## 4 Proposed Model
### Proposed Hybrid Model
#### 4.1.2 Adversarial Training Methods
MIA Training Method  
The momentum iterative attack (MIA) is usually used to model security attacks against neural networks. It mainly belongs to the adversarial attack type, which includes the misuse of artificial learning models, which can be deceptively successful. The MIA makes minor modifications to the input data to mislead the model's intended output. The MIA aims to create a more effective adversarial sample by adding a momentum term to iterative attacks. An iterative attack attempts to mislead the model's response by manipulating the model's predictions step by step. The momentum term ensures consistency between these steps and makes the attack more effective. In other words, the primary purpose of the MIA is to mislead a model's decision boundaries and direct the model to produce erroneous predictions. However, it is essential to understand such attacks and determine how they function to make a model more robust and resilient. By simulating such attacks, we can determine how vulnerable a model is to them, thus making the model more resilient to them. This type of attack is usually employed to assess a model's security and resilience. If a model can correctly classify adversarial samples, this model is considered safe and robust. Jacobian-Based Saliency Map Attack (JSMA) Training Method  
The Jacobian-based saliency map attack (JSMA) represents an adversarial attack usually utilized against deep learning models. The attack changes a model's input in a tiny and targeted way to redirect the model's output to a specific target. The name JSMA arises from two main concepts: the Jacobian matrix and the saliency map. The Jacobian matrix measures the impact of each function input on the output. The saliency map is a map showing the impact of the input on the output. The JSMA utilizes the Jacobian matrix to mislead the output of a model. First, it measures the impact of each input feature on the output. Afterward, the features affecting the output the most are determined, and these features are changed in a targeted way. The changes in question are generally minimal and invisible to the human eye but can considerably impact the model's output [30]. The JSMA is generally employed as an attack method but can also make a model more robust. It is possible to utilize the JSMA to understand how a model deals with misleading samples and enhance its performance on such samples. The process mentioned above is commonly known as adversarial training. Adversarial training involves creating misleading samples of a model and adding these examples to the model's training set. The model then learns to classify these misleading samples correctly. The JSMA can be employed to create these misleading samples. CWL2 Attack Training Method  
The CWL2 attack represents an adversarial attack technique developed by [PERSON] and [PERSON] in 2017 [11]. The attack is used to mislead learning models by minimally altering them so that the model yields an incorrect output. The CWL2 attack changes the input data to direct the model to a target output. For example, in an image classification model, an attacker can cause an image to appear to belong to a different class by making small, usually invisible changes. These changes are generally invisible to the human eye but considerably impact the model's output. The term \"L2\" in the CWL2 attack name indicates that this attack uses the L2 norm (or Euclidean distance) to measure the extent of the changes in the input data. The L2 norm refers to the linear (Euclidean) distance between two points or vectors. The CWL2 attack employs this measure when comparing the original and modified inputs.