## 3 Results
For the curves in Figure 8, the situation was opposite to that in Figure 7. At first, the decrease in accuracy occurred very slowly, but after reaching the share of damage of 0.3%, especially for the CNN-5 network, a decrease in accuracy was observed. Tables 3 and 4 present the results for the test sample, taking into account the classification into 10 (MNIST) and 2 (Dogs vs. Cats) classes. At the same time, images distorted by Attacks No. 1-4 were gradually added to the training set. Table 3 corresponds to the results for the MNIST handwritten number dataset, and Table 4 corresponds to the Kaggle dogs vs. cats dataset. An analysis of the obtained results shows that the use of learning transfer is advisable, since the results of the VGG-16 and Inception-v3 networks were much better than those of a network trained from scratch, even in the absence of knowledge about possible attacks during training. In addition, the effect of adding distorted symbols to the training set was obvious. For example, for the Inception-v3 network, it was possible to increase the efficiency of correct recognition by 21% and 22% compared to the network, which was trained on the not-attacked images. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Architecture** & **No Attack** & **Attack No. 1** & **Attacks No. 1–2** & **Attacks No. 1–3** & **Attacks No. 1–4** \\ \hline VGG-16 & 66.91 & 73.65 & 79.78 & 86.63 & 90.08 \\ Inception-v3 & 70.32 & 78.54 & 82.16 & 88.82 & **92.32** \\ CNN-5 & 60.10 & 65.55 & 68.94 & 73.45 & 80.64 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Percentage of correct Kaggle.Dogs vs. Cats image recognitions without prevention of visual attacks. Figure 8: Dependence of accuracy on the size of distortions in Attack No. 3. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Architecture** & **No Attack** & **Attack No. 1** & **Attacks No. 1–2** & **Attacks No. 1–3** & **Attacks No. 1–4** \\ \hline VGG-16 & 72.83 & 79.64 & 82.35 & 88.65 & 94.67 \\ Inception-v3 & 74.60 & 80.32 & 83.18 & 90.32 & **95.84** \\ CNN-5 & 63.22 & 72.18 & 73.27 & 81.37 & 90.12 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Percentage of correct MNIST.DIGITS image recognitions without prevention of visual attacks. Tables 5 and 6 present the results from the test sample, taking into account classification into 11 (MNIST) and 3 (Kaggle) classes. Additional classes define distorted images that are not included in the calculation of the final accuracy metric. Thus, the share of correct recognitions was calculated only for images that did not fall into the added (distorted) class. Moreover, the data in the second columns of Tables 5 and 6 were obtained when calculating the initial number of classes, i.e., 10 for MNIST.DIGITS and 2 for dogs vs. cats. This is due to the fact that, in the absence of distorted images in the training set, it is impossible to identify a new class. At the same time, images distorted by Attacks No. 1-4 in such a way that the distorted images constituted a new class were gradually included in the training set, similar to the experiments in Tables 3 and 4. The accuracy of the network was finally recalculated only for images that the network classified as undistorted. Table 5 corresponds to the results for the MNIST dataset and Table 6 for the dogs vs. cats dataset. Similar dependences noted for the results in Tables 3 and 4 are preserved in Tables 5 and 6. However, the main conclusion that can be drawn from the analysis of Tables 5 and 6 is the conclusion about the effectiveness of the proposed method. Indeed, the use of attack prevention in post-processing allowed us to increase the proportion of correctly recognized images by 2-3%. Moreover, the best results in each case were provided by the Inception-v3 network, which provided 98.55% correct recognition for the MNIST.DIGITS image database and 94.82% for the Kaggle.Dogs vs. Cats image database. However, this approach discarded about 25-30% of the images. Additional validation of these images with SVD can reduce this figure.