## 2 Materials and Methods  
Let us introduce the concept of a visual attack on CNNs and the types of attacks that will be considered in this article. If a distorted image is fed into the network input in a special way (according to the specified rules), then such a process will be called a visual  
Figure 1: Changes in a convolutional network from a one-pixel attack. attack. The distortion process itself is described by specified rules and can be implemented in different ways, forming different types of attacks. Within the framework of this article, the main attention is focused on the development of more universal methods of dealing with visual attacks; therefore, the types of attacks used in this task are not so important. For simplicity, the following types of attacks will be analyzed in the following sections. (1) Distortion by white Gaussian noise with different variances. We will assume that the brightness of an image at each point and color channel is described by the function \(F(c,x,y)\), where \(c\) (color) characterizes one of the three color channels in RGB; and \((x,y)\) is the spatial coordinates of the pixel in the specified chroma channel. If the brightness storage system is used in the uint8 data type, then the values can vary in the range of 0 (black corresponds to 0 in all channels) to 255 (white corresponds to 255 in all channels), then a change in noise should not lead to overshooting this range. To do this, it is possible to use a simple procedure for equalizing noisy images. The expression that allows to form a distorted noisy image can be written using Formula (1). \[A_{1}(c,x,y)=\left[F(c,x,y)+N(0,\sigma)\right]_{eq255}, \tag{1}\]  
where \(N(0,\sigma_{N})\) is random noise additive at any point, obeying the Gaussian distribution and characterized by zero mean and variance, \(\sigma_{N}^{2}\); \([\ldots]_{eq255}\) is the brightness equalization procedure (for values from 0 to 255). For the convenience of constructing comparative tables, this attack is named as \"Attack No. 1\". (2) One-pixel distortion  
During this project's implementation, the brightness of a randomly selected pixel was replaced by values close to the boundary values, i.e., for black pixels, the possible range of values is (0,1,2) and for white pixels it is (253,254,255). In this case, the same values are set for all color channels. As shown above (Figure 1), even a small change in the original image can lead to a strong modification of the feature vector used for recognition. The image model with a distortion of one pixel can be written as Formula (2). \[A_{2}(c,x,y)=\left\{ \begin{array}{ccc}F(c,x,y),&if&(x,y)\
eq(x_{0},y_{0}),\\ 0(255)+(-)j,&if&(x,y)=(x_{0},y_{0}),\end{array} \right. \tag{2}\]  
where \(j\) is random integer from (0; 3) interval. Since changes are made within the range of 0-255, additional equalization of the distorted picture is not required. For further convenience, we will call this attack \"Attack No. 2\". (3) Single color distortion of the image area  
This type of attack is based on the idea of Attack No. 2, with the difference being that, instead of changing the brightness of one pixel, a procedure of maximizing or minimizing the brightness of a group of pixels located in a certain local neighborhood takes place. The attack implies that the brightness values inside this neighborhood will be the same for all pixels. In the simplest case, a rectangular area can be distorted. The model of such an attack can be written in accordance with Expression (3). \[A_{3}(c,x,y)=\left\{ \begin{array}{ccc}F(c,x,y),&if&(x,y)\
otin D_{0},\\ 0(255)+(-)j,&if&(x,y)\in D_{0},\end{array} \right. \tag{3}\]  
where \(D_{0}\) is a local area with a given distorted brightness. Further in the text, we refer to this type of attack as \"Attack No. 3\". (4) Binary distortion of the image area  
This type of attack develops the \"Single color distortion\" attack. Binary distortion refers to the replacement of pixels with two possible brightness values.