## 3 Methodology
### Clustering of Adversarial Samples: Distance Metric and Degradation Potential  
We introduce a novel distance metric sensitive to the degradation potential of adversarial examples. This allows our clustering algorithm to group adversarial examples based on the degree of threat they present to the model, rather than solely on their proximity in the input space. First, we define the degradation potential of an adversarial example. Given a neural network model \(f\) with parameters \(\theta\), an input \(x\), and its corresponding adversarial input \(x_{adv}\), we define the degradation potential of \(x_{adv}\) on \(f\) as follows:  
\[\Delta_{adv}(x_{adv},f)=\
abla L(f(x_{adv},\theta),y) \tag{5}\]  
where \(L\) denotes the loss function between the model's prediction \(f(x_{adv})\) and the true label \(y\). \(\
abla L\) is the gradient of the loss function \(L\) with respect to the input. The term \(\
abla L(f(x_{adv};\theta),y)\) signifies the change in the model's loss caused by the adversarial example. Calculating this degradation potential is already performed when generating the adversarial samples, and all that should be done is to save it. Next, we define the distance metric \(D_{adv}\) between two adversarial examples \(x_{adv1}\) and \(x_{adv2}\) in a space governed by the \(l_{p}\) norm and the degradation potential \(\Delta_{adv}\):  
\[D_{adv}(x_{adv1},x_{adv2})=||x_{adv1}-x_{adv2}||_{p}+\lambda|\Delta_{adv}(x_{ adv1},f)-\Delta_{adv}(x_{adv2},f)| \tag{6}\]  
The \(||||_{p}\) captures the geometric distance between the two adversarial samples. \(\lambda\) is a trade-off parameter that controls the relative importance of the input space distance and the degradation potential difference. This metric ensures that adversarial examples causing a similar degree of degradation to the model performance are grouped together. Conversely, adversarial examples causing distinct levels of performance degradation might be separated, even if they are close in the input space. Thus, our distance metric allows the clustering algorithm to capture the nuanced characteristics of adversarial examples, differentiating clusters according to the nature and threat level of the adversarial samples. This, in turn, provides a more informed basis for adversarial training, resulting in more robust models. We are interested in a more nuanced way of characterizing the \"difference\" between degradation potentials of two adversarial samples. Rather than simply taking the absolute difference of degradation potentials, we could quantify the relationship between the degradation potentials of two adversarial samples. There are various methods to measure the correlation or similarity between two sets of data, such as Pearson correlation coefficient (PCC) [20], [PERSON]'s rank correlation coefficient [21], Kullback-Leibler (KL) divergence [22], and mutual information (MI) [23]. Among these, KL divergence and mutual information might be the most appropriate for our case since they are capable of capturing complex relationships between probability distributions, which could be useful given the highly nonlinear nature of deep neural networks. We could incorporate KL divergence or mutual information into the distance metric \(D_{adv}\) as follows:  
\[D_{adv}(x_{adv1},x_{adv2}) = ||x_{adv1}-x_{adv2}||_{p}+\lambda D_{KL}(\Delta_{adv}(x_{adv1},M )||\Delta_{adv}(x_{adv2},M)) \tag{7}\]  
where \(\lambda\) is trade-off parameters controlling the importance of the input space distance, the KL divergence, and the mutual information. \(D_{KL}(P||Q)\) is the KL divergence between the degradation potentials of \(x_{adv1}\) and \(x_{adv2}\). Let us say that \(P\) and \(Q\) are two probability distributions. The KL divergence of Q from P is defined as follows:  
\[D_{KL}(P||Q)=\sum_{i}P(i)log\frac{P(i)}{Q(i)} \tag{8}\]  
where \(i\) ranges over all possible events. In our case, \(P\) and \(Q\) are the probability distributions representing the degradation potentials of \(x_{adv1}\) and \(x_{adv2}\), respectively.