![](bg2.png)
gation efforts to enhance the robustness of the classi-
fication function.
Our contributions in this paper are listed below:
• We propose an approach to estimate the trained
DNN model’s vulnerability to a particular mis-
classification. Along with it, we propose the crite-
ria to categorise the DNN model’s vulnerability to
a particular misclassification into one of the three
levels: low, moderate or high.
• We further argue that the ease with which the rate
of a particular misclassification can be kept un-
der control depends on the estimated value of the
DNN model’s vulnerability to it. In other words,
we highlight that it is easier to control those mis-
classifications to which the model is estimated to
be lowly vulnerable, as compared to the misclassi-
fications to which it is estimated to be highly vul-
nerable. We validate our arguments empirically.
The practical examples and the corresponding ex-
perimentation
1
conducted in context of the above-
mentioned contributions have been extensively dis-
cussed in the paper. The remainder of the paper is
organized as follows. In Section 2, we present a brief
background to discuss the rationale behind our pro-
posed approach of estimating the DNN’s vulnerabil-
ity to a particular misclassification. In Section 3, we
present a detailed description of the approach, and an
experimental analysis in context of traffic sign classi-
fication. Section 4 addresses the second part of our
contributions, i.e., an empirical investigation to show
that the set of misclassifications to which the DNN
model is ranked to be highly vulnerable are rather
difficult to manage, even after the implementation of
the measures to control the misclassification rate. Fi-
nally, Section 5 presents a conclusion along with a
brief overview on the possible future directions.
2 BACKGROUND
In context of image classification, the objective is to
ensure that a classifier is able to correctly distinguish
between the target classes. In Tian et al. (2020), for
instance, the authors assess the classifier model’s abil-
ity to distinguish between any two classes by comput-
ing the confusion score. This score is based on mea-
suring the euclidean distance between the neuron ac-
tivation probability vectors corresponding to the two
1
For the experimentation, the libraries: Numpy (Harris
et al., 2020), Keras (Chollet et al., 2015), SciPy (Virta-
nen et al., 2020), Scikit-learn (Pedregosa et al., 2011) and
Matplotlib (Hunter, 2007) were used along with some of
the other standard Python libraries and their functions.
classes. Such analyses are usually performed by eval-
uating the trained model against a set of independent
(test) images. However, such evaluations against a set
of test images are not sufficient to realize the classi-
fier’s ability to distinguish between the classes (since
the completeness of the test data serves as a major
challenge). As an additional assessment, the critical
misclassifications corresponding to the DNN model
can be identified by determining the set of possible
misclassifications to which the model is highly vul-
nerable. In Agarwal et al. (2021), it has been argued
that the classifier’s vulnerability to a particular mis-
classification (let us say, from the true class k
1
into
an incorrect class k
2
or vice versa) can be assessed in
terms of the similarity between the dominant visual
characteristics of the corresponding two classes (i.e.,
k
1
and k
2
). For instance, the dominant visual charac-
teristics in the traffic signs are shape and color (Gao
et al., 2006). By evaluating the overlap in terms of (a)
the shape of the traffic sign board, and (b) the color
combination of the border and the background, the
similarity between any two traffic sign classes can be
analysed a priori (Agarwal et al., 2021). The obtained
measure of similarity between the classes k
1
and k
2
is
recognized as a measure of the classifier’s vulnerabil-
ity to misclassifying an input image belonging to the
class k
1
into the class k
2
or vice versa. Higher simi-
larity between the two classes is considered to induce
higher vulnerability to the corresponding misclassifi-
cation.
We illustrate it further with an example. In this re-
gard, we trained a DNN to classify the different traf-
fic signs from the German Traffic Sign Recognition
Benchmark (GTSRB) dataset (Stallkamp et al., 2012).
Mathematically, we represent the DNN (classifier)
model as f : X
X
X ∈ R
(48×48×3)
−→ ˆy ∈ {1,2,...,43},
where ˆy is the predicted class for the input image X
X
X.
The hyperparameters and the training details related
to it are provided in Appendix A. From the set of
10000 test images, we choose 2207 images which be-
long to the danger sign type. We determine the per-
centage of these images that the DNN model f mis-
classifies into: (a) another danger sign, (b) a speed
limit or a prohibitory sign, (c) a derestriction sign,
and (d) a mandatory sign. The results are graphically
presented in Figure 1. We first consider the results
plotted for the GTSRB original test images (i.e., the
test images without any perturbations deliberately en-
forced by us). We observe a higher rate of misclassi-
fication of a danger sign into another danger sign, as
compared to the other misclassifications. All the traf-
fic signs that belong to the danger sign type have high
similarity due to their two dominant visual character-
istics being the same. This can perhaps be a potential
VEHITS 2021 - 7th International Conference on Vehicle Technology and Intelligent Transport Systems
212