# ShuffleDetect: Detecting Adversarial Images against Convolutional Neural Networks
## 4 ShuffleDetect
```
1:Compute and store \(t\) permutations \(\sigma_{1},\ldots,\sigma_{t}\)
2:Select the size \(s\) for the patches
3:Compute the integer \(s_{th}=\lfloor tR_{th}\rfloor\)
4:From \(\mathcal{C}\), obtain the classification output vector \(\mathbf{o}_{\mathcal{I}}\)
5:Extract \(\text{Dom}_{\mathcal{C}}(\mathcal{I})\)
6:Set \(N=0\)
7:For i from 1 to \(t\) run ShuffleDetect\({}^{\mathcal{C}}_{\sigma_{i}}(\mathcal{I})\) as follows:
8:Create \(sh_{\sigma}(\mathcal{I},s)\)
9:From \(\mathcal{C}\), obtain the classification output vector \(\mathbf{o}_{sh_{\sigma}(\mathcal{I},s)}\)
10:Extract \(\text{Dom}_{\mathcal{C}}(sh_{\sigma}(\mathcal{I},s))\). 11:Compare \(\text{Dom}_{\mathcal{C}}(\mathcal{I})\) and \(\text{Dom}_{\mathcal{C}}(sh_{\sigma}(\mathcal{I},s))\). 12:Output 0 if they match, and 1 if they do not. In this latter case, \(N:=N+1\). 13:end
14:Output \"adversarial\" if \(N\geq s_{th}\), and \"clean\" otherwise. ```  
**Algorithm 1** ShuffleDetect\({}^{\mathcal{C},R_{th},t}(\mathcal{I})\) pseudo-code  
**Remarks. ** (1) Note that the process of comparing dominant categories does not require a precise assessment of their actual label values. Even in the case where an image is considered \(\sigma\)_-clean_ for a given permutation \(\sigma\), it is likely that, although the same category dominates both in the unshuffled and shuffled versions of the image, its label values differ strongly between both images. (2) Although there is some flexibility _a priori_ in setting the value of parameter \(s\) at will, there are choices that turn out to be more appropriate for a given CNN's input size (see Section 8 for the choice of \(s\) and its rationals for the experiments performed in this paper). (3) When assessing many images of the same size, even if one fixes the number (\(t\)) of rounds once and for all, which is convenient in practice, there is still some flexibility in when to select the permutations. One option is to \"reset\" the random choice of \(t\) permutations for each image to be tested. Another option is to proceed to the choice of the permutations at the same time as one chooses the value \(t\), so that both \(t\) and the set of \(t\) random permutations \(\sigma_{1},\ldots,\sigma_{t}\) are decided once for all images to test. There are pros and cons for both options, the former being (slightly) more time-consuming and (slightly) more memory-consuming but less biased, the latter saving time, allowing for an easier comparison and reproduction of the experiments, but providing a possible security leak because an attacker may ultimately guess what the \(t\)-selected permutations are and adapt to them accordingly. See Section 8 for the choices made in our experiments. (4) Although there are theoretical measures and bounds of the proportion of composite numbers declared probably primes after \(t\) rounds of a probabilistic test, there is no such thing regarding the proportion of adversarial images that are declared clean after \(t\) rounds of ShuffleDetect. Therefore, for the time being, our choice of parameters is purely experimental. (5) One can generalize the ShuffleDetect method thanks to the group of symmetries that preserve the square, namely the (non-abelian) dihedral group \(D_{8}\) of order 8. Indeed, with consistent notations, and since each patch is a square, one could add to the action of a cycle \((k_{1},k_{2},\ldots,k_{M})\) of a permutation a randomly chosen sequence of elements \(\gamma_{k_{1}},\gamma_{k_{2}},\ldots,\gamma_{k_{M}}\in D_{8}\), which will act on the respective corresponding patches as well. We do not further explore this direction here, and stick to the exposed design of ShuffleDetect, which actually amounts to taking the identity for all symmetries \(\gamma_{k_{j}}\in D_{8}\).