## 2 Materials and Methods
### Proposed Methodology  
We introduce our proposed adversarial attack detection method in this section. Our primary image classification system, shown in Figure 1, is based on the DNN approach, and we choose ResNet with 34 layers here for our investigation. The primary model could be any other DNN model that uses backpropagation because adversarial attacks exploit backpropagation to optimize the perturbations introduced to the input data on DNN models. The input is an image that could be a real image with no alteration or an adversarial generated sample from one of four attacks: FGSM, Deepfool, CW, or PGD. Our output of ResNet-34 is the highest probability index that indicates the class the image belongs to, which is referred to as Top_1 classification.  
Unlike the primary approach, we use the classical ML model, the random forest (RF) model, as a secondary model for adversarial attack detection. The model can be vulnerable to adversarial attacks, as seen in [31], with the aim of deceiving the intrusion detection system. Nonetheless, we opt to use this as a secondary model because it employs a different method and does not rely on the gradient technique utilized in computer vision adversarial attacks. Therefore, the perturbation added to the images does not impact the model's image features or the model classification performance.  
The RF model is a decision tree module based used in regression and multiclassification problems [32; 33; 34; 35; 36]. It is an extension of the bagging method, as it utilizes both bagging and random feature selection to create an uncorrelated forest of decision trees. It also reduces overfitting and increases the diversity of the trees in the forest. The randomness in selecting the features for each tree determines and eliminates the inserted perturbations information on the adversarial samples, as illustrated in Figure 2, where the accuracies of RF model before and after different attacks are almost identical. In the same figure, the \(k\)-NN model is demonstrated as a classical ML model that is not affected by the added perturbations as well.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \multirow{2}{*}{**Attack**} & \multicolumn{2}{c}{**Targeted Model**} & \multicolumn{2}{c}{**Untargeted Models**} \\ \cline{3-5}  & & **ResNet-34** & **VGG16** & **DenseNet** \\ \hline \multirow{4}{*}{
\begin{tabular}{c} **ResNet** \\ **width** \\ \end{tabular} } & Without attack & 77.47 & 72.25 & 78.69 \\ \cline{2-5}  & FGSM & 34.25 & 35.09 & 36.19 \\ \cline{2-5}  & Deepfool & 25.78 & 24.79 & 24.84 \\ \cline{2-5}  & CW & 25.77 & 24.49 & 25.0 \\ \cline{2-5}  & PGD & 22.58 & 22.87 & 22.7 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Accuracy comparison of different DNN models before and after adversarial attacks on the CIFAR-100 dataset.  
Our outputs of RF are the top k indices (Top_k) of the predicted class probabilities for the inputs. We selected Top_k and relied on it for our study to match the accuracy of the RF model with the selected DNN model on the CIFAR-100 dataset, which has 100 classes. Top_1 in the RF represents the worst accuracy, as illustrated in Figure 2, whereas Top_100 represents 100 percent accuracy because its decision is always correct, where the decision group includes all possible classes. When the \(k\) parameter in Top_k equals 22, the accuracy reaches around 77 percent, the same percentage as the primary DNN method prediction accuracy in the top_1 classification. Moreover, by adjusting the value of \(k\) in the Top_k classification, our methodology provides more control to its users and more choices to select optimal security versus classification accuracy based on the AI application design, as described in depth in Section 2.3.