# Defense against Adversarial Attacks in Image Recognition Based on Multilayer Filters
## 4 Experimental Results
### Evaluation of the Impact of Noise Injection on the Robustness of Classifiers
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Attack**} & \multirow{2}{*}{**Defense**} & \multicolumn{2}{c}{**MNIST**} & \multicolumn{2}{c}{**CIFAR10**} & \multicolumn{2}{c}{**CIFAR100**} \\ \cline{3-10}  & & **CNN** & **DNN** & **DNN** & **VGG16** & **ResNet50** & **VGG16** & **ResNet50** \\ \hline \multirow{3}{*}{FGSM} & DIP (2023) [39] & 0.83222 & 0.60648 & 0.61143 & 0.37918 & 0.35497 & 0.24902 & 0.35442 \\  & LPIF (2023) [40] & 0.87256 & 0.65574 & 0.70605 & 0.76355 & 0.82319 & 0.43198 & 0.52629 \\  & MLFD (Ours) & 0.94256 & 0.67222 & 0.76297 & 0.77154 & 0.84574 & 0.44723 & 0.54943 \\ \hline \multirow{3}{*}{BIM} & DIP (2023) [39] & 0.87321 & 0.68469 & 0.38390 & 0.38534 & 0.45134 & 0.26314 & 0.47384 \\  & LPIF (2023) [40] & 0.91545 & 0.80672 & 0.58750 & 0.63211 & 0.70308 & 0.37452 & 0.67570 \\  & MLFD (Ours) & 0.94664 & 0.84135 & 0.59862 & 0.63529 & 0.70470 & 0.42786 & 0.69665 \\ \hline \multirow{3}{*}{PGD} & DIP (2023) [39] & 0.89276 & 0.73076 & 0.54229 & 0.38658 & 0.55810 & 0.26150 & 0.47556 \\  & LPIF (2023) [40] & 0.91908 & 0.84484 & 0.59477 & 0.59051 & 0.66361 & 0.39228 & 0.65303 \\  & MLFD (Ours) & 0.94184 & 0.86873 & 0.59925 & 0.63494 & 0.70250 & 0.43419 & 0.70332 \\ \hline \multirow{3}{*}{C\&W} & DIP (2023) [39] & 0.90580 & 0.81568 & 0.59861 & 0.42256 & 0.74056 & 0.38984 & 0.59375 \\  & LPIF (Ours) & 0.92153 & 0.90213 & 0.73496 & 0.77202 & 0.83548 & 0.50473 & 0.73226 \\  & MLFD (Ours) & 0.94324 & 0.94235 & 0.79007 & 0.77570 & 0.88081 & 0.54676 & 0.77240 \\ \hline \multirow{3}{*}{AutoAttack} & DIP (2023) [39] & 0.72425 & 0.77357 & 0.59860 & 0.41551 & 0.45827 & 0.38652 & 0.59107 \\  & LPIF (2023) [40] & 0.91857 & 0.89419 & 0.56649 & 0.50486 & 0.62317 & 0.45371 & 0.66516 \\  & MLFD (Ours) & 0.93976 & 0.93262 & 0.60243 & 0.52458 & 0.63503 & 0.50223 & 0.68746 \\ \hline \multirow{3}{*}{VNIFGSM} & DIP (2023) [39] & 0.84227 & 0.73079 & 0.55705 & 0.40158 & 0.50637 & 0.32980 & 0.51549 \\  & LPIF (2023) [40] & 0.91254 & 0.83871 & 0.63081 & 0.62862 & 0.70782 & 0.44808 & 0.65922 \\ \cline{1-1}  & MLFD (Ours) & 0.94264 & 0.86498 & 0.65929 & 0.64444 & 0.73397 & 0.48867 & 0.68821 \\ \hline \multirow{3}{*}{Average} & DIP (2023) [39] & 0.84508 & 0.72366 & 0.54864 & 0.39845 & 0.51160 & 0.31330 & 0.50068 \\ \cline{1-1}  & LPIF (2023) [40] & 0.90995 & 0.82372 & 0.63676 & 0.64861 & 0.72605 & 0.43421 & 0.65194 \\ \cline{1-1}  & MLFD (Ours) & 0.94278 & 0.85370 & 0.66877 & 0.66441 & 0.75045 & 0.47449 & 0.68291 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The accuracy of the image classifier using DIP, LPIF, and our defense on the MNIST dataset, the CIFAR-10 dataset, and the CIFAR-100 dataset. FGSM, BIM, PGD, C&W, AutoAttack, and VNIFGSM as baselines attacks. The image recognition classifier adopts CNN, DNN, VGG16, and ResNet50 architecture, respectively. useful information learned by the model, leading to performance degradation. In the CIFAR10 dataset, we found that the optimal noise intensity is 3, at which point the defense performance reaches its optimal level.