# ShuffleDetect: Detecting Adversarial Images against Convolutional Neural Networks
## 9 Intrinsic Performance of ShuffleDetect\({}^{\mathbf{C},R_{th},t}\)  
**Indicators and performance. ** Since ShuffleDetect\({}^{\mathbf{C},R_{th},t}\) is an unsupervised detector, the complexity criterion does not apply. The values of the remaining indicators do depend on the number \(t\) of permutations to be considered, and most of them are determined by the selected threshold ratio \(R_{th}\). To assess the inference time latency, the creation of \(t=100\) permutations (Step 1 of Algorithm 1) took 0.064 s using the command SymmetricGroup(16) and 100 calls of the command RandomElement on Maple 2022 (this timing could certainly be optimized). Running ShuffleDetect\({}^{C}_{\
u}\) for a single permutation \(\sigma\) (Steps 8 to 12 of Algorithm 1) takes 0.0784 s/permutation on average (over 100 considered permutations, overall 10 CNNs, and over 100 random clean images because considering them is sufficient to assess this average). The time required by Steps 2, 3, 6, and 14 (all of which are outside the loop of the \(t\) permutations) is negligible. The overall inference time latency of ShuffleDetect performed on an image with \(t=100\) permutations amounts to \(\simeq\)0.064 + 1 \(\times\) 0.0784 + 100 \(\times\) 0.0784 = 0.064 + 7.918 = 7.982 s/image on average. On the one hand, the prediction process performed by the CNN (one time in Steps 4 and 5 for the unshuffled image, and \(t=100\) times in Steps 9 and 10 for the shuffled images) contributes to \(\simeq\)98.02% of this time consumption. On the other hand, the shuffling process (Step 8, called \(t=100\) times) contributes to \(\simeq\)1.98% of this time consumption. See Appendix B, Table A4 for detailed information on all CNNs. One should take into account two positive aspects of the proposed detector. Firstly, the 0.064 s consumed by the creation of the 100 permutations can be mutualized over several calls of the detector for different input images. Secondly, the tasks performed iteratively (Steps (7) to (13)) can be easily distributed; thus, apart from the time required for the creation of the 100 permutations, the algorithm would require only \(\simeq\)0.0784, plus some minor time due to the gathering of the distributed information, and the final computation and comparison. The Overhead is very limited (and can be optimized). Algorithm 1 shows that the \"permanent storage\" is limited to the \(t=100\) permutations expressed as products of cycles as in Table A3, Appendix B (which actually can be called upon if the permutations are computed once for all images to handle as we do in our experiments), the integer \(s_{th}\), and the extracted dominating category \(\text{Dom}_{\mathcal{C}}(\mathcal{I})\) (which amounts to a numbering among the 1000 categories of ImageNet in our case). The \"incremental storage\" is made of the value 0 or 1 as \(\sigma\) progresses throughout the \(t\) permutations, hence (at most) \(t\) such Boolean values if one wants to keep the whole information. A memory-saving alternative is to keep only the updated \(N\) as \(\sigma\) progresses throughout the \(t\) permutations. The \"ephemeral storage\" (deleted after each run) is composed of the running images \(sh_{\sigma}(\mathcal{I},s)\) and \(\text{Dom}_{\mathcal{C}}(sh_{\sigma}(\mathcal{I},s))\). The computation resources are essentially limited to the creation of \(t\) permutations (to be done once at the beginning, as recommended), to \(1+t\) calls to the CNN for the classification of \(\mathcal{I}\) and \(sh(\mathcal{I},\sigma_{i})\), and to the creation of the (up to) \(t\) shuffled images \(sh_{\sigma}(\mathcal{I},s)\). Finding the dominant category, as is necessary once for \(\mathcal{I}\) and (at most) \(t\) times for the shuffled images, amounts to looking for the largest value in the classification output category, which is immediate in a set of 1000 values, as is the case here. Note that in what precedes, we mention \"at most\" a few times since one could stop the loop before its natural end.