Table 1.

The classifier’s prediction results

Input		P(χ = 0)	P(χ = 1)	P(χ =−2)
h = 0.5	Leg.	0	0	1
	Adv.(C.)	0	0.776	0.224
h = 2.0	Leg.	0	1	0
	Adv.(C.)	0.004	0.293	0.703
h = 3.2	Leg.	1	0	0
	Adv.(C.)	0.002	0.998	0
	Adv.(D.)	0.262	0.738	0

The output on experimentally implemented legitimate (Leg.) samples and their corresponding adversarial (Adv.) examples. The classifier successfully identifies the phase label for legitimate samples with nearly unity confidence. Yet, it is deceived by experimentally implemented adversarial examples, making incorrect predictions with confidence larger than 0.5. C. (D.) represents adversarial examples obtained by continuous(discrete) attacks.