Table. Classification Accuracy of the Conventional Deep Learning Models on Adversarial Examples Crafted by the Fast Gradient Sign Method (FGSM) Using InceptionV3.

Model	Accuracy of deep learning models, %a
	InceptionV3	MobileNetV2	ResNet50
Fundus photography
No attack	89.1	88.6	89.9
FGSM using the InceptionV3 modela	13.4	63.7	77.5
Ultrawide-field fundus photography
No attack	97.6	97.4	96.8
FGSM using the InceptionV3 modelb	5.0	74.3	72.1
Optical coherence tomography
No attack	99.6	99.5	99.6
FGSM using the InceptionV3 modelb	8.2	68.8	64.8

^aThe results were derived from the validation dataset.

^bPerturbation coefficient ε = 0.010.