# PSI Analysis of Adversarial-Attacked DCNN Models
## 3 Experimental Results  
To clarify the relationship between adversarial examples and the PSI, we analyzed the research contents related to the sparseness coding scheme studied by [PERSON] et al. (2016). They presented significant insight regarding the PSI through the utilization of pre-trained AlexNet and VGG11 models on both the ImageNet and Caltech256 datasets. Their examination of the PSI values within the context of the ImageNet validation dataset revealed consistently modest values across all layers for every object category (median \(<\) 0.4), with the highest values not surpassing 0.6 in their conducted experiments. This observation suggests the widespread adoption of a sparse coding approach throughout all layers of the DCNNs for the purpose of object representation. Figure 3 illustrates the experimental findings depicting variations in the PSI values based on the layer, as depicted in [16]. Another noteworthy finding surfaced as the distributions of PSI for all categories exhibited considerable breadth (range \(>\) 0.2) across each layer, indicating pronounced variations in sparsity across distinct object categories. Notably, it was observed that the  
Figure 3: Experimental results in [16] of hierarchical sparse coding for object categories in DCNNs. The sparsity was assessed by means of the PSI for individual object categories within each layer, employing the ImageNet dataset. median PSI values displayed an inclination to rise progressively along the hierarchy, both in the convolutional and fully connected layers, respectively. The median PSI trajectory, however, was not strictly monotonic, with the initial layer showing slightly higher PSI than its immediate neighbors. Interestingly, despite the dissimilar number of convolutional layers between AlexNet and VGG11, a marked elevation in the median PSI was evident in the last two layers. To investigate the relationship between adversarial examples and the PSI, we generated adversarial examples through FGSM attack on the ImageNet validation dataset. Then, the adversarial examples by FGSM attack were applied to pre-trained AlexNet and VGG11 models. Figure 4 shows the hierarchical sparse coding for object categories by FGSM-attacked adversarial examples in AlexNet and VGG11. It was commonly observed in AlexNet and VGG11 that the median of the PSI in the FGSM-attacked ImageNet dataset was in a lower range (median \(<\) 2.5) than the values in the benign ImageNet dataset. In the experimental results in [16], the median of the PSI in AlexNet gradually increased after convolutional layer 2, but in the case of FGSM attack, it continuously decreased until convolutional layer 4, and then increased in the last convolutional layer. In the fully connected layer, the value of the median of the PSI rather decreased, which is opposite to the result in [16]. In comparison to the normal validation ImageNet dataset in Figure 3, despite the increase in the number of layers in AlexNet, the graph hardly shifted to the right; rather, a left shift was observed in the fully connected layer. From the overall observation, the  
Figure 4: Hierarchical sparse coding for object categories by FGSM adversarial samples in DCNN. In comparison to the results of the normal ImageNet validation dataset in Figure 3, the right shift of the graph hardly occurs despite the increase in the number of layers in AlexNet. change in the PSI due to FGSM attack shows that the value of the median of the PSI was lower compared to the normal case, and a right shift of the graph rarely occurred. The same experiment was performed on the pre-trained AlexNet and VGG11 on adversarial examples of ImageNet attacked by PGD attack. The result of the median of the PSI was less than 0.3, which is smaller than the result from the non-attacked ImageNet validation dataset (typical dataset) shown in Figure 5. Although the median value of the PSI in the first convolutional layer was observed to be similar to that in the typical ImageNet dataset, there was no rapid increase in the median PSI values as the hierarchy progressed.