# Lightweight Robust Image Classifier Using Non-Overlapping Image Compression Filters
## 4 Experimental Results
### Performance of Our Defense Techniques  
To evaluate defense performance, we compared the effectiveness of DIP, LPIF, Data Filtering, UDFilter, and our own defense techniques on the CIFAR10 and CIFAR100 datasets. We adopted three architectures: VGG16, ResNet34, and Inception ResNet-v2. As shown in Table 4, we selected white-box attacks (FGSM, BIM, and PGD) and a black-box attack (Square attack) as baseline adversarial attack methods, applying these five defense measures on the two datasets to test the accuracy of the image classifier when faced with adversarial samples. The results reveal that our method exhibited higher accuracy compared to the other four defense strategies, indicating its robustness. However, when attempting to use the \begin{table}
\begin{tabular}{c l c c c c c c} \hline \hline \multirow{2}{*}{**Attack**} & \multirow{2}{*}{**Defense**} & \multicolumn{2}{c}{**VGG16**} & \multicolumn{2}{c}{**ResNet34**} & \multicolumn{2}{c}{**Inception-ResNet-v2**} \\ \cline{3-8}  & & **CIFAR10** & **CIFAR100** & **CIFAR10** & **CIFAR100** & **CIFAR100** & **CIFAR100** \\ \hline \multirow{4}{*}{FGSM} & DIP (2023) [10] & 0.618 & 0.506 & 0.677 & 0.541 & - & - \\  & LPIF (2023) [11] & 0.704 & 0.589 & 0.771 & 0.629 & 0.800 & 0.695 \\  & Data Filtering (2024) [12] & 0.729 & 0.608 & 0.798 & 0.650 & 0.828 & 0.718 \\  & UDFilter (2024) [13] & 0.723 & 0.605 & 0.792 & 0.647 & 0.822 & 0.715 \\  & Our & 0.731 & 0.610 & 0.801 & 0.653 & 0.831 & 0.721 \\ \hline \multirow{4}{*}{BIM} & DIP (2023) [10] & 0.551 & 0.477 & 0.643 & 0.557 & - & - \\  & LPIF (2023) [11] & 0.625 & 0.531 & 0.729 & 0.621 & 0.761 & 0.696 \\  & Data Filtering (2024) [12] & 0.641 & 0.530 & 0.748 & 0.619 & 0.781 & 0.695 \\  & UDFilter (2024) [13] & 0.638 & 0.522 & 0.744 & 0.610 & 0.777 & 0.685 \\  & Our & 0.654 & 0.535 & 0.763 & 0.625 & 0.796 & 0.701 \\ \hline \multirow{4}{*}{PGD} & DIP (2023) [10] & 0.548 & 0.468 & 0.642 & 0.528 & - & - \\  & LPIF (2023) [11] & 0.628 & 0.521 & 0.736 & 0.588 & 0.777 & 0.661 \\  & Data Filtering (2024) [12] & 0.643 & 0.551 & 0.753 & 0.621 & 0.795 & 0.698 \\  & UDFilter (2024) [13] & 0.646 & 0.548 & 0.756 & 0.618 & 0.798 & 0.694 \\  & Our & 0.648 & 0.551 & 0.759 & 0.622 & 0.802 & 0.698 \\ \hline \multirow{4}{*}{Square} & DIP (2023) [10] & 0.572 & 0.481 & 0.650 & 0.524 & - & - \\  & LPIF (2023) [11] & 0.638 & 0.564 & 0.725 & 0.614 & 0.765 & 0.681 \\ \cline{1-1}  & Data Filtering (2024) [12] & 0.670 & 0.582 & 0.761 & 0.634 & 0.803 & 0.702 \\ \cline{1-1}  & UDFilter (2024) [13] & 0.676 & 0.583 & 0.768 & 0.635 & 0.811 & 0.703 \\ \cline{1-1}  & Our & 0.681 & 0.587 & 0.774 & 0.639 & 0.816 & 0.708 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The accuracy of DIP, LPIF, Data Filtering, UDFilter, and our defense techniques on the CIFAR10 and CIFAR100 datasets. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Dataname** & **Attack** & **Origin** & **Rotation** & **BrightnessContrast** & **Noise** & **UDFilter** & **Our** \\ \hline \multirow{4}{*}{CIFAR10} & FGSM & 54.9\% & 63.0\% & 65.1\% & 66.4\% & 68.7\% & 72.3\% & 73.1\% \\  & BIM & 47.7\% & 56.8\% & 57.3\% & 59.4\% & 60.5\% & 63.8\% & 65.4\% \\  & PGD & 47.9\% & 54.2\% & 58.0\% & 56.2\% & 59.1\% & 64.6\% & 64.8\% \\  & Square & 51.9\% & 56.9\% & 58.0\% & 59.1\% & 61.4\% & 67.6\% & 68.1\% \\ \hline \multirow{4}{*}{CIFAR100} & FGSM & 37.6\% & 37.7\% & 41.6\% & 58.0\% & 58.9\% & 60.5\% & 61.0\% \\  & BIM & 31.6\% & 33.5\% & 32.2\% & 45.2\% & 47.1\% & 52.2\% & 53.5\% \\ \cline{1-1}  & PGD & 31.7\% & 33.8\% & 33.2\% & 48.1\% & 49.8\% & 54.8\% & 55.1\% \\ \cline{1-1}  & Square & 33.7\% & 36.1\% & 35.4\% & 51.3\% & 52.1\% & 58.3\% & 58.7\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The impact of different image transformations on the accuracy of adversarial attacks under the VGG16 architecture. DIP method, due to its fixed output image size (659 \(\times\) 659), it exceeded the performance limit of our device during the training of the Inception-ResNet-v2 architecture, resulting in an inability to train.