## 5 Results and Discussion
### Classifier Model  
The deep learning classifier we utilized is the DeepConvNet, which is a high-performance model capable of classifying the 11 modulation signals in the RML2016.10a dataset. It serves as a standard benchmark model. The DeepConvNet architecture comprises four convolutional layers, each followed by batch normalization and ReLU activation functions. Additionally, two of these convolutional layers apply max pooling operations to downsample the inputs. The channel sizes across these layers increase from 2 to 256. The model is concluded with a fully connected part that flattens the tensor outputs from the convolutional layers, passing through a linear layer with dimensions ranging from 256 \(\times\) 1 \(\times\) 16 to 512, followed by a ReLU activation layer and a dropout layer for regularization. The final linear layer reduces the size to the number of classes. During the forward pass, the input tensor passes through each of these layers sequentially. Comparative Experiments on the Degree of Difference in Reconstruction Errors under Different Paradigms  
In this experimental section, we will utilize adversarial examples as input to the detection AE and simultaneously obtain their reconstructed samples. Subsequently, we will calculate errors based on different norms to identify the most suitable norm for reconstructing error analysis. The optimal reconstruction error norm should differentiate between original and adversarial examples as much as possible. In other words, the reconstruction error for original and adversarial examples should be maximized to the greatest extent possible. In Table 1, we have documented the reconstruction error values based on \(L_{0}\), \(L_{1}\), \(L_{2}\), and \(|x|_{\infty}\) norms. The experimental results indicate that the reconstruction error based on the \(L_{0}\) norm is nearly 1 for both the original samples and all adversarial examples, making it unsuitable as a sample detection threshold benchmark. The threshold selection based on the \(L_{1}\) norm is also not a good reference point. The more suitable norms are the \(L_{2}\) norm and \(|x|_{\infty}\). Under these two norm benchmarks, there is a significant difference in the reconstruction error between the original samples and the three gradient-based adversarial examples, making them suitable as sample discrimination criteria. Under the \(L_{2}\) norm, the reconstruction error for the original sample is 0.0021, differing by 33% from the 0.0012 error of the FGSM-based adversarial example. In the \(|x|_{\infty}\) measurement, the two error values are 0.0530 and 0.0370, differing by 31%. Notably, regardless of the norm used for reconstruction error measurement, both types of optimization-based attacks, CW and Deepfool, have the same reconstruction error as the original sample. It can be observed that optimization-based attacks are very close to the original sample in explicit representation, making them undetectable by the reconstruction error-based detection method. Therefore, other methods are needed to detect adversarial examples generated by optimization-based attacks. Considering that \(|x|_{\infty}\) reflects the maximum value in a vector, it ensures that the perturbation of each element of the signal does not exceed a specific upper limit. Thus, we use \(|x|_{\infty}\) as a scale for measuring the reconstruction error. The detection rates under various reconstruction error thresholds based on \(|x|_{\infty}\) are shown in Table 2.  
Based on the analysis above, we conducted comparative experiments for the adversarial example threshold detection in Table 2. As shown in the table, both the FGSM and PGD adversarial examples were generated under a perturbation strength of 0.15. We tested thresholds from 0.0005 to 0.001 with a step size of 0.0001, and also conducted detection experiments with larger thresholds such as 0.002, 0.005, and 0.01.