# Defense against Adversarial Attacks in Image Recognition Based on Multilayer Filters
## 4 Experimental Results
### Number of Layers for Multilayer Image Filters  
The multilayer filter defense model uses Gaussian filters to suppress the impact of adversarial noise on the model. As the number of filter layers increases, the robustness of the model is improved. This is because each layer of the filter can further clean the input data, remove noise, and make the model more stable. However, we need to note that increasing the number of layers is not entirely an advantage. When there are too many layers, the generalization ability of the model to normal samples will be affected, resulting in poor performance of the model in practical applications. Therefore, balancing the robustness and generalization ability of the model has become a key issue. In order to further investigate this issue, this study conducted a comparative analysis on multiple models with layers ranging from 1 to 5. In every testing scenario, CNN served as the image classification framework for both MNIST and CIFAR10 datasets, whereas ResNet50 was utilized for the CIFAR100 dataset. All methodologies employed a 3 \(\times\) 3 dimensional filtering area. The Gaussian filter's standard deviation was established at 1, and a noise injection strategy was incorporated into the model's training process. As illustrated in Table 6, the average accuracy comparison results for each layer model on the three datasets are displayed across six distinct adversarial attack scenarios. Based on the data observed, we deduce that the model's performance attains its peak when the quantity of filter layers is 2. This finding indicates that within a specific range, augmenting the number of filtering layers can indeed enhance the model's robustness; however, an excessive number of layers can lead to a decline in the model's generalization capabilities. \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline \multirow{2}{*}{**Number of Layers**} & \multirow{2}{*}{**Dataset**} & \multicolumn{6}{c}{**Attack**} & \multirow{2}{*}{**Average Accuracy**} \\ \cline{3-3} \cline{5-8}  & & **FGSM** & & & **BIM** & **PGD** & **CW** & **AA** & **VNFGSM** \\ \hline \multirow{3}{*}{1} & MNIST & 0.870 & 0.930 & 0.935 & 0.931 & 0.943 & 0.940 & 0.925 \\  & CIFAR10 & 0.770 & 0.603 & 0.606 & 0.802 & 0.650 & 0.651 & 0.680 \\  & CIFAR100 & 0.383 & 0.682 & 0.687 & 0.749 & 0.662 & 0.668 & 0.638 \\ \hline \multirow{3}{*}{2} & MNIST & 0.891 & 0.935 & 0.945 & 0.943 & 0.926 & 0.922 & 0.927 \\  & CIFAR10 & 0.789 & 0.632 & 0.632 & 0.812 & 0.681 & 0.683 & 0.705 \\  & CIFAR100 & 0.384 & 0.712 & 0.723 & 0.787 & 0.641 & 0.644 & 0.649 \\ \hline \multirow{3}{*}{3} & MNIST & 0.828 & 0.912 & 0.919 & 0.911 & 0.912 & 0.918 & 0.900 \\  & CIFAR10 & 0.765 & 0.604 & 0.603 & 0.782 & 0.631 & 0.637 & 0.677 \\  & CIFAR100 & 0.389 & 0.679 & 0.688 & 0.747 & 0.613 & 0.618 & 0.622 \\ \hline \multirow{3}{*}{4} & MNIST & 0.800 & 0.898 & 0.914 & 0.910 & 0.899 & 0.892 & 0.884 \\  & CIFAR10 & 0.746 & 0.591 & 0.590 & 0.775 & 0.612 & 0.619 & 0.656 \\  & CIFAR100 & 0.399 & 0.648 & 0.661 & 0.736 & 0.602 & 0.609 & 0.609 \\ \hline \multirow{3}{*}{5} & MNIST & 0.841 & 0.893 & 0.893 & 0.892 & 0.896 & 0.890 & 0.883 \\  & CIFAR10 & 0.737 & 0.598 & 0.597 & 0.772 & 0.603 & 0.607 & 0.653 \\ \cline{1-1}  & CIFAR100 & 0.374 & 0.667 & 0.666 & 0.734 & 0.591 & 0.601 & 0.605 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The average accuracy comparison results for each layer model on the three datasets are displayed across six distinct adversarial attack scenarios.