# TwinNet: A Double Sub-Network Framework for Detecting Universal Adversarial Perturbations
## 4 Method
### Shadow Classifier  
The shadow classifier \(f_{shdw}\) runs in parallel with the target classifier \(f_{tagt}\). In comparison with \(f_{tagt}\), \(f_{shdw}\) is dedicated to enhancing adversarial-related features. Whether it is fed a normal or  
Figure 4: Architecture of the TwinNet framework.  
an adversarial example, \(f_{shdw}\) always produces the same result as what \(f_{tagt}\) outputs given the corresponding adversarial example.  
_Hybrid training Set_. In order to selectively enhance adversarial-related features in an example, \(f_{shdw}\) is fully trained on a synthetic, specially labelled dataset called a hybrid training set, which is by definition the product mixture of two types of examples as follows  
\[\begin{array}{c}\text{D}_{hts}=\{(\mathbf{x}_{norm},\mathbf{y}_{adv}{}^{\prime}),( \mathbf{x}_{adv},\mathbf{y}_{adv})\}\\ \mathbf{y}_{adv}^{\prime}=\text{F}(\mathbf{x}_{norm}+\mathbf{v}),\\ \mathbf{y}_{adv}=\text{F}(\mathbf{x}_{adv}),\end{array} \tag{4}\]  
where \(\text{F}(x)\) is the classification function of the target classifier, which predicts the label for the input example \(x\); and \(\mathbf{v}\) are the universal adversarial perturbations. In the hybrid training set \(\text{D}_{hts}\), the former tuple is the normal part containing the normal examples \(\mathbf{x}_{norm}\) labelled with the corresponding adversarial labels \(\mathbf{y}_{adv}{}^{\prime}\) for suppressing the normal-related features. Additionally, the latter is the adversarial part containing the adversarial examples \(\mathbf{x}_{adv}\) and the labels \(\mathbf{y}_{adv}\) for more obvious adversarial-related features.  
Furthermore, all of the examples collected in a hybrid training set are 'bottleneck values'. We refer to the term of 'bottleneck value' as the activations of the layer just before the classification layers. The details of constructing a hybrid training set are described in Algorithm 1.  
```
0:\(\text{D}_{norm}\leftarrow\)-normal example set, \(\text{F}(x)\leftarrow\)-classification function of target classifier, \(v\leftarrow\)-universal adversarial perturbation
0:\(\text{D}_{hts}\leftarrow\)-hybrid training set
1: Initialize \(\text{D}_{hts}\leftarrow\varnothing\)
2:for\(x\) in \(\text{D}_{norm}\):
3:if\(\text{F}(x+v)\
eq\text{F}(x)\) :
4:\(l_{abk}\leftarrow\)-classification label \(\text{F}(x+v)\)
5:\(btrk_{norm}\leftarrow\)-bottleneck activations of \(x\)
6:\(btrk_{abk}\leftarrow\)-bottleneck activations of \((x+v)\)
7:\(\text{D}_{hts}\leftarrow\)-\(\{(btrk_{norm},\,l_{adv})\}\cup\text{D}_{hts}\)
8:\(\text{D}_{hts}\leftarrow\{(btrk_{abk},\,l_{adv})\}\cup\text{D}_{hts}\)
9:return\(\text{D}_{hts}\)
```  
**Algorithm 1** Constructing Hybrid Training Set  
_Training_. Considering time and computing resources, \(f_{shdw}\) is retrained from \(f_{tagt}\) on a hybrid training set using the transfer learning technique [23]. Transfer learning is a technique which shortcuts a lot of work of parameter training by taking a fully trained model for a set of categories, and retraining from the existing weights for new classes. Eventually, only the parameters of the classification layers are learned from scratch, leaving those of the feature extraction layers unchanged. We therefore collect bottleneck values in a hybrid training set rather than in original image examples.