## 4 Adversarial Attack and Defenses  
During the road transportation of hazmat, some errors in risk assessment or emergency rescue decision making can potentially lead to major accidents. The effectiveness of deep learning cannot be guaranteed when the dataset contains noise, errors and so forth. In particular, for the hazmat road transportation accident dataset, the sample size is relatively small, such that the results are likely to be biased and sensitive to noise and error. Therefore, it is necessary to improve the robustness of the GRU-DNN with MFE, reducing the number of false warnings caused by abnormal feedback data. Adversarial attacks are widely used in deep learning. Given an input, an adversarial attack tries to produce a perturbation or distortion to the input leading the input to be misclassified by a well-trained DNN. The antagonistic case must typically be misclassified with high confidence. Widely used adversarial attacks include FGSM [48], JSMA [49], DeepFool [50], C&W attack [51], etc. C&W attack was developed based on FGSM and transforms the generation of adversarial examples into a constrained optimization problem, minimizing the \(l_{0}\)-, \(l_{2}\)- or \(l_{\infty}\)-norm-based perturbations under the premise that the model outputs are all wrong results. Additionally, the formulation of the C&W attack can avoid the box constraint. The C&W attack is regarded as being a powerful attack that is more effective than FGSM, JSMA and DeepFool. It is able to generate an adversarial example that has a significantly smaller perturbation distance, especially on the \(l_{2}\)-norm metric [46]. In this paper, C&W attack with \(l_{2}\)-norm mode was performed, using the following constrained optimization problem. \[\text{minimize}\|\delta\|_{2}+c\text{max}\bigg{\{}\max_{i\
eq l}(\mathbf{Z}(\mathbf{X }+\delta)_{i})-\mathbf{Z}(\mathbf{X}+\delta)_{t},-\kappa\bigg{\}} \tag{12}\]  
\[\text{subject to }\mathbf{X}+\delta\in[0,1]^{n} \tag{13}\]  
where \(\delta\) denotes the adversarial perturbations and \(\delta=\{\delta_{1},\ldots,\delta_{n}\}\) where \(n=20\) in this paper. \(\|\delta\|_{2}\) is the \(l_{2}\)-norm and \(\|\delta\|_{2}=\left(\sum_{i=1}^{n}\delta_{i}^{2}\right)^{\frac{1}{2}}\). \(\mathbf{Z}(\cdot)\) denotes the hidden layer of the proposed model. \(t\) and \(l\) are the target and correct labels of \(\mathbf{X}\), respectively. \(\kappa\) represents the confidence that the adversarial example is misclassified. The higher the \(\kappa\), the stronger the attack ability, but the larger the perturbations of the adversarial example. The first term in Equation (7) represents the distance between normal sample \(\mathbf{X}\) and adversarial example \(\mathbf{X}+\delta\). The objective is to find a small change from \(\delta\) to \(\mathbf{X}\) such that the classification of \(\mathbf{X}\) is changed, but the result is still valid, which is reflected by the second term. The main part of the second term should have been in the constraint condition. Due to its high non \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **ACC (\%)** & **AUC** & **F1 (\%)** \\ \hline GRU-DNN with MFE & 87.6 & 0.91 & 87.7 \\ CNN with MFE & 88.1 & 0.77 & 83.6 \\ MLR with MFE & 75.4 & 0.62 & 67.1 \\ DNN with MFE & 82.5 & 0.81 & 78.1 \\ KNN with MFE & 88.7 & 0.82 & 88.3 \\ SVM with MFE & 83.3 & 0.80 & 81.5 \\ NB with MFE & 76.9 & 0.86 & 78.9 \\ DT with MFE & 83.2 & 0.85 & 83.3 \\ RF with MFE & 88.8 & 0.84 & 88.5 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Comparisons among nine models. linearity and box characteristic, it is added to the objective function for optimization with a hyperparameter \(c\), balancing the weight of the two terms and avoiding the box constraint. On the opposite side of adversarial attacks, various defense techniques have been developed that aim to either provide immunity from the attack or to identify the adversarial examples such that the decision of the DNN will be more robust. The evolution of attack and defense strategies has previously been presented as an \"arms race\".