# Lightweight Robust Image Classifier Using Non-Overlapping Image Compression Filters
## 3 Materials and Methods
### Performance Metrics  
The accuracy metric is defined as the quantitative measure of the number of samples correctly predicted by the model, as shown in the following Equation (8):  
\[accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{8}\]  
where TP refers to True Positive, TN to True Negative, FP to False Positive, and FN to False Negative. In scenarios involving adversarial images, this metric is appropriately termed \"robust accuracy\". The utilization of accuracy as an evaluation criterion enables a direct comparison with previously established methodologies and offers a clear indication of the model's performance under the conditions of an adversarial attack. The Inception Score (IS) [48] serves as a metric to gauge the disparity between an original image and its corresponding adversarial counterpart. The IS relies on the carefully designed convolutional network model Inception-V3. This model accepts an image tensor as its input and yields a 1000-dimensional vector as output. Each dimension within this vector corresponds to the likelihood of the image being classified into a particular category, \begin{table}
\begin{tabular}{c c c c c c} \hline
**CNN** & **VGGNet** & **ResNet** & **GoogLeNet** \\ \hline Architectures & VGG16 & ResNet34 & Inception-ResNet-v2 \\ \hline Input & \multicolumn{4}{c}{\(32\times 32\) RGB image} \\ \hline Name & Layer & Output Size & Layer & Output Size & Layer & Output Size \\ \hline Stem & \multirow{4}{*}{\([3\times 3,64]\times 2\)} & stem,strides=1 & \(32\times 32\) & stem,strides=1 & \(32\times 32\) \\  & & & \(\begin{bmatrix}3\times 3,64\\ 3\times 3,64\end{bmatrix}\times 3\) & \(16\times 16\) & Inception-resnet-A\(\times 5\) & \(32\times 32\) \\  & & maxpool & & & ReductionA & \(16\times 16\) \\ Block-B & \([3\times 3,128]\times 2\) & \(8\times 8\) & \(\begin{bmatrix}3\times 3,128\\ 3\times 3,128\end{bmatrix}\times 4\) & \(8\times 8\) & Inception-resnet-B\(\times 10\) & \(16\times 16\) \\ Block-C & \([3\times 3,256]\times 3\) & \(4\times 4\) & \(\begin{bmatrix}3\times 3,256\\ 3\times 3,256\end{bmatrix}\times 6\) & \(4\times 4\) & Inception-resnet-C\(\times 5\) & \(8\times 8\) \\ Block-D & \([3\times 3,512]\times 3\) & \(2\times 2\) & \(\begin{bmatrix}3\times 3,512\\ 3\times 3,512\end{bmatrix}\times 3\) & \(2\times 2\) & \\ Block-E & \([3\times 3,512]\times 3\) & \(1\times 1\) & & & \\  & maxpool & & & & \\  & FullConnect & 256 & AveragePooling,strides=1 & AveragePooling,strides=1 \\ Block-F & FullConnect & 128 & \multirow{2}{*}{FullConnect} & Dropout(0.8) & \multirow{2}{*}{FullConnect} \\ Output & FullConnect & num\_classes & & & \\ \hline \end{tabular}
\end{table} 
Table 2: The CNN architecture we adopted and the specific configuration of each module. thereby allowing the entire vector to be interpreted as a probability distribution. The IS is defined by the following equation:  
\[IS(x^{adv})=e^{\mathbb{E}[KL(p(y|x^{adv})||p(y)))]} \tag{9}\]  
where \(p(y|x^{adv})\) represents the output distribution of the Inception model when inputting image \(x^{adv}\), \(P(x^{adv})\) represents the probability of adversarial image \(x^{adv}\), and \(P(y_{i}|x^{adv})\) represents the probability of the Inception model predicting that adversarial image \(x\) belongs to class \(i\). \(KL(p(y|x^{adv})||p(y))\) represents the KL divergence (relative entropy) between these two distributions. The calculation formula is as follows:  
\[KL(P||Q)=\sum_{i}P(i)log\frac{P(i)}{Q(i)} \tag{10}\]  
Based on this definition, a higher IS value correlates with a superior quality of the adversarial image. Learned Perceptual Image Patch Similarity (LPIPS) [49] is a sophisticated metric designed to assess the dissimilarity between two images. Unlike straightforward mathematical computations, LPIPS employs deep neural networks to facilitate its evaluations. Typically, the LPIPS model accepts two images as inputs and yields a score that quantifies their perceived similarity. The model's architecture and parameters are derived from extensive training, with the goal of discerning the perceptual attributes of images.