## 4 Experiment Results and Discussion
### Performance Evaluation and Discussion
#### 4.4.3. FAT with PGD Samples Results  
This section examines similar FAT scenarios as the preceding section, albeit using adversarial samples generated with PGD. Table 2 details the hyperparameters used in these experiments. The accuracy results for the fl-normal, fat-pgd, mixed-pgd, fl-pgd-25, fl-pgd-50, and fl-pgd-75 scenarios are graphically depicted in Figure 9. Unlike the use of FGSM adversarial samples, which yielded nearly identical results for all six experiments, the results of the experiments in this section vary, as shown in Table 6.  
The accuracy of the fl-normal model remained the same as in the previous section, at 91.34%. In the fat-pgd scenario, where 50% of the data in each participating client dataset was normal and 50% was PGD adversarial samples, the accuracy dropped to 81.13%. This represents a 10% reduction in the accuracy from adversarial attacks, demonstrating the effectiveness of the fat-pgd adversarial training method in producing a robust global model. The accuracy reduction from the baseline is relatively small, at approximately 10%, and can be mitigated by using a stronger baseline model architecture with more layers and  
Figure 8: FAT results for different scenarios involving FGSM samples. \begin{table}
\begin{tabular}{c c} \hline \hline
**Scenario Name** & **Accuracy (\%)** \\ \hline fl-normal & **91.34** \\ fat-fgsm & 89.05 \\ fl-mixed-fgsm & 88.15 \\ fl-fgsm-25 & 91.18 \\ fl-fgsm-50 & **91.34** \\ fl-fgsm-75 & 88.73 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The result of the test accuracy of FAT scenarios with FGSM samples. neurons or by using a more complex CNN architecture. Another approach to enhancing the robustness of a global model is to increase the number of clients engaged in FL. Assuming a greater volume of data becomes available, the global model will exhibit enhanced accuracy and robustness. In the fl-mixed-pgd scenario, one client trained a local model using a normal dataset, two clients used a combination of 50% normal data and 50% PGD adversarial samples, and one client assumed the role of an attacker with a completely adversarial dataset. The accuracy of the global model declined significantly during some communication rounds but recovered to 82.60% after 30 rounds. However, the fat-pgd scenario exhibited greater stability in classification accuracy trends than the fl-mixed-pgd scenario (Figure 9). Figure 10 shows the confusion matrices for the test accuracy and performance of fl-normal (left), fat-pgd (center), and fl-mixed-pgd (right). fl-normal was used as the baseline. A closer look reveals that fat-pgd has better accuracy in predicting the good air quality index (AQI) class than fl-mixed-pgd, while fl-mixed-pgd has better accuracy in predicting the unhealthy for sensitive groups (USG) and severe classes. However, both models have critical drawbacks. For example, fat-pgd's accuracy in predicting the severe class could lead to dangerous consequences. If a severe AQI class is misclassified as a very unhealthy class, it is still considered acceptable. However, in the fat-pgd test prediction, 7.5% of the images that should belong to the severe class were predicted as USG class. This could harm people if they believe it is safe to go outside due to this misclassified information. \begin{table}
\begin{tabular}{c c} \hline \hline
**Scenario Name** & **Accuracy (\%)** \\ \hline fl-normal & **91.34** \\ fat-pgd & 81.13 \\ fl-mixed-pgd & 82.60 \\ fl-pgd-25 & 83.99 \\ fl-pgd-50 & 48.53 \\ fl-pgd-75 & 30.56 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The result of the test accuracy of FAT scenarios with PGD samples. Figure 9: FAT results for different scenarios involving PGD samples. On the other hand, in the fl-mixed-pgd test prediction for the good class, only 57.75% of the images were predicted correctly; 16.9%, 11.97%, 5.65%, 2.11%, and 5.65% of the images were misclassified as moderate, USG, unhealthy, very unhealthy, and severe, respectively.