# TwinNet: A Double Sub-Network Framework for Detecting Universal Adversarial Perturbations
## 5 Experiment
### Experiment Results and Analysis  
Figure 6a shows the PCA projection of the activations output by the shadow classifier onto the 1 st and 2 nd eigenvectors. The adversarial part, in comparison to how the target classifier performs (Figure 6c), appears more dispersed and even covers the normal part, which indicates a higher standard deviation. It demonstrates that the shadow classifier can effectively enhance adversarial-related features. When we move to the tail of the projection space (Figure 6b), the distribution of the examples is similar to that of the target classifier (Figure 6d). Figure 6: Scatter plots of PCA projection of activations at the first fully connected layer onto specific eigenvectors. Blue area indicates normal examples and red area indicates adversarial ones: in the shadow classifier, (**a**) projection onto the 1 st and 2 nd eigenvectors; (**b**) projection onto the 890 th and 891 st eigenvectors; in the target classifier, (**c**) projection onto the 1 st and 2 nd eigenvectors; (**d**) projection onto the 890 th and 891 st eigenvectors. Table 2 shows six different network architectures that we test on and compares the fooling rate of UAPs before and after applying our framework. Each classifier is tested by the UAP, which is generated with knowledge of the classifier itself. For example, the classifier GoogLeNet is tested by the UAP generated with knowledge of GoogLeNet. We can see that TwinNet can significantly improve the robustness of all of the test classifiers. Additionally, in the best case (CaffeNet), TwinNet is able to reduce the damage brought by the UAP from 93.3% to 29.79%. This is the best result up to now. In Table 3, we show the detection performance of TwinNet in more detail (T = 0.45). TwinNet is good not only at detecting adversarial perturbations, but it is also good at maintaining a high accuracy on normal examples. Moreover, the robustness of TwinNet across different architectures remains stable consistently such that it can get an average detecting hit rate of up to 72.67%, and even the worst case of VGG-F can reach 66.55%, which is much better than that of existing works. In Table 4, we evaluate the performance of TwinNet defending GoogLeNet against a transfer attack (\(T\) = 0.45). The fields of the first column are the network architectures used to craft UAPs by the adversary. The UAPs used here are generated with knowledge of the remaining five classifiers. We find that TwinNet, with the detecting threshold of 0.45, is practically immune to the transfer attack. It always maintains a high detecting hit rate and a low false alarm rate, reaching 70.27% and 6.45%, respectively, on average. We also note that the network of VGG-F is relatively hard to protect. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Network Architecture of Adversary** & **Detecting Hit Rate/(\%)** & **False Alarm Rate/(\%)** \\ \hline CaffeNet & 67.84 & 6.7 \\ VGG-F & 58.76 & 6.3 \\ VGG-16 & 76.54 & 6.76 \\ VGG-19 & 73.22 & 6.26 \\ ResNet-152 & 75 & 6.26 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Robustness of the TwinNet framework for defending GoogLeNet against a transfer attack on 10-class ImageNet. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Network Architecture** & **Classification Accuracy/(\%)** & **Fooling Rate/(\%)** & **Fooling Rate (applying TwinNet)/(\%)** \\ \hline GoogLeNet [26] & 93.3 & 78.9 & 26.68 \\ CaffeNet [27] & 83.6 & 93.3 & 29.79 \\ VGG-F [28] & 92.9 & 93.7 & 33.45 \\ VGG-16 [29] & 92.5 & 78.3 & 23.17 \\ VGG-19 [29] & 92.5 & 77.8 & 26.19 \\ ResNet-152 [30] & 95.5 & 84 & 24.7 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Classification accuracy of six network architectures on normal examples and the fooling rate that the UAP reached before and after applying the TwinNet framework.