## 5 Results
### eWINE Data Set
#### 5.1.2 Performance of the LOS/NLOS Classification  
This sub-section provides the results related to the metric measuring the classification accuracy between LOS- and NLOS-related samples. An important aspect is related to the  
Figure 4: Detection rate of poisoned samples with the SDO algorithm and the random forest classifier for the different scenarios of the eWINE data set; \(S_{P}=16\) for the FSP and TFP attacks (for the LF attack, \(S_{P}\) does not apply). \(P_{San}=80\%\). Figure 3: Impact of the \(S_{P}\) parameter on the detection rate of poisoned samples with first scenario (Office 1) and the SDO algorithm. The y-axis provides the percentage of poisoned samples correctly identified. The x-axis indicates the value of the percentage \(T_{P}\) of the poisoned samples. improvement in accuracy between the case where the sanitation step is applied and the case where this step is not applied and the poisoned model is used for classification. The first aspect related to the absolute accuracy obtained on the sanitized data is illustrated in Figure 5, where it can be seen that the improvement in accuracy is roughly equivalent among the three OD algorithms. The SDO algorithm is slightly better than the IF and OCSVM algorithm for the TFP attack and values of \(T_{P}\) greater than 0.4. These values are obtained with a sanitation percentage \(P_{SAN}\) of 80% (80% of the samples with the lowest outlier scores are selected). While it may seem counter-intuitive that SDO manages to achieve a high detection accuracy (as shown in the previous subsection) while the absolute classification accuracy is roughly equivalent, it should be considered that the two metrics are based on different sets of selected samples. \(T_{Det}\) is based on the samples with the highest outlier scores (i.e., anomalies) while the sanitation is based on the lower outlier scores. Thus, the selected samples of the training data set are disjoint or they scarcely overlap (this is based on the value of the hyper-parameters). Beyond the absolute accuracy, a more valuable indicator of the performance of the proposed approach is the improvement of accuracy between the application of the RaF algorithm on the sanitized training data and the poisoned training data. Figure 6 shows the improvement in accuracy obtained with the SDO algorithm with \(S_{P}\) = 16 (for the FSP and TFP attacks) for the different attacks for different values of the percentage of \(P_{SAN}\). It can be seen that a lower value of \(P_{SAN}\) provides the best improvement accuracy, especially for the FSP and TFP attacks. In particular, for \(P_{SAN}\), the improvement of accuracy is over 10%, which is a remarkable achievement, while it is still in the range between 2% and 4% for other values of \(P_{SAN}\) and \(T_{P}\). It should be noted that these values are achieved with the highest severity of the attack with \(S_{P}\) = 16. The approach has a better performance for the FSP and TFP attacks than for the LF attack. This may be due to the consideration that the perturbation is more likely to generate anomalies (which are then excluded in the sanitized training model) than the FL attack. There is also a trend across the three different attacks that higher values of \(P_{SAN}\) (i.e., 90% and 95%) are not very effective in excluding poisoned samples and in fact the improvement of accuracy can  
Figure 5: Accuracy obtained with the different OD algorithms and the random forest classifier for the different attacks for scenario 1 (Office 1); \(S_{P}=16\) for the FSP and TFP attacks (for the LF attack, \(S_{P}\) does not apply). \(P_{San}\) = 80%. also be negative for a severe attack with \(T_{P}=0.5\). This is understandable because for such values of \(P_{SAN}\), many poisoned samples are still likely to be present in the training data. On the other hand, potential benefits for the improving the accuracy of the application of OD as an instance selection tool should be considered, especially for high values of \(P_{SAN}\).