# Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
## 4 Experiment
### Weight Modification  
In this work, the attack exploits the dense part of the detailed model; specifically, the first fully connected layer is the target of the weight modification attack. Briefly, we start by searching different image clusters from the breast cancer image dataset presented in Section 4.1. For each clustering, the attack described in Section 3 is applied and the results are discussed in Section 5. Once the model is trained, 2000 well-classified images (1000 per class) are selected randomly from the test data. The misclassified images are discarded from the test data since the internal behavior of the model is different or abnormal in those cases. This selected subset of images is separated by classes, generating two initial clusters. Next, the feature vectors of the images are obtained through the convolutional network (Figure 3). In this case, the first layer of the dense part is considered the targeted layer. The output of the convolutional block is a feature vector, where the output values of the convolutional layers from the vector are assigned to an input neuron of the dense block. Therefore, if the most-influential features in the prediction are known, the input neurons with the highest \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Layer Name** & **Layer Type** & **Input Size** & **Output Size** \\ \hline input\_2 & InputLayer & \((50,50,3)\) & \((50,50,3)\) \\ block1\_conv1 & Conv2D & \((50,50,3)\) & \((50,50,64)\) \\ block1\_conv2 & Conv2D & \((50,50,64)\) & \((50,50,64)\) \\ block1\_pool & MaxPooling2D & \((50,50,64)\) & \((25,25,64)\) \\ block2\_conv1 & Conv2D & \((25,25,64)\) & \((25,25,128)\) \\ block2\_conv2 & Conv2D & \((25,25,128)\) & \((25,25,128)\) \\ block2\_pool & MaxPooling2D & \((25,25,128)\) & \((12,12,128)\) \\ block3\_conv1 & Conv2D & \((12,12,128)\) & \((12,12,256)\) \\ block3\_conv2 & Conv2D & \((12,12,256)\) & \((12,12,256)\) \\ block3\_conv3 & Conv2D & \((12,12,256)\) & \((12,12,256)\) \\ block3\_pool & MaxPooling2D & \((12,12,256)\) & \((6,6,256)\) \\ block4\_conv1 & Conv2D & \((6,\,6,256)\) & \((6,6,512)\) \\ block4\_conv2 & Conv2D & \((6,\,6,512)\) & \((6,\,6,512)\) \\ block4\_conv3 & Conv2D & \((6,\,6,512)\) & \((6,\,6,512)\) \\ block4\_pool & MaxPooling2D & \((6,\,6,512)\) & \((3,\,3,512)\) \\ block5\_conv1 & Conv2D & \((3,\,3,512)\) & \((3,\,3,512)\) \\ block5\_conv2 & Conv2D & \((3,\,3,512)\) & \((6,\,6,512)\) \\ block5\_conv3 & Conv2D & \((3,\,3,512)\) & \((3,\,3,512)\) \\ block5\_pool & MaxPooling2D & \((3,\,3,512)\) & \((1,\,1,512)\) \\ flatten\_1 & Flatten & \((1,\,1,\,512)\) & \((512)\) \\ dense\_2 & Dense & \((512)\) & \((256)\) \\ dense\_3 & Dense & \((256)\) & \((2)\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Target model structure. impact are detected. With this in mind, the influence of the densest input neurons is studied through the computed feature vectors. The gradient is used as a metric of prediction impact to obtain the most-influential, densest input neurons. Once all gradients are calculated, two sets of the same size of gradient vectors are obtained (Figure 4). Note that a gradient vector of the same dimension is obtained for each feature vector. Each group contains various important values of the input neurons. Specifically, one value is assigned to a neuron for each gradient vector in the gradient set. Since a single value per feature is desired, the mean of the absolute value of all gradients associated with an input neuron is selected as a representative value indicating the impact level of the feature. Therefore, a single gradient vector is computed from each gradient set. The values of these vectors indicate the importance of the input features in predicting the selected cluster. Both clusters can share some highly influential features, but modifying the corresponding weights could also misclassify unwanted input data. Therefore, when choosing meaningful attributes for generating the attack on the specified cluster, it is essential to discard the features shared with the rest of the clusters (Figure 5).