## 3 Results  
Since we managed to provide balanced datasets for the research, we restricted ourselves to analyzing only the accuracy metric, which actually reflects the proportion of correct recognitions. All subsequent results of measuring the proportion of correct recognitions, which are presented in this section, were obtained using a graphics computingdevice (NVIDIA GeForce GTX1060 3 GB GDDR5 1708 MHz video card), which made it possible to speed up the calculations in comparison with a CPU. First, a study of the influence of Attacks No. 1 and No. 3 was carried out in order to determine the noise levels and the sizes of the distorted areas. Since the sizes of the images in the dogs vs. cats dataset provided a wider range of sizes for the distortion regions, only this dataset was used. Table 1 shows the characteristics of recognition when using only Attack No. 1 in the test set and only non-distorted images in the training set. The DVC-2 kit was selected for research. At the same time, different noise levels were set for Attack No. 1. Due to our intentions to test the procedure using an extreme worst-case scenario, low SNR levels were also investigated. An analysis of the obtained results showed that at signal-to-noise values greater than one, the transfer learning algorithms approached the limit in recognition possibilities, and that the CNN-5 algorithm provided insufficient accuracy, even with limited values. A visualization of Table 1 is shown in Figure 7. From the graphs presented in Figure 7, it can be seen that, before reaching SNR = 100%, a slow increase in the accuracy of neural networks was observed, of the order of 3-5%. However, after the signal was further increased in relation to the noise, the increase in accuracy reached about 10-15%. Table 2 shows the characteristics of recognition when using only Attack No. 3 in the test set, and only non-distorted images in the training set. The DVC-2 set was selected for the research. At the same time, different sizes of distorted regions were set for Attack No. 3. However, since all the original images were 150 \(\times\) 150 pixels in size, the dependence on the ratio of the area of the distorted area to the area of the image \(S_{c}/S_{i}\) was investigated. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Architecture** & **SNR = 0.2** & **SNR = 0.5** & **SNR = 1** & **SNR = 1.5** & **SNR = 2** \\ \hline VGG-16 & 81.38 & 83.16 & 84.32 & 89.65 & 91.37 \\ Inception-v3 & 82.55 & 84.01 & 85.11 & 90.32 & **92.16** \\ CNN-5 & 62.22 & 65.96 & 67.02 & 71.37 & 78.12 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Dependence of the proportion of correct recognitions on the signal-to-noise ratio (SNR). \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Architecture** & \(S_{c}/S_{i}\) = 0.0002 & \(S_{d}/S_{i}\) = 0.0007 & \(S_{d}/S_{i}\) = 0.0028 & \(S_{d}/S_{i}\) = 0.0054 & \(S_{c}/S_{i}\) = 0.01 \\ \hline VGG-16 & 89.65 & 88.32 & 85.11 & 83.07 & 80.08 \\ Inception-v3 & **89.98** & 89.02 & 86.49 & 84.22 & 80.65 \\ CNN-5 & 77.35 & 76.04 & 72.25 & 69.76 & 61.73 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Dependence of the proportion of correct recognitions on the size of the distorted area. Figure 7: Dependence of accuracy on noise level in Attack No. 1. The analyses of the obtained results showed that at small distortion sizes, transfer learning algorithms are capable of demonstrating a high accuracy; however, a slight increase in the distortion area, up to 0.01 of the image area, led to a loss of about 10% in accuracy. At the same time, the CNN-5 algorithm was invariant to even smaller distortions, and, with an increase in the distortion area, its quality decreased sharply. A visualization of Table 3 is shown in Figure 8.  
Analyses made it possible to establish the values of the parameters of visual attacks based on the inflections of the graphs, i.e., for the SNR ratio, 1.1 was chosen, and for the area ratio, 0.001 was chosen. Further, all types of attacks and methods of dealing with them were investigated.