# Image Segmentation Framework for Detecting Adversarial Attacks for Autonomous Driving Cars
## 4 Experimental Setup
### The Configuration of the Proposed Adversarial Detection Method  
The adversarial detection process involves the following steps:  
* OCSVM Model: The first line of defense in the pipeline is the OCSVM model trained on the segmentation masks generated by the U-net model. Using the Sklearn library, we configured the OCSVM model with default parameters shown in Table 4. Also, Table 4 outlines that the OCSVM models demonstrated high accuracy across all data sets. The segmentation masks, as shown in the second row of each data set in Figure 6, were used to isolate the object of interest from the background in each image, and the masked images were converted to grayscale for the KAS algorithm, as shown in the third row of each data set in Figure 6.
* KAS algorithm: The KAS algorithm involves three key processes to generate the segmented and inverted versions, depicted in the third and fourth rows of each data set in Figure 6, of the masked input image, as illustrated in Algorithm 1: \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Data Set** & **Model** & \(\gamma\) & \(\mu\) &
\begin{tabular}{c} **Test** \\ **Accuracy** \\ \end{tabular} \\ \hline MNIST & OCSVM & auto & 0.01 & 99.17\% \\ \hline CIFAR-10 & OCSVM & auto & 0.01 & 99.25\% \\ \hline GTSRB-8 & OCSVM & auto & 0.01 & 97.7\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Metrics of the OCSVM models. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Data Set** & **Model** & **Test IOU** & **Test Dice** \\ \hline MNIST & U-net & 97.17\% & 98.39\% \\ \hline CIFAR-10 & U-net & 73.85\% & 84.10\% \\ \hline GTSRB-8 & U-net & 83.9\% & 91.1\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Segmentation Metrics of the U-net models. * Denoising: Instead of averaging only nearby pixels, the non-local-mean filter [40] identifies multiple similar patches within a larger area of the image and replaces the central patch with the averaged values of those similar patches. Since the noise is assumed to have a mean value of zero, this averaging process effectively reduces noise while maintaining the sharpness of the edges, preserving the integrity of the image structure. A non-local-mean filter with a \(3\times 3\) filtering window and a researching window of \(13\times 13\) with a filter strength of 1 was applied to denoise and normalize the similar regions of the image, preparing it for segmentation. We followed the feature squeezing setting in choosing these parameters except for the filter strength, where we chose it to be lower to reduce the blurring effect of the filter. The filter parameters are denoted by a-b-c, where a is the filtering window, b is the searching window, and c is the filter strength. * k-means Clustering: After denoising with the non-local-mean filter, the masked filtered image is segmented using the k-means algorithm into \(k\) regions, where \(k\) was set to 35% of the number of grayscale shades in the image. This approach dynamically determines the number of clusters for each image, allowing more flexible segmentation and making it harder for the attackers to adapt this dynamic mechanism. * Median Filtering: The segmented image was further smoothed and denoised using a \(3\times 3\) median filter. As a result, the inverted and segmented images were produced, as shown in the last two rows for each data set in Figure 6.
* Verifier Model: The second line of defense is the verifier model. The verifier model shares the same architecture as the main target model, as shown in Table 2, but with a single-channel input layer (grayscale) \(64\times 64\) for the verifier model instead of a three-channel input (RGB) of the target. Moreover, an additional class was introduced to the verifier's output to classify unrelated or noisy inputs. The additional class consists of a set of dummy images generated using the DIG algorithm and augmented in the training process of the verifier model. Table 5 reports the test accuracy of the verifier models for the three data sets.