# SCS-JPGD: Single-Channel-Signal Joint Projected Gradient Descent
## 2 Related Works
### Adversarial Samples and Adversarial Training  
In recent years, significant progress has been made in improving model reliability and robustness. For instance, [PERSON] et al. [21] explored how to optimize the architecture of non-parametric probabilistic modeling through extensive Bayesian learning (BBL) to enhance model robustness. This method provides stronger defenses by incorporating probabilistic modeling and Bayesian inference, particularly in situations where data are uncertain or incomplete. [PERSON] et al. [22] analyzed the robustness of deep neural networks under noise disturbances, proposing a framework to evaluate the impact of different typesof noise on the model, and improving its performance in noisy environments through network structure optimization and regularization. [PERSON] et al. [23] proposed using adversarial training to improve the adversarial robustness of deep neural networks, training the model with adversarial samples to increase its resilience to hostile disturbances. These studies provide an effective theoretical foundation for improving robustness and defense capabilities. However, they primarily focus on a single aspect, such as noise or adversarial perturbations, and lack a comprehensive defense strategy against multiple types of disturbances and attack patterns. Especially in high-dimensional spaces or complex environments, existing defense methods often fail to maintain sufficient stability and accuracy when faced with diverse attack modes. Therefore, integrating noise robustness, adversarial attack defense, and feature extraction optimization remains a pressing challenge that needs to be addressed. To address these issues, researchers have proposed various strategies to enhance model stability and robustness. Adversarial samples refer to inputs that are carefully crafted with small perturbations to cause deep learning models to make incorrect predictions. These perturbations are usually imperceptible to human observers but can significantly affect the model's output. To generate these adversarial samples, various adversarial attack methods have been proposed, among which the most common are the Fast Gradient Sign Method (FGSM) [6; 8] and the Projected Gradient Descent (PGD) method [8]. The Fast Gradient Sign Method (FGSM) is a technique that generates adversarial samples by applying a single perturbation based on the gradient sign of the input data. Specifically, FGSM computes the gradient of the loss function with respect to the input and applies a perturbation in the direction of the gradient's sign at each pixel. For example, [PERSON] et al. [5] manipulated signal frequency spectra to reveal hidden risks in fault diagnosis models, while [PERSON] et al. [7] validated the model's resistance to adversarial attack scenarios by incorporating white Gaussian noise based on FGSM and zero-order optimization (Zoo) attacks. The formula for generating adversarial samples is shown in Equation (1). \[x^{\prime}=x+\epsilon\cdot\text{sign}(\
abla_{x}J(\theta,x,y)) \tag{1}\]  
In this context, \(x\) represents the original input, \(\epsilon\) is the perturbation magnitude, \(\
abla_{x}J(\theta,x,y)\) is the gradient of the loss function \(J\) with respect to the input \(x\), \(\theta\) represents the model parameters, \(y\) is the true label, and sign denotes the sign of the gradient. FGSM generates adversarial samples through a single gradient update, making it computationally efficient, but the adversarial samples it produces may be relatively weak. The Projected Gradient Descent (PGD) method is an extension of FGSM, which iteratively applies perturbations to the input, generating stronger adversarial samples. The main idea of PGD is to use gradient information to iteratively apply small perturbations and, after each iteration, project the generated sample back into the valid range of the original data. For example, [PERSON] et al.