# Defense Against Adversarial Attacks in Deep Learning
## 5 Experimental Results and Analysis
### The Evaluation of Defending Strategy  
In our overall defense strategy, to improve the robustness of the model and improve the accuracy of the model, we also used a model training method based on knowledge transfer. We first used the deep denoising network to remove the noise of the attack image, and then used the relatively clean image to train the model. To verify that the overall strategy was effective, we compared our proposed defense strategy with other existing defense methods. The results are shown in Table 3 and Figure 7. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Defense** & **Clean** & **WhiteTestSet** & **BlackTestSet** \\ \hline NA & 0.0000 & 0.0373 & 0.0157 \\ DAE & 0.0153 & 0.0359 & 0.0161 \\ PGD & 0.0138 & 0.0178 & 0.0145 \\
**UDDN** & **0.0125** & **0.0167** & **0.0134** \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The L1 distance between the input image and the denoised image. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Defense** & **Clean** & **WhiteTestSet** & **BlackTestSet** \\ \hline NA & 84.5\% & 22.3\% & 69.0\% \\ DAE & 66.1\% & 28.8\% & 62.7\% \\ PGD & 81.9\% & 58.2\% & 72.2\% \\
**UDDN** & **83.1\%** & **60.2\%** & **75.3\%** \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The accuracy of model with different denoising methods on the test datasets. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Defense** & **Clean** & **WhiteTestSet** & **BlackTestSet** \\ \hline NA & 84.5\% & 22.3\% & 69.0\% \\ Data Compression [13] & 82.2\% & 53.4\% & 55.8\% \\ PGD [27] & 83.3\% & 51.4\% & 70.0\% \\ DCN [28] & 81.9\% & 58.2\% & 72.2\% \\ Distillation [29] & 83.6\% & 56.3\% & 70.8\% \\
**Our method** & **83.9\%** & **61.2\%** & **76.5\%** \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The accuracy of model under different defending methods. As we can see from Table 3, these defensive algorithms have achieved certain effects in resisting the adversarial samples. When the model does not have any defensive strategies, the accuracy rates obtained under white box attacks and black box attacks are 22% and 69%, respectively. Under the white box attack, Data Compression and DCN improved the accuracy of the model by 30%, PGD and Distillation increased the accuracy by about 35%, and our algorithm improved the model by about 40%. Under the black box attack, Data Compression has no obvious defense effect. DCN, PGD and Distillation improve the accuracy of the model by about 2%. Our method improves accuracy by about 6%, which is three times than that of other methods. The experimental results of the model accuracy show that the model achieved the highest accuracy under the protection of our proposed defense mechanism, which proves that we have the strongest defense ability against the adversarial attacks. Therefore, we can see that no matter what kind of attack, under our proposed algorithm, the accuracy of the model is the highest, and the best defense effect is achieved. To prove the robustness of the strategy, the experiments were performed on different mainstream deep learning models and different datasets. Except for the LFW dataset, we performed experiments on the Youtube Face dataset (YTF) and Social Face Classification dataset (SFC) face datasets respectively. The results of the experiment are shown in Table 4.  
From Table 4, we can see that compared with the model without the defense algorithm, our defense strategy has achieved good defensive effects on the three face datasets. In the white box attack, our defense strategy improved accuracy by approximately 40% on three datasets. In the black box attack, our model improved the accuracy by about 5%. Therefore, our proposed strategy is valid across multiple datasets. Our proposed defense strategy does not apply to a special face recognition model. To prove that our proposed algorithm has good generalization, we have selected several popular networks and used the face dataset LFW for training. The results of the experiment are shown in Table 5.