## 6 Discussion
It is assumed that as the multi-sectional model architecture is trained, its computational efficiency of inference is improved by saving resources on simple examples without perturbations. Figure 3 shows the dependence of the ratio of the average time spent in the adaptive mode T\({}_{\text{adap}}\) to the time of inference across the entire network T\({}_{\text{full}}\) on the \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Are the Outputs**} & \multicolumn{5}{c}{**MED (Acc) after Perturbation**} \\ \cline{3-6}  & \multirow{2}{*}{**Perturbation**} & \multicolumn{2}{c}{**Backbone Based on**} & \multicolumn{2}{c}{**Backbone Based on**} \\
**Sections Taken** & & **ResNet Blocks** & & **Swin Transformer Blocks** \\ \cline{3-6}
**into Account?** & & **Prototype-Based** & **Dense Layer-Based** & **Prototype-Based** & **Dense Layer-Based** \\  & & **Classifier Head** & **Classifier Head** & **Classifier Head** & **Classifier Head** \\ \hline True & \begin{tabular}{c} Fault injection \\ (fault\_rate = 0.3) \\ \end{tabular} & 0.852 & 0.831 & 0.849 & 0.841 \\ False & \begin{tabular}{c} Fault injection \\ (fault\_rate = 0.3) \\ \end{tabular} & 0.802 & 0.792 & 0.810 & 0.800 \\ True & \
\begin{tabular}{c} Adversarial \\ (fault\_rate = 0.3) \\ \end{tabular} & 0.762 & 0.712 & 0.782 & 0.722 \\ True &
\begin{tabular}{c} Adversarial \\ (threshold = 3) \\ \end{tabular} & 0.723 & 0.685 & 0.754 & 0.709 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: A comparison of the accuracy under perturbation for the modified model. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Are the Outputs**} & \multicolumn{5}{c}{**MED (Rec\_Steps)**} \\ \cline{3-6}  & \multirow{2}{*}{**Perturbation**} & \multicolumn{2}{c}{**Backbone Based on**} & \multicolumn{2}{c}{**Backbone based on**} \\
**Sections Taken** & & **ResNet Blocks** & & **Swin Transformer Blocks** \\ \cline{3-6}
**into Account? ** & & **Prototype-Based** & **Dense Layer-Based** & **Prototype-Based** & **Dense Layer-Based** \\  & & **Classifier Head** & **Classifier Head** & **Classifier Head** & **Classifier Head** \\ \hline True & \begin{tabular}{c} Fault injection \\ (fault\_rate = 0.3) \\ \end{tabular}  & 25 & 45 & 55 & 95 \\ False & \ \begin{tabular}{c} Fault injection \\ (fault\_rate = 0.3) \\ \end{tabular}  & 151 & 277 & 240 & 297 \\ True &
\begin{tabular}{c} Adversarial \\ \(\_\)\(\_\)\(\_\)\(\_\_\)\(\_\_\_\)\(\_\_\_\) \(\  
number of training mini-batches from CIFAR-10 (Figure 3a), the maximum amplitude of the adversarial L\({}_{\infty}\) attack (Figure 3b), and the fault_rate (Figure 3c). Figure 3 confirms that the hypotheses that the average inference time decreases when the degree of network training increases and the average inference time increases when the amplitude of the adversarial attack and the frequency of faults increase. Thus, the proposed classifier can absorb a certain level of perturbations; detect samples outside the training distribution and the concept drift; and provide graceful degradation, recovery, and performance improvement. It also performs better than the conventional approach. It is very important to assure resilience to cyber attacks and the fault tolerance of  
Figure 3: Dependence of the average time ratio in the adaptive mode to the time of inference across the entire network on the factor of influence: (**a**)—number of training mini-batches; (**b**)—the maximum amplitude of the adversarial attack L\({}_{\infty}\); (**c**)—the fault_rate.