## 4 Experiment Results and Discussion
### Performance Evaluation and Discussion
#### 4.4.3. FAT with PGD Samples Results
This result could confuse some people, especially sensitive groups, about whether it is safe to perform activities outside while the air quality is actually good. Based on this explanation, we can understand how dangerous adversarial attacks are. The ability to make models make misjudgments or misclassify decisions can often endanger people. The three remaining scenarios, denoted as fl-pgd-25, fl-pgd-50, and fl-pgd-75, were all attack scenarios. In the fl-pgd-25 scenario, one attacker joined the FL system, while the remaining three participants served as standard clients (assuming 25% of participants were attackers). The attacker executed a white-box poisoning (insider attack) by using a local model that had been trained exclusively on PGD adversarial samples. The attacker then used this method to send poisoned gradients to the federated server, which aggregated them with the three genuine gradients. This attack was effective because there was no additional filtering in the aggregation process on the federated server. However, the results showed that a 25% participant attack is insufficient to significantly compromise the accuracy of the global model. Under these conditions, the accuracy of the global model can be maintained at 83.99%. The impact of the attacks becomes visible when at least 50% of the participants are attackers, as demonstrated by the scenario results for fl-pgd-50 (50% attackers) and fl-pgd-75 (75% attackers). In scenarios fl-pgd-50 and fl-pgd-75, the global model accuracy after the attack was recorded at 48.53% and 30.56%, respectively. To gain insights into the adversarial attack phenomenon, we scrutinized the results of the fl-pgd-50 scenario. In this scenario, Clients 1 and 2 were assigned as normal clients, while Clients 3 and 4 acted as attackers. The normal clients retrained and updated their models using a standard dataset, while the attackers used only PGD adversarial samples to retrain their models. After retraining, the local gradients from each client and attacker were sent to the federated server. The federated server used the FedAvg algorithm to aggregate all received gradients, creating a new global model, which was then evaluated using the server's own dataset. Figure 11 shows the local accuracy of each client and attacker, as well as the updated global model accuracy for each iteration. The figure shows that the attackers achieved almost 100% accuracy in their local model updates. This high accuracy on the attacker side indicates an increased risk level, as it means that the attackers have effectively manipulated their local models. Therefore, it is reasonable to infer that including these poisoned gradients in the aggregation process would significantly reduce the accuracy of the resulting global model. Figure 10: Confusion matrices: (**left**) fl-normal, (**center**) fat-pgd, and (**right**) fl-mixed-pgd. Although both of the normal clients achieved around 75% accuracy, this contribution was insufficient to counteract the negative impact of the attacker gradients on the aggregation process. As a result, the global model exhibited very low and unstable accuracy, as shown by the orange line in Figure 11. Moreover, as a consequence of this attack, Clients 1 and 2 were unable to attain their optimal accuracy in their local updates. This was attributed to the reception of compromised and erroneous gradients from the global model in each round. In contrast to the fl-normal scenario, where all participating clients were normal, this led to a relatively high overall accuracy. The impact of the attack in this scenario significantly hindered the ability of Clients 1 and 2 to achieve their highest accuracy levels during local updates. Figures 12 and 13 provide a more comprehensive insight into how the attacker gradients detrimentally impacted the robustness of the global model. Figure 12 shows that Clients 1 (Figure 12a) and 2 (Figure 12b) were about equally good at correctly identifying the air quality index (AOI) class when their local models were tested on a normal dataset.