# Lightweight Robust Image Classifier Using Non-Overlapping Image Compression Filters
## 3 Materials and Methods
### Receptive Field  
The receptive field is defined as the region in the input space that a particular feature of a convolutional neural network is examining [41]. It is a two-dimensional concept, so the receptive field is also two-dimensional. Therefore, the receptive field is designed as an \(a\times b\) rectangle. The receptive field scans the entire image from left to right and top to bottom. There are two scanning methods--overlapping and non-overlapping--as shown in Figure 3. In adversarial settings, non-overlapping filters perform better.  
Figure 3: Scanning methods of two different image filters: (**a,c**) Scanning mode diagrams of the receptive fields of overlapping and non-overlapping image filters, respectively. (**b,d**) Diagrams of data transmission methods for the corresponding methods. The red dots represent the filter layer pixels that can be influenced by the input layer pixel \(x\).  
Figure 2: The detailed process of applying image filters to a classifier model to solve the vulnerability of adversarial perturbations.  
Figure 3a shows the scanning method of the receptive field of the overlapping image filter. The overlapping image filter outputs a filtered image with the same size as the input image. Each pixel of the filtered image is affected by its neighbors. Each pixel of the input image is reused by the receptive field. Given the input image size \(n\times n\) and the receptive field size \(a\times b\), a filtered image of size \(n\times n\) is calculated by all pixels of the receptive field. Let \(S_{x,y}\) denote the set of coordinates of the input image affected by the receptive field of the filtered image at point \((x,y)\), as shown in the following Equation (5):  
\[\begin{split} S_{x,y}&=\{(u,v)|u\in[x-\frac{a}{2}, x+\frac{a}{2})\wedge[0,n),\\ v&\in[y-\frac{b}{2},y+\frac{b}{2})\wedge[0,n),u,v \in N\}\end{split} \tag{5}\]  
Figure 3c shows the scanning method of the receptive field of the non-overlapping image filter. The non-overlapping image filter outputs a low-resolution image smaller than the input image size. Like the overlapping image filter, each pixel of the filtered image is affected by its neighbors. However, each pixel of the input image is only used once. Similarly, let \(S^{{}^{\prime}}_{x,y}\) denote the set of coordinates of the input image affected by the receptive field of the filtered image at point \((x,y)\), as shown in the following Equation (6):  
\[\begin{split} S^{{}^{\prime}}_{x,y}&=\{(u,v)|u\in[ ax,ax+a)\wedge[0,n),\\ v&\in[by,by+b)\wedge[0,n),u,v\in N\}\end{split} \tag{6}\]  
where \((u,v)\) is the coordinate of the input image affected by the receptive field, and its value must be a positive number. The region of the receptive field is a rectangle of size \(a\times b\) formed by the center pixel \((x,y)\) and its neighboring pixels.  
When processing the edges of the input image, it is necessary to expand the image boundary to ensure the completeness of the receptive field. The padding method used for the image boundary affects the performance of the image filter. Ideally, the result of the image filter should be completely unaffected by the padding value. In this paper, the input image boundary is filled with 0.