# Defense against Adversarial Attacks in Image Recognition Based on Multilayer Filters
## 5 Discussion  
We propose a method using multilayer filter technology aimed at significantly improving the robustness of the image classifier model. Specifically, we embedded filtering layers in the vulnerable classifier network, thus constructing a powerful defense model that can effectively resist various types of attacks. At the same time, during the training phase of the classifier, we also introduced a noise injection mechanism to further strengthen the model's defense ability. Through multiple experimental comparisons, we found that the multilayer filter defense model using a double-layer Gaussian filter with a filtering area of \(3\times 3\) and a standard deviation of 1 achieved average accuracies of 92.7%, 70.5%, and 64.9% on the MNIST, CIFAR10, and CIFAR100 datasets, respectively. To verify the practical effectiveness of this method, we designed six adversarial attack scenarios on the MNIST, CIFAR10, and CIFAR100 datasets, and conducted comprehensive comparative tests between our model and two filter-based defense models DIP and LPIF. The experimental outcomes reveal that our integrated method maintains an average accuracy of 71.9% across the six adversarial attack scenarios (FGSM, BIM, PGD, C&W, AutoAttack, and VNIFGSM). The results indicate that by introducing additional filtering layers and combining noise injection mechanisms, we have successfully achieved stronger robustness in learning-based image classification systems under resource constraints. Notably, this method excels not only on small-scale datasets but also exhibits robustness on large-scale datasets (miniImageNet) and modern models (EfficientNet and WideResNet). Upon assessing the time required for model training, we determined that the additional time incurred by the inclusion of multi-layer filters is relatively minor, with an increase of under 10%. Nonetheless, the primary time expenditure during training stems from the noise injection phase, which results in a doubling of the dataset size. While noise injection enhances model robustness, it also notably extends the training duration. Consequently, future research may wish to investigate more efficient noise injection methodologies or refine training techniques to mitigate time costs and attain a harmonious balance between model robustness and training efficiency. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Classifier**} & \multirow{2}{*}{**Original**} & \multicolumn{2}{c}{**With Multilayer Filter**} & \multicolumn{2}{c}{**With Noise Injection**} & \multicolumn{2}{c}{**MLFD**} \\ \cline{3-8}  & & & **Time** & **Rate** & **Time** & **Rate** & **Time** & **Rate** \\ \hline \multirow{2}{*}{MNIST} & DNN & 0.020 & 0.021 & 5.39\% & 0.041 & 105.87\% & 0.046 & 128.82\% \\  & CNN & 0.030 & 0.031 & 10.60\% & 0.062 & 102.15\% & 0.064 & 109.78\% \\ \hline \multirow{2}{*}{CIFAR10} & CNN & 0.146 & 0.149 & 2.60\% & 0.304 & 108.15\% & 0.307 & 110.39\% \\  & VGG16 & 0.261 & 0.272 & 4.08\% & 0.478 & 82.65\% & 0.525 & 100.74\% \\  & ResNet50 & 0.499 & 0.503 & 0.79\% & 0.932 & 86.54\% & 1.255 & 151.02\% \\ \hline \multirow{2}{*}{CIFAR100} & VGG16 & 0.612 & 0.668 & 9.06\% & 1.249 & 103.84\% & 1.280 & 108.87\% \\  & ResNet50 & 0.302 & 0.325 & 7.64\% & 0.565 & 87.23\% & 0.656 & 117.18\% \\ \hline \hline \end{tabular}
\end{table} 
Table 8: The overview of the time expenses required to train the model across seven distinct scenarios. The unit is hours. **Author Contributions:** Conceptualization, M.W. and Z.L. ; methodology, M.W. and Z.L. ; software, M.W. ; validation, M.W. and Z.L. ; formal analysis, M.W. ; investigation, M.W. ; resources, M.W. ; data curation, M.W. ; writing--original draft preparation, M.W. ; writing--review and editing, Z.L. ; visualization, Z.L. ; supervision, Z.L. ; project administration, Z.L. ; funding acquisition, Z.L. All authors have read and agreed to the published version of the manuscript. **Funding:** This research received no external funding. **Institutional Review Board Statement:** Not applicable.