# ShuffleDetect: Detecting Adversarial Images against Convolutional Neural Networks
## 10 Performance Comparison of ShuffleDetect and Feature Squeezer (FS)  
To assess the extrinsic performance of ShuffleDetect, we compared it with the FS detector [13]. We selected this detector since, similar to ShuffleDetect, it is an unsupervised detector, which also presents no significant complexity issues. The comparison between ShuffleDetect and FS is performed only according to the detection rate, and not according to the other indicators mentioned in Section 3, since, for instance, the value of FPR in [13] is determined by the behavior of FS as compared to another detector (MagNet [35]); hence, it is not an intrinsic value, to the difference of what we do in Section 9 for ShuffleDetect. Therefore, the comparisons of the detectors are performed on the 9480 images of Table 3, adversarial against the 10 considered CNNs (Section 7). \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline \multicolumn{11}{c}{**Optimal Number \(t_{optimal,\mathcal{C},\text{att}}\) of Permutations per CNN and Attack**} \\ \hline \hline \(R_{\text{st}}\) & **Scenario** & **Attacks** & \(\mathbf{C_{1}}\) & \(\mathbf{C_{2}}\) & \(\mathbf{C_{3}}\) & \(\mathbf{C_{4}}\) & \(\mathbf{C_{5}}\) & \(\mathbf{C_{6}}\) & \(\mathbf{C_{7}}\) & \(\mathbf{C_{8}}\) & \(\mathbf{C_{9}}\) & \(\mathbf{C_{10}}\) \\ \hline \multirow{8}{*}{0.91} & \multirow{8}{*}{Untargeted} & EA & 3 & 3 & 3 & 3 & 3 & 3 & 3 & 3 & 3 & 3 \\ \cline{3-11}  & & FGSM & 3 & 19 & 13 & 3 & 9 & 9 & 7 & 13 & 5 \\ \cline{3-11}  & & BIM & 3 & 3 & 11 & 5 & 11 & 19 & 3 & 17 & 13 & 5 \\ \cline{3-11}  & & PGD Inf & 3 & 3 & 11 & 5 & 11 & 19 & 3 & 17 & 13 & 5 \\ \cline{3-11}  & & PGD L2 & 3 & 7 & 3 & 7 & 5 & 15 & 66 & 27 & 7 & 9 \\ \cline{3-11}  & & CW Inf & 3 & 5 & 25 & 17 & 5 & 3 & 5 & 23 & 7 & 3 \\ \cline{3-11}  & & DeepFool & 5 & 3 & 7 & 3 & 37 & 9 & 68 & 3 & 3 & 3 \\ \hline \multirow{8}{*}{Targeted} & EA & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11}  & & BIM & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11}  & & PGD Inf & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11}  & & PGD L2 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11} \cline{2-11}  & & \(t_{optimal,\mathcal{C}}\) per CNN & & 12 & 12 & 25 & 17 & 37 & 19 & 68 & 27 & 13 & 12 \\ \hline \multirow{8}{*}{0.91} & \multirow{8}{*}{Untargeted} & EA & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11}  & & EA & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11} \cline{2-11} \cline{2-11}  & & FGSM & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11} \cline{2-11}  & & BIM & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 100 & 12 \\ \cline{3-11} \cline{2-11}  & & PGD Inf & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11} \cline{2-11}  & & FG LM & 12 & 12 & 23 & 12 & 34 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11} \cline{2-11}  & & DeepFool & 12 & 34 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \hline \multirow{8}{*}{Targeted} & EA & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{3-11} \cline{2-11}  & & BIM & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{1-1} \cline{2-11}  & & PGD Inf & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{1-1} \cline{2-11}  & & PGD L2 & 12 & 67 & 12 & 12 & 12 & 12 & 12 & 12 & 12 \\ \cline{1-1} \cline{2-11} \cline{2-11}  & & \(t_{optimal,\mathcal{C}}\) per CNN & & 12 & 67 & 23 & 12 & 34 & 12 & 12 & 12 & 100 & 12 \\ \hline \hline \end{tabular}
\end{table} 
Table 15: \(Cont.\)In our experiments, we used multiple squeezers for FS as suggested in [13] (we keep their notations in what follows). The \(L_{1}\) norm is used to measure the difference between the prediction by the CNN of the input image and the prediction of the squeezed input image:  
\[score^{x,x_{squared}}=||g(x)-g(x_{squeezed})||_{L_{1}}, \tag{12}\]  
where \(x\) is the input image and \(g(x)\) is the classification vector of the CNN according to the different categories. Multiple feature squeezers are combined in the FS detector.