# Defense against Adversarial Attacks in Image Recognition Based on Multilayer Filters
## 1 Introduction
This mechanism is achieved by inserting noise layers into the classification network. The noise layer enhances the image classifier by inserting noise into deep learning networks using different noise generation mechanisms, such as Laplacian and Gaussian mechanisms. The adversarial purification-guided diffusion model (GDMAP) [31] receives pure Gaussian noise as initial input and gradually denoises it to the adversarial image. DensePure [32] iteratively denoises input images with different random seeds to obtain multiple reverse samples, which are fed to the classifier. The final prediction is based on majority voting. In addition, [PERSON] et al. [33] used the latest diffusion model [34], demonstrating that diffusion models with higher efficiency and image quality can be directly transformed into better robust accuracy. However, noise injection methods require a compromise between natural and adversarial accuracy, making their performance unsatisfactory. Before training the classifier, denoising the training data can improve the robustness of the classifier. Common methods include data quantization [35; 36] and image filters [37; 38]. [PERSON] et al. proposed a quantization-based defense mechanism to protect deep neural networks (DNNs) from adversarial attacks (QuSecNets) [36]. However, QuSecNets obtains control parameters by training neural networks, which requires complex computational resources and raw data. [PERSON] et al. proposed a defense based on digital image processing (DIP) [39], which uses spatial filters and thresholds for image preprocessing to remove adversarial disturbances. This method can easily and effectively resist adversarial attacks. While effective in grayscale imagery, this method exhibits limitations in its application to color images, as the utilization of threshold techniques may result in partial loss of critical image information. [PERSON] and [PERSON] proposed a low-pass image filtering (LPIF) [40] technique to reduce the impact of high-frequency noise on cellular neural networks. Thisapproach offers advantages in terms of resource efficiency and ease of implementation. However, it may be ineffective against low-frequency adversarial attacks. Taking inspiration from the above methods, we propose a robust enhancement strategy for image classifiers based on multilayer filtering techniques. This strategy establishes a robust defense model capable of withstanding a variety of attacks by integrating filtering layers into susceptible classifier networks. Additionally, we incorporated a noise injection mechanism during the classifier's training phase to further bolster the model's defensive capabilities. The filtering layer, functioning as a processing unit, enhances the classifier's resilience to minor alterations in input data by exploiting information from neighboring pixels. We also studied the effects of different filter combinations, filter area sizes, standard deviations, and filter layers on defense effectiveness. The comparative analysis of experimental results on filters with different layers revealed that employing a double-layer Gaussian filter with a filter area size of \(3\times 3\) and a standard deviation of 1 yielded the highest average accuracy for the multilayer filter defense model in the MNIST, CIFAR10, and CIFAR100 datasets. Furthermore, comparative results against two alternative defense models utilizing filters indicate that our approach outperforms, demonstrating that this model significantly enhances the robustness of image recognition classifiers. We have also confirmed the efficacy of our method on large-scale datasets, such as miniImageNet, and modern models like EfficientNet and WideResNet. Finally, we analyzed the time cost required for model training and explored the balance between model robustness and training efficiency.