# Defense against Adversarial Attacks in Image Recognition Based on Multilayer Filters
## 3 Materials and Methods  
### Robustness Defense  
Image recognition algorithms occupy an important position in the field of artificial intelligence, among which convolutional neural networks (CNNs) and their variants are widely used. However, there are differences between CNN and human visual systems in processing image information, which pose potential risks for adversarial attacks. Specifically, the human visual system has strong adaptability to high-frequency components such as details and noise in images, and the high-frequency information has a limited impact on human visual perception [52]. In contrast, CNN processes all types of information equally when processing images, regardless of whether they belong to high-frequency or low-frequency components. Therefore, when facing images containing complex high-frequency noise or edge information, the recognition accuracy of CNN may be significantly affected. Given this difference, attackers can construct adversarial samples; that is, by fine-tuning pixel values while maintaining the visual perception of the image, CNN produces erroneous recognition results. Due to the relatively fragile processing of high-frequency information by CNN, attackers can successfully carry out adversarial attacks by cleverly introducing or modifying high-frequency noise or edge information. Figure 1: The architectural layout of the CNN. Figure 2: The architectural layout of the DNN. The use of Gaussian filters for preprocessing training images can effectively suppress high-frequency noise components in the images, thereby improving the robustness of image recognition models in dealing with adversarial attacks [40]. Based on this, we further investigate and propose a defense strategy based on multilayer filters. This strategy adds a filtering layer after the input layer to achieve multilayer filtering processing of the input image. This method does not rely on a specific network architecture; therefore, it has broad applicability and can be flexibly applied to various existing defense models. In addition, we introduce a noise injection mechanism during the model training phase. This cannot only further suppress image noise and improve image quality, but also significantly enhance the robustness of the image recognition model in dealing with adversarial attacks, thereby improving the recognition accuracy and stability of the model. Through this mechanism, we can further enhance the reliability and robustness of the model in practical applications while ensuring its performance. As shown in Figure 3, the proposed defense model inserts a filtering layer between the input layer and the first convolutional layer. The traditional image classification method (as shown in black in Figure 3) is to train a classification system based on machine learning algorithms that can distinguish images with different labels. This method is easily susceptible to adversarial attacks and loses effectiveness. Typically, deep learning models consist of multiple convolutional layers and a fully connected layer. \(S\) represents the scoring function of the original classification. It is a deterministic mapping of the probability distribution from the image \(x\) to the \(k\) label, and then \(Y(X)=argmax(S(X))\). The main reason for being vulnerable to adversarial example attacks is the infinite sensitivity of \(S\) to \(p\)-norm change in the input. By adding calibration noise to convert \(S\) into a random function \(FS\), the expected output of this function will be sensitive to changes in the \(p\)-norm in the input. We achieve this by introducing a filter layer (shown in blue in Figure 3), which first performs preliminary Gaussian filtering operations. This move aims to weaken the high-frequency noise interference in the image and reduce its adverse impact on the model training process.