A Novel Approach for Defense Against Adversarial Attacks in Image Classification

A Novel Approach for Defense Against Adversarial Attacks in Image Classification | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article A Novel Approach for Defense Against Adversarial Attacks in Image Classification Gal Erez, Yosef Ben Ezra This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7068197/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract We propose a novel method to enhance the adversarial robustness of image classification models by leveraging discrete wavelet transforms (DWT). Our defense applies a two-level DWT decomposition to input images, entirely discarding the detail coefficients and preserving only the approximation components. These denoised images are then used to augment the clean training set, enabling robust model training without requiring access to adversarial examples. Using the CIFAR-10 dataset, we evaluate ResNet18 models against six white-box attacks: Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), DeepFool, Momentum Iterative FGSM (MI-FGSM), Jacobian-based Saliency Map Attack (JSMA), and AutoAttack. To explore the impact of wavelet selection, we test three wavelet families—Haar, Daubechies-4 (DB4), and Symlet-4 (SYM4)—training separate models for each. Evaluation on clean, adversarial, and denoised inputs demonstrates that wavelet-based augmentation significantly improves robustness against a broad range of attacks while preserving high accuracy on unperturbed data. Physical sciences/Engineering Physical sciences/Mathematics and computing Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Introduction Deep neural networks have achieved remarkable performance in image classification tasks across diverse domains, ranging from medical imaging and facial recognition to autonomous driving. However, despite their high accuracy on clean data, these models are highly vulnerable to adversarial examples—carefully crafted perturbations that subtly manipulate input data and cause misclassification while remaining nearly imperceptible to humans [ 1 ] [ 2 ]. While image classification is the most widely studied domain, adversarial attacks have also been demonstrated in other fields such as natural language processing, facial recognition, financial transactions and many more [ 1 ]. The vulnerability of deep learning models to adversarial attacks poses significant challenges for their deployment in real-world applications, where security and reliability are paramount; for example, in autonomous driving, adversarial perturbations could lead to misclassification of road signs or pedestrians, potentially resulting in accidents [ 3 ]. Numerous defense strategies have been proposed in response to these challenges. The most prominent and widely adopted approach is adversarial training , where models are trained using clean and adversarial images to enhance robustness. This method improves performance against specific threat models and has been developed into variants like Ensemble Adversarial Training , which incorporates diverse adversarial sources during training [ 4 ] [ 5 ]. Another popular category of defenses involves input preprocessing techniques that aim to mitigate adversarial perturbations before classification. JPEG compression is a common approach that reduces high-frequency noise potentially introduced by adversarial perturbations [ 6 ]. Feature squeezing reduces the input’s degrees of freedom by applying bit-depth reduction and smoothing techniques, thereby limiting adversarial space [ 7 ]. Some defenses modify the internal structure or training process of models. Defensive distillation , for example, uses a two-stage training process involving a "teacher" and a "student" network, where the student learns to mimic softened outputs produced by the teacher, aiming to smooth the decision boundaries [ 8 ]. Other approaches, like feature denoising , introduce architectural changes that suppress adversarial gradients by learning denoising filters within the network [ 9 ]. More recently, wavelet-based methods have emerged as promising defense strategies. One such approach, Wavelet Extension and Denoising (WED) , augments the model’s input by concatenating the original image with a wavelet-decomposed low-frequency version, and later applies wavelet-based denoising at inference to suppress potential perturbations [ 10 ]. Another dual-stage framework detects adversarial examples and reconstructs them using wavelet domain features to restore clean inputs before classification [ 11 ]. While existing defense strategies have demonstrated varying degrees of success, they often suffer from limitations such as high computational overhead, attack-specific optimisation, or degradation in clean data accuracy [ 1 ]. These shortcomings highlight a broader challenge: developing a simple, effective, attack-agnostic defense that does not require adversarial examples during training. This motivated our investigation into a lightweight preprocessing-based approach and led to two central research questions: (1) Can such a method improve adversarial robustness without significantly harming clean data performance? and (2) Can it generalise across a wide range of adversarial attack strategies? Our approach was motivated by experiments showing that fusing the clean image’s high-frequency details with the adversarial image’s low-frequency components significantly reduced misclassification. This suggests that adversarial perturbations mainly affect high-frequency regions, while low-frequency components preserve the image’s core structure. To test this hypothesis, we conducted extensive experiments on the CIFAR-10 dataset [ 12 ], consisting of 50,000 training and 10,000 test images across 10 classes. The classification model used throughout was a ResNet-18 architecture [ 13 ], trained from scratch. We benchmarked our approach against several widely-used adversarial attacks: Fast Gradient Sign Method (FGSM) [ 4 ], Projected Gradient Descent (PGD) [ 14 ], DeepFool [ 15 ], Momentum Iterative FGSM (MI-FGSM) [ 16 ], Jacobian-based Salience Maps Attack (JSMA) [ 17 ], and Auto-Attack [ 18 ]. To assess robustness across signal representations, we trained three different models using three wavelet families: Haar , Daubechies-4 (db4) , and Symlet-4 (sym4) [ 19 ] [ 20 ]. The proposed defense strategy focuses on training a model on a clean dataset augmented with low-frequency components derived from wavelet decomposition. The components contain the essential structural information of the images, which helps the model generalise better. The key innovation is that this method does not require generating adversarial examples during training; instead, we use the data already available and used for training. To evaluate the denoising strategy further, we also applied it to adversarial examples generated by the attacks mentioned above as a preprocessing step before classification. The remaining sections of this paper are organised as follows: the Methods section, which describes the proposed wavelet-based approach and the experimental setup. The Results section presents the experimental findings, including comparisons of the wavelet-based defense against various adversarial attacks. The Discussion section interprets the results and their implications for future research and presents conclusions drawn from the study. The rest of the paper includes the data availability, references, acknowledgements, and author contributions. Proposed Approach While existing defense strategies typically rely on adversarial training or input preprocessing at inference [ 1 ], our approach introduces a fundamentally different and novel approach: instead of modifying the model architecture or training on adversarial examples, we augment the training data itself using a wavelet-based denoising method. This strategy eliminates the need for adversarial examples, offering a lightweight, attack-agnostic defense mechanism. The conceptual foundation of this approach was inspired by empirical observations made during early experimentation. We applied wavelet decomposition to clean and adversarial versions of the same image. We reconstructed a hybrid image by fusing the clean image’s high-frequency (detail) coefficients with the adversarial image’s low-frequency (approximation) components. Feeding these fused images into a classifier consistently reduced misclassification rates. This outcome led to the hypothesis that adversarial perturbations primarily reside in the high-frequency components of the image. In contrast, the low-frequency components retain the structural content necessary for accurate classification. This insight aligns with the inherent design of many adversarial attacks: to remain imperceptible to human vision, they tend to manipulate fine-grained, high-frequency pixel patterns, leaving the coarse structure largely untouched. Based on this hypothesis, we designed a wavelet-based denoising method that reconstructs each image using only its approximation coefficients, effectively discarding all high-frequency detail coefficients during inverse transformation. Initial tests using this approach showed that the resulting denoised images, when classified, produced significantly improved robustness to adversarial examples. In some cases, the classifier even outperformed its predictions on the original clean images. These results demonstrated that complete suppression of detail coefficients was sufficient to mitigate adversarial effects, eliminating the need for a dynamic system that computes adaptive thresholds per image. This simplification validated the hypothesis and enabled a streamlined, deterministic denoising process. Figure 2 illustrates the denoising process used to augment the training data. Each clean image undergoes a two-level discrete wavelet transform (DWT). The resulting detail coefficients (horizontal, vertical, and diagonal components) are entirely suppressed, while the approximation coefficients are retained. The image is then reconstructed using the inverse DWT to produce a denoised version. This denoised image is used alongside the original clean image during training, doubling the dataset and reinforcing the model’s exposure to low-frequency representations. This augmentation was consistently applied to all training images — every input passed to the model was either clean or denoised. Additionally, during evaluation, the same denoising pipeline was used as a preprocessing step for adversarial examples generated via several adversarial attacks, allowing us to assess the method's effectiveness as both a training augmentation and a test-time defense. Dataset and Preprocessing All experiments in this study were conducted using the CIFAR-10 dataset [ 12 ], which comprises 60,000 colour images of size 32×32×3, evenly distributed across 10 mutually exclusive classes. The dataset is split into 50,000 training images and 10,000 test images and is widely used for benchmarking image classification models and evaluating robustness to adversarial attacks. For model training and evaluation, the original (clean) CIFAR-10 dataset was obtained via Torchvision, a Python library that provides tools for computer vision tasks. Standard data augmentation techniques were applied during training, including random cropping with 4-pixel padding, horizontal flipping and normalisation. For evaluation, only normalisation was applied. To generate the denoised counterparts used for augmentation and evaluation, each clean image was saved to disk in PNG format and processed offline. The denoising process (detailed in the next section) was applied to each image. The resulting denoised images were saved as PNG files and reloaded for training and inference alongside the original clean images. Wavelet-Based Denoising The denoising method was implemented using MATLAB R2022a’s Wavelet Toolbox and applied independently to each image in the dataset. The objective was to remove high-frequency components (detail coefficients) while preserving the structural content of the image via its low-frequency approximation components. This process supported the training and evaluation strategy described earlier and was applied offline before loading the images into the deep learning pipeline. Three wavelet families were used for decomposition and reconstruction: Haar , Daubechies-4 ( DB4 ), and Symlet-4 ( SYM4 ). Haar was selected as a simple and commonly used baseline in image processing due to its fast computation and intuitive structure. DB4 and SYM4 were chosen based on prior research demonstrating their superior performance in image denoising, compression, and signal representation tasks [ 22 ]. The method consists of the following steps: 1. Wavelet Decomposition : Each RGB image was decomposed using a two-level discrete wavelet transform (DWT) with the selected wavelet basis. 2. Detail Coefficient Suppression : The detail coefficients (horizontal, vertical, and diagonal) at both decomposition levels were suppressed across all three color channels. 3. Image Reconstruction : The image was reconstructed using the untouched approximation components and the suppressed detail coefficients, using the inverse DWT. 4. Output : The denoised image was saved to disk in PNG format. All processing was performed per image and preserved the original RGB colour format. No grayscale conversion was applied at any stage. The resulting denoised datasets (one for each wavelet family) were later used alongside the clean dataset during training and evaluation, as described in the preceding and following sections. Model Architecture and Training All models were implemented and trained using PyTorch [ 23 ], based on a ResNet-18 architecture [ 13 ]. The training script was modified to support joint training on clean and wavelet-denoised images. Using its corresponding denoised dataset, a separate model was trained from scratch for each wavelet family (Haar, DB4, and SYM4). Each model's training set consisted of the original 50,000 clean images concatenated with their denoised counterparts, resulting in 100,000 images per training run. Similarly, the evaluation set included the 10,000 clean test images and their denoised versions, totalling 20,000 test images per model. All models were trained using the Cross-Entropy Loss function. Optimization was performed using Stochastic Gradient Descent (SGD) with an initial learning rate of 0.1 , momentum of 0.9 , and weight decay of \(\:5\bullet\:1{0}^{-4}\) . The learning rate was scheduled using Cosine Annealing with \(\:{T}_{max}=200\) . Training was conducted for 200 epochs with a batch size of 128 for training and 100 for testing. Model checkpoints were saved whenever an improvement in test set accuracy was observed. All models were initialised with random weights and trained entirely from scratch (no pretrained parameters were used). Adversarial Attacks To evaluate the robustness of the proposed models, adversarial examples were generated using the Adversarial Robustness Toolbox (ART) [ 24 ]. They targeted a surrogate ResNet-18 model trained solely on the clean CIFAR-10 dataset. The model was wrapped using ART’s PyTorchClassifier interface, allowing compatibility with various attack implementations. Six widely used attack methods were employed: ● Fast Gradient Sign Method (FGSM) [ATK-FGSM]: Applied with a perturbation magnitude coefficient of \(\:ϵ=0.01\) . ● Projected Gradient Descent (PGD) [ATK-PGD]: Configured with \(\:ϵ=0.01\) , step size \(\:\alpha\:=0.0025\) , and 20 iterations. ● DeepFool [ATK-DF]: Used with an overshoot of \(\:ϵ={10}^{-6}\) , up to 50 iterations, and 10 class gradients. ● Momentum Iterative FGSM (MI-FGSM) [ATK-MIFGSM]: Executed with \(\:{l}_{\infty\:}\) -norm, \(\:ϵ=0.01\) , step size \(\:\alpha\:=0.0025\) , and 20 iterations. ● Jacobian-based Saliency Map Attack (JSMA) [ATK-JSMA]: Configured with the perturbation magnitude applied to each selected feature \(\:\theta\:=\:0.05\) and maximum fraction of features being perturbed \(\:\gamma\:=\:0.1\) . ● AutoAttack [ATK-AA]: Applied under the \(\:{l}_{\infty\:}\) -norm with \(\:ϵ=\:0.03\) and step size \(\:\alpha\:=0.01\) . All adversarial examples were generated using ART’s native routines, which internally manage normalisation, clipping, and batch handling based on the model’s configuration. The attacks were executed in batch mode, with parameters and preprocessing handled automatically by ART. Following generation, the adversarial images were saved in PNG format and processed offline using the same wavelet-based denoising method described earlier. The resulting denoised adversarial examples were evaluated alongside the original and clean test images. This attack setup ensured that all perturbations were created independently of the wavelet-trained models, thus representing a realistic threat against a surrogate model. Performance Metrics Each trained model was evaluated across various sets to assess both clean accuracy and robustness to adversarial perturbations and their denoised counterparts. These included the original CIFAR-10 test set [ 12 ], its denoised version, adversarial examples generated by FGSM [ 4 ], PGD [ 14 ], DeepFool [ 15 ], MI-FGSM [ 16 ], JSMA [ 17 ], and AutoAttack [ 18 ], and the denoised versions of all attacks. Top-1 classification accuracy was used as the primary evaluation metric across all conditions. No ensemble strategies, input randomisation, or stochastic inference techniques were applied. All reported accuracy scores are based on a single evaluation run per model, without statistical averaging or bootstrapping. This controlled and systematic setup enabled consistent comparison of model behaviour across varying input scenarios, isolating the impact of both the training augmentation and the denoising defense applied during inference. Computational Resources All experiments were conducted locally, on a personal Windows 10 machine equipped with an NVIDIA GeForce RTX 2080 SUPER GPU . The deep learning pipeline was implemented in Python 3.12.4 , and denoising was performed in MATLAB R2022a using the Wavelet Toolbox. Training of each ResNet18 model on the combined clean and denoised dataset (100,000 training images + 20,000 test images) required approximately 4 hours . All fourteen sets were evaluated in \(\:\sim\) 1–2 minutes per model, as all images were preloaded into memory prior to inference. No distributed computing or cluster-based acceleration was used in this study. This local setup demonstrates that the proposed wavelet-based defense strategy is effective, computationally practical, and accessible. LLM Usage Disclosure Portions of the manuscript were formatted and edited for clarity using OpenAI’s ChatGPT. The language model did not generate content, experimental design, data analysis, or interpretation. The authors conceived, implemented, and validated all scientific content. Results Visual Comparison of Perturbations and Denoising In Fig. 4 , we present a visual comparison to illustrate the impact of adversarial perturbations and the effectiveness of the proposed wavelet-based denoising method. The top row displays the original clean image and its adversarial variants generated by FGSM [ 4 ], PGD [ 14 ], DeepFool [ 15 ], MI-FGSM [ 16 ], JSMA [ 17 ], and AutoAttack [ 18 ]. Subsequent rows show the corresponding denoised versions produced using the Haar, DB4, and SYM4 wavelet families. Across attacks, adversarial perturbations typically manifest as subtle high-frequency distortions that are visually imperceptible but sufficient to alter model predictions. In some cases (such as JSMA or AutoAttack), perturbations appear more noticeable, likely due to the chosen attack parameters and the small resolution of CIFAR-10 images (32×32×3), where even minor pixel-level changes are more apparent than they would be in higher-resolution images. Notably, the denoised images across all wavelet types suppress these fine-grained perturbations while preserving the overall structure and semantics of the original image. This qualitative comparison visually supports our hypothesis that adversarial perturbations primarily reside in the high-frequency components of images. By retaining only the low-frequency (approximation) elements, the denoising process effectively reduces adversarial noise without erasing essential class-relevant content. These insights help contextualise the quantitative findings presented in the following sections. Overall Performance Comparison Figure 5 presents a heatmap summarising the top-1 classification accuracy across all test conditions for the baseline model and the three wavelet-trained models. Our findings consistently show that wavelet-based denoising is most effective when integrated into the training process, rather than used as a preprocessing defense at inference time. While standalone denoising can improve robustness in some cases, particularly on surrogate-generated adversarial inputs, its inconsistent results limit its standalone utility, especially on clean data. The following sub-sections explore the approach’s effect on clean data, adversarial robustness, and the impact of wavelet choice in more detail. Effect on Clean Data We examine model performance on clean and denoised versions of the CIFAR-10 test set. As shown in Fig. 5 , the baseline ResNet-18 model achieves 95.47% top-1 accuracy on clean inputs. However, its accuracy drops sharply to 66.8% on denoised clean images, indicating that applying wavelet denoising as a preprocessing step removes critical high-frequency features needed for classification without training the model accordingly. In contrast, all models trained with clean and denoised images maintain high accuracy on both input types. Their clean accuracy remains in the 95.03–95.14% range, and their denoised accuracy stays above 93.5% . This shows that training with wavelet-denoised data encourages reliance on robust, low-frequency features and structural patterns, rather than fragile fine-grained details. Robustness Against Adversarial Attacks We now assess the models' performance under adversarial perturbations generated using six attack methods. As shown in Fig. 5 , the baseline ResNet-18 model, trained solely on clean data, suffers severe accuracy degradation across all attacks. For example, top-1 accuracy drops from 95.47% (clean) to 58.87% under FGSM, 7.24% under PGD, and 21.64% under DeepFool, highlighting the model’s vulnerability. In contrast, the wavelet-trained models demonstrate significantly enhanced robustness. When evaluated directly on adversarial examples (without additional preprocessing), they achieve: ● FGSM: 76.67–81.5% ● PGD: 63.24–78.04% ● DeepFool: 86.26–90.03% ● MI-FGSM: 57.74–73.88% ● JSMA: 92.0–92.54% ● AutoAttack: 34.86–51.31% These results consistently improve over the baseline across all attacks, particularly for strong gradient-based attacks like PGD and AutoAttack. Applying the denoising method as a preprocessing step to the adversarial inputs yields mixed outcomes. For weaker attacks such as FGSM and PGD, accuracy improves modestly (e.g., up to 82.49% for FGSM and 81.21% for PGD). However, for DeepFool and JSMA, the denoised inputs slightly reduce performance compared to their non-denoised adversarial counterparts. The most notable gains from preprocessing occur with AutoAttack, where denoising improves accuracy by 6–12% across models. These findings indicate that while the denoising method is effective when incorporated into training, its utility as a standalone preprocessing defense is attack-dependent. The most substantial benefit arises from the joint training procedure, which encourages models to learn representations resilient to high-frequency adversarial noise. Effect of Wavelet Choice We conclude by analysing the impact of the wavelet family used during denoising and model training. As shown in Fig. 5 , all three wavelet-trained models—Haar, DB4, and SYM4—outperform the baseline across all adversarial scenarios, though small performance differences emerge depending on the wavelet used. On the clean test set, performance is nearly identical across wavelets, with accuracies ranging from 95.03–95.14% . Similarly, when evaluated on denoised clean images, all three models maintain high accuracy ( 93.54–94.09% ), indicating that the denoising process across wavelet types preserves class-relevant information and semantic structure. Across adversarial conditions, however, the model trained with Haar-based denoised images consistently achieves the highest accuracy. For instance: ● On raw FGSM, Haar reaches 81.5% , outperforming DB4 and SYM4 by \(\:\sim\) 5% . ● On denoised FGSM, Haar scores 82.49% , \(\:\sim\) 5–6% higher than the others. ● On raw PGD, Haar achieves 78.04% , surpassing DB4 and SYM4 by \(\:\sim\) 15% . ● On denoised PGD, it attains 81.21% , again leading by a significant margin. ● For DeepFool, Haar also performs best, reaching 90.03% (raw) and 88.92% (denoised), with 3–4% margins over the other models. These results suggest that while all three wavelet families contribute to enhanced robustness, Haar-based training appears most effective overall. This may stem from Haar’s compact support and sharp localisation in both spatial and frequency domains, which could better preserve essential image structures while discarding fine-grained perturbations. Discussion Our results demonstrate that wavelet-based denoising can significantly enhance the robustness of image classification models against adversarial attacks without requiring access to adversarial examples during training. By augmenting clean training data using the proposed approach, our models consistently outperformed the baseline across a wide range of test conditions. This robustness held across three wavelet families (Haar, DB4, SYM4) and six white-box attacks, including gradient-based (FGSM [ 4 ], PGD [ 14 ], MI-FGSM [ 16 ]), optimisation-based (DeepFool [ 15 ], AutoAttack [ 18 ]), and saliency-based methods (JSMA [ 17 ]). These findings support the hypothesis that adversarial perturbations predominantly affect the high-frequency components of images, a notion corroborated by prior work in adversarial robustness and frequency analysis [ 9 ] [ 25 ]. The discrete wavelet transform (DWT) provides a structured and interpretable means to isolate and suppress these components. Discarding all detail coefficients across multiple decomposition levels, our approach filters out much of the adversarial signal while preserving the semantic content embedded in the low-frequency approximation [ 19 ]. Interestingly, the models trained with denoised data improved robustness to adversarial inputs and maintained strong performance on clean test images (Fig. 5 ). This indicates that wavelet-based denoising does more than simply smooth inputs – it may act as a form of regularisation that encourages the model to rely on stable, low-frequency features, thereby improving generalisation. Similar effects have been reported in works on robust optimisation and frequency-based input transformations [ 26 ] [ 27 ]. Compared to adversarial training [ 4 ] (a dominant yet computationally intensive defense strategy), our method is both attack-agnostic and model-agnostic, requiring no gradient computations or attack generation during training. Adversarial training often leads to overfitting against specific attack types or norms, whereas our models showed resilience across multiple, diverse attacks, including stronger composite attacks like AutoAttack. Notably, this robustness was achieved without compromising accuracy on clean data - a standard tradeoff in many defense strategies. That said, our work has several limitations. First, we evaluated performance on CIFAR-10 [ 12 ] using a ResNet18 [ 13 ] backbone. While standard, these may not capture the full complexity of high-resolution datasets or deeper architectures. Second, the denoising method employed a fixed, non-adaptive suppression strategy. Future work could explore data-driven or learnable thresholding schemes, potentially adapting wavelet coefficients to local structure or training dynamics. Additionally, our evaluation focused on white-box attacks generated from a fixed baseline model. A broader assessment remains an important direction, including black-box, adaptive, or transfer-based attacks. This work opens several avenues for future research: extending the methodology to larger datasets (e.g., ImageNet [ 28 ]), combining wavelet-based preprocessing with adversarial training, or integrating it into certified defense frameworks, to name a few. Moreover, incorporating learned representations in the wavelet domain (e.g., scattering transforms, sparse coding, or hybrid frequency-spatial defenses) may offer deeper theoretical grounding and improved performance. In conclusion, wavelet-based denoising emerges as a simple yet effective strategy for adversarial defense. It is lightweight, attack-agnostic, and generalizable , offering robustness gains without sacrificing clean accuracy or introducing complex training procedures. These properties make it a promising candidate for real-world deployment and a solid foundation for further innovation in frequency-domain adversarial defenses. Declarations Funding No funding. Author Contribution G.E. designed and implemented the experiments, produced the results, and co-wrote the manuscript and Y.B.E. conceived the training methodology, provided scientific guidance throughout the project, analyzed the results, and co-wrote the manuscript. Acknowledgement The author would like to thank Prof. Yosef Ben Ezra for their invaluable guidance, mentorship, and support throughout the course of this research. Appreciation is extended to Holon Institute of Technology for providing access to research materials and scientific literature. Special thanks to Mr. Samuel Hazak for their thoughtful feedback and encouragement during the entire process. Lastly, deep gratitude goes to the author's wife for her unwavering patience and support throughout eight years of academic pursuit. Data Availability The CIFAR-10 dataset used in this study is publicly available from the University of Toronto at https://www.cs.toronto.edu/~kriz/cifar.html. Denoised versions of the dataset generated using the described wavelet-based preprocessing pipeline, along with the corresponding adversarial examples and model checkpoints, are available from the corresponding author upon reasonable request. References Costa, J. C., Roxo, T., Proença, H. & Inácio, P. R. M. How deep learning sees the world: a survey on adversarial attacks & defenses. IEEE Access. 12 , 61113–61136 (2024). Wang, Y. et al. Adversarial attacks and defenses in machine learning-powered networks: A contemporary survey. Preprint at (2023). https://arxiv.org/abs/2303.06302 Ibrahum, A. D. M., Hussain, M. & Hong, J. E. Deep learning adversarial attacks and defenses in autonomous vehicles: a systematic literature review from a safety perspective. Artif Intell. Rev 58 , (2024). Goodfellow, I. J., Shlens, J. & Szegedy, C. Explaining and harnessing adversarial examples. Preprint at (2014). https://arxiv.org/abs/1412.6572 Tramèr, F. et al. Ensemble adversarial training: attacks and defenses. Preprint at (2017). https://arxiv.org/abs/1705.07204 Dziugaite, G. K., Ghahramani, Z. & Roy, D. M. A study of the effect of JPG compression on adversarial images. Preprint at (2016). https://arxiv.org/abs/1608.00853 Xu, W., Evans, D. & Qi, Y. Feature squeezing: detecting adversarial examples in deep neural networks. Preprint at (2017). https://arxiv.org/abs/1704.01155 Papernot, N., McDaniel, P., Wu, X., Jha, S. & Swami, A. Distillation as a defense to adversarial perturbations against deep neural networks. In Proc. IEEE Symp. Secur. Priv. 582–597 (2016). Xie, C., Wu, Y., Maaten, L. V. D., Yuille, A. L. & He, K. Feature denoising for improving adversarial robustness. In Proc. IEEE Conf. Comput. Vis. Pattern Recognit. 501–509 (2019). Zheng, Q. et al. Resisting adversarial examples via wavelet extension and denoising. In SmartCom 204–214 (2021). Sarvar, A. & Amirmazlaghani, M. Defense against adversarial examples based on wavelet domain analysis. Appl. Intell. 53 , 423–439 (2023). Krizhevsky, A. & Hinton, G. Learning multiple layers of features from tiny images. Technical Report, University of Toronto (2009). He, K., Zhang, X., Ren, S. & Sun, J. Deep residual learning for image recognition. In Proc. IEEE Conf. Comput. Vis. Pattern Recognit. 770–778 (2016). Madry, A., Makelov, A., Schmidt, L., Tsipras, D. & Vladu, A. Towards deep learning models resistant to adversarial attacks. Preprint at (2017). https://arxiv.org/abs/1706.06083 Moosavi-Dezfooli, S. M., Fawzi, A. & Frossard, P. DeepFool: A simple and accurate method to fool deep neural networks. In Proc. IEEE Conf. Comput. Vis. Pattern Recognit. 2574–2582 (2016). Dong, Y. et al. Boosting adversarial attacks with momentum. Preprint at (2017). https://arxiv.org/abs/1710.06081v3 Papernot, N. et al. The limitations of deep learning in adversarial settings. In Proc. IEEE Eur. Symp. Secur. Priv. 372–387 (2016). Croce, F. & Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. Preprint at (2020). https://arxiv.org/abs/2003.01690 Mallat, S. A theory for multiresolution signal decomposition: The wavelet representation. IEEE Trans. Pattern Anal. Mach. Intell. 11 , 674–693 (1989). Donoho, D. L. De-noising by soft-thresholding. IEEE Trans. Inf. Theory . 41 , 613–627 (1995). Zhai, J., Shen, W., Singh, I., Wanyama, T. & Gao, Z. A review of the evolution of deep learning architectures and comparison of their performances for histopathologic cancer detection. Procedia Manuf. 46 , 683–689 (2020). Doroslovacki, M. L. On the least asymmetric wavelets. IEEE Trans. Signal. Process. 46 , 1125–1130 (1998). Paszke, A. et al. PyTorch: an imperative style, high-performance deep learning library. In Proc. Adv. Neural Inf. Process. Syst. 32, 8024–8035 (2019). Nicolae, M. I. et al. Adversarial Robust. Toolbox v 1.0.0. Preprint at (2018). https://arxiv.org/abs/1807.01069 Yin, D., Lopes, R. G., Shlens, J., Cubuk, E. D. & Gilmer, J. A Fourier perspective on model robustness in computer vision. In Proc. Adv. Neural Inf. Process. Syst. 32 (2023). Hendrycks, D. & Dietterich, T. Benchmarking neural network robustness to common corruptions and perturbations. Preprint at (2019). https://arxiv.org/abs/1903.12261 Pang, T., Xu, K. & Zhu, J. Mixup inference: better exploiting mixup to defend adversarial attacks. Preprint at (2019). https://arxiv.org/abs/1909.11515 Deng, J. et al. ImageNet: A large-scale hierarchical image database. In Proc. IEEE Conf. Comput. Vis. Pattern Recognit. 248–255 (2009). Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7068197","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":484331401,"identity":"2a18ae13-7efe-4696-9d4b-c1e72abacb0c","order_by":0,"name":"Gal Erez","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA0ElEQVRIiWNgGAWjYFAC5gYGhgogLcHYAOazsRPUAlJ5BqylEayHjZkYLYxtIC0MUGsIaZF3P9j4uHLetsQG6eb2Bww1dgx8hLQYnklsNjy77XZig8xBoMOOJRN2mGFDYptkI0iLRCJQC9sBIrT0P2z/2TgHpuUfEVrkJRLbgEEF1cLYRoQWA4mHzZINx24btwG1zEjsS+YhbEt/8sGPDTW3Zfsl0h98+PDNTk6+vYGALQcgtCMoahgSGBh4CNgBtAVqpD1BlaNgFIyCUTByAQD0i0KEY1cOUAAAAABJRU5ErkJggg==","orcid":"","institution":"Holon Institute of Technology","correspondingAuthor":true,"prefix":"","firstName":"Gal","middleName":"","lastName":"Erez","suffix":""},{"id":484331402,"identity":"defeda36-9ae2-4747-9268-10680d4592f3","order_by":1,"name":"Yosef Ben Ezra","email":"","orcid":"","institution":"Holon Institute of Technology","correspondingAuthor":false,"prefix":"","firstName":"Yosef","middleName":"Ben","lastName":"Ezra","suffix":""}],"badges":[],"createdAt":"2025-07-07 18:53:08","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7068197/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7068197/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":87031391,"identity":"ef2347c0-bffe-48ad-b0ef-62840b2f8732","added_by":"auto","created_at":"2025-07-18 12:51:56","extension":"png","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":607428,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cem\u003eClassification output before and after an adversarial attack [21].\u003c/em\u003e\u003c/p\u003e","description":"","filename":"floatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7068197/v1/887670c3fb6a7f8f9737e375.png"},{"id":87030339,"identity":"66596fe0-b00b-4b71-bf45-500a5b0ead74","added_by":"auto","created_at":"2025-07-18 12:43:56","extension":"png","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":155540,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cem\u003eProposed approach – Wavelet-based denoising as an augmentation step for training.\u003c/em\u003e\u003c/p\u003e","description":"","filename":"floatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-7068197/v1/44d8c00d1cf6d20ada3af79b.png"},{"id":87030349,"identity":"8c1500eb-f999-4ecc-9511-66ab6f2d6a0a","added_by":"auto","created_at":"2025-07-18 12:43:56","extension":"png","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":234011,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cem\u003eExample images from the CIFAR-10 dataset.\u003c/em\u003e\u003c/p\u003e","description":"","filename":"floatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-7068197/v1/c487343365618f4076117b88.png"},{"id":87032438,"identity":"dd59ea20-5a54-4be1-a518-ebeb0d2cf3da","added_by":"auto","created_at":"2025-07-18 12:59:56","extension":"png","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":174559,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cem\u003eVisual comparison of a CIFAR-10 test image under clean, adversarial, and denoised conditions. Rows show the original and denoised versions (top to bottom), while columns represent the clean image and adversarial variants (left to right).\u003c/em\u003e\u003c/p\u003e","description":"","filename":"floatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-7068197/v1/2264508b2fd2532d2d52ca07.png"},{"id":87030342,"identity":"0e66b8bc-709d-46d6-8497-d9a98158df38","added_by":"auto","created_at":"2025-07-18 12:43:56","extension":"png","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":70704,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cem\u003eHeatmap showing top-1 classification accuracy for all models across the evaluated test sets. The highest-performing model for each set is highlighted.\u003c/em\u003e\u003c/p\u003e","description":"","filename":"floatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-7068197/v1/b2a807063e0b827c32f68c2c.png"},{"id":104772110,"identity":"13717999-b7d6-4fed-9f7e-16557765c6b1","added_by":"auto","created_at":"2026-03-17 05:41:41","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":2169432,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7068197/v1/797446b5-7b85-4c37-b1a5-88aea083cf6e.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"A Novel Approach for Defense Against Adversarial Attacks in Image Classification","fulltext":[{"header":"Introduction","content":"\u003cp\u003eDeep neural networks have achieved remarkable performance in image classification tasks across diverse domains, ranging from medical imaging and facial recognition to autonomous driving. However, despite their high accuracy on clean data, these models are highly vulnerable to adversarial examples—carefully crafted perturbations that subtly manipulate input data and cause misclassification while remaining nearly imperceptible to humans [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e] [\u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eWhile image classification is the most widely studied domain, adversarial attacks have also been demonstrated in other fields such as natural language processing, facial recognition, financial transactions and many more [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eThe vulnerability of deep learning models to adversarial attacks poses significant challenges for their deployment in real-world applications, where security and reliability are paramount; for example, in autonomous driving, adversarial perturbations could lead to misclassification of road signs or pedestrians, potentially resulting in accidents [\u003cspan citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eNumerous defense strategies have been proposed in response to these challenges. The most prominent and widely adopted approach is \u003cb\u003eadversarial training\u003c/b\u003e, where models are trained using clean and adversarial images to enhance robustness. This method improves performance against specific threat models and has been developed into variants like \u003cb\u003eEnsemble Adversarial Training\u003c/b\u003e, which incorporates diverse adversarial sources during training [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e] [\u003cspan citationid=\"CR5\" class=\"CitationRef\"\u003e5\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eAnother popular category of defenses involves input preprocessing techniques that aim to mitigate adversarial perturbations before classification. \u003cb\u003eJPEG compression\u003c/b\u003e is a common approach that reduces high-frequency noise potentially introduced by adversarial perturbations [\u003cspan citationid=\"CR6\" class=\"CitationRef\"\u003e6\u003c/span\u003e]. \u003cb\u003eFeature squeezing\u003c/b\u003e reduces the input’s degrees of freedom by applying bit-depth reduction and smoothing techniques, thereby limiting adversarial space [\u003cspan citationid=\"CR7\" class=\"CitationRef\"\u003e7\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eSome defenses modify the internal structure or training process of models. \u003cb\u003eDefensive distillation\u003c/b\u003e, for example, uses a two-stage training process involving a \"teacher\" and a \"student\" network, where the student learns to mimic softened outputs produced by the teacher, aiming to smooth the decision boundaries [\u003cspan citationid=\"CR8\" class=\"CitationRef\"\u003e8\u003c/span\u003e]. Other approaches, like \u003cb\u003efeature denoising\u003c/b\u003e, introduce architectural changes that suppress adversarial gradients by learning denoising filters within the network [\u003cspan citationid=\"CR9\" class=\"CitationRef\"\u003e9\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eMore recently, wavelet-based methods have emerged as promising defense strategies. One such approach, \u003cb\u003eWavelet Extension and Denoising (WED)\u003c/b\u003e, augments the model’s input by concatenating the original image with a wavelet-decomposed low-frequency version, and later applies wavelet-based denoising at inference to suppress potential perturbations [\u003cspan citationid=\"CR10\" class=\"CitationRef\"\u003e10\u003c/span\u003e]. Another dual-stage framework detects adversarial examples and reconstructs them using \u003cb\u003ewavelet domain\u003c/b\u003e features to restore clean inputs before classification [\u003cspan citationid=\"CR11\" class=\"CitationRef\"\u003e11\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eWhile existing defense strategies have demonstrated varying degrees of success, they often suffer from limitations such as high computational overhead, attack-specific optimisation, or degradation in clean data accuracy [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e]. These shortcomings highlight a broader challenge: developing a simple, effective, attack-agnostic defense that does not require adversarial examples during training. This motivated our investigation into a lightweight preprocessing-based approach and led to two central research questions: (1) Can such a method improve adversarial robustness without significantly harming clean data performance? and (2) Can it generalise across a wide range of adversarial attack strategies?\u003c/p\u003e\u003cp\u003eOur approach was motivated by experiments showing that fusing the clean image’s high-frequency details with the adversarial image’s low-frequency components significantly reduced misclassification. This suggests that adversarial perturbations mainly affect high-frequency regions, while low-frequency components preserve the image’s core structure.\u003c/p\u003e\u003cp\u003eTo test this hypothesis, we conducted extensive experiments on the \u003cb\u003eCIFAR-10\u003c/b\u003e dataset [\u003cspan citationid=\"CR12\" class=\"CitationRef\"\u003e12\u003c/span\u003e], consisting of 50,000 training and 10,000 test images across 10 classes. The classification model used throughout was a \u003cb\u003eResNet-18\u003c/b\u003e architecture [\u003cspan citationid=\"CR13\" class=\"CitationRef\"\u003e13\u003c/span\u003e], trained from scratch. We benchmarked our approach against several widely-used adversarial attacks: \u003cb\u003eFast Gradient Sign Method (FGSM)\u003c/b\u003e [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e], \u003cb\u003eProjected Gradient Descent (PGD)\u003c/b\u003e [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e], \u003cb\u003eDeepFool\u003c/b\u003e [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e], \u003cb\u003eMomentum Iterative FGSM (MI-FGSM)\u003c/b\u003e [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e], \u003cb\u003eJacobian-based Salience Maps Attack (JSMA)\u003c/b\u003e [\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e], and \u003cb\u003eAuto-Attack\u003c/b\u003e [\u003cspan citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e]. To assess robustness across signal representations, we trained three different models using three wavelet families: \u003cb\u003eHaar\u003c/b\u003e, \u003cb\u003eDaubechies-4 (db4)\u003c/b\u003e, and \u003cb\u003eSymlet-4 (sym4)\u003c/b\u003e [\u003cspan citationid=\"CR19\" class=\"CitationRef\"\u003e19\u003c/span\u003e] [\u003cspan citationid=\"CR20\" class=\"CitationRef\"\u003e20\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eThe proposed defense strategy focuses on training a model on a clean dataset augmented with low-frequency components derived from wavelet decomposition. The components contain the essential structural information of the images, which helps the model generalise better. The key innovation is that this method does not require generating adversarial examples during training; instead, we use the data already available and used for training. To evaluate the denoising strategy further, we also applied it to adversarial examples generated by the attacks mentioned above as a preprocessing step before classification.\u003c/p\u003e\u003cp\u003eThe remaining sections of this paper are organised as follows: the Methods section, which describes the proposed wavelet-based approach and the experimental setup. The Results section presents the experimental findings, including comparisons of the wavelet-based defense against various adversarial attacks. The Discussion section interprets the results and their implications for future research and presents conclusions drawn from the study. The rest of the paper includes the data availability, references, acknowledgements, and author contributions.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"},{"header":"Proposed Approach","content":"\u003cp\u003eWhile existing defense strategies typically rely on adversarial training or input preprocessing at inference [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e], our approach introduces a fundamentally different and novel approach: instead of modifying the model architecture or training on adversarial examples, we augment the training data itself using a wavelet-based denoising method. This strategy eliminates the need for adversarial examples, offering a lightweight, attack-agnostic defense mechanism.\u003c/p\u003e\u003cp\u003eThe conceptual foundation of this approach was inspired by empirical observations made during early experimentation. We applied wavelet decomposition to clean and adversarial versions of the same image. We reconstructed a hybrid image by fusing the clean image’s high-frequency (detail) coefficients with the adversarial image’s low-frequency (approximation) components. Feeding these fused images into a classifier consistently reduced misclassification rates. This outcome led to the hypothesis that adversarial perturbations primarily reside in the high-frequency components of the image. In contrast, the low-frequency components retain the structural content necessary for accurate classification. This insight aligns with the inherent design of many adversarial attacks: to remain imperceptible to human vision, they tend to manipulate fine-grained, high-frequency pixel patterns, leaving the coarse structure largely untouched.\u003c/p\u003e\u003cp\u003eBased on this hypothesis, we designed a wavelet-based denoising method that reconstructs each image using only its approximation coefficients, effectively discarding all high-frequency detail coefficients during inverse transformation. Initial tests using this approach showed that the resulting denoised images, when classified, produced significantly improved robustness to adversarial examples. In some cases, the classifier even outperformed its predictions on the original clean images. These results demonstrated that complete suppression of detail coefficients was sufficient to mitigate adversarial effects, eliminating the need for a dynamic system that computes adaptive thresholds per image. This simplification validated the hypothesis and enabled a streamlined, deterministic denoising process.\u003c/p\u003e\u003cp\u003eFigure \u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003e illustrates the denoising process used to augment the training data. Each clean image undergoes a two-level discrete wavelet transform (DWT). The resulting detail coefficients (horizontal, vertical, and diagonal components) are entirely suppressed, while the approximation coefficients are retained. The image is then reconstructed using the inverse DWT to produce a denoised version. This denoised image is used alongside the original clean image during training, doubling the dataset and reinforcing the model’s exposure to low-frequency representations.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThis augmentation was consistently applied to all training images — every input passed to the model was either clean or denoised. Additionally, during evaluation, the same denoising pipeline was used as a preprocessing step for adversarial examples generated via several adversarial attacks, allowing us to assess the method's effectiveness as both a training augmentation and a test-time defense.\u003c/p\u003e\u003cp\u003eDataset and Preprocessing\u003c/p\u003e\u003cp\u003eAll experiments in this study were conducted using the CIFAR-10 dataset [\u003cspan citationid=\"CR12\" class=\"CitationRef\"\u003e12\u003c/span\u003e], which comprises 60,000 colour images of size 32×32×3, evenly distributed across 10 mutually exclusive classes. The dataset is split into 50,000 training images and 10,000 test images and is widely used for benchmarking image classification models and evaluating robustness to adversarial attacks.\u003c/p\u003e\u003cp\u003eFor model training and evaluation, the original (clean) CIFAR-10 dataset was obtained via Torchvision, a Python library that provides tools for computer vision tasks. Standard data augmentation techniques were applied during training, including random cropping with 4-pixel padding, horizontal flipping and normalisation. For evaluation, only normalisation was applied.\u003c/p\u003e\u003cp\u003eTo generate the denoised counterparts used for augmentation and evaluation, each clean image was saved to disk in PNG format and processed offline. The denoising process (detailed in the next section) was applied to each image. The resulting denoised images were saved as PNG files and reloaded for training and inference alongside the original clean images.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eWavelet-Based Denoising\u003c/p\u003e\u003cp\u003eThe denoising method was implemented using MATLAB R2022a’s Wavelet Toolbox and applied independently to each image in the dataset. The objective was to remove high-frequency components (detail coefficients) while preserving the structural content of the image via its low-frequency approximation components. This process supported the training and evaluation strategy described earlier and was applied offline before loading the images into the deep learning pipeline.\u003c/p\u003e\u003cp\u003eThree wavelet families were used for decomposition and reconstruction: \u003cb\u003eHaar\u003c/b\u003e, \u003cb\u003eDaubechies-4\u003c/b\u003e (\u003cb\u003eDB4\u003c/b\u003e), and \u003cb\u003eSymlet-4\u003c/b\u003e (\u003cb\u003eSYM4\u003c/b\u003e). Haar was selected as a simple and commonly used baseline in image processing due to its fast computation and intuitive structure. DB4 and SYM4 were chosen based on prior research demonstrating their superior performance in image denoising, compression, and signal representation tasks [\u003cspan citationid=\"CR22\" class=\"CitationRef\"\u003e22\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eThe method consists of the following steps:\u003c/p\u003e\u003cp\u003e1. \u003cb\u003eWavelet Decomposition\u003c/b\u003e: Each RGB image was decomposed using a two-level discrete wavelet transform (DWT) with the selected wavelet basis.\u003c/p\u003e\u003cp\u003e2. \u003cb\u003eDetail Coefficient Suppression\u003c/b\u003e: The detail coefficients (horizontal, vertical, and diagonal) at both decomposition levels were suppressed across all three color channels.\u003c/p\u003e\u003cp\u003e3. \u003cb\u003eImage Reconstruction\u003c/b\u003e: The image was reconstructed using the untouched approximation components and the suppressed detail coefficients, using the inverse DWT.\u003c/p\u003e\u003cp\u003e4. \u003cb\u003eOutput\u003c/b\u003e: The denoised image was saved to disk in PNG format.\u003c/p\u003e\u003cp\u003eAll processing was performed per image and preserved the original RGB colour format. No grayscale conversion was applied at any stage. The resulting denoised datasets (one for each wavelet family) were later used alongside the clean dataset during training and evaluation, as described in the preceding and following sections.\u003c/p\u003e\u003cp\u003eModel Architecture and Training\u003c/p\u003e\u003cp\u003eAll models were implemented and trained using \u003cb\u003ePyTorch\u003c/b\u003e [\u003cspan citationid=\"CR23\" class=\"CitationRef\"\u003e23\u003c/span\u003e], based on a ResNet-18 architecture [\u003cspan citationid=\"CR13\" class=\"CitationRef\"\u003e13\u003c/span\u003e]. The training script was modified to support joint training on clean and wavelet-denoised images.\u003c/p\u003e\u003cp\u003eUsing its corresponding denoised dataset, a separate model was trained from scratch for each wavelet family (Haar, DB4, and SYM4). Each model's training set consisted of the original 50,000 clean images concatenated with their denoised counterparts, resulting in \u003cb\u003e100,000 images\u003c/b\u003e per training run. Similarly, the evaluation set included the 10,000 clean test images and their denoised versions, totalling \u003cb\u003e20,000 test images\u003c/b\u003e per model.\u003c/p\u003e\u003cp\u003eAll models were trained using the \u003cb\u003eCross-Entropy Loss\u003c/b\u003e function. Optimization was performed using \u003cb\u003eStochastic Gradient Descent (SGD)\u003c/b\u003e with an \u003cb\u003einitial learning rate of 0.1\u003c/b\u003e, \u003cb\u003emomentum of 0.9\u003c/b\u003e, and \u003cb\u003eweight decay of\u003c/b\u003e \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:5\\bullet\\:1{0}^{-4}\\)\u003c/span\u003e\u003c/span\u003e. The learning rate was scheduled using \u003cb\u003eCosine Annealing\u003c/b\u003e with \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{T}_{max}=200\\)\u003c/span\u003e\u003c/span\u003e. Training was conducted for \u003cb\u003e200 epochs\u003c/b\u003e with a batch size of \u003cb\u003e128\u003c/b\u003e for training and \u003cb\u003e100\u003c/b\u003e for testing.\u003c/p\u003e\u003cp\u003eModel checkpoints were saved whenever an improvement in test set accuracy was observed. All models were initialised with random weights and trained entirely from scratch (no pretrained parameters were used).\u003c/p\u003e\u003cp\u003eAdversarial Attacks\u003c/p\u003e\u003cp\u003eTo evaluate the robustness of the proposed models, adversarial examples were generated using the \u003cb\u003eAdversarial Robustness Toolbox (ART)\u003c/b\u003e [\u003cspan citationid=\"CR24\" class=\"CitationRef\"\u003e24\u003c/span\u003e]. They targeted a surrogate ResNet-18 model trained solely on the clean CIFAR-10 dataset. The model was wrapped using ART’s PyTorchClassifier interface, allowing compatibility with various attack implementations.\u003c/p\u003e\u003cp\u003eSix widely used attack methods were employed:\u003c/p\u003e\u003cp\u003e● \u003cb\u003eFast Gradient Sign Method (FGSM)\u003c/b\u003e [ATK-FGSM]: Applied with a perturbation magnitude coefficient of \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:ϵ=0.01\\)\u003c/span\u003e\u003c/span\u003e.\u003c/p\u003e\u003cp\u003e● \u003cb\u003eProjected Gradient Descent (PGD)\u003c/b\u003e [ATK-PGD]: Configured with \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:ϵ=0.01\\)\u003c/span\u003e\u003c/span\u003e, step size \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\alpha\\:=0.0025\\)\u003c/span\u003e\u003c/span\u003e, and 20 iterations.\u003c/p\u003e\u003cp\u003e● \u003cb\u003eDeepFool\u003c/b\u003e [ATK-DF]: Used with an overshoot of \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:ϵ={10}^{-6}\\)\u003c/span\u003e\u003c/span\u003e, up to 50 iterations, and 10 class gradients.\u003c/p\u003e\u003cp\u003e● \u003cb\u003eMomentum Iterative FGSM (MI-FGSM)\u003c/b\u003e [ATK-MIFGSM]: Executed with \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{l}_{\\infty\\:}\\)\u003c/span\u003e\u003c/span\u003e-norm, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:ϵ=0.01\\)\u003c/span\u003e\u003c/span\u003e, step size \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\alpha\\:=0.0025\\)\u003c/span\u003e\u003c/span\u003e, and 20 iterations.\u003c/p\u003e\u003cp\u003e● \u003cb\u003eJacobian-based Saliency Map Attack (JSMA)\u003c/b\u003e [ATK-JSMA]: Configured with the perturbation magnitude applied to each selected feature \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\theta\\:=\\:0.05\\)\u003c/span\u003e\u003c/span\u003e and maximum fraction of features being perturbed \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\gamma\\:=\\:0.1\\)\u003c/span\u003e\u003c/span\u003e.\u003c/p\u003e\u003cp\u003e● \u003cb\u003eAutoAttack\u003c/b\u003e [ATK-AA]: Applied under the \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{l}_{\\infty\\:}\\)\u003c/span\u003e\u003c/span\u003e-norm with \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:ϵ=\\:0.03\\)\u003c/span\u003e\u003c/span\u003e and step size \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\alpha\\:=0.01\\)\u003c/span\u003e\u003c/span\u003e.\u003c/p\u003e\u003cp\u003eAll adversarial examples were generated using ART’s native routines, which internally manage normalisation, clipping, and batch handling based on the model’s configuration. The attacks were executed in batch mode, with parameters and preprocessing handled automatically by ART.\u003c/p\u003e\u003cp\u003eFollowing generation, the adversarial images were saved in PNG format and processed offline using the same wavelet-based denoising method described earlier. The resulting denoised adversarial examples were evaluated alongside the original and clean test images.\u003c/p\u003e\u003cp\u003eThis attack setup ensured that all perturbations were created independently of the wavelet-trained models, thus representing a realistic threat against a surrogate model.\u003c/p\u003e\u003cp\u003ePerformance Metrics\u003c/p\u003e\u003cp\u003eEach trained model was evaluated across various sets to assess both clean accuracy and robustness to adversarial perturbations and their denoised counterparts. These included the original CIFAR-10 \u003cb\u003etest set\u003c/b\u003e [\u003cspan citationid=\"CR12\" class=\"CitationRef\"\u003e12\u003c/span\u003e], its \u003cb\u003edenoised\u003c/b\u003e version, adversarial examples generated by \u003cb\u003eFGSM\u003c/b\u003e [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e], \u003cb\u003ePGD\u003c/b\u003e [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e], \u003cb\u003eDeepFool\u003c/b\u003e [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e], \u003cb\u003eMI-FGSM\u003c/b\u003e [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e], \u003cb\u003eJSMA\u003c/b\u003e [\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e], and \u003cb\u003eAutoAttack\u003c/b\u003e [\u003cspan citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e], and the \u003cb\u003edenoised\u003c/b\u003e versions of all attacks.\u003c/p\u003e\u003cp\u003e\u003cb\u003eTop-1 classification accuracy\u003c/b\u003e was used as the primary evaluation metric across all conditions. No ensemble strategies, input randomisation, or stochastic inference techniques were applied. All reported accuracy scores are based on a single evaluation run per model, without statistical averaging or bootstrapping.\u003c/p\u003e\u003cp\u003eThis controlled and systematic setup enabled consistent comparison of model behaviour across varying input scenarios, isolating the impact of both the training augmentation and the denoising defense applied during inference.\u003c/p\u003e\u003cp\u003eComputational Resources\u003c/p\u003e\u003cp\u003eAll experiments were conducted locally, on a personal Windows 10 machine equipped with an \u003cb\u003eNVIDIA GeForce RTX 2080 SUPER GPU\u003c/b\u003e. The deep learning pipeline was implemented in \u003cb\u003ePython 3.12.4\u003c/b\u003e, and denoising was performed in \u003cb\u003eMATLAB R2022a\u003c/b\u003e using the Wavelet Toolbox.\u003c/p\u003e\u003cp\u003eTraining of each ResNet18 model on the combined clean and denoised dataset (100,000 training images + 20,000 test images) required approximately \u003cb\u003e4 hours\u003c/b\u003e. All fourteen sets were evaluated in \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\sim\\)\u003c/span\u003e\u003c/span\u003e\u003cb\u003e1–2 minutes\u003c/b\u003e per model, as all images were preloaded into memory prior to inference. No distributed computing or cluster-based acceleration was used in this study.\u003c/p\u003e\u003cp\u003eThis local setup demonstrates that the proposed wavelet-based defense strategy is effective, computationally practical, and accessible.\u003c/p\u003e\u003cp\u003eLLM Usage Disclosure\u003c/p\u003e\u003cp\u003ePortions of the manuscript were formatted and edited for clarity using OpenAI’s ChatGPT. The language model did not generate content, experimental design, data analysis, or interpretation. The authors conceived, implemented, and validated all scientific content.\u003c/p\u003e"},{"header":"Results","content":"\u003cp\u003eVisual Comparison of Perturbations and Denoising\u003c/p\u003e\u003cp\u003eIn Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003e, we present a visual comparison to illustrate the impact of adversarial perturbations and the effectiveness of the proposed wavelet-based denoising method. The top row displays the original clean image and its adversarial variants generated by FGSM [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e], PGD [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e], DeepFool [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e], MI-FGSM [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e], JSMA [\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e], and AutoAttack [\u003cspan citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e]. Subsequent rows show the corresponding denoised versions produced using the Haar, DB4, and SYM4 wavelet families.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eAcross attacks, adversarial perturbations typically manifest as subtle high-frequency distortions that are visually imperceptible but sufficient to alter model predictions. In some cases (such as JSMA or AutoAttack), perturbations appear more noticeable, likely due to the chosen attack parameters and the small resolution of CIFAR-10 images (32\u0026times;32\u0026times;3), where even minor pixel-level changes are more apparent than they would be in higher-resolution images. Notably, the denoised images across all wavelet types suppress these fine-grained perturbations while preserving the overall structure and semantics of the original image.\u003c/p\u003e\u003cp\u003eThis qualitative comparison visually supports our hypothesis that adversarial perturbations primarily reside in the high-frequency components of images. By retaining only the low-frequency (approximation) elements, the denoising process effectively reduces adversarial noise without erasing essential class-relevant content. These insights help contextualise the quantitative findings presented in the following sections.\u003c/p\u003e\u003cp\u003eOverall Performance Comparison\u003c/p\u003e\u003cp\u003eFigure \u003cspan refid=\"Fig5\" class=\"InternalRef\"\u003e5\u003c/span\u003e presents a heatmap summarising the top-1 classification accuracy across all test conditions for the baseline model and the three wavelet-trained models.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eOur findings consistently show that wavelet-based denoising is most effective when integrated into the training process, rather than used as a preprocessing defense at inference time. While standalone denoising can improve robustness in some cases, particularly on surrogate-generated adversarial inputs, its inconsistent results limit its standalone utility, especially on clean data.\u003c/p\u003e\u003cp\u003eThe following sub-sections explore the approach\u0026rsquo;s effect on clean data, adversarial robustness, and the impact of wavelet choice in more detail.\u003c/p\u003e\u003cp\u003eEffect on Clean Data\u003c/p\u003e\u003cp\u003eWe examine model performance on clean and denoised versions of the CIFAR-10 test set. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig5\" class=\"InternalRef\"\u003e5\u003c/span\u003e, the baseline ResNet-18 model achieves \u003cb\u003e95.47%\u003c/b\u003e top-1 accuracy on clean inputs. However, its accuracy drops sharply to \u003cb\u003e66.8%\u003c/b\u003e on denoised clean images, indicating that applying wavelet denoising as a preprocessing step removes critical high-frequency features needed for classification without training the model accordingly.\u003c/p\u003e\u003cp\u003eIn contrast, all models trained with clean and denoised images maintain high accuracy on both input types. Their clean accuracy remains in the \u003cb\u003e95.03\u0026ndash;95.14%\u003c/b\u003e range, and their denoised accuracy stays above \u003cb\u003e93.5%\u003c/b\u003e. This shows that training with wavelet-denoised data encourages reliance on robust, low-frequency features and structural patterns, rather than fragile fine-grained details.\u003c/p\u003e\u003cp\u003eRobustness Against Adversarial Attacks\u003c/p\u003e\u003cp\u003eWe now assess the models' performance under adversarial perturbations generated using six attack methods. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig5\" class=\"InternalRef\"\u003e5\u003c/span\u003e, the baseline ResNet-18 model, trained solely on clean data, suffers severe accuracy degradation across all attacks. For example, top-1 accuracy drops from \u003cb\u003e95.47%\u003c/b\u003e (clean) to \u003cb\u003e58.87%\u003c/b\u003e under FGSM, \u003cb\u003e7.24%\u003c/b\u003e under PGD, and \u003cb\u003e21.64%\u003c/b\u003e under DeepFool, highlighting the model\u0026rsquo;s vulnerability.\u003c/p\u003e\u003cp\u003eIn contrast, the wavelet-trained models demonstrate significantly enhanced robustness. When evaluated directly on adversarial examples (without additional preprocessing), they achieve:\u003c/p\u003e\u003cp\u003e● FGSM: 76.67\u0026ndash;81.5%\u003c/p\u003e\u003cp\u003e● PGD: 63.24\u0026ndash;78.04%\u003c/p\u003e\u003cp\u003e● DeepFool: 86.26\u0026ndash;90.03%\u003c/p\u003e\u003cp\u003e● MI-FGSM: 57.74\u0026ndash;73.88%\u003c/p\u003e\u003cp\u003e● JSMA: 92.0\u0026ndash;92.54%\u003c/p\u003e\u003cp\u003e● AutoAttack: 34.86\u0026ndash;51.31%\u003c/p\u003e\u003cp\u003eThese results consistently improve over the baseline across all attacks, particularly for strong gradient-based attacks like PGD and AutoAttack.\u003c/p\u003e\u003cp\u003eApplying the denoising method as a preprocessing step to the adversarial inputs yields mixed outcomes. For weaker attacks such as FGSM and PGD, accuracy improves modestly (e.g., up to \u003cb\u003e82.49%\u003c/b\u003e for FGSM and \u003cb\u003e81.21%\u003c/b\u003e for PGD). However, for DeepFool and JSMA, the denoised inputs slightly reduce performance compared to their non-denoised adversarial counterparts. The most notable gains from preprocessing occur with AutoAttack, where denoising improves accuracy by \u003cb\u003e6\u0026ndash;12%\u003c/b\u003e across models.\u003c/p\u003e\u003cp\u003eThese findings indicate that while the denoising method is effective when incorporated into training, its utility as a standalone preprocessing defense is attack-dependent. The most substantial benefit arises from the joint training procedure, which encourages models to learn representations resilient to high-frequency adversarial noise.\u003c/p\u003e\u003cp\u003eEffect of Wavelet Choice\u003c/p\u003e\u003cp\u003eWe conclude by analysing the impact of the wavelet family used during denoising and model training. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig5\" class=\"InternalRef\"\u003e5\u003c/span\u003e, all three wavelet-trained models\u0026mdash;Haar, DB4, and SYM4\u0026mdash;outperform the baseline across all adversarial scenarios, though small performance differences emerge depending on the wavelet used.\u003c/p\u003e\u003cp\u003eOn the clean test set, performance is nearly identical across wavelets, with accuracies ranging from \u003cb\u003e95.03\u0026ndash;95.14%\u003c/b\u003e. Similarly, when evaluated on denoised clean images, all three models maintain high accuracy (\u003cb\u003e93.54\u0026ndash;94.09%\u003c/b\u003e), indicating that the denoising process across wavelet types preserves class-relevant information and semantic structure.\u003c/p\u003e\u003cp\u003eAcross adversarial conditions, however, the model trained with Haar-based denoised images consistently achieves the highest accuracy. For instance:\u003c/p\u003e\u003cp\u003e● On raw FGSM, Haar reaches \u003cb\u003e81.5%\u003c/b\u003e, outperforming DB4 and SYM4 by \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\sim\\)\u003c/span\u003e\u003c/span\u003e\u003cb\u003e5%\u003c/b\u003e.\u003c/p\u003e\u003cp\u003e● On denoised FGSM, Haar scores \u003cb\u003e82.49%\u003c/b\u003e, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\sim\\)\u003c/span\u003e\u003c/span\u003e\u003cb\u003e5\u0026ndash;6%\u003c/b\u003e higher than the others.\u003c/p\u003e\u003cp\u003e● On raw PGD, Haar achieves \u003cb\u003e78.04%\u003c/b\u003e, surpassing DB4 and SYM4 by \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\sim\\)\u003c/span\u003e\u003c/span\u003e\u003cb\u003e15%\u003c/b\u003e.\u003c/p\u003e\u003cp\u003e● On denoised PGD, it attains \u003cb\u003e81.21%\u003c/b\u003e, again leading by a significant margin.\u003c/p\u003e\u003cp\u003e● For DeepFool, Haar also performs best, reaching \u003cb\u003e90.03%\u003c/b\u003e (raw) and \u003cb\u003e88.92%\u003c/b\u003e (denoised), with 3\u0026ndash;4% margins over the other models.\u003c/p\u003e\u003cp\u003eThese results suggest that while all three wavelet families contribute to enhanced robustness, Haar-based training appears most effective overall. This may stem from Haar\u0026rsquo;s compact support and sharp localisation in both spatial and frequency domains, which could better preserve essential image structures while discarding fine-grained perturbations.\u003c/p\u003e"},{"header":"Discussion","content":"\u003cp\u003eOur results demonstrate that wavelet-based denoising can significantly enhance the robustness of image classification models against adversarial attacks without requiring access to adversarial examples during training. By augmenting clean training data using the proposed approach, our models consistently outperformed the baseline across a wide range of test conditions. This robustness held across three wavelet families (Haar, DB4, SYM4) and six white-box attacks, including gradient-based (FGSM [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e], PGD [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e], MI-FGSM [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e]), optimisation-based (DeepFool [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e], AutoAttack [\u003cspan citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e]), and saliency-based methods (JSMA [\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e]).\u003c/p\u003e\u003cp\u003eThese findings support the hypothesis that adversarial perturbations predominantly affect the high-frequency components of images, a notion corroborated by prior work in adversarial robustness and frequency analysis [\u003cspan citationid=\"CR9\" class=\"CitationRef\"\u003e9\u003c/span\u003e] [\u003cspan citationid=\"CR25\" class=\"CitationRef\"\u003e25\u003c/span\u003e]. The discrete wavelet transform (DWT) provides a structured and interpretable means to isolate and suppress these components. Discarding all detail coefficients across multiple decomposition levels, our approach filters out much of the adversarial signal while preserving the semantic content embedded in the low-frequency approximation [\u003cspan citationid=\"CR19\" class=\"CitationRef\"\u003e19\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eInterestingly, the models trained with denoised data improved robustness to adversarial inputs and maintained strong performance on clean test images (Fig.\u0026nbsp;\u003cspan refid=\"Fig5\" class=\"InternalRef\"\u003e5\u003c/span\u003e). This indicates that wavelet-based denoising does more than simply smooth inputs \u0026ndash; it may act as a form of regularisation that encourages the model to rely on stable, low-frequency features, thereby improving generalisation. Similar effects have been reported in works on robust optimisation and frequency-based input transformations [\u003cspan citationid=\"CR26\" class=\"CitationRef\"\u003e26\u003c/span\u003e] [\u003cspan citationid=\"CR27\" class=\"CitationRef\"\u003e27\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eCompared to adversarial training [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e] (a dominant yet computationally intensive defense strategy), our method is both attack-agnostic and model-agnostic, requiring no gradient computations or attack generation during training. Adversarial training often leads to overfitting against specific attack types or norms, whereas our models showed resilience across multiple, diverse attacks, including stronger composite attacks like AutoAttack. Notably, this robustness was achieved without compromising accuracy on clean data - a standard tradeoff in many defense strategies.\u003c/p\u003e\u003cp\u003eThat said, our work has several limitations. First, we evaluated performance on CIFAR-10 [\u003cspan citationid=\"CR12\" class=\"CitationRef\"\u003e12\u003c/span\u003e] using a ResNet18 [\u003cspan citationid=\"CR13\" class=\"CitationRef\"\u003e13\u003c/span\u003e] backbone. While standard, these may not capture the full complexity of high-resolution datasets or deeper architectures. Second, the denoising method employed a fixed, non-adaptive suppression strategy. Future work could explore data-driven or learnable thresholding schemes, potentially adapting wavelet coefficients to local structure or training dynamics. Additionally, our evaluation focused on white-box attacks generated from a fixed baseline model. A broader assessment remains an important direction, including black-box, adaptive, or transfer-based attacks.\u003c/p\u003e\u003cp\u003eThis work opens several avenues for future research: extending the methodology to larger datasets (e.g., ImageNet [\u003cspan citationid=\"CR28\" class=\"CitationRef\"\u003e28\u003c/span\u003e]), combining wavelet-based preprocessing with adversarial training, or integrating it into certified defense frameworks, to name a few. Moreover, incorporating learned representations in the wavelet domain (e.g., scattering transforms, sparse coding, or hybrid frequency-spatial defenses) may offer deeper theoretical grounding and improved performance.\u003c/p\u003e\u003cp\u003eIn conclusion, wavelet-based denoising emerges as a simple yet effective strategy for adversarial defense. It is \u003cb\u003elightweight, attack-agnostic, and generalizable\u003c/b\u003e, offering robustness gains without sacrificing clean accuracy or introducing complex training procedures. These properties make it a promising candidate for real-world deployment and a solid foundation for further innovation in frequency-domain adversarial defenses.\u003c/p\u003e"},{"header":"Declarations","content":"\u003ch2\u003eFunding\u003c/h2\u003e\u003cp\u003eNo funding.\u003c/p\u003e\u003ch2\u003eAuthor Contribution\u003c/h2\u003e\u003cp\u003eG.E. designed and implemented the experiments, produced the results, and co-wrote the manuscript and Y.B.E. conceived the training methodology, provided scientific guidance throughout the project, analyzed the results, and co-wrote the manuscript.\u003c/p\u003e\u003ch2\u003eAcknowledgement\u003c/h2\u003e\u003cp\u003eThe author would like to thank Prof. Yosef Ben Ezra for their invaluable guidance, mentorship, and support throughout the course of this research. Appreciation is extended to Holon Institute of Technology for providing access to research materials and scientific literature. Special thanks to Mr. Samuel Hazak for their thoughtful feedback and encouragement during the entire process. Lastly, deep gratitude goes to the author's wife for her unwavering patience and support throughout eight years of academic pursuit.\u003c/p\u003e\u003ch2\u003eData Availability\u003c/h2\u003e\u003cp\u003eThe CIFAR-10 dataset used in this study is publicly available from the University of Toronto at https://www.cs.toronto.edu/~kriz/cifar.html. Denoised versions of the dataset generated using the described wavelet-based preprocessing pipeline, along with the corresponding adversarial examples and model checkpoints, are available from the corresponding author upon reasonable request.\u003c/p\u003e"},{"header":"References","content":"\u003col\u003e\u003cli\u003e\u003cspan\u003eCosta, J. C., Roxo, T., Proen\u0026ccedil;a, H. \u0026amp; In\u0026aacute;cio, P. R. M. How deep learning sees the world: a survey on adversarial attacks \u0026amp; defenses. \u003cem\u003eIEEE Access.\u003c/em\u003e \u003cb\u003e12\u003c/b\u003e, 61113\u0026ndash;61136 (2024).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eWang, Y. et al. Adversarial attacks and defenses in machine learning-powered networks: A contemporary survey. Preprint at (2023). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/2303.06302\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/2303.06302\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eIbrahum, A. D. M., Hussain, M. \u0026amp; Hong, J. E. Deep learning adversarial attacks and defenses in autonomous vehicles: a systematic literature review from a safety perspective. \u003cem\u003eArtif Intell. Rev\u003c/em\u003e \u003cb\u003e58\u003c/b\u003e, (2024).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eGoodfellow, I. J., Shlens, J. \u0026amp; Szegedy, C. Explaining and harnessing adversarial examples. Preprint at (2014). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/1412.6572\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/1412.6572\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eTram\u0026egrave;r, F. et al. Ensemble adversarial training: attacks and defenses. Preprint at (2017). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/1705.07204\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/1705.07204\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eDziugaite, G. K., Ghahramani, Z. \u0026amp; Roy, D. M. A study of the effect of JPG compression on adversarial images. Preprint at (2016). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/1608.00853\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/1608.00853\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eXu, W., Evans, D. \u0026amp; Qi, Y. Feature squeezing: detecting adversarial examples in deep neural networks. Preprint at (2017). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/1704.01155\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/1704.01155\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003ePapernot, N., McDaniel, P., Wu, X., Jha, S. \u0026amp; Swami, A. Distillation as a defense to adversarial perturbations against deep neural networks. In \u003cem\u003eProc. IEEE Symp. Secur. Priv.\u003c/em\u003e 582\u0026ndash;597 (2016).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eXie, C., Wu, Y., Maaten, L. V. D., Yuille, A. L. \u0026amp; He, K. Feature denoising for improving adversarial robustness. In \u003cem\u003eProc. IEEE Conf. Comput. Vis. Pattern Recognit.\u003c/em\u003e 501\u0026ndash;509 (2019).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eZheng, Q. et al. Resisting adversarial examples via wavelet extension and denoising. In \u003cem\u003eSmartCom\u003c/em\u003e 204\u0026ndash;214 (2021).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eSarvar, A. \u0026amp; Amirmazlaghani, M. Defense against adversarial examples based on wavelet domain analysis. \u003cem\u003eAppl. Intell.\u003c/em\u003e \u003cb\u003e53\u003c/b\u003e, 423\u0026ndash;439 (2023).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eKrizhevsky, A. \u0026amp; Hinton, G. Learning multiple layers of features from tiny images. Technical Report, University of Toronto (2009).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eHe, K., Zhang, X., Ren, S. \u0026amp; Sun, J. Deep residual learning for image recognition. In \u003cem\u003eProc. IEEE Conf. Comput. Vis. Pattern Recognit.\u003c/em\u003e 770\u0026ndash;778 (2016).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eMadry, A., Makelov, A., Schmidt, L., Tsipras, D. \u0026amp; Vladu, A. Towards deep learning models resistant to adversarial attacks. Preprint at (2017). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/1706.06083\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/1706.06083\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eMoosavi-Dezfooli, S. M., Fawzi, A. \u0026amp; Frossard, P. DeepFool: A simple and accurate method to fool deep neural networks. In \u003cem\u003eProc. IEEE Conf. Comput. Vis. Pattern Recognit.\u003c/em\u003e 2574\u0026ndash;2582 (2016).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eDong, Y. et al. Boosting adversarial attacks with momentum. Preprint at (2017). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/1710.06081v3\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/1710.06081v3\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003ePapernot, N. et al. The limitations of deep learning in adversarial settings. In \u003cem\u003eProc. IEEE Eur. Symp. Secur. Priv.\u003c/em\u003e 372\u0026ndash;387 (2016).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eCroce, F. \u0026amp; Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. Preprint at (2020). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/2003.01690\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/2003.01690\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eMallat, S. A theory for multiresolution signal decomposition: The wavelet representation. \u003cem\u003eIEEE Trans. Pattern Anal. Mach. Intell.\u003c/em\u003e \u003cb\u003e11\u003c/b\u003e, 674\u0026ndash;693 (1989).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eDonoho, D. L. De-noising by soft-thresholding. \u003cem\u003eIEEE Trans. Inf. Theory\u003c/em\u003e. \u003cb\u003e41\u003c/b\u003e, 613\u0026ndash;627 (1995).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eZhai, J., Shen, W., Singh, I., Wanyama, T. \u0026amp; Gao, Z. A review of the evolution of deep learning architectures and comparison of their performances for histopathologic cancer detection. \u003cem\u003eProcedia Manuf.\u003c/em\u003e \u003cb\u003e46\u003c/b\u003e, 683\u0026ndash;689 (2020).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eDoroslovacki, M. L. On the least asymmetric wavelets. \u003cem\u003eIEEE Trans. Signal. Process.\u003c/em\u003e \u003cb\u003e46\u003c/b\u003e, 1125\u0026ndash;1130 (1998).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003ePaszke, A. et al. PyTorch: an imperative style, high-performance deep learning library. In \u003cem\u003eProc. Adv. Neural Inf. Process. Syst.\u003c/em\u003e 32, 8024\u0026ndash;8035 (2019).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eNicolae, M. I. et al. \u003cem\u003eAdversarial Robust. Toolbox v\u003c/em\u003e 1.0.0. Preprint at (2018). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/1807.01069\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/1807.01069\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eYin, D., Lopes, R. G., Shlens, J., Cubuk, E. D. \u0026amp; Gilmer, J. A Fourier perspective on model robustness in computer vision. In \u003cem\u003eProc. Adv. Neural Inf. Process. Syst.\u003c/em\u003e 32 (2023).\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eHendrycks, D. \u0026amp; Dietterich, T. Benchmarking neural network robustness to common corruptions and perturbations. Preprint at (2019). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/1903.12261\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/1903.12261\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003ePang, T., Xu, K. \u0026amp; Zhu, J. Mixup inference: better exploiting mixup to defend adversarial attacks. Preprint at (2019). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/abs/1909.11515\u003c/span\u003e\u003cspan address=\"https://arxiv.org/abs/1909.11515\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eDeng, J. et al. ImageNet: A large-scale hierarchical image database. In \u003cem\u003eProc. IEEE Conf. Comput. Vis. Pattern Recognit.\u003c/em\u003e 248\u0026ndash;255 (2009).\u003c/span\u003e\u003c/li\u003e\u003c/ol\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"","lastPublishedDoi":"10.21203/rs.3.rs-7068197/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7068197/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eWe propose a novel method to enhance the adversarial robustness of image classification models by leveraging discrete wavelet transforms (DWT). Our defense applies a two-level DWT decomposition to input images, entirely discarding the detail coefficients and preserving only the approximation components. These denoised images are then used to augment the clean training set, enabling robust model training without requiring access to adversarial examples.\u003c/p\u003e\u003cp\u003eUsing the CIFAR-10 dataset, we evaluate ResNet18 models against six white-box attacks: Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), DeepFool, Momentum Iterative FGSM (MI-FGSM), Jacobian-based Saliency Map Attack (JSMA), and AutoAttack. To explore the impact of wavelet selection, we test three wavelet families\u0026mdash;Haar, Daubechies-4 (DB4), and Symlet-4 (SYM4)\u0026mdash;training separate models for each.\u003c/p\u003e\u003cp\u003eEvaluation on clean, adversarial, and denoised inputs demonstrates that wavelet-based augmentation significantly improves robustness against a broad range of attacks while preserving high accuracy on unperturbed data.\u003c/p\u003e","manuscriptTitle":"A Novel Approach for Defense Against Adversarial Attacks in Image Classification","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-07-18 12:43:51","doi":"10.21203/rs.3.rs-7068197/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"8152e7a5-e39a-42a7-a5c2-4e93a3161150","owner":[],"postedDate":"July 18th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":51429117,"name":"Physical sciences/Engineering"},{"id":51429118,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-03-17T05:41:16+00:00","versionOfRecord":[],"versionCreatedAt":"2025-07-18 12:43:51","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7068197","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7068197","identity":"rs-7068197","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}