# A Holistic Review of Machine Learning Adversarial Attacks in IoT Networks
## 5 Adversarial Defense Methods in IoT Networks
### Data Optimization
#### 5.2.1 Adversarial Training  
It is one of the proactive approaches to countering against adversarial attacks. The fundamental goal is to intentionally add adversarial samples into the training set to increase the regularity and robustness of the target model.  
When [PERSON] et al. [15] proposed the FGSM attack, they also introduced for the first time an adversarial training technique in the field of imaging by adding adversarial samples to the training set. However, [PERSON] et al. [51] were the inaugural researchers to theoretically formulate and provide proof through the perspective of robust optimization for DL. Researchers have displayed a notable level of interest in this area of study. This led to multiple contributions proposing several variants of adversarial training method trying to overcome the limitations of this method, such as the data generalization and overfitting, as well as the decreased efficiency to the black-box attacks and the cost can be substantial due to the iterative nature of training the model with adversarial examples.  
For large models and data sets, [PERSON] et al. [50] made suggestions for adversarial training. Building on the idea that brute force training regularizes the network and reduces overfitting, [PERSON] et al. [92] proposed the 'Virtual Adversarial Training' approach to smooth the outcome distributions of the neural networks. [PERSON] et al. [93] proposed the'stability training' method to improve the resilience of neural networks against small distortions. In their work, [PERSON] et al. [94] put forth the Ensemble Adversarial Training (EAT) to augment the diversity of adversarial samples. [PERSON] et al. [95] proposed a method known as Multi-strength Adversarial Training (MAT), which integrates adversarial training samples and diverse levels of adversarial strength. [PERSON] et al. [96] proposed the Mixed-minibatch PGD (M-PGD) adversarial training approach, which combines clean and adversarial examples. Their approach includes a logit pairing strategy with two methods: pairing clean with adversarial samples and pairing clean with clean samples. In the training process, [PERSON] et al. [97] propose to take into consideration the distinctive impact of misclassified clean examples using the so-called Misclassification Aware adveRsarial Training (MART) method. In the objective to solve the generalization issue, [PERSON] et al. [98] suggested a spectral normalization-based regularization for adversarial training. [PERSON] et al. [99] proposed a bilateral adversarial training method, which involves perturbing the input images and their labels during the training process. In their work, [PERSON] et al. [100] proposed the Universal Adversarial Training (UAT) method that produces robust models with only two tile the cost of natural training. [PERSON] and [PERSON] [101] also introduced a dropout scheduling approach to enhance the effectiveness of adversarial training by using a single-step method. For the overall generalization of adversarially trained models, [PERSON] et al. [102] suggested Robust Local Features for Adversarial Training (RLFAT) that involves randomly reshuffling a block of the input during training. [PERSON] et al. [103] propose the integration of a hypersphere method. This method ensures that features are regularized onto a compact manifold.