## 3 Proposed Method  
A data augmentation method using color perturbation based on the color characteristics of the image and Gaussian noise was proposed to make a deep learning network robust against adversarial attacks. The proposed data augmentation method can overcome data deficiencies and improve the classification accuracy. Use of a suitable data augmentation method is key to image classification. Therefore, the proposed method focuses on color perturbations. To apply color perturbation, we tuned the pixels of the image using the inverse PSNR, Gaussian-distributed random numbers, and weights calculated by histogram. An overview of the proposed method is presented in Figure 2.  
Figure 2: Overview of the proposed method. As shown in this figure, the proposed method can be divided into six parts as follows: capturing image; decision of perturbation range (Figure 3); weight calculation (Figure 6); image preprocessing; color perturbation; geometric transformation. To establish the training image set, the objects to be classified were captured using the vision sensor. Based on the captured images, the perturbation value was calculated to determine the color perturbation range randomly. Further, the weights were calculated by using the histogram of the captured images. These weights were used when calculating the perturbation matrix. Background elimination was performed in image preprocessing. Next, color perturbation and geometric transformation were carried out to augment the training images. First, we collected training images captured using a vision sensor. We loaded the training images to calculate the perturbation range automatically. The proposed method suggests a technique for determining an ideal perturbation range. This process is illustrated in detail in Figure 3.  
The perturbation range was determined using images extracted arbitrarily from the training dataset. Random noise was generated and incorporated into an image. The PSNR was calculated using the original image and the noisy image. As mentioned previously, the PSNR indicates the similarity between the two images. We used the characteristics to determine the perturbation range. The PSNR was calculated for all randomly extracted images. Following the PSNR calculation, the perturbation range was determined for inverse PSNR data augmentation. Next, we generated new training images by the adaptive inverse PSNR data augmentation. This process, which is related to the inverse PSNR, was based on the following calculation (4). \[ \begin{split} 10\log_{10}\left(\frac{1}{mn}\sum_{i=1}^{m} \sum_{j=1}^{n}[I(i,j)-K(i,j)]^{2}\right)=20\log_{10}\left(MAX_{1}^{2}\right)- PSNR,\\ \sum_{i=1}^{m}\sum_{j=1}^{n}[I(i,j)-K(i,j)]^{2}=mn*10^{2\log_{10} \left(MAX_{1}^{2}\right)-0.1 PSNR}\end{split}  \tag{4}\]  
Figure 3: Process of perturbation range calculation. This equation, which was obtained from (2), yielded the optimal range for color perturbation. As we considered a data augmentation method based on the value of image similarity, we implemented the PSNR equation inversely. After loading the training images into categories and determining the perturbation value, the alpha channel was extracted from an image. The alpha channel is a criterion for isolating an object from its background. The region of an object is the region of interest (ROI). ROI is extracted to tune only the pixels of an object in an image. In addition, we analyzed the color characteristics of the training images in each category based on their histograms to improve the classification accuracy. First, we focused on color, a notable characteristic of an image. Figure 4 shows the RGB channel histograms, which are calculated by accumulating the pixel values of the images in each category. These images were included in the training images for object classification using deep learning. However, it was difficult to find distinct characteristics because black was the dominant color of some objects. Therefore, we rewrote the histogram, excluding the black objects.