# ShuffleDetect: Detecting Adversarial Images against Convolutional Neural Networks
## 8 Parameters and Experiments Performed on ShuffleDetect\({}_{\sigma}^{\mathcal{C}}\)
\begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline \(\textit{atk}\) & \(\mathcal{C}_{1}\) & \(\mathcal{C}_{2}\) & \(\mathcal{C}_{3}\) & \(\mathcal{C}_{4}\) & \(\mathcal{C}_{5}\) & \(\mathcal{C}_{6}\) & \(\mathcal{C}_{7}\) & \(\mathcal{C}_{8}\) & \(\mathcal{C}_{9}\) & \(\mathcal{C}_{10}\) & Total \\ \hline EA & \((9 The experiments performed in [23] show that among the four considered possibilities, \(s=56\) provides an optimal balance between the proportion of clean ancestors that are correctly declared \"clean\" (67.6%), and the proportion of adversarial images that are correctly declared \"adversarial\" (99.6% for the adversarial images created by the EA, and 85.9% for those created by BIM) by our method. The choice of \(s=56\) being made, there are consequently \(4^{2}=16\) patches of size \(56\times 56\), and the symmetric group \(\mathfrak{S}_{16}\) has \(16!>2.10^{13}\) different permutations. Secondly, to keep the computations manageable, we selected at random 100 permutations (they are given in Table 13 in Appendix B). For \(1\leq t\leq 100\), one defines \(\mathcal{P}_{t}\) as the set of the first \(t\) permutations. One has \(\mathcal{P}_{t_{1}}\supset\mathcal{P}_{t_{2}}\) if \(t_{1}\geq t_{2}\). In particular, the first permutation \(\sigma_{1}\) is common to all sets \(\mathcal{P}_{t}\), the second permutation \(\sigma_{2}\) is common to all sets \(\mathcal{P}_{t}\) for \(t\geq 2\), etc. Given a set \(\Omega\) of images and \(\mathcal{C}\) a CNN, one defines the function \(\Psi_{\mathcal{C}}(t,s,\Omega)\) as the proportion of images in \(\Omega\) declared \(\sigma\)-adversarial for \(s\) out of the first \(t\) permutations. In other words, for \(t\) and \(s\) such that \(1\leq s\leq t\leq 100\), one has:  
\[\Psi_{\mathcal{C}}(t,s,\Omega)=\frac{\#\{\mathcal{I}\in\Omega\text{ such that ShuffleDetect}_{\mathcal{C}}^{\mathcal{C}}(\mathcal{I})=1\text{ for at least $s$ permutations }\sigma\in\mathcal{P}_{t}\}}{\#\{\mathcal{I}\in\Omega\}}.\]  
Geometrically, \(\mathcal{C}\) and \(\Omega\) being fixed, \(\Psi_{\mathcal{C}}(t,s,\Omega)\) defines a discrete surface. For a given \(\mathcal{C}\), this function provides an assessment of the FPR value of the ShuffleDetect method for \(\mathcal{C}\) by choosing for \(\Omega\) a set of images known to be clean. This function also provides an assessment of the DR value by choosing for \(\Omega\) a set of images known to be adversarial for \(\mathcal{C}\). As already stated in Section 4, the actual values of FPR and DR are determined by the choice of the threshold ratio \(R_{th}\). Its value is fixed as a consequence of the experiments performed on clean images, on the one hand, and adversarial images, on the other hand. **Assessment of the clean images. ** In the first step, we take for \(\Omega\) the set \(\Omega_{clean}\) of 100 clean ancestors \(\mathcal{A}_{q}^{p}\) represented in Figure 11 (Appendix A). For \(\mathcal{C}=\mathcal{C}\), one computes ShuffleDetect\({}_{v}^{\mathcal{C}_{t}}(\mathcal{A}_{q}^{p})\) for all 100 permutations \(\sigma\in\mathcal{P}_{100}\). This leads to the 10 histograms represented in Figure 12 in Appendix C. An example of the outcomes is illustrated in Figure 12a for \(\mathcal{C}_{1}=\) VGG16, where each vertical bar assesses the number of clean images classified as adversarial for a number of permutations given on the \(x\)-axis, out of the 100 possible permutations. The notations \([a,b]\) and \((a,b]\) indicate that the number of permutations is between \(a\) and \(b\), with both included in the former case and \(a\) excluded in the latter case. The average outcome (_mutatis mutandis_) for 10 CNNs is shown in Figure 12b. Over the 100 clean images, on average, over the 10 CNNs, an image is declared adversarial by 34.7% of the 100 considered permutations, as indicated in Figure 12b. Table 5 shows that this percentage varies between 26.4% (for \(\mathcal{C}_{7}\)) and 44.4% (for \(\mathcal{C}_{9}\)).