# PSI Analysis of Adversarial-Attacked DCNN Models
## 3 Experimental Results
In the same experiment on the PGD-attacked Caltech356 dataset, the AlexNet model was observed to exhibit higher peak values in the PSI distribution compared to the results of the ImageNet dataset that was subjected to the same attack in Figure 8. It is worth noting that in the PGD-attacked ImageNet dataset, the peak value of the PSI decreased as it progressed from fully connected layer 1 to fully connected layer 2, but in the PGD-attacked Caltech256 dataset, it increased, as it did in both benign datasets. The VGG11 model shows very similar results to the benign Caltech256 dataset in the convolution layers, but it was observed that the peak value of the PSI distribution decreased sharply in fully connected layer 1 and then recovered to a value similar to that of the benign dataset in fully connected layer 2. Figure 7: PSI results of VGG11 and AlexNet models by FGSM-attacked Caltech256 dataset. In the experiments with the CW-attacked Catech256 dataset, the AlexNet model had peak values that were similar to or slightly lower than those of the benign Caltech256 dataset in the convolution layers in Figure 9. A slightly lower value was observed in fully connected layer 1 compared to the results of the benign dataset, but a peak value of 0.28 was observed in fully connected layer 2, which was significantly smaller than the peak value of 0.42 in the benign dataset. Figure 4:0 PSI results of VGG11 and AlexNet models by PGD-attacked Caltech256 dataset. Figure 4:1 _Cont._  
In addition, the VGG11 model showed almost the same experimental results as the benign Caltech256 dataset, although convolution layer 6 showed a different peak value. In the analysis of the median PSI, it was observed that the results of the AlexNet model were almost identical to the results of the benign Caltech256 dataset, and a pattern similar to the results of the AlexNet model was found in the VGG11 model. This study involved analyzing the coding scheme across various layers of two conventional DCNNs, AlexNet and VGG11, using two attacked versions of datasets--ImageNet and Caltech256. The results of our experiments can be summarized as shown in Tables 3 and 4 for the median PSI analysis and in Tables 5 and 6 for the PSI peak value analysis. These tables present the layer-specific median PSI values and PSI peak values, offering insights into the level of sparsity within each layer of conventional DCNNs, AlexNet and VGG11. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Layer**} & \multicolumn{5}{c}{**PSI Peak Value**} \\ \cline{3-6}  & & **Benign** & **FGSM** & **PGD** & **CW** \\ \hline \multirow{5}{*}{AlexNet} & conv1 & 0.17 & 0.14 & 0.17 & 0.13 \\  & conv2 & 0.17 & 0.18 & 0.18 & 0.18 \\ \cline{1-1}  & conv3 & 0.23 & 0.19 & 0.24 & 0.25 \\ \cline{1-1}  & conv4 & 0.24 & 0.26 & 0.25 & 0.23 \\ \cline{1-1}  & conv5 & 0.33 & 0.26 & 0.28 & 0.30 \\ \cline{1-1}  & fc1 & 0.27 & 0.18 & 0.23 & 0.23 \\ \cline{1-1}  & fc2 & 0.42 & 0.19 & 0.28 & 0.28 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Layer-wise PSI peak values in AlexNet and VGG11 models for benign and adversarial examples from attacked Caltech256 dataset.