# ShuffleDetect: Detecting Adversarial Images against Convolutional Neural Networks
## 11 Conclusions
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline
**Scenario** & **Attacks** & **Detectors** & \(\mathbf{C_{1}}\) & \(\mathbf{C_{2}}\) & \(\mathbf{C_{3}}\) & \(\mathbf{C_{4}}\) & \(\mathbf{C_{5}}\) & \(\mathbf{C_{6}}\) & \(\mathbf{C_{7}}\) & \(\mathbf{C_{8}}\) & \(\mathbf{C_{9}}\) & \(\mathbf{AVG}\) \\ \hline \multirow{4}{*}{Untargeted} & \multirow{2}{*}{FGD L2} & ShuffleDetect & 68.8 & 61.5 & 80.4 & 91.9 & 83.3 & 77.7 & 86.7 & 88.6 & 78.1 & 73.6 & 79.1 \\ \cline{2-13}  & & FS & 97.8 & 90.1 & 94.8 & 97 & 97 & 90.9 & 94.9 & 93.8 & 95.8 & 91.6 & 94.4 \\ \cline{2-13}  & & ShuffleDetect & 79.7 & 86.3 & 93.8 & 93.9 & 91.8 & 90.0 & 93.8 & 96.9 & 88.1 & 89.3 & 90.4 \\ \cline{2-13}  & & FS & 93.6 & 92.6 & 92.9 & 91.9 & 92 & 89 & 96.9 & 91.9 & 95.7 & 91.5 & 92.8 \\ \cline{2-13}  & & ShuffleDetect & 94.6 & 93.8 & 95.6 & 96.9 & 97.8 & 96.0 & 97.8 & 97.9 & 94.7 & 93.6 & 95.9 \\ \cline{2-13}  & & FS & 98.9 & 96.9 & 97.8 & 96.9 & 95 & 95 & 97.9 & 96.9 & 99 & 100 & 97.4 \\ \hline \multirow{4}{*}{**Overall**} & \multirow{2}{*}{**ShuffleDetect**} & **86.5** & **87.1** & **93.2** & **96.3** & **93.5** & **92.2** & **94.3** & **96.3** & **91.7** & **91.4** & **92.2** \\ \cline{2-13}  & & **FS** & **92.4** & **88.6** & **90.4** & **90.9** & **89.9** & **86.7** & **89.4** & **88.5** & **91.1** & **89.3** & **89.7** \\ \hline \hline \end{tabular}
\end{table} 
Table 17: _Cont._untargeted attacks. Our study also provides the scores of the other relevant indicators, i.e., TP, FP, FN, precision, recall, and F1. While performing a thorough comparison with other detectors requires overcoming the difficult challenges outlined in Section 3, in order to make sound comparisons under the same conditions, we performed this task for one detector, namely FS, and showed that, on average, ShuffleDetect achieves better detection rates than FS. Independent of the outcome of any comparison process with other detectors, our ShuffleDetect method could be used as a first line of defense before applying more sophisticated, time-consuming, and overhead-consuming detection methods than ShuffleDetect. As a potential area for future research, it would be worthwhile to assess the effectiveness of ShuffleDetect using CNNs trained on Cifar10 and MNIST datasets. This could result in determining the optimal patch size as a ratio to the image size. Additionally, it would be beneficial to explore the optimal patch size for images containing very small or very large objects. All authors: writing--review and editing. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. The authors thank [PERSON] for the fruitful discussions on this subject. The authors declare no conflict of interest. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & \multicolumn{4}{c}{**Per Permutation**} \\ \cline{2-5} \cline{5-6} \(\boldsymbol{\mathcal{C}}\) & **Steps: 8–12** & \multicolumn{1}{c}{**Shuffling**} & \multicolumn{1}{c}{**Predicting**} & \multirow{2}{*}{**Shuff\%**} & \multirow{2}{*}{**Pred\%**} \\ \cline{3-3} \cline{5-6}  & & **Step: 8** & & & & \\ \hline \(C_{1}\) & 0.0955 & 0.0014 & 0.0941 & 1.483 & 98.511 \\ \hline \(C_{2}\) & 0.1176  
Figure A2: Shuffling test results of 100 clean (ancestor) images on \(\mathcal{C}=\mathcal{C}\) for \(1\leq k\leq 10\) over 100 permutations.