# Image Segmentation Framework for Detecting Adversarial Attacks for Autonomous Driving Cars
## 6 Conclusions  
In conclusion, we have introduced a novel adversarial detection framework utilizing image segmentation within a two-tier defense mechanism. The first line of defense utilized the U-net model with the OCSVM model. The second involved developing two novel algorithms, KAS and DIG, with a verifier model that dictates the input prediction. The proposed detection framework achieved state-of-the-art detection rates exceeding 96% for eleven adversarial attack algorithms on three heterogeneous data sets under white-box attack conditions. This approach effectively secures autonomous driving systems by detecting adversarial attacks on speed-limit signs with a detection rate surpassing 99%. Our experimental results demonstrate that the proposed method significantly outperforms the feature squeezing technique for the GTSRB-8 and CIFAR-10 data sets while maintaining comparable performance on the MNIST data set. Specifically, the framework successfully detects FGSM and BIM attacks with an average accuracy of 95.65% across the three data sets, compared to a 62.63% detection rate achieved by feature squeezing. The precision of the segmentation masks, as well as the alignment of the classification accuracy between the verifier and main model, is critical to maintaining low false positive rates. In general, the proposed detection framework is robust and generalizable as it is model and adversarial knowledge agnostic and exhibits high detection rates in diverse data sets, including grayscale and RGB images. Moreover, training the verifier model on segmented and inverted data sets enhances robustness to color changes in the input data, further improving adversarial detection rates. This paper demonstrates how leveraging image segmentation techniques to reduce the feature space can effectively mitigate adversarial effects and detect a broad range of adversarial attacks. Future work could explore the use of more advanced segmentation methods and models to minimize false positive rates. Additionally, efforts may focus on developing a more robust verifier model and investigating alternative machine learning techniques to improve the detection of adversarial perturbations within the reduced feature space of the image. Figure 9: A visual comparison between clean images in the first row and their adversarial counterparts in the second row detected by the second line of defense, the verifier model, in our adversarial detection framework. The third and fourth rows represent the segmented versions yielded by the KAS Algorithm 1 processing the clean and adversarial images, respectively. The last two rows are the inverted version. **Author Contributions:** Conceptualization, A.F.A.S. ; methodology, A.F.A.S. ; software, A.F.A.S. ; validation, A.F.A.S., A.C., A.M. and R.T.; writing--original draft preparation, A.F.A.S. ; writing--review and editing, A.F.A.S., A.C., A.M. and R.T.; visualization, A.F.A.S. ; supervision, A.C., A.M. and R.T.; investigation, A.M. and R.T.; project administration, A.C. and A.M. All authors have read and agreed to the published version of the manuscript. **Funding:** The authors would like to acknowledge that this work has been supported by the Maroun Semaan Faculty of Engineering and Architecture (MSFEA) at the American University of Beirut (AUB), and the APC was funded by MSFEA. **Institutional Review Board Statement** Not applicable. **Informed Consent Statement** Not applicable.