## 4 Experiments and Results
### Comparison with Other Methods  
We conducted comparative experiments with other three state-of-the-art methods: kernel density estimates (KD)-based method [21], local intrinsic dimensionality (LID)-based method [13], and natural scene statistic (NSS)-based method [18], which are all supervised methods, as is our method. As Tables 2 and 3 show, we report the AUC score of different detection methods on different datasets with different attacks. We found our method achieved good results in almost all datasets and attacks. Especially on CW\({}_{2}\)[24], JSMA [22], DeepFool [23] attacks, our method had obvious advantages. \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Parameter** & **MNIST** & **SVHN** & **CIFAR** \\ \hline
**Optimization Method** & SGD & SGD & Adam \\
**Learning Rate** & 0.05 & 0.05 & 0.001 \\
**Momentum** & 0.9 & 0.9 & - \\
**Batch Size** & 200 & 100 & 100 \\
**Epoch** & 20 & 40 & 200 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Parameters set for training the classifier. Figure 3: Single layer detector’s AUC score with IACS and ICS. Figure 2: IACS comparison between normal and adversarial examples. The red points denote the normal examples’ IACS values, and the green points denote the adversarial examples’ IACS values. **Crossing Attack Study**: As an intuitive thought, we hoped the detector trained with one type of attack could be used to detect other types. Therefore, we studied the property of the detector's crossing attacks. We conducted the experiments on the CIFAR10 dataset and compared our method with the LID-based method [13], KD-based method [21], and NSS-based method [18] on different attacks. From Figure 4, we can observe that our method obtained better performance against crossing attacks than the other methods, which meant our method had the ability to detect unknown attacks. We speculated that it was because the IACS value was relatively stable on different attacks. To confirm our conjecture, we presented the IACS values at the penultimate layer on different attacks. As Figure 5 shows, the IACS values of normal examples distributed around about 0.85, and the adversarial examples around about 0.5. The results supported our conjecture. **Crossing Model Study**: To further evaluate our method, we used a different model (ConvNet) with \(3\times 3\times 32\) and \(3\times 3\times 64\) convolutional layers on the CIFAR10 dataset to extract the features (it reported an accuracy of 84% on the test dataset). In other words, we detected adversarial examples generated by the different models. Table 4 reports the accuracy of the adversarial examples on different models and shows that the adversarial examples generated by DeepFool, JSMA, and CW\({}_{2}\) basically have no attack ability on Convnet. Then, we compared our method with the LID-based method [13] and the KD-based method [21], which rely on the target model to extract features. In Figure 6, we see that the performance did not change much and was even better on our method, while the performance of the other methods decreased significantly, especially the KD-based method [21]. We conjectured that the adjusted cosine similarity could better seize the intrinsic differences between adversarial examples and normal examples even though the adversarial examples had no attack effect. \begin{table}
\begin{tabular}{c c c c c c c c} \hline  & \multicolumn{4}{c}{**MNIST**} & \multicolumn{4}{c}{**SVHN**} \\ \cline{2-9}  & **KD** & **LID** & **NSS** & **IACS** & **KD** & **LID** & **NSS** & **IACS** \\ \hline
**FGSM** & 0.9284 & 0.9907 & **1.0000** & **1.0000** & 0.6787 & 0.996 & **1.0000** & 0.9987 \\
**PGD** & 0.8938 & 0.8929 & **1.0000** & **1.0000** & 0.7926 & 0.9735 & **1.0000** & 0.9982 \\
**DeepFool** & 0.9597 & 0.9844 & **1.0000** & **1.0000** & 0.5494 & 0.8048 & 0.5102 & **0.9996** \\
**JSMA** & 0.9711 & 0.983 & **1.0000** & **1.0000** & 0.6801 & 0.9225 & 0.9961 & **1.0000** \\
**CW\({}_{2}\)** & 0.9847 & 0.9872 & **1.0000** & **1.0000** & 0.5163 & 0.7709 & 0.6250 & **1.0000** \\ \hline \end{tabular}
\end{table}