# Class Retrieval of Detected Adversarial Attacks
## 3 Class Retrieval
Our class retrieval algorithm for a detected adversarial attack is presented in Algorithm 1 as a pseudo-code, and explained as a flowchart in Figure 4. \(AdvImg\) is the adversarial image which has been selected by an adversarial attack detector filtering any potential adversarial threat. The neural network prediction for the label of the adversarial image is \(AdvLab\), which is a misclassification according to our detector. \(NbClass\) is a fixed parameter representing the number of classes in our classification problem. We apply a counter targeted attack using \(Attack()\) function where \(NbIter\) is the number of iterations in the iterative adversarial attack and \(Target\) is the targeted label. The loss function, \(loss()\), calculates the cross entropy loss of the counter adversarial image, \(ContAdvImg\), having \(Target\) as a label. We exterminate the possibility of the adversarial label, \(AdvLab\), being the original class by setting its loss to infinity. The original label, \(OrigClass\), is the class with the minimum loss excluding the adversarial label where we used \(argmin\) function to return the index of the smallest loss. ```
1 Parameters:\(NbIter\),\(NbClass\),\(AdvImg\),\(AdvLab\) Result:\(OrigClass\)\(Losses=0\),\(Losses[AdvLab]=\infty\)for\(Target:0\)to\(NbClass\)do
2 if\(Target!=AdvLab\)then
3\(ContAdvImg=Attack(AdvImg,NbIter,Target)\)\(Losses[Target]=loss(ContAdvImg,Target)\)
4
5 end for
6
7 end for
8
9\(OrigClass=argmin(Losses)\)
```  
**Algorithm 1**Class retrieval algorithm for a detected adversarial attack  
Figure 3: A showcase of our algorithm is illustrated in the figure using an image from ImageNet dataset, where the first two images show the clean sample, squirrel, and its adversarial version, where \(Pred\) is the index of the predicted class and \(Prob\) is the confidence. The last image depicts the losses of the counter adversarial attacks throughout 8 iterations, where the legends refer to the targeted classes. We can see that the index of the original label, nine, have the smallest loss since the first iteration. To demonstrate the validity of our work, we assumed the existence of an optimal detector which can identify any adversarial attacks. We investigated four different adversarial attacks (projected gradient descent attack (PGD) [32], MPGD [17], Deepfool [18], TPGD [20], PGDDLR [19]; most of the attacks were adopted from Torchattacks library [33] while we used the codes of the original paper for the Deepfool attack) which were briefly explained in the previous section. Deepfool is not a targeted attack and the last two attacks are extended versions of the first attack; thus, we only used the first two previously mentioned attacks, PGD attack and PGD with momentum, as a counter adversarial attack. All the investigated adversarial attacks are white-box attacks, and this relies on the gradients to calculate the small perturbations fooling the classifier. For the sake of reproducibility, you can find our codes online [[https://github.com/[PERSON]/class_retrieval](https://github.com/[PERSON]/class_retrieval)]([https://github.com/[PERSON]/class_retrieval](https://github.com/[PERSON]/class_retrieval)) (accessed on 7 June 2021), which include the chosen investigated parameters.