# Image Segmentation Framework for Detecting Adversarial Attacks for Autonomous Driving Cars
## 5 Results and Discussion
The third is that, unlike the main model that is trained on the full version of the data set, the verifier model is trained on the masked version. To validate the last point, we trained a dense model under the same architecture and parameters of the target model using the masked version of the CIFAR-10 data set of \(32\times 32\). The results showed that the classification accuracy of the trained dense model is 88.17%, which is less than the target model accuracy by 6.67%. In other words, removing the background from the images in the data set using the masks degrades the classification accuracy of the model. In addition, the preciseness of the U-net model in generating accurate segmentation masks directly affects the verifier model's accuracy. The same argument holds for the OCSVM model. The results in Table 8 show that verifier 1 trained on segmented and inverted images achieved higher detection rates for nearly every adversarial attack, with an overall detection rate 4.2% higher than verifier 2 that trained only on segmented images. However, verifier 2 had a 1.1% lower false positive rate. Regarding the robustness of the model, as shown in Table 1, verifier 1 also outperformed verifier 2 in terms of classification accuracy for both segmented and inverted test images. In addition, verifier 2 suffered a significant drop in classification accuracy for inverted images, achieving only 23.93%. These results indicate that verifier 1, trained on both segmented and inverted images, developed a more robust understanding of the data set's structure and demonstrated superior adversarial detection capabilities. The findings in Table 9 reveal that our detection method achieves state-of-the-art adversarial detection across all tested perturbation values, with an overall detection rate of 97.37%. Notably, our method consistently outperformed the best feature squeezing techniques for all \(\varepsilon\) values of the FGSM attack, reflecting the robustness of the proposed method. The bar chart of Figure 3 indicates that the SSIM values for all classes of the three data sets are above 98.5%, signifying a high degree of structural similarity between the images before and after the KAS segmentation algorithm at \(k=35\%\). Therefore, the KAS algorithm preserves the salient features of the input image. Figure 4 illustrates that all tested values of \(k\) yielded SSIM indices above 98.5%. However, as \(k\) increases, both the processing time of the KAS algorithm and the SSIM index increase. Therefore, we selected \(k=35\%\) as a balanced trade-off between the processing time and SSIM index. Figure 5 illustrates the detection rates of our proposed method compared to the best feature squeezer for various \(\varepsilon\) values of the FGSM attack on the GTSRB-8 data set. This  
figure highlights the robustness and consistency of our detection method, maintaining a high detection rate above 93% regardless of the perturbation level. The most effective FGSM attack occurred at \(\varepsilon=0.07\), where our method successfully achieved a detection rate of 93.54%. In contrast, the best feature squeezer managed only a 49.46% detection rate for the same level of perturbation. In order to visually illustrate how the mechanism of the proposed two-tier adversarial detection works, we plotted some detected adversarial images from different types of attacks on the MNIST data set. Figure 8 presents some adversarial images detected by the first line of defense of the detection pipeline using the OCSVM model for the MNIST data set. The first row of Figure 8 represents the clean images, the second row represents the adversarial images after applying different attacks, the third row is the clean masks generated by the U-net model, and the last row shows the resultant masks of the adversarial image after passing them to the U-net model. We can see visually that the generated adversarial masks by the U-net model shown in Figure 8 do not fall into the categories of clean masks shown in the third row of the figure.