# Defense against Adversarial Attacks in Image Recognition Based on Multilayer Filters
## 1 Introduction  
System security and privacy are closely related to the security and efficiency of a system. Deep learning networks perform particularly well on many artificial intelligence tasks, including security-sensitive applications such as object recognition [1], self-driving cars [2], computational vision [3], and image classification [4]. Some data carefully crafted by adversaries seriously threatened these systems [5, 6, 7]. These data are called adversarial examples [8]: the adversary finds that adversarial images are generated by adding subtle adversarial perturbations to legitimate input images [9, 10]. Such carefully crafted perturbations are visually imperceptible to the human cognitive system, and they can cause deep learning models to misclassify the input images. AN FGSM [11] attack is a relatively basic but very effective adversarial attack. It generates adversarial perturbations by calculating the gradient of the loss function with respect to the input image and based on the sign of the gradient. The VNIFGSM [12] attack method is based on a new method called variance tuning to enhance iterative gradient-based attacks and improve their transferability. Defense system designers often prioritize the modification of models. For instance, they may streamline the architecture of a classifier [13] or incorporate pre/post-processing layers into the classifier's architecture [14, 15]. Dynamic network routing (DNR) [16] standsout by producing pruned DNNs that boost both high robustness and standard accuracy. It achieves this through a unified constraint optimization formula and a mixed loss function, effectively merging ultra-high model compression with robust adversarial training. On the other hand, low-temperature distillation (LTD) [17] employs a distillation framework to generate labels, utilizing lower temperatures in the teacher model and distinct fixed temperatures for both the teacher and student models. The integration of parameter-shifted sigmoid linear units (PSSiLUs) with learnable parameter activation functions (PAFs), coupled with adversarial training, further enhances robustness. SENSEI [18] adopts a strategy that either substitutes each data point with suitable variants or retains it as is. These methods, however, alter specific deep learning model architectures, potentially leading to reduced adaptability and portability. Researchers have designed an independent module to identify adversarial samples in order to enhance the robustness of the classifier [19]. For example, MagNet [20] consists of one or more independent detector networks and a reformer network. The function of the reformer network is to guide adversarial samples onto the manifold of normal samples, which is particularly effective for accurately classifying adversarial samples under small perturbations. A class activation feature-based denoiser (CAFD) [21] is a self-supervised method that trains a set of examples generated by class activation feature-based attacks (CAFAs) [21] from adversarial examples to remove noise. The detector graph (DG) [22] constructs a latent neighborhood graph (LNG) for each original instance and uses graph neural networks (GNNs) [23] to consider the relationship between the original instance and the adversarial instance, considering the graph to detect adversarial instances. An adversarial defense with local implicit functions (DISCO) [24] serves as an adjunct network to the classifier, employing local manifold projections to mitigate adversarial perturbations. It receives adversarial images and a query pixel position. This defense mechanism includes an encoder that creates depth features per pixel and a local implicit module that uses these features to predict clean RGB values. These methods require a significant amount of overhead to maintain an additional module. As a defense mechanism, noise injection [25; 26; 27] has been demonstrated in many literature studies [28; 29; 30] to provide provable defense performance against adversarial attacks in certain situations.