# ShuffleDetect: Detecting Adversarial Images against Convolutional Neural Networks
## 11 Conclusions  
In this paper, we presented ShuffleDetect as a new unsupervised method for the detection of image adversarials against trained CNNs. We provided a complete design and recommendations for the selection of the values of its parameters. Given a CNN and an image potentially resized to fit the CNN's input size, the steps that essentially compose this new detection method are fairly simple. During the initiation phase, the dominant category in which the CNN sorts the input image is required, the image is split into non-overlapping patches (of fixed sizes, depending on the CNN's own input size), and a fixed set of appropriate permutations is selected at random. Then a loop is performed according to the successive permutations, where the patches are shuffled with the running permutation, and the dominant category in which the CNN sorts the shuffled image is compared with the outcome for the unshuffled image, leading to a Boolean value. Finally, one assesses the proportion of permutations for which the CNN classifies the shuffled image into a different category than the unshuffled input image. ShuffleDetect declares the image as adversarial if this proportion exceeds a threshold value \(R_{th}\) and declares the image clean otherwise. Our extensive experiments with 10 diverse and state-of-the-art CNNs, trained on ImageNet with images usually resized to \(224\times 224\), with 8 attacks (one 'black-box' and seven 'white-box'), and with 9500 clean and adversarial images for the targeted or untargeted scenario led us to recommend a size of \(56\times 56\) for the altogether 16 patches, and the \"democratic\" value \(R_{th}\) = 0.51. Although running ShuffleDetect with 100 permutations is perfectly feasible and could be considered a safe option, a smaller number of permutations, varying between 12 and 68 according to the considered CNN, may also lead to a satisfactory detection rate. Additionally, if the defender has more information about the type of attack expected, the number of permutations can be fine-tuned accordingly. This said, and since this type of knowledge occurs rarely, we recommend taking at least 100 permutations. Apart from the time needed for the creation of a fixed set of permutations, namely 0.064 s to obtain 100 permutations, which can be performed once for all (at least in our implementation), the intrinsic performance of ShuffleDetect on our computers shows an inference time latency of \(\simeq\)0.0784 s per image per permutation. The algorithm can be easily parallelized so that the required time for a complete run of the algorithm can be significantly less than the \(\simeq\)7.982 s/image when this task is not distributed. Out of this time-consuming process, the classification process of an image by the CNN is \(\simeq\)98.02%; therefore, the shuffling process itself requires only \(\simeq\)1.98%. The overhead is very limited since its main part, the \"permanent storage\", is required essentially only for the 100 permutations (the storage per permutation is a sequence of groups of distinct integers between 1 and 16 in our case), and the dominating category of the unshuffled image. Among the main indicators of a detector, the most relevant ones are the false positive rate and the detection rate. With \(R_{th}\) = 0.51 and 100 permutations, as well as the average overall considered CNNs and images, ShuffleDetect achieves an average FPR of 32.7%, an average DR of 100% for the adversarial images obtained by targeted attacks, and 87.79% of those obtained by