# ShuffleDetect: Detecting Adversarial Images against Convolutional Neural Networks
## 2 CNNs and Adversarial Images  
A CNN, which is expected to perform image classification, is first trained on a large dataset \(\mathcal{S}\) of images. Training consists of sorting the given images into a finite set of predefined categories. The categories \(c_{1},\ldots,c_{\ell}\), their number \(\ell\), and the images used in the process are associated with \(\mathcal{S}\), and are common to any CNN trained on \(\mathcal{S}\). The training phase of a CNN consists of two phases. Firstly, the CNN is given the training images, and, for each training image, a vector of length \(\ell\), where each real-value component assesses the probability that the training image represents an object in the corresponding category. Secondly, CNN is challenged against a validation set of images that assesses its ability to sort images accurately. Once trained, a CNN can be exposed to an arbitrary image, and perform its classification according to \(\ell\) categories. An important, albeit technical, issue involves the sizes of the images. While the sizes of the images of \(\mathcal{S}\) are arbitrary and may vary from one image to another, a CNN handles images of a fixed input size. Therefore, a resizing process is usually necessary to adapt a given image to the input size of the CNN before classification. To simplify the notation, we consider that this resizing process has been performed, and the input size handled by the CNN is square (Section 5 specifies which resizing function is used in the experiments). We also often identify image \(\mathcal{I}\) with its resized version, which fits the input size of the CNN. **Image classification and label values. ** Concretely, given an input image \(\mathcal{I}\), the trained CNN produces a classification output vector  
\[\mathbf{o}_{\mathcal{I}}=(\mathbf{o}_{\mathcal{I}}[1],\ldots,\mathbf{o}_{ \mathcal{I}}[\ell]),\]  
where \(0\leq\mathbf{o}_{\mathcal{I}}[i]\leq 1\) for \(1\leq i\leq\ell\), and \(\sum_{i=1}^{\ell}\mathbf{o}_{\mathcal{I}}[i]=1\). Each component \(\mathbf{o}_{\mathcal{I}}[i]\) defines the \(c_{i}\)-label value measuring the probability that image \(\mathcal{I}\) belongs to the category \(c_{i}\). Consequently, the CNN classifies image \(\mathcal{I}\) as belonging to the category \(c_{k}\) if \(k=\arg\max_{1\leq i\leq\ell}(\mathbf{o}_{\mathcal{I}}[i])\). One denotes \((c_{k},\mathbf{o}_{\mathcal{I}}[k])\) this outcome, and \(\text{Dom}_{\mathcal{C}}(\mathcal{I})=c_{k}\) the dominating category in which \(\mathcal{C}\) classifies \(\mathcal{I}\). The higher the label value \(\mathbf{o}_{\mathcal{I}}[k]\), the higher the confidence that \(\mathcal{I}\) represents an object of the category \(c_{k}\). **Adversarial image requisites. ** Assume that we are given \(\mathcal{C}\) a trained CNN, \(c_{a}\) a category among the \(\ell\) possible categories, and \(\mathcal{A}\) an image classified by \(\mathcal{C}\) as belonging to \(c_{a}\), with \(\tau_{a}\) its \(c_{a}\)-label value. For any attack scenario that we consider in this paper (namely the _target_ or the _untargeted scenario_, as made precise below), we assume that the attack aims at creating a new _adversarial image_\(\mathcal{D}(\mathcal{A})\), which remains so close to the ancestor's _clean image_\(\mathcal{A}\) that a human would not be able to distinguish between \(\mathcal{D}(\mathcal{A})\) and \(\mathcal{A}\). The quantity \(\epsilon(\mathcal{A},\mathcal{D}(\mathcal{A}))\), which controls (or restricts) the global maximum amplitude allowed for the value modification of each individual pixel of \(\mathcal{A}\) to obtain \(\mathcal{D}(\mathcal{A})\), numerically assesses this human perception. In the _untargeted scenario_, \(\mathcal{C}\) is only required to classify the adversarial image \(\mathcal{D}(\mathcal{A})\) as any class \(c\
eq c_{a}\). In the _target scenario_, one selects, _a priori_, a target category \(c_{t}\
eq c_{a}\).