# SCS-JPGD: Single-Channel-Signal Joint Projected Gradient Descent
## 3 Methods
### Signal Projected Gradient Descent  
Existing methods often use data augmentation to train models and improve their robustness, enabling the model to effectively counteract disturbances in fault diagnosis tasks. However, disturbances encountered during real-world model training are not solely influenced by noise. This study aims to ensure that the model can still effectively perform fault diagnosis when subjected to perturbations. To maximize the model's exposure to  
Figure 2: Signal Projected Gradient Descent adversarial attack architecture. attacks, we focus on the inherent distribution characteristics of the data, as shown in Figure 3. Inspired by PGD, we propose a Perturbation Gradient Descent method for single-channel signals (SPGD), which is suitable for joint training to enhance the model's generalization ability. SPGD is a typical adversarial attack method for deep learning models, where a series of small, carefully designed perturbations are applied to the input data to induce incorrect predictions. This method generates adversarial samples through multiple iterations, optimizing the perturbations to maximize the model's loss function while keeping the samples close to the original data. In 1D convolution, the convolution operation between the input signal \(x\) and the convolution kernel \(w\) can be expressed as Equation (5). \[y_{i}=(x*w)_{i}=\sum_{m=-k}^{k}x_{i+m}w_{m} \tag{5}\]  
In this process, \(x_{i}\) represents the sampled value of the input signal at position \(i\), \(w_{m}\) is the weight at the \(m\)-th position in the convolution kernel, and \(y_{i}\) is the output value at position \(i\). The convolution operation involves sliding the convolution kernel \(w\) over the input signal \(x\) and calculating the weighted sum of each local region. This process is essentially a local sampling of the signal. Each output \(y_{i}\) is computed by taking the weighted average of the signal segment covered by the convolution kernel. Therefore, the receptive field of the convolution operation is limited to the size of the kernel. The local perception determines how the convolutional network processes the local features of the input signal. Effective attack methods can better validate the model's robustness against interference. The purpose of the SPGD attack is to calculate the gradient of the loss function with respect to the input signal and apply small perturbations along the gradient direction to induce the neural network to make incorrect classifications. The core of the attack process is to compute the gradient \(\
abla_{x}\mathcal{L}\) of the loss function \(\mathcal{L}\) with respect to the input signal \(x\) and use this gradient to update the input signal, as shown in formula (6). \[x^{(t+1)}=x^{(t)}+\alpha\cdot\text{sign}(\
abla_{x}\mathcal{L}) \tag{6}\]  
Figure 3: In a two-dimensional space, the red and blue data points represent two classes of samples, and the model distinguishes these two classes using a decision boundary. Although the data distribution appears to be separable, the decision boundary is very close to some data points. The adversarial perturbation (represented by the green arrow) involves making small adjustments to these data points near the boundary. These adjustments are enough to cause the model to change its decision, misclassifying data that originally belonged to class 1 as class 2. In other words, the model is highly sensitive near the decision boundary, and even small perturbations can lead to classification errors, revealing its vulnerability. where \(\alpha\) is the step size, \(\text{sign}(\cdot)\) is the sign function used to adjust the input signal in the direction of the gradient, and \(t\) represents the number of iterations. In Convolutional Neural Networks, the SPGD attack perturbs certain sampled points of the input signal (i.e., pixels or feature values) to maximize the value of the loss function, thereby altering the network's output.