# Lightweight Robust Image Classifier Using Non-Overlapping Image Compression Filters
## 2 Related Works
\begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Method** & **Year** & **Motivation** & **Innovative Approach** & **Inadequacy** \\ \hline \multirow{2}{*}{DNR [15]} & \multirow{2}{*}{2021} & Improving performance & Combines ultra-high model compression with robust adversarial training to generate a pruned DNN. & Lower adaptability and portability \\ \hline LTD [16] & \multirow{2}{*}{2021} & Improving performance & Using a distillation framework, different fixed temperatures are used in both teacher and student models. & Lower adaptability and portability \\ \hline PSSiLU [17] & \multirow{2}{*}{2022} & Improving performance & Uses learnable parametric activation functions (PAFs) to improve performance. & Lower adaptability and portability \\ \hline SENSEI [18] & \multirow{2}{*}{2020} & Improving performance & Replaces each data point with a suitable variant or keeps it unchanged. & Lower adaptability and portability \\ \hline Magnet [20] & \multirow{2}{*}{2017} & Improving performance & Uses one or more separate detector networks and a reformer network. & Overhead to maintain an additional module \\ \hline CAFD [21] & \multirow{2}{*}{2021} & Improving performance & Employs a defense mechanism called defense distillation to reduce the effectiveness of adversarial samples on DNNs. & Overhead to maintain an additional module \\ \hline DG [22] & \multirow{2}{*}{2021} & Improving performance & Uses a Graph Neural Network (GNN) [30] to construct a Latent Neighborhood Graph (LNG) for each original example. & Overhead to maintain an additional module \\ \hline DISCO [23] & \multirow{2}{*}{2022} & Improving performance & Adversarial Defense with Local Implicit Functions (DISCO) serves as an adjunct network to the classifier. & Overhead to maintain an additional module \\ \hline HAT [24] & \multirow{2}{*}{2021} & Adversarial training & Additional mislabeled examples were added during the training process. & Reduced generalization ability \\ \hline FAT [25] & \multirow{2}{*}{2021} & Adversarial training & Performing stochastic smoothing effectively optimizes the internal maximization problem. & Reduced generalization ability \\ \hline DiffPure [6] & \multirow{2}{*}{2022} & Adversarial training & Uses the denoising diffusion probabilistic model (DDPM) [7] for adversarial purification. & Cost of maintaining adversarial images \\ \hline GDMAP [28] & \multirow{2}{*}{2022} & Adversarial training & Takes pure Gaussian noise as the initial input and gradually denoises it into the adversarial image. & Cost of maintaining adversarial images \\ \hline DensePure [29] & \multirow{2}{*}{2022} & Adversarial training & Iterative denoising of input images using different random seeds to obtain multiple reverse samples. & Cost of maintaining adversarial images \\ \hline [PERSON] et al. [8] & \multirow{2}{*}{2023} & Adversarial training & Uses a diffusion model [9]. & Cost of maintaining adversarial images \\ \hline QuSecNets [31] & \multirow{2}{*}{2019} & Increase insensitivity & Uses a quantization-based defense mechanism to secure deep neural networks against adversarial attacks. & Complex computing resources \\ \hline DIP [10] & \multirow{2}{*}{2023} & Increase insensitivity & Uses spatial filters and thresholds for image preprocessing to remove adversarial disturbances. & Limitations for color images \\ \hline LPIF [11] & \multirow{2}{*}{2023} & Increase insensitivity & Uses the low-pass image-filtering technique to reduce the impact of high-frequency noise on cellular neural networks. & Poor effect against low-frequency attacks \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Recent studies of adversarial defense in the domain of image recognition. and classification, attack intensity refers to the degree of modification of the pixel values, such that the adversarial image will be noticed by the human eye [32; 33]. Common methods include data quantification [31; 34] and image filtering [35]. [PERSON] et al.