# Lightweight Robust Image Classifier Using Non-Overlapping Image Compression Filters
## 5 Discussion and Conclusions  
In this paper, we introduced a simple and practical strategy for defending against adversarial attacks. This strategy aims to enhance the robustness of deep convolutional neural networks against adversarial attacks. We pointed out the shortcomings of current adversarial defense techniques based on image filters in terms of time efficiency. In order to shorten the training time of the model without reducing adversarial robustness, we proposed a new method that uses non-overlapping image compression filters to protect the image recognition classifier from adversarial attacks. This filter was validated on multiple datasets and under different CNN architectures. The experimental results showed that our method achieved an average accuracy of 75.48% on the CIFAR10 dataset. This proves that the method can effectively resist adversarial attacks and maintain good performance under various learning architectures. First, we compared our method with traditional image conversion techniques, including rotation, brightness adjustment, and noise addition, to evaluate its effectiveness in enhancing the robustness of the network against various disturbances. The results showed that our method performed better in improving the robustness of the network against these disturbances. After experimental verification, the results showed that using non-overlapping image filters achieved higher efficiency in eliminating adversarial disturbances. Akin to the overlapping image filter, the non-overlapping image filter is influenced by neighboring pixels during image processing. Nevertheless, it is imperative to emphasize that the non-overlapping image filter ensures that each pixel within the input image is utilized only once, thereby effectively minimizing the influence of adversarial disturbances. The proposed method demonstrates significant advantages in computational efficiency, characterized by the need for only one simple filtering preprocessing step for subsequent image recognition tasks. The time required for filtering mainly depends on the resolution of the image. Among the three different CNN architectures, the shortest training time for the entire image classification network was only 0.169 h.  
Then, we determined that our method demonstrates robustness in resisting adversarial attacks. Specifically, when the value of the attack factor \(\epsilon\) remains below 0.2, the attack success rate is firmly constrained within the limit of \(rate<0.25\). Within this parameter range, the perturbations introduced are imperceptible to the human eye. Finally, we tested two diffusion model-based defense methods and evaluated the standard and robust accuracies of our proposed method on the CIFAR10 test set. Under the WRN-28-10 architecture, our method achieved a standard accuracy of 91.28% and an average robust accuracy of 76.46%. These results demonstrate the effectiveness of our method in enhancing the robustness of the model. Given the demonstrated efficiency and low-complexity advantages of the proposed method, it stands as a potentially effective tool for diverse image recognition applications, particularly those operating on hardware platforms constrained by limited computing resources. However, we must be cautious about the potential limitations of this method, particularly those pertaining to its performance in addressing non-gradient-based adversarial attacks. Therefore, in future research, we will delve into image classification models for adversarial attacks from the perspectives of the following two types of image preprocessing: