# Image Segmentation Framework for Detecting Adversarial Attacks for Autonomous Driving Cars
## 5 Results and Discussion  
The detection rates of our proposed pipeline against the best combination of feature squeezers of the adversarial images, generated using eleven attacks for all three data sets, are summarized in Table 7. Our proposed method achieved a detection rate exceeding 96% for successful adversarial attacks across all data sets. Notably, the detection rates for FGSM \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Configuration**} & \multicolumn{6}{c}{\(L_{\alpha}\)**Attacks**} & \multicolumn{6}{c}{\(L_{\delta}\)**Attacks**} & \multicolumn{6}{c}{\(L_{\delta}\)**Attacks**} & \multicolumn{6}{c}{**Overall**} & **False** \\ \cline{2-13} \multirow{2}{*}{**Detector**} & \multirow{2}{*}{**Trainset**} & \multirow{2}{*}{**Threshold**} & & \multirow{2}{*}{**FGSM**} & & \multicolumn{2}{c}{**EW\({}_{\alpha}\)**} & \multicolumn{2}{c}{**CW\({}_{\alpha}\)**} & \multicolumn{2}{c}{**JSMA**} & \multicolumn{2}{c}{**Detection**} & **Positive** \\  & & & & & & **Next** & **LL** & **Next** & **LL** & **Next** & **LL** & **Next** & **LL** & **Rate** & **Rate** \\ \hline \multirow{4}{*}{DNN Verifier 1} & Training using & & & & & & & & & & & & & & & \\  & Segmented \& Inverted & & & & & & & & & & & & & & \\  & Images & & & & & & & & & & & & & & & \\ \hline \multirow{4}{*}{DNN Verifier 2} & Training using & & & & & & & & & & & & & & & \\  & Segmented & & & & & & & & & & & & & & & \\  & Images & & & & & & & & & & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Adversarial detection results and configurations of two DNN verifiers, one trained using segmented and inverted images and the other trained only using the segmented images. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Configuration**} & \multicolumn{6}{c}{**FGSM Attack with Different \(\varepsilon\) Volume**} & & & & & & & & & & & & & & \\  & **Detector** & **Parameters** & **Threshold** & **0.01** & **0.02** & **0.03** & **0.04** & **0.05** & **0.05** & **0.06** & **0.07** & **0.08** & **0.07** & **0.08** & **0.1** & **0.2** & **0.3** & **0.4** & **0.5** & **Ratio** \\ \hline \multirow{4}{*}{Fashion-Segments} & \multirow{2}{*}{**S-14**} & 0.12805 & 28.34\% & 24.09\% & 11.87\% & 10.11\% & 4.99\% & 2.15\% & 1.07\% & 9.7\% & 2.12\% & 0.0\% & 0.0\% & 0.0\% & 0.0\% & 0.0\% & 0.0\% \\  & & Segmented & & & & & & & & & & & & & & & \\  & Segmented & & & & & & & & & & & & & & & & &  
and BIM attacks were higher than the best-performing feature squeezing detector across all data sets. We attribute this to the major difference in the core functionality between our proposed method and feature squeezing. The feature squeezing method depends on bit-depth reduction, which normalizes the salient feature of the image and the perturbation or adversarial noise equally. On the other hand, our detection method uses the KAS algorithm that selectively chooses and preserves the salient features of the image in the segmented regions, reducing the overall effect of the perturbation noise. Although the detection rate of our method for MNIST was slightly lower than the best feature squeezing detector, it still exceeded 96%. For the CIFAR-10 and GTSRB-8, our detection method outperformed the feature squeezing method by over 10%. The false positive rates of our method are comparable to feature squeezing for the MNIST and GTSRB-8 data sets. However, for the CIFAR-10, the false positive rate is higher due to the reduction in classification accuracy of the verifier model. This accuracy reduction is mainly attributed to three factors. The first is the added dummy class in the training set, which increases the difficulty of the classification task knowing that we are using the same architecture of the target model that was developed only to classify the original classes. The second is the smoothing effect of the median filter, which degrades the image contrast.