# PSI Analysis of Adversarial-Attacked DCNN Models
## 3 Experimental Results
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Layer**} & \multicolumn{5}{c}{**Median PSI Value**} \\ \cline{3-6}  & & **Benign** & **FGSM** & **PGD** & **CW** \\ \hline \multirow{5}{*}{AlexNet} & conv4 & 0.19 & 0.22 & 0.23 & 0.20 \\  & conv5 & 0.22 & 0.28 & 0.33 & 0.23 \\  & fc1 & 0.16 & 0.22 & 0.23 & 0.15 \\  & fc2 & 0.29 & 0.26 & 0.28 & 0.25 \\ \hline \multirow{5}{*}{VGG11} & conv1 & 0.20 & 0.23 & 0.13 & 0.22 \\  & conv2 & 0.19 & 0.18 & 0.17 & 0.18 \\ \cline{1-1}  & conv3 & 0.19 & 0.17 & 0.18 & 0.17 \\ \cline{1-1}  & conv4 & 0.18 & 0.17 & 0.17 & 0.16 \\ \cline{1-1}  & conv5 & 0.18 & 0.17 & 0.18 & 0.17 \\ \cline{1-1}  & conv6 & 0.20 & 0.22 & 0.19 & 0.19 \\ \cline{1-1}  & conv7 & 0.20 & 0.21 & 0.19 & 0.18 \\ \cline{1-1}  & conv8 & 0.25 & 0.28 & 0.24 & 0.24 \\ \cline{1-1}  & fc1 & 0.16 & 0.19 & 0.17 & 0.17 \\ \cline{1-1}  & fc2 & 0.29 & 0.27 & 0.17 & 0.25 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: _Cont._ \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Layer**} & \multicolumn{5}{c}{**PSI Peak Value**} \\ \cline{3-6}  & & **Benign** & **FGSM** & **PGD** & **CW** \\ \hline \multirow{5}{*}{AlexNet} & conv1 & 0.22 & 0.20 & 0.25 & 0.24 \\  & conv2 & 0.17 & 0.21 & 0.17 & 0.17 \\  & conv3 & 0.16 & 0.22 & 0.18 & 0.17 \\  & conv4 & 0.22 & 0.13 & 0.18 & 0.24 \\  & conv5 & 0.26 & 0.17 & 0.23 & 0.35 \\  & fc1 & 0.26 & 0.08 & 0.17 & 0.24 \\  & fc2 & 0.36 & 0.16 & 0.30 & 0.43 \\ \hline \multirow{5}{*}{VGG11} & conv1 & 0.15 & 0.20 & 0.17 & 0.17 \\  & conv2 & 0.15 & 0.19 & 0.18 & 0.18 \\ \cline{1-1}  & conv3 & 0.14 & 0.18 & 0.18 & 0.18 \\ \cline{1-1}  & conv4 & 0.14 & 0.18 & 0.19 & 0.19 \\ \cline{1-1}  & conv5 & 0.13 & 0.17 & 0.19 & 0.20 \\ \cline{1-1}  & conv6 & 0.22 & 0.16 & 0.20 & 0.20 \\ \cline{1-1}  & conv7 & 0.22 & 0.16 & 0.20 & 0.33 \\ \cline{1-1}  & conv8 & 0.25 & 0.24 & 0.33 & 0.36 \\ \cline{1-1}  & fc1 & 0.23 & 0.20 & 0.18 & 0.13 \\ \cline{1-1}  & fc2 & 0.37 & 0.23 & 0.32 & 0.32 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Layer-wise PSI peak values in AlexNet and VGG11 models for benign and adversarial examples from attacked ImageNet dataset. In the PSI analysis of the two DCNN models for the benign examples, it was found that the PSI, as the degree of sparseness, increased with the increase in the layers in the DCNNs. The observation that an increased median PSI at each layer aligned with greater behavioral relevance within the DCNNs implies that this phenomenon serves as a fundamental mechanism for efficiently representing a diverse range of objects. Essentially, this suggests that in the initial stages of visual processing, a larger population of general neurons is engaged to accurately process various natural objects. As we move up the processing hierarchy, these objects are parsed into more abstract features, leading to the involvement of a smaller, yet highly specialized, group of neurons in constructing this representation. This heightened level of sparsity significantly enhances the interpretability of these representations, as the extent of sparsity appears to predict behavioral performance primarily in the higher processing stages [16]. As shown in the median PSI values for the benign examples of the AlexNet and VGG11 models in Table 3, the median PSI values tended to increase progressively from convolution layer 2 to convolution layer 5 in AlexNet and to convolution layer 8 in VGG11, except for convolution layer 1. In the case of the Caltech256 dataset in Table 4, when benign examples were applied to the two models, it can be observed that the median PSI increased along the convolution layers entirely. In addition, as shown in the study of [16], it was observed that the last convolution layer, which corresponds to conv5 in AlexNet and conv8 in VGG11, and the last fully connected layers in the two models had a dramatical decrease in the median PSI value. In the PSI analysis, the same tendency was observed in the adversarial examples in both DCNN model.