# Image Segmentation Framework for Detecting Adversarial Attacks for Autonomous Driving Cars
## 1 Introduction  
Autonomous driving technology represents a sophisticated intelligent system composed of numerous interconnected subsystems [1], enabling autonomous vehicles to navigate and operate without human interaction [2, 3]. Each of these subsystems is responsible for managing critical tasks spanning the entire operational pipeline--from the perception phase, where the environment is sensed and understood, to the control phase, where decisions are translated into precise vehicle actions [3]. These subsystems typically include sensor fusion [4], object detection [5], trajectory planning [6], and vehicle control [7]. The seamless integration of these components is essential to ensure safe, efficient, and reliable autonomous operation, particularly in dynamic and unpredictable environments [8]. However, autonomous driving systems rely heavily on DNN models, which are, in nature, prone to adversarial attacks [9]. This vulnerability poses a critical threat to such safety-critical autonomous driving systems. Adversarial attacks subtly manipulate the input data by adding small perturbations that lead to misclassifications by the DNN, despitenot visibly distorting the input. Such imperceptible changes can cause significant deviations in the model output, aligned with the intent of the attacker. Multiple studies have shown that adversarial examples can be effectively transferred to real-world environments [10; 11; 12; 13; 14]. Furthermore, recent studies introduced innovative approaches that craft stealthy adversarial attacks by mainly manipulating the style and the color of the captured images by the car's sensors [15; 16; 17; 18; 19; 20; 21] under different driving environments and light conditions. Therefore, a comprehensive defense technique that restricts these image space manipulations is crucial to secure the autonomous driving environment and mitigate the threat of adversarial attacks on such critical systems. Existing defense mechanisms against adversarial attacks face challenges such as limited generalization, e.g., when using adversarial training [22; 23], high computational costs, e.g., when using Generative Adversarial Networks (GANs) [24], and reduced effectiveness against certain adversarial attacks [25]. To this end, we propose a novel adversarial detection method based on image segmentation techniques that can be easily added to any DNN model, thus making the detection method model agnostic. Also, the proposed detection method does not need prior knowledge of any adversarial algorithms as opposed to adversarial training; therefore, it is adversarial-knowledge agnostic. The proposed pipeline mitigates the adversarial effect by checking the segmentation mask patterns of the input images and classifying their salient features while neglecting non-structural ones. Our approach begins by extracting the segmentation mask of the input image using a U-net model and then feeding it into a one-class Support Vector Machine (SVM) to verify if it matches legitimate patterns of the segmentation masks. This is the first line of defense. Next, the object of interest is isolated using the segmentation mask, and a proposed segmentation algorithm based on k-means dynamically segments the masked image into several regions preserving its structural features. The segmentation algorithm generates two versions of the input image: a segmented image and an inverted one. Both versions are classified by a verifier model, that is, a DNN model different from the main one. The predictions are then compared to the original input prediction of the target (main) model for the final decision. The verifier model with the segmentation algorithm is the second line of defense. Our work can be summarized into four main contributions:  
1. We propose a segmentation mask verification method (first line of defense): The proposed method verifies the segmentation mask of the input image for adversarial noise instead of directly analyzing the image.