# Image Segmentation Framework for Detecting Adversarial Attacks for Autonomous Driving Cars
## 4 Experimental Setup
### Inverted Along with Segmented Image
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Configuration**} & \multicolumn{3}{c}{\(L_{m}\)**Attacks**} & \multicolumn{3}{c}{\(L_{2}\)**Attacks**} & \multicolumn{3}{c}{\(L_{2}\)**Attacks**} & \multicolumn{3}{c}{**Overall**} & \multicolumn{1}{c}{**False**} \\ \cline{3-14}  & **Detector** & **Parameters** & **Threshold** & **FGSM** & **BIM** & \multicolumn{3}{c}{**CW\({}_{0}\)**} & \multicolumn{1}{c}{**Cw\({}_{0}\)**} & \multicolumn{1}{c}{**CW\({}_{0}\)**} & \multicolumn{1}{c}{**JSMA**} & \multicolumn{1}{c}{**Detection**} & \multicolumn{1}{c}{**Positive**} \\ \cline{3-14}  & **Neat** & **LL** & **Next** & **LL** & **Next** & **LL** & **Next** & **LL** & **Next** & **LL** & **Next** & **LL** & **Next** & **LL** & **Rate** \\ \hline \multirow{3}{*}{**Cw.**} & FeatureSqueezing & 1-bit & 0.00025 & 97.8\% & 98.9\% & 100\% & 100\% & 100\% & 100\% & 100\% & 71\% & 64\% & 100\% & 100\% & 92.9\% & 4.1\% \\ \cline{2-14}  & FeatureSqueezing & 2-bit & 0.00008 & 73.9\% & 8.6\% & 94\% & 98\% & 100\% & 59.9\% & 99\% & 63\% & 76\% & 100\% & 100\% & 81.5\% & 3.9\% \\ \cline{2-14}  & FeatureSqueezing & Median-Filter 2\(\times\)2 & -1 bit & 0.00275 & 97.8\% & 97.8\% & 100\% & 100\% & 100\% & 100\% & 93\% & 95\% & 100\% & 100\% & 98.4\% & 4\% \\ \cline{2-14}  & **Segmentation** & Median-Filter 3\(\times\)3 & - & & & & & & & & & & & & & & \\
**Our Method** & **L** - _Mans_ = 0.35 & - & **100\%** & **100\%** & 100\% & 96\% & 94.9\% & 96\% & 90\% & 95\% & 96.8\% & 97.7\% & 96.9\% & 3.3\% \\ \cline{2-14}  & FeatureSqueezing & 5-bit & 0.2997 & 4.6\% & 14.1\% & 38\% & 67\% & 56.7\% & 79\% & 92\% & 2\% & 5\% & 6\% & 8.1\% & 34.3\% & 4.9\% \\ \cline{2-14}  & FeatureSqueezing & Median-Filter 2\(\times\)2 & 1.1683 & 25.5\% & 48.9\% & 95\% & 100\% & 71.1\% & 98\% & 100\% & 99\% & 100\% & 77\% & 86.7\% & 82.9\% & 4.9\% \\ \cline{2-14}  & FeatureSqueezing & Non-local Mean 13 \(-\)3 \(-\)2 & 0.3588 & 17.4\% & 30.4\% & 88\% & 95\% & 74.2\% & 91\% & 99\% & 4\% & 6\% & 24\% & 21.4\% & 49.9\% & 4.7\% \\ \cline{2-14}  & FeatureSqueezing & Median-Filter 2\(\times\)2 & -5 bit & 1.1683 & 27.9\% & 50\% & 97\% & 100\% & 76.2\% & 99\% & 100\% & 99\% & 100\% & 77\% & 86.7\% & 83.9\% & 5.1\% \\ \cline{2-14}  & **Segmentation** & Median-Filter 3\(\times\)3 & - & **83.7\%** & **91.3\%** & **99\%** & 100\% & **93.8\%** & 100\% & 100\% & 98\% & 100\% & **98\%** & **97.9\%** & **96.7\%** & 18.6\% \\ \cline{2-14}  & **Our Method** & **L** - _Mans_ = 0.35 & - & **83.7\%** & **91.3\%** & **99\%** & 100\% & **93.8\%** & 100\% & 100\% & 98\% & 100\% & **98\%** & **97.9\%** & **96.7\%** & 18.6\% \\ \cline{2-14}  & **Segmentation** & Median-Filter 3\(\times\)3 & - & **83.7\%** & **91.3\%** & **99\%** & 100\% & **93.8\%** & 100\% & 100\% & 98\% & 100\% & 100\% & **98\%** & **97.9\%** & **96.7\%** & 18.6\% \\ \cline{2-14}  & **Segmentation** & Non-local Mean 13 \(-\)3 \(-\)1 & - & **98.6\%** & **100\%** & **98.9\%** & 100\% & **100\%** & 98.9\% & 100\% & 100\% & 100\% & **100\%** & **99.7\%** & 5.9\% \\ \cline{2-14}  & **Segmentation** & Median-Filter 3\(\times\)3 & - & **98.6\%** & **100\%** & **98.9\%** & 100\% & **100\%** & 98.9\% & 100\% & 100\% & 100\% & **100\%** & **100\%** & **99.7\%** & 5.9\% \\ \cline{2-14}  & **Segmentation** & **L** -_Mans_ = 0.35 & - & **98.6\%** & **100\%** & **98.9\%** & 100\% & **100\%** & 98.9\% & 100\% & **100\%** & 100\% & **100\%** & **99.7\%** & 5.9\% \\ \cline{2-14}  & **Our Method** & Non-local Mean 13 \(-\)3 \(-\)3 \(-\)1 & & & & & & & & & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Adversarial detection configurations and results of the proposed method compared to feature squeezing.