## 3 Results
Then you need to take into account the images revised by the architecture when calculating the recognition accuracy. The use of additional analysis with a reduction in dimensions by 10% and 20% allowed reducing the proportion of distorted images to 21-27%. At the same time, the accuracy characteristics change insignificantly, and in some cases even increased. The recalculated results are presented in Tables 7 and 8. Analyses of the presented results shows that, on average, the accuracy characteristic for the studied datasets deteriorates after returning some rejected images. However, the recognition process is still robust. Thus, such algorithms can be used for enhanced output datasets with labels. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Architecture** & **No Attack** & **Attack No. 1** & **Attacks No. 1–2** & **Attacks No. 1–3** & **Attacks No. 1–4** \\ \hline VGG-16 & 66.91 & 75.12 & 81.80 & 87.92 & 91.74 \\ Inception-v3 & 70.32 & 79.24 & 83.74 & 90.11 & **94.82** \\ CNN-5 & 60.10 & 68.55 & 70.24 & 75.50 & 84.62 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Percentage of correct Kaggle.Dogs vs. Cats image recognitions with prevention of visual attacks. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Architecture** & **No Attack** & **Attack No. 1** & **Attacks No. 1–2** & **Attacks No. 1–3** & **Attacks No. 1–4** \\ \hline VGG-16 & 72.07 & 81.16 & 83.33 & 90.02 & 96.58 \\ Inception-v3 & 74.31 & 82.73 & 84.76 & 92.78 & **98.02** \\ CNN-5 & 61.18 & 73.08 & 74.19 & 82.11 & 88.58 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Percentage of correct MNIST.DIGITS image recognition with prevention of visual attacks and reduction of dimension. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Architecture** & **No Attack** & **Attack No. 1** & **Attacks No. 1–2** & **Attacks No. 1–3** & **Attacks No. 1–4** \\ \hline VGG-16 & 72.83 & 81.12 & 83.63 & 90.08 & 97.22 \\ Inception-v3 & 74.60 & 82.54 & 84.90 & 92.64 & **98.55** \\ CNN-5 & 63.22 & 73.07 & 75.25 & 83.37 & 91.09 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Percentage of correct MNIST.DIGITS image recognitions with prevention of visual attacks. However, it is much more interesting to compare results against known and widely used architectures. Thus, it is possible to take our best network for each dataset; called Inception-v3 + Prevention + SVD, because using SVD allows the processing of more data. The comparison will be produced for data which were not rejected by our algorithm. Table 9 presented the results for the MNIST and Kaggle.Dogs vs. Cats datasets. It should be noted that other architectures were learning on not-attacked images. From Table 9, it can be seen that preventing attacks by using augmentations in training datasets shows great results in comparison to attempting to process images using neural networks which were trained only on clear data. It was also interesting to test more complex types of attacks. The non-uniform noise generated in non-overlapping windows of different sizes and having different white Gaussian noises parameters was used. Table 10 presents the results for our best architectures and different window sizes. The noise expectation varies from \(-1\) to \(+2\) and noise variance lies in range from 0.1 to 2.5. The Gaussian noise model was randomly selected for each window. The average accuracy was calculated in 30 experiments. From Table 10, it can be seen that a non-uniform noise decrease resulted for our solution. However, for big sizes of non-overlapping windows, it is possible to achieve results that are closest to the best ones for uniform noise. Results for MNIST are better because the images in the dataset were smaller.