# ShuffleDetect: Detecting Adversarial Images against Convolutional Neural Networks
## 9 Intrinsic Performance of ShuffleDetect\({}^{\mathbf{C},R_{th},t}\)
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{\(R_{th}\)} & \multicolumn{2}{c}{**Targeted**} & \multirow{2}{*}{**Metrics**} & \multirow{2}{*}{\(\mathcal{C}_{1}\)} & \multirow{2}{*}{\(\mathcal{C}_{2}\)} & \multirow{2}{*}{\(\mathcal{C}_{3}\)} & \multirow{2}{*}{\(\mathcal{C}_{4}\)} & \multirow{2}{*}{\(\mathcal{C}_{5}\)} & \multirow{2}{*}{\(\mathcal{C}_{6}\)} & \multirow{2}{*}{\(\mathcal{C}_{7}\)} & \multirow{2}{*}{\(\mathcal{C}_{8}\)} & \multirow{2}{*}{\(\mathcal{C}_{9}\)} & \multirow{2}{*}{\(\mathcal{C}_{10}\)} & \multirow{2}{*}{Avg} \\ \cline{3-3} \cline{8-12}  & \multirow{3}{*}{**Attack**} & & & & & & & & & & & & \\ \hline \multirow{11}{*}{**0.87**} & \multirow{11}{*}{**0.88**} & **DR** & 100 & 100 & 100 & 98.1 & 97.8 & 98.2 & 98.6 & 100 & 100 & 98.7 & **99.1** \\  & & **TP** & 43 & 38 & 57 & 51 & 45 & 55 & 72 & 50 & 87 & 77 & **57.5** \\  & & **FP** & 17 & 9 & 11 & 15 & 11 & 11 & 9 & 27 & 18 & **13.9** \\  & & **FN** & 0 & 0 & 1 & 1 & 1 & 1 & 0 & 0 & 1 & **0.5** \\  & **Precision** & 0.71 & 0.80 & 0.83 & 0.77 & 0.80 & 0.83 & 0.86 & 0.84 & 0.76 & 0.81 & **0.8** \\  & **Recall** & 1 & 1 & 1 & 0.98 & 0.978 & 0.982 & 0.986 & 1 & 1 & 0.987 & **0.99** \\  & & **F1** & 0.83 & 0.88 & 0.90 & 0.86 & 0.88 & 0.89 & 0.91 & 0.91 & 0.86 & 0.88 & **0.87** \\ \hline \multirow{11}{*}{**0.87**} & \multirow{11}{*}{**0.87**} & **DR** & 100 & 100 & 100 & 98.1 & 97.8 & 98.2 & 98.6 & 100 & 100 & 98.7 & **99.1** \\  & & **TP** & 49 & 38 & 57 & 51 & 45 & 55 & 72 & 50 & 87 & 77 & **57.5** \\  & **FP** & 17 & 9 & 11 & 15 & 11 & 11 & 9 & 27 & 18 & **13.9** \\  & **FN** & 0 & 0 & 0 & 1 & 1 & 1 & 1 & 0 & 0 & 1 & **0.5** \\  & **Precision** & 0.74 & 0.80 & 0.83 & 0.77 & 0.80 & 0.83 & 0.86 & 0.84 & 0.76 & 0.81 & **0.8** \\  & **Recall** & 1 & 1 & 1 & 0.98 & 0.978 & 0.982 & 0.986 & 1 & 1 & 0.987 & **0.99** \\  & **F1** & 0.85 & 0.88 & 0.90 & 0.86 & 0.88 & 0.89 & 0.91 & 0.91 & 0.86 & 0.88 & **0.87** \\ \hline \multirow{11}{*}{**0.87**} & \multirow{11}{*}{**0.87**} & **DR** & 100 & 100 & 100 & 98.9 & 97.8 & 98.2 & 98.6 & 100 & 100 & 98.7 & **99.1** \\  & & **TP** & 49 & 38 & 57 & 51 & 45 & 55 & 72 & 50 & 87 & 77 & **58.1** \\  & **FP** & 17 & 9 & 11 & 15 & 11 & 11 & 9 & 27 & 18 & **13.9** \\  & **FN** & 0 & 0 & 0 & 1 & 1 & 1 & 1 & 0 & 0 & 1 & **0.5** \\  & **Precision** & 0.74 & 0.80 & 0.83 & 0.77 & 0.80 & 0.83 & 0.86 & 0.84 & 0.76 & 0.81 & **0.8** \\  & **Recall** & 1 & 1 & 1 & 0.98 & 0.978 & 0.982 & 0.986 & 1 & 1 & 0.987 & **0.99** \\  & **F1** & 0.85 & 0.88 & 0.90 & 0.86 & 0.88 & 0.89 & 0.91 & 0.91 & 0.86 & 0.88 & **0.88** \\ \hline \multirow{11}{*}{**0.87**} & \multirow{11}{*}{**0.87**} & **DR** & 100 & 100 & 100 & 98.9 & 98.8 & 98.9 & 98.9 & 100 & 100 & 98.9 & **99.4** \\  & **TP** & 90 & 88 & 94 & 91 & 88 & 93 & 93 & 86 & 97 & 98 & **91.8** \\  & **FP** & 17 & 9 & 11 & 19 & 12 & 15 & 12 & 11 & 28 & 19 & **15.3** \\
**PGD L2** & **FN** & 0 & 0 & 0 & 1 & 1 & 1 & 1 & 0 & 0 & 1 & **0.5** \\  & **Precision** & 0.84 & 0.90 & 0.89 & 0.82 & 0.88 & 0.86 & 0.88 & 0.88 & 0.77 & 0.83 & **0.85** \\  & **Recall** & 1 & 1 & 1 & 0.98 & 0.98 & 0.98 & 0.98 & 1 & 1 & 0.98 & **0.99** \\  & **F1** & 0.91 & 0.94 & 0.94 & 0.89 & 0.92 & 0.91 & 0.92 & 0.93 & 0.87 & 0.89 & **0.91** \\ \hline \multirow{11}{*}{**0.87**} & \multirow{11}{*}{**0.87**} & **DR** & 100 & 100 & 100 & 100 & 100 & 100 & 100 & 100 & 100 & **100** \\  & & **TP** & 91 & 90 & 88 & 84 & 79 & 85 & 89 & 86 & 97 & 97 & **88.6** \\  & **FP** & 23 & 13 & 14 & 17 & 11 & 13 & 10 & 8 & 23 & 15 & **14.7** \\
**EA** & **FN** & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & **0** \\  & **Precision** & 0.79 & 0.87 & 0.86 & 0.83 & 0.87 & 0.86 & 0.89 & 0.91 & 0.80 & 0.86 & **0.85** \\  & **Recall** & 1 & 1 & 1 & 1 & 1 & 1 & 1 & 1 & 1 & 1 & 1 & **1** \\  & **F1** & 0.88 & 0.93 & 0.92 & 0.90 & 0.93 & 0.92 & 0.94 & 0.95 & 0.