# SCS-JPGD: Single-Channel-Signal Joint Projected Gradient Descent
## 4 Experiments and Results
### Experimental Results
To evaluate how disturbances in different ranges affect the test results, we conducted a parameter sensitivity experiment under the 1797 condition, as shown in Table 3.  
Through sensitivity experiments on different parameter combinations, we investigated the impact of hyperparameters such as learning rate, perturbation range (\(\epsilon\)), and step size (\(\alpha\)) on model performance. The experimental results demonstrate that selecting appropriate parameter configurations is crucial for enhancing the model's robustness against adversarial samples. In particular, when these parameters are properly optimized, the model can maintain high classification performance when confronted with adversarial attacks. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Model Type** & **Accuracy** & **Adversarial Test Accuracy** \\ \hline Baseline Model (1730) & 79.34\% & 4.43\% \\ SCS-JPGD (1730) & 90.34\% & 66.72\% \\ Baseline Model (1750) & 70.07\% & 8.06\% \\ SCS-JPGD (1750) & 93.42\% & 60.36\% \\ Baseline Model (1772) & 77.47\% & 39.80\% \\ SCS-JPGD (1772) & 94.24\% & 74.01\% \\ Baseline Model (1797) & 91.39\% & 1.84\% \\ SCS-JPGD (1797) & 99.80\% & 69.47\% \\ CNN [25] (FGSM) & 97.94\% & 45.24\% \\ CNN [25] (BIM) & 97.94\% & 43.46\% \\ CNN [25] (PGD) & 97.94\% & 41.15\% \\ CNN [25] (C\&W) & 97.94\% & 43.87\% \\ LeNet [26] (FGSM) & 95.96\% & 57.98\% \\ LeNet [26] (BIM) & 95.96\% & 58.09\% \\ LeNet [26] (PGD) & 95.96\% & 58.91\% \\ LeNet [26] (C\&W) & 95.96\% & 58.36\% \\ AlexNet [27] (FGSM) & 93.01\% & 52.27\% \\ AlexNet [27] (BIM) & 93.01\% & 56.72\% \\ AlexNet [27] (PGD) & 93.01\% & 53.42\% \\ AlexNet [27] (C\&W) & 93.01\% & 54.06\% \\ ResNet-18 [28] (FGSM) & 96.45\% & 60.08\% \\ ResNet-18 [28] (BIM) & 96.45\% & 61.14\% \\ ResNet-18 [28] (PGD) & 96.45\% & 60.78\% \\ ResNet-18 [28] (C\&W) & 96.45\% & 59.98\% \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Model classification accuracy and adversarial test accuracy The choice of learning rate directly affects the training stability and convergence speed of the model. At higher learning rates (e.g., 0.005), although the training process accelerates, it often leads to excessive fluctuations, thereby weakening the model's performance on adversarial samples. For instance, when the learning rate is set to 0.005, the model achieves high accuracy on the original dataset but suffers a significant drop in accuracy on adversarial samples, indicating insufficient defense against perturbations. In contrast, lower learning rates (e.g., 0.003 and 0.001) help to avoid large fluctuations during training, ensuring stable convergence. Specifically, at a learning rate of 0.003, the model performs more consistently on both the original dataset and adversarial test set, suggesting that a moderate learning rate helps improve the performance on the original dataset while enhancing robustness against adversarial attacks. The perturbation range (\(\epsilon\)) has a significant impact on the generation of adversarial samples and the model's performance. A larger perturbation range (e.g., 0.05) can generate more challenging adversarial samples but may result in the model failing to effectively recognize these perturbed samples, severely reducing accuracy on adversarial samples. The experiment shows that when the perturbation range is set to 0.05, the model's accuracy on adversarial samples approaches zero, indicating weak robustness. By choosing a more moderate perturbation range (e.g., 0.009 and 0.01), the model can maintain robustness while avoiding the negative impact of excessive perturbations on classification performance, thus improving the model's distinguishing capability. The step size (\(\alpha\)) determines the magnitude of each step in the adversarial sample update process and has a profound impact on the optimization direction during training. A smaller step size (e.g., 0.001) helps adjust the model parameters gradually, avoiding the risk of premature convergence into a local optimum.