## 3 Results
### Main Results  
Table 4 summarizes the AUC scores of four adversarial attack detectors with our proposed method from Section 2.2 using features from all the DNN penultimate layers. For comparison, we compare our proposed method with four other popular adversarial detection methods: DkNN [9], LID [10], Mahalanibis [11], and NNIF [12]. Overall, our proposed Top_1 threshold surpasses other methods in most attacks, as indicated in bold, while the LID method is the least effective in detecting attacks. The best FGSM attack detection corresponds to our proposed Top_22 method. Additionally, the NNIF model is the second-best detector approach to resist all attacks. The AUC scores at FGSM show a roughly 10 percent gap between the detectors. In contrast, in Deep-fool, the gap is much more pronounced, with LID scoring 52.25 and our proposed Top_1 scoring 97.57. The AUC score comparisons for different adversarial detector models on various attacks are shown in Figure 3. The x-axis represents the four adversarial attacks, while the y-axis describes the AUC score, ranging from 0 to 100. Each color on the graph represents one defense method, as represented in the top-right legend, namely DkNN, LID, Mahalanibis, NNIF, proposed[1], and proposed[122] represented by gray, navy, light green, light pink, light blue, and light brown, respectively. In the FGSM attack, DkNN and the proposed[122] method were the most effective defense mechanisms, while the others showed slight differences, with a score of around 80. The Deepfool bars show significant improvement in detection methods, but some methods have noticeable weaknesses. For the CW attack detection, DkNN, NNIF, and the proposed[1] perform well, while the others score an average of 70. Finally, the PGD attack is proven to be powerful against DkNN, LID, and Mahalanibis, with a semi-matching AUC score of 72, while the remaining methods show significant improvement, with the proposed[1] method scoring the highest, with a score of 96. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Detector**} & \multicolumn{4}{c}{**AUC Score**} \\  & **FGSM** & **Deepfool** & **CW** & **PGD** \\ \hline DkNN [9] & 93.65 & 76.71 & 93.77 & 73.78 \\ \hline LID [10] & 80.68 & 52.25 & 67.84 & 72.25 \\ \hline Mahalanibis [11] & 83.90 & 62.05 & 71.60 & 72.46 \\ \hline NNIF [12] & 87.23 & 84.20 & 94.58 & 83.09 \\ \hline Top\_1 & 86.62 & **97.57** & **98.21** & **96.49** \\ \hline Top\_22 & **94.17** & 74.17 & 83.50 & 86.04 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: AUC score of adversarial detection methods. For our proposed system, there is an inherent tradeoff between higher accuracy in detecting adversarial attacks and higher classification accuracy for clean data inputs, as illustrated in Table 2. We assign varying weights to each application depending on the potential risks we might face in the event of overlooking a successful attack and depending on our preferred accuracy in classifying normal clean inputs. Our adaptive optimization algorithm (Equation (1)) determines that the optimal settings for the RF Top_\(x\) probability index should be as follows. In all types of attacks, autonomous driving takes the Top_1 due to the potential for severe accidents if adversarial or misclassified samples are not detected. In health care, FGSM takes Top_5, and the remaining attacks all take Top_1. A face recognition application selects Top_3 for FGSM and Top_1 for the rest. Finally, detecting inappropriate content on a system selects Top_14 for the FGSM attack and Top_1 for the other attacks. In Section 2.3.5, we discussed how misclassification samples could improve the accuracy of the ResNet-34 model in detecting adversarial attacks. To demonstrate this, we conduct an FGSM attack experiment using the same applications and weights as in Table 2. We present the results in Table 5. First, we calculate the accuracy without the misclassification samples using Equation (1).