# Lightweight Robust Image Classifier Using Non-Overlapping Image Compression Filters
## 1 Introduction  
In image classification tasks, deep learning has demonstrated remarkable and impressive performance. However, recent research on adversarial attacks has found that deep learning models are vulnerable in the presence of adversarial images. [PERSON] et al. [1] provided a survey article on the latest adversarial attacks, grouped by attack capability, and modern defenses, grouped by protection strategies. Adversarial images are generated by adding subtle adversarial perturbations to legitimate input images. Such carefully crafted perturbations are visually imperceptible to the human cognitive system, but they can cause deep learning models to misclassify the input images [2; 3; 4]. As depicted in Figure 1, adversarial perturbations have been intentionally introduced into the handwritten image of the numeral \"3\" to create an adversarial image. While human observers can effortlessly discern the original numeral \"3\", the image classification model incorrectly identifies it as the numeral \"8\". This phenomenon highlights the susceptibility of machine learning models to adversarial examples. At first, researchers adopted a strategy of building one or more adversarial sample detectors to identify whether the input image was an adversarial example. Once such samples are identified, they are reset to the structure of normal samples through the transformation of the reformer network. It is worth noting that this detector is essentially a classifier, and it also carries the risk of being attacked, which may result in normal samples being misjudged as adversarial samples. The diffusion model, as a powerful generative model, surpasses GANs in image generation [5]. The diffusion model consists of two processes: (1) a forward diffusion process, which converts data into noise by gradually adding noise; and (2) a reverse generation process, which starts with noise, gradually removes it, and generates data. In the generation process, the diffusion model purifies the noise samples, which is similar to the purification model. DiffPure [6] uses the Denoising Diffusion Probability Model (DDPM) [7] for adversarial purification. [PERSON] et al. [8] demonstrated that a diffusion model with higher efficiency and image quality can improve the robustness of image classifiers using the Explanatory Diffusion Model (EDM) [9]. However, diffusion models are sensitive to image colors, and as we increase the resolution and diffusion length T of the image, the inference speed becomes unbearable. To address this issue, recent research has proposed a defense strategy based on image filters. This type of filter is simple to execute and performs well in preserving the original color information of the image, providing an effective and practical solution for processing adversarial samples. [PERSON] et al. proposed a defense based on digital image processing (DIP) [10], which uses spatial filters and thresholds for image preprocessing to remove adversarial disturbances. This method can easily and effectively resist adversarial attacks. While effective in grayscale imagery, this method exhibits limitations in its application to color images, as the utilization of threshold techniques may result in partial loss of critical image information. [PERSON] and [PERSON] proposed a low-pass image-filtering (LPIF) [11] technique to reduce the impact of high-frequency noise on cellular neural networks. This approach offers advantages in terms of resource efficiency and ease of implementation. However, it may be ineffective against low-frequency adversarial attacks. [PERSON] et al. [12] introduced the Universal Defense Filter (UDFilter) to counter adversarial patch attacks. The UDFilter employs defense filters of equal size to overlay the input image, thereby mitigating the adverse effects of adversarial patches. However, the generation of these defense filters relies on an adaptive learning algorithm, necessitating the training of a model with a substantial number of parameters, which results in high computational costs.