## 2 Materials and Methods
Finally, substituting \(B\) From (7) into (6), we can write the singular value decomposition (8) for matrix \(A\). \[A=PQ^{T}WQS, \tag{8}\]  
where \(U=PQ^{T}\), \(V^{T}=QS\). The resulting expansion will be used to reduce the dimension. Figure 3: Images that have been visually attacked using different attack types: (**a**) Attack No. 1; (**b**) Attack No. 2; (**c**) Attack No. 3; and (**d**) Attack No. 4. The idea of the proposed algorithm for preventing visual attacks is that you can first teach a network to distinguish distorted images and then discard them with the \"attacked\" label. This approach will potentially allow obtaining a large proportion of correct recognitions directly from the pre-filtered images. For the rejected images, alternate dimensionality reduction will be performed based on the SVD. The original rejected image and images reduced by 10% and 20% will be passed through a network that cannot distinguish between distorted images. If all 3 classifiers give the same answer, then such an image will be returned to the undistorted database with a corresponding label. Figure 4 shows a diagram of the described ensemble. Units SVD means SVD with different levels of feature reduction. Note again that, for the scheme shown in Figure 4, the input images will be presented in grayscale. Since the analyses will be performed for datasets with an equal number of instances in each class, the use of additional metrics, such as precision and recall [46], is not required. We will only evaluate the probability of correct recognition in the dataset. This metrics is also known as accuracy. For this study, the MNIST dataset was first selected, namely MNIST.DIGITS, which contains 28 \(\times\) 28-pixel images of handwritten digits. The MNIST database contains 60,000 images for training and 10,000 images for testing [47]. Half of the training and testing samples were from the NIST training set and the other half were from the NIST testing set [48]. Figure 5 shows examples of some images from the MNIST.DIGITS set. Using the examples in Figure 5, it becomes obvious that the main task is recognition, since each image contains only one digit. Considering the size of the images, 28 \(\times\) 28, the distortion of the rectangular area can only be carried out with side lengths of 2 and 3 pixels. Using the specified MNIST database, we will prepare two separate datasets. In the first, all images will remain original (not attacked), and in the second, a number of images will be subjected to the attacks discussed previously. To analyze the effectiveness of the proposed algorithm, the following sets were obtained:  
(1) MNIST-1 set. Consists of 60,000 training images without distortion, as well as 6000 images for a test sample without distortion, 1000 images of a test sample with distortions by Attack No. 1, 1000 images of a test sample with distortions by Attack No. 3, and 1000 images of the test sample with distortions by Attack No. 4. (2) MNIST-2 set. Consists of 52,000 training images without distortion, 2000 training images with distorted by Attack No. 1, 2.000 training images with distorted Attack No. 2, 2000 training images with distorted Attack No. 3, and 2000 training images with distorted Attack No. 4; the test sample is similar to that described earlier. Distortions are evenly distributed over images of all classes. Figure 4: Flowchart to combat visual attacks. Since the MNIST dataset does not allow for a qualitative study of the dependencies of the recognition accuracy on the size of distorted regions and the noise level, the dogs vs. cats dataset from the Kaggle portal is also used [49]. This dataset contains labeled images of cats and dogs. At the same time, the training sample contains 12,500 images of cats and 12,500 images of dogs, and the test sample contains 12,500 unlabeled images. For the convenience of further accuracy calculations, the test sample was compiled by truncating the training sample. This dataset does not have fixed image sizes, so additional scaling procedures were applied.