# ShuffleDetect: Detecting Adversarial Images against Convolutional Neural Networks
## 8 Parameters and Experiments Performed on ShuffleDetect\({}_{\sigma}^{\mathcal{C}}\)  
In what follows, we essentially consider ShuffleDetect\({}_{\sigma}^{\mathcal{C}}\) for each individual permutation \(\sigma\), each CNN \(\mathcal{C}\), each clean image, and each image that is adversarial against \(\mathcal{C}\). Altogether, the method is applied to all (resized if necessary) ancestors \(\mathcal{A}_{q}^{p}\) on the one hand, as well as to all 2975 successful adversarials \(\mathcal{D}_{k}^{\textit{atk,target}}(\mathcal{A}_{q}^{p})\) and all 6505 successful adversarials \(\mathcal{D}_{k}^{\textit{atk,untarget}}(\mathcal{A}_{q}^{p})\) that compose Table 3 on the other hand. The ShuffleDetect parameters are specified below. **Size of patches, number of permutations, and \(\Psi_{\mathcal{C}}(t,s,\Omega)\). ** Firstly, we selected \(s=56\) based on experiments detailed in [23]. Indeed, Table 4, extracted from [23], shows the average outcome for \(2\times 437\) adversarial images obtained from 84 common ancestor images (of size \(224\times 224\)) for the same 10 CNNs considered here. The shuffling process was performed in [23] only for one permutation \(\sigma\) per value of \(s\) (hence \(t=1\) in this case) to obtain the values of Table 4. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline \(\textit{atk}\) & \(\mathcal{C}_{1}\) & \(\mathcal{C}_{2}\) & \(\mathcal{C}_{3}\) & \(\mathcal{C}_{4}\) & \(\mathcal{C}_{5}\) & \(\mathcal{C}_{6}\) & \(\mathcal{C}_{7}\) & \(\mathcal{C}_{8}\) & \(\mathcal{C}_{9}\) & \(\mathcal{C}_{10}\) & Total \\ \hline EA & \((96,91)\) & \((97,90)\) & \((99,88)\) & \((98,84)\) & \((98,79)\) & \((99,85)\) & \((97,89)\) & \((98,86)\) & \((99,97)\) & \((99,97)\) & \((980,886)\) \\ \hline FGSM & \((11,0)\) & \((83,3)\) & \((82,2)\) & \((81,3)\) & \((80,2)\) & \((86,3)\) & \((77,4)\) & \((80,2)\) & \((92,13)\) & \((89,9)\) & \((761,41)\) \\ \hline BIM & \((93,43)\) & \((91,38)\) & \((96,57)\) & \((96,52)\) & \((93,46)\) & \((98,56)\) & \((95,73)\) & \((95,50)\) & \((95,87)\) & \((94,78)\) & \((946,580)\) \\ \hline PGD Inf & \((93,49)\) & \((91,38)\) & \((96,57)\) & \((96,52)\) & \((93,46)\) & \((98,56)\) & \((95,73)\) & \((95,50)\) & \((95,87)\) & \((94,78)\) & \((946,586)\) \\ \hline PGD L1 & \((26,0)\) & \((28,1)\) & \((19,0)\) & \((17,1)\) & \((12,0)\) & \((19,1)\) & \((15,0)\) & \((10,0)\) & \((33,0)\) & \((32,0)\) & \((211,3)\) \\ \hline PGD L2 & \((93,90)\) & \((91,88)\) & \((97,94)\) & \((99,92)\) & \((96,89)\) & \((99,94)\) & \((98,94)\) & \((97,86)\) & \((96,97)\) & \((95,99)\) & \((961,923)\) \\ \hline CW Inf & \((94,0)\) & \((95,0)\) & \((98,0)\) & \((99,0)\) & \((98,0)\) & \((100,0)\) & \((97,0)\) & \((99,0)\) & \((93,0)\) & \((94,0)\) & \((967,0)\) \\ \hline DeepFool & \(94\) & \(97\) & \(92\) & \(97\) & \(94\) & \(100\) & \(94\) & \(97\) & \(96\) & \(94\) & \(955\) \\ \hline Total & \((600,273)\) & \((673,258)\) & \((679,298)\) & \((683,284)\) & \((664,262)\) & \((699,295)\) & \((668,333)\) & \((671,274)\) & \((699,381)\) & \((691,361)\) & \((6727,3019)\) \\ \hline \end{tabular}
\end{table} 
Table 2: For each attack \(atk\), and each \(\mathcal{C}_{k}\), the number of successful runs performed on the 100 ancestors are presented. The results are given as a pair \((\alpha,\beta)\) or as a single value \(\alpha\), depending on whether \(atk\) is performed for both the untargeted and the targeted scenarios (assessed, respectively, by the values of \(\alpha,\beta\) in the pair), or only the untargeted scenario (assessed by the single value of \(\alpha\)). The statistically relevant successful attacks on each individual CNN are given in the last row with obvious notations.