter 2 specifically pinpoints features triggered exclusively by the adversarial sample.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attack** & **Filter** & \
\begin{tabular}{c} **NITR** \\ \end{tabular} & **
\begin{tabular}{c} **EPS** \\ \end{tabular}** & **0.01** & **0.02** & **0.1** \\ \hline \multirow{2}{*}{FGSM} & 22 & & 0.6820 & 0.6623 & 0.8531 \\  & 2 & & 1.0000 & 1.0000 & 1.0000 \\ \hline \multirow{4}{*}{BIM} & 22 & 5 & 0.6732 & 0.6732 & 0.8838 \\  & 22 & 10 & 0.6557 & 0.6294 & 0.8640 \\  & & 15 & 0.6623 & 0.6535 & 0.8596 \\ \cline{2-6}  & & 5 & 1.0000 & 1.0000 & 1.0000 \\ \cline{1-1}  & 2 & 10 & 1.0000 & 1.0000 & 1.0000 \\ \cline{1-1}  & 15 & 1.0000 & 1.0000 & 1.0000 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Classification accuracy of adversarial sample detection using selected filters by proposed framework in this work for CT segmentation model.  
Figure 7: Visualization of the top 1% of important features from classifiers trained using (**a**) the distinctive filter number 2 and (**b**) other than the distinctive filter number 22. These features are derived using the mean decrease in impurity from a random forest classifier for CT segmentation model.