Fig. 4

Blue is the decision boundary, in which the left side of the decision boundary is clean labels while the right side is wrong labels. We obtained the adversarial samples by adding a perturbation of \(\delta\) to the clean samples (\(a^{'}\)-\(\delta\), \(b^{'}\)-\(\delta\), \(c^{'}\)-\(\delta\), \(d^{'}\)-\(\delta\)) (\(a^{'}\), \(b^{'}\),\(c^{'}\), \(d^{'}\)) are classified as mislabeled. Moreover, our reconstructed images by interpolation (0.5\(a^{'}\)+0.5\(b^{'}\), 0.5\(a^{'}\)+0.5\(b^{'}\), \(0.5c^{'}\)+0.5\(d^{'}\), 0.5\(c^{'}\)+0.5\(d^{'}\)) reverted to the correct category. In other words, our reconstructed image increases the distance to the adversarial sample and makes its escape from the interval of the adversarial sample