See discussions, stats, and author profiles for this publication at: [Link]

net/publication/388100070

Approximation-based energy-efficient cyber-secured image classification

framework

Article in Signal Processing Image Communication · April 2025

DOI: 10.1016/[Link].2025.117261

CITATIONS READS

0 14

8 authors, including:

Md. Abdur Rahman Salma Sultana Tunny

19 PUBLICATIONS 45 CITATIONS
Monash University (Australia)
11 PUBLICATIONS 78 CITATIONS
SEE PROFILE
SEE PROFILE

Aminul Huq Md. Sohel Rana

BRAC University Rajshahi University of Engineering and Technology
17 PUBLICATIONS 71 CITATIONS 68 PUBLICATIONS 857 CITATIONS

SEE PROFILE SEE PROFILE

All content following this page was uploaded by Md. Abdur Rahman on 19 January 2025.

The user has requested enhancement of the downloaded file.

 Signal Processing: Image Communication 133 (2025) 117261

Contents lists available at ScienceDirect

Signal Processing: Image Communication

journal homepage: [Link]/locate/image

Approximation-based energy-efficient cyber-secured image classification

framework✩
M.A. Rahman a,b , Salma Sultana Tunny c , A.S.M. Kayes d ,∗, Peng Cheng d , Aminul Huq e ,
M.S. Rana b , Md. Rashidul Islam b , Animesh Sarkar Tusher b
a
Department of Electronic & Electrical Engineering, Hongik University, 94 Wausan-ro, Mapo-gu, Seoul 04066, Republic of Korea
b Department of Electrical & Electronic Engineering, Rajshahi University of Engineering & Technology, Kazla, Rajshahi 6204, Bangladesh
c Department of Chemical & Biological Engineering, Monash University, Clayton, VIC 3800, Australia
d Department of Computer Science & Information Technology, La Trobe University, Bundoora, VIC 3086, Australia
e
Department of Computer Science & Engineering, University of Nevada Reno, 1664 N. Virginia Street, Reno, NV 89557, United States

ARTICLE INFO ABSTRACT

Keywords: In this work, an energy-efficient cyber-secured framework for deep learning-based image classification is
Image classification proposed. This simultaneously addresses two major concerns in relevant applications, which are typically
Image approximation handled separately in the existing works. An image approximation-based data storage scheme to improve
Memory efficiency
the efficiency of memory usage while reducing energy consumption at both the source and user ends is
Adversarial attacks
discussed. Also, the proposed framework mitigates the impacts of two different adversarial attacks, notably
Cybersecurity
retaining performance. The experimental analysis signifies the academic and industrial importance of this
work as it demonstrates reductions of 62.5% in energy consumption for image classification when accessing
memory and in the effective memory sizes of both ends by the same amount. During the improvement of
memory efficiency, the multi-scale structural similarity index measure (MS-SSIM) is found to be the optimum
image quality assessment method among different similarity-based metrics for the image classification task
with approximated images and an average image quality of 0.9449 in terms of MS-SSIM is maintained. Also,
a comparative analysis of three different classifiers with different depths indicates that the proposed scheme
maintains up to 90.17% of original classification accuracy under normal and cyber-attack scenarios, effectively
defending against untargeted and targeted white-box adversarial attacks with varying parameters.

1. Introduction and so on [1,2]. These DL models are susceptible to physical and cyber-
oriented adversarial attacks, which have raised concerns in the research
Recent technological developments have enabled images and videos community, especially for computer vision applications [3–6]. Various
to be utilized in the provision of services in almost every sector while notable adversarial attacks have been discussed with defensive methods
bringing smartness to every aspect of life, such as smart cities, smart in [7,8], where examples of attack models include fast gradient sign
transportation, and smart grids. The application of smart devices and
method (FGSM), basic-iterative method (BIM), iterative least-likely
the Internet of Things (IoT) has made it easier to collect visual data
class method (ICLM), projected gradient descent (PGD), Carlini and
for automation in various application areas. Consequently, with the
availability of a large amount of visual data, the popularity of deep Wagner (C&W), DeepFool, poisoning, and backdoor. With consider-
learning (DL) in the field of machine learning (ML) for different im- ation of the wide range of application areas of image classification,
age processing applications has increased significantly in recent years, defense against adversarial attacks for image classification is focused
which includes but is not limited to classification, recognition, detec- in this work.
tion, segmentation, super-resolution, generation, restoration, encoding,

✩ This work investigates the feasibility of image approximation for image classification through a comparative analysis to develop an energy-efficient and
cyber-secured framework. Also, the design of the proposed framework enables energy consumption to be reduced at both ends during normal conditions and
adversarial attacks.
∗ Corresponding author.
E-mail addresses: [Link].1995@[Link] (M.A. Rahman), [Link]@[Link] (S.S. Tunny), [Link]@[Link] (A.S.M. Kayes),
[Link]@[Link] (P. Cheng), [Link]@[Link] (A. Huq), [Link]@[Link] (M.S. Rana), rashidul@[Link] (M.R. Islam),
[Link]@[Link] (A.S. Tusher).

[Link]
Received 5 February 2024; Received in revised form 5 October 2024; Accepted 26 November 2024
Available online 16 January 2025
0923-5965/© 2025 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY license ([Link]
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

Several defensive methods for cyber-secured image classification (CE1) This work extends the application of the image approximation-
have been discussed in the existing literature [9]. For example, de- based memory optimization scheme to achieve energy efficiency
fensive distillation [10] and adversarial training [11] involve retrain- and memory size reduction for computer vision applications by
ing classifier models to improve robustness. As they cause changes using the image classification task as an example. A comparative
in the existing models involving significant computational complexi- analysis of the impacts of image approximation on three DL-
ties, pre-processing approaches have been considered as an alterna- based classifiers with different depths is presented, considering
tive for providing protection without affecting classifiers. Adversar- changes in the approximation amount. Also, instead of lim-
ial attack detection [12], attack detection and reconstruction based iting to the user end only like the previous work [20], this
mitigation [13], JPG compression [14], image transformations [14], investigation of the feasibility of image approximation extends
compression–reconstruction [9], and denoiser [15] are some exam- energy-efficient memory usage at both source and user ends for
ples of pre-processing based defensive measures. As pre-processing image classification.
approaches can be added as a layer of defense without any changes to (CE2) An IQA metric selection for image classification with approxi-
the existing classification systems, they are comparatively more popular mated images is presented through a comparative analysis of
than improving the robustness of models. All these security measures different similarity-based metrics, which can help in selecting
have their own advantages and disadvantages in relation to improving a suitable approximation amount considering the application
performances during adversarial attacks. However, they do not provide requirements. While the previous work [20] is limited to IQA
a solution for energy consumption when utilizing numerous images for selection for HVS-based applications using average values and
image classification. standard deviations, this work presents the IQA selection for im-
When dealing with a large amount of visual media, energy con- age classification by evaluating the correlation of three different
sumption is a critical issue, especially for portable devices with limited DL-based classifiers’ accuracies with IQA metrics.
energy supply. During image classification, DL models consume a sig- (CE3) This work extends the application of approximated memory to
nificant amount of energy due to computational complexities. Also, address cybersecurity concerns in image classification. A feasi-
the backlight of display devices and memory sub-systems consume bility analysis of the effectiveness of image approximation as a
a lot of energy on any display device. To address this issue, many defensive measure is presented against two different adversarial
research studies have focused on optimizing energy for backlight as attacks on image classification. As pre-processing defense meth-
well as memory sub-systems [16]. Backlight dimming [17], optimizing ods are less costly and have a minimal impact on the existing
memory refresh [18,19], optimizing memory access [20], and improv- model, an image approximation-based scheme is proposed to of-
ing computational efficiency for DL approaches [21] are worthy of fer both computational convenience and cost-effectiveness. Also,
attention as energy saving technologies. These technologies are mostly a formulation of the approximation amount for robust image
limited to the user end only. Also, as the focus of all these energy-saving classification is presented in this work.
methodologies is limited to optimizing energy usage from different (CE4) Using image classification as a case study, an energy-efficient
aspects, there is no consideration of cybersecurity in these works. protective scheme is proposed, which can be employed in com-
However, energy optimization and cybersecurity are critical concerns puter vision applications. The integrated solution introduces a
for reliable, efficient, and robust image classification. Hence, in order framework for addressing energy efficiency and cybersecurity
to achieve an energy-efficient and cyber-secured image classification for image classification simultaneously, where memory usage
system with effective memory size reduction in a computationally efficiency is enhanced at the source and the user ends.
efficient manner, the following research problems (RPs) need to be The rest of the work is organized as follows. First, the relevant
addressed. research works are summarized in Section 2. Next, an energy-efficient
cyber-secured image classification system is proposed in detail in Sec-
(RP1) How to reduce energy consumption in memory access and ef-
tion 3. After that, the experimental setup is presented in Section 4,
fective memory size for image classification while maintaining
which includes a description of the dataset, DL-based classifier models,
reasonable performance?
adversarial attack models, and the performance evaluation metrics. In
(RP2) How to mitigate the impacts of adversarial attacks on image clas-
Section 5, the results of this investigation are discussed by organizing
sification without any changes in existing DL-based classification
them according to each objective. In Section 6, the advantages of
models?
this work are highlighted by comparing its contributions with the
(RP3) How to provide cyber-security while ensuring energy efficiency
contributions of the relevant research works. Section 7 concludes the
at both source and user ends for image classification tasks?
paper and provides suggestions for future directions.
The above discussions on existing literature indicate the need for
an integrated system for ensuring energy efficiency and cyber-security 2. Related works
simultaneously with low computational complexities. Also, there is a
necessity to develop a multi-stage memory usage optimization frame- The existing works related to reducing energy consumption for
work for image classification, as existing literature indicates the lack memory usage and providing security against adversarial attacks dur-
of research work on such technology for both source and transmis- ing image classifications are summarized in this section. The relevant
sion ends. In the previous work [20], an image approximation-based works are presented by categorizing them according to their area of
memory optimization method has been discussed with an optimum contributions as follows.
image quality assessment (IQA) metric selection to decide the approx-
imation amount, which is limited to the user ends only focusing on 2.1. Cybersecurity measures
the human visual system (HVS)-based applications. As the require-
ments for computer vision applications vary from the requirements The defensive mechanism against adversarial attacks on image clas-
for human perception, this work extends the previous approach in the sification can be broadly classified into pre-processing approaches and
area of computer vision applications. This work aims at presenting the model’s robustness enhancement schemes [9]. Pre-processing ap-
a framework for image classification to ensure energy optimization proaches are considered more efficient and convenient for implemen-
at source and transmission ends while improving robustness against tation because no alternations are required in existing models. On the
adversarial attacks. The contributions and significant extensions (CEs) contrary, the model’s robustness enhancement schemes involve signif-
are summarized as follows. icant changes to the models. For example, the concept of distillation

2
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

has been discussed as a defensive measure for re-training a model, becomes a more critical issue with the increasing resolution of images,
which makes the classifier less sensitive to adversarial perturbations controlling the refresh period for each local segment individually has
due to gradient masking [10]. As discussed in [11], the distillation been suggested in [24] to reduce energy usage.
scheme is less effective in improving the model’s robustness and can be Again, due to the inherent resilient nature of input data, approx-
vulnerable to non-gradient-based attacks, resulting in its low popularity imate computing can be used for various applications to improve
compared to adversarial training as an approach of robustifying models. energy efficiency [25]. For example, considering computational energy
Adversarial training causes changes in the models through training to consumption in neural networks and image processing applications,
increase robustness and requires attack templates for training. To im- approximate multipliers have been presented in [21] based on approx-
prove robustness and reduce the training time for adversarial training, imate compressors while maintaining quality. An approximation-based
a re-constructor-based training architecture has been used in [22] to en- full-adder has been discussed in [26] for achieving computational effi-
able the classifier to learn the important features efficiently while using ciency in image addition. In [20], image approximation has been used
an enhanced version of FGSM as an attack template. As both defensive to increase memory access efficiency and to reduce the corresponding
distillation and adversarial training involve training classifiers, they are power consumption for end users focusing on HVS-based applications,
computationally expensive and time-consuming processes with a signif- while indicating its feasibility in computer vision applications. In an-
icant impact on the existing systems, while possibly being vulnerable to other work [27], an integrated display system has been discussed to
new types of attacks. Hence, compared to these security schemes, pre- optimize energy usage for memory and backlight of display devices. All
processing schemes have less impact on the existing systems by working these notable technologies have focused on achieving energy efficiency
as add-ons, whose computational complexities depend on the type of in different areas, but their concern is limited to the user end only
approach. without any consideration for the source end. Furthermore, as these
An adversarial attack detection scheme has been presented in [12], works aim at energy usage optimization, no discussion on cybersecurity
comparing the difference between image classes before and after fea- is included.
ture squeezing without discussing any solution against adversarial at-
tacks. In [13], a two-step defensive scheme has been discussed by 3. Energy-efficient cyber-secured classification framework
utilizing detector and reformer networks for attack detection and image
reconstruction upon detection, respectively. Detector-based schemes The perception of visual media by the HVS is affected by various
require no knowledge of attack models, but the training of a detector factors, causing perception to change non-linearly with changes in
can be computationally expensive. Also, there is a possibility of the de- data. An example of such a phenomenon is adversarial attacks on im-
tector’s failure, which presents uncertainty about its effectiveness. The ages. During adversarial attacks, an adversary introduces perturbations
effectiveness of JPG compression as a pre-processing defensive measure (𝛿𝐼 𝑚𝑔 ) to an image data (𝐼 𝑚𝑔) to generate an adversarial image (𝐼 𝑚𝑔𝑎𝑑 𝑣 )
has been investigated in [14], noting its usefulness for small perturba- as expressed in Eq. (1).
tions while its failure during large perturbations. The analysis described 𝐼 𝑚𝑔𝑎𝑑 𝑣 = 𝐼 𝑚𝑔 + 𝛿𝐼 𝑚𝑔 (1)
in [14] highlights the possibility of image transformations as effective
solutions. In [9], two convolutional neural network (CNN) models have
been used to remove the adversarial perturbations from images through An adversarial image can deceive DL models, although the changes
compression and reconstruction as a defensive mechanism. In another compared to the original image remain imperceptible to HVS. As
work [15], considering adversarial perturbations as noise, a denoiser changes in visual data remaining invisible to HVS is one of the key
has been trained to minimize the errors of an adversarial image in factors during modeling adversarial attacks, the adversary’s freedom
high-level representation to improve the accuracy of image classifi- to alternate pixels is limited to small perturbations [28]. As addressed
cation. Although denoiser and compression–reconstruction are well- in [24], HVS tends to be comparatively insensitive to alternations in the
known image-transformations-based pre-processing approaches, they least significant bits (LSBs) of a pixel in an image but very sensitive
are computationally expensive. Also, utilizing DL methods as a de- to changes in the most significant bits (MSBs), which indicates the
fensive measure opens a potential vulnerability in the classification possibility of the impacts of adversarial attacks being limited to LSBs
scheme through the defensive layer. Furthermore, the aforementioned only. Based on this hypothesis, an image approximation-based scheme
technologies have fcoused their concerns to cybersecurity only. Hence, is proposed in this work, where LSBs are approximated as a defensive
they lack consideration for another major problem in dealing with a measure while saving energy. As rounding-based approximation has
large amount of visual media, which is energy consumption. been found to be efficient while keeping perceivable errors compara-
tively low [20], it has been used in this work for image approximation.
2.2. Energy saving measures For a pixel (𝐼𝑖𝑗 ) of an image data (𝐼 𝑚𝑔), the process of approximating
its n-bits (𝑛𝑏𝑖𝑡 ) using the rounding approach can be mathematically
This issue of energy consumption can be significant, especially for modeled as in Eq. (2).
{ 𝐴𝑝𝑥
portable devices such as smartphones, tablets, laptops, and IoT systems. 𝐼𝑖𝑗 − 𝑅𝑉𝑖𝑗 , if 𝑅𝑉𝑖𝑗 < 2𝑠𝑡𝑒𝑝
For devices with display systems, a significant amount of energy is 𝐼𝑖𝑗𝑎𝑝𝑥 = 𝐴𝑝𝑥𝑠𝑡𝑒𝑝 (2)
𝐼𝑖𝑗 − 𝑅𝑉𝑖𝑗 + 𝐴𝑝𝑥𝑠𝑡𝑒𝑝 , if 𝑅𝑉𝑖𝑗 ≥ 2
consumed by the backlight and memory sub-systems, while the com-
putational cost of implementing DL-based approaches increases energy where 𝐼𝑖𝑗𝑎𝑝𝑥 indicates approximated pixel, 𝐴𝑝𝑥𝑠𝑡𝑒𝑝 indicates quantization
usage. Hence, different energy management technologies have been step for 𝑛𝑏𝑖𝑡 approximation, and 𝑅𝑉𝑖𝑗 indicates the reminder value after
discussed in existing literature [16]. The methodologies for reducing the division of 𝐼𝑖𝑗 by 𝐴𝑝𝑥𝑠𝑡𝑒𝑝 . 𝐴𝑝𝑥𝑠𝑡𝑒𝑝 is evaluated by 2𝑛𝑏𝑖𝑡 , while 𝑅𝑉𝑖𝑗 is
energy consumption in display systems have been discussed in [17], expressed as 𝑚𝑜𝑑(𝐼𝑖𝑗 , 𝐴𝑝𝑥𝑠𝑡𝑒𝑝 ).
which optimize the backlight of LCD displays by considering responses Based on Eq. (2), a value is added to or subtracted from the original
of the HVS to images in different ambient light and viewing distances. pixel (𝐼𝑖𝑗 ) to generate the approximated pixel (𝐼𝑖𝑗𝑎𝑝𝑥 ) depending on
In another work [23], the operating voltage and frequency of GPU/CPU the amount of approximation (𝑛𝑏𝑖𝑡 ), which is illustrated in Fig. 1. As
have been adaptively optimized to improve energy efficiency for global indicated in Fig. 1(a), an approximator changes the original pixels to
illumination. A combination of two different auto-refresh methods has the approximated pixels to assign zeros in LSBs and these zeros in LSBs
been discussed in [18] to improve memory refresh efficiency while re- are extracted to generate partial pixels as outputs, where partial pixels
ducing the corresponding energy usage. Also, focusing on ML and signal are to be stored in memory. For example, values are subtracted and
processing-related applications, refresh interval optimization has been added to original pixels with values of 226 and 230 to generate 224
discussed in [19] for saving refresh energy. As energy consumption and 232 as approximated pixels after 3 bit approximation based on

3
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

Fig. 1. Rounding based approximation of pixels.

Fig. 2. Proposed energy-efficient cyber-secured image classification framework.

Eq. (2), as illustrated in Fig. 1(a). Consequently, zeros are assigned to improving efficiency in writing and reading tasks, image data passes
the 𝑛𝑏𝑖𝑡 (= 3) LSBs as a result of this process, which helps to omit the through the approximator and the deapproximator to store and retrieve
values in LSBs. If the impacts of adversarial perturbations are limited to them from memory, as shown in Fig. 2. Also, because only partial pixels
LSBs based on the hypothesis detailed earlier, this process can remove are stored, the effective size of the memory can be reduced compared
the impacts on LSBs of an adversarial image while sacrificing some data to the conventional approach, as discussed earlier. For the implemen-
accuracy in the original image’s LSBs. At the same time, as illustrated tation, either the algorithms of the existing memory controller can be
in Fig. 1(a) for a pixel value of 230, the impacts of data in LSBs can updated to perform approximation and deapproximation or a separate
be propagated to the nearest MSBs due to adding a value during the application-specific integrated circuit (ASIC) can be used according to
approximation based on Eq. (2). Hence, if the adversarial attacks affect one’s preference.
𝑛𝑏𝑖𝑡 − 1 LSBs, approximating 𝑛𝑏𝑖𝑡 LSBs can be capable of mitigating this As illustrated in Fig. 2, the image data needs to be stored at both
impact, which is investigated in this work. source and user ends. Hence, the approximation-based data storage
The deapproximator can read the partial pixels from memory to system is proposed for both ends to improve memory usage efficiency,
generate full-length pixels by filling the LSBs with zeros, as illustrated where the focus of the existing works on energy-efficient systems is
in Fig. 1(b). The approximated images from the deapproximator can be mainly limited to the user end. For the source end before transmission,
used for computer vision applications such as image classification. As the approximation process omits data in 𝑛𝑏𝑖𝑡 LSBs, which reduces the
these partial pixels are stored in and read from memory, it can reduce data accuracy of an image. The perception of this change to HVS
the data amount for reading and writing tasks to save the corresponding depends on the amount of approximation. On the other hand, the
energy while reducing the required memory for storing this data. Due approximation process omits zeros in 𝑛𝑏𝑖𝑡 LSBs on the user ends after
to the simplicity of approximation and deapproximation processes, the the reception without causing any further change in image data while
scheme is computationally efficient. Based on the aforementioned con- ensuring memory usage efficiency in normal cases. During adversarial
cept, an energy-efficient cyber-secured image classification framework attack cases, the perturbations are introduced during transmission.
is proposed in this work, as presented in Fig. 2. With the objective of Hence, the contaminated data in 𝑛𝑏𝑖𝑡 LSBs can be omitted through the

4
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

Table 1
Overview of the selected pre-trained DL models [31].
DL model Depth Size (MB) Accuracy (%)
GoogLeNet [32] 22 27 66.25
ResNet-101 [33] 101 167 75.96
DenseNet-201 [34] 201 77 75.85

investigation. Of the available pre-trained models for MATLAB [31],

three DL models with different depth levels are used for this investiga-
tion. Based on the discussions in [31], the depth, size, and accuracy of
Fig. 3. Dataset selection for the experiment analysis.
the selected pre-trained models are presented in Table 1. The selected
models were trained on the ImageNet dataset [30] with the ability to
classify images into 1000 categories, where the prediction times for
approximation process after the reception, which is the objective of the GoogLeNet and DenseNet-201 are the lowest and the highest of the
proposed scheme. As 𝑛𝑏𝑖𝑡 is the key factor for affecting the accuracy of selected ones, as addressed in [31]. The input image size requirements
data or performance of a classifier, controlling quality degradations in are the same, which is 224-by-224. Brief descriptions of these models
images, and mitigating adversarial examples, it can be expressed as in are provided as follows.
Eq. (3).
4.2.1. GoogLeNet
𝑛𝑏𝑖𝑡 = 𝑓𝑛 (𝛿𝐼 𝑚𝑔 𝑀 𝑋 , 𝑃 𝑄𝐶 𝑀 𝑋 , 𝐴𝑐 𝑐 𝑢𝑟𝑎𝑐 𝑦𝐿 ) (3)
GoogLeNet utilizes inception modules for the efficient collection
where 𝑓𝑛 indicates the function to determine the value of 𝑛𝑏𝑖𝑡 for of information at different scales through the utilization of pooling
a DL-based classifier in the proposed framework, 𝛿𝐼 𝑚𝑔 𝑀 𝑋 indicates operations within the same layer and various convolutional filters of
the maximum defendable value of perturbations while maintaining a varying sizes (i.e., 1 × 1, 3 × 3, and 5 × 5) [32]. With the well-planned
reasonable performance, 𝑃 𝑄𝐶 𝑀 𝑋 indicates the maximum allowable utilization of dimension reduction and projection layers, this light
perceptual quality change for achieving a reasonable performance, and architecture offers computational efficiency and low prediction time,
𝐴𝑐 𝑐 𝑢𝑟𝑎𝑐 𝑦𝐿 indicates the least amount of accuracy to be achieved to while processing an image at several stages and combining them for
satisfy the application requirements. The values of these parameters feature extraction. The auxiliary classifiers connected to intermediate
are investigated while presenting the performance of the proposed layers in its architecture support better classification abilities with
framework in detail in Section 5. gradient propagation efficiency.

4.2.2. ResNet-101
4. Experiment setup
The development of ResNet provides a solution to vanishing/
exploding gradient problems in DL models using feature learning by
This section describes the image dataset as well as the pre-trained residual block generation using skip connections [33]. Although there
DL classifiers used for this investigation on image classification. Ad- is a possibility of overfitting, the model offers convenience in training
ditionally, models of adversarial attacks on image classifiers are pre- with better performance. ResNet-101, a variant of ResNet with a com-
sented in a summarized manner. At the end of this section, the perfor- plex feature learning ability, improves performance. Due to the stack
mance evaluation metrics are discussed, which are used to assess the of many layers, its size is comparatively larger with a larger number
effectiveness of the proposed framework in Section 5. This investigation of model parameters, which raises concerns about its computational
is conducted on the online version of MATLAB utilizing its available complexities.
resources for adversarial attack generation [29].
4.2.3. DenseNet-201
4.1. Dataset DenseNet-201 is another DL model that provides solutions to van-
ishing gradient issues similar to ResNet, while achieving better per-
The dataset for this investigation was collected from ImageNet [30], formance with fewer parameters [34]. It achieves feature reuse by
which is widely used for analyzing the robustness of defensive schemes providing each layer access to all its preceding layers, which offers
in image classification. As pre-trained models were employed in this better learning with optimized gradient flow during the training stage.
work, a test dataset called ’New Test Dataset’ was used from the Ima- The architecture consists of transition blocks and a bottleneck layer
geNet Challenge 2017, containing 5500 images. Among 5500 images, for downsampling and limiting the availability of feature maps quan-
2380 images were selected, which have been classified identically by tity [34]. Also, a factor for feature map size reduction is used in
the DL-based pre-trained classifiers used in this work, as presented in controlling a potential parameter explosion. However, there is a possi-
Fig. 3. As different pre-trained models have different levels of accuracy, bility of overfitting and there may be computational complexities with
a comparatively longer prediction time due to the large number of
this identical classification-based sample data selection is used to keep
layers.
the accuracy the same on the sample data at normal conditions.
4.3. Cyber-attacks
4.2. Pre-trained models
Depending on the adversary’s knowledge of the system, attacks can
In practical applications, noise can be present in image data, which be classified into white-box, gray-box, and black-box, where white-box
can cause the performance of a highly accurate classifier to decrease attacks are the most notorious as the adversary has complete access to
moderately. As the scope of this work is limited to adversarial at- the system [7]. White-box attacks can be one-step as well as iterative,
tacks, moderately accurate models are used to resemble the scenario in where the latter is more successful than the former. Also, the attacks
practical applications. Also, the quantization errors introduced during can be categorized as targeted or untargeted, depending on whether
approximation can cause a decrease in the classifier’s accuracy, which the attacks aim to guide the misclassification to a specific class or not.
may be amplified with the increase in the depth of DL models. As this Hence, two basic well-known white-box adversarial attacks, FGSM and
work aims to investigate the effectiveness of the proposed framework BIM, are considered in this work as examples of untargeted one-step
with the existing systems, pre-trained models are employed during the and targeted iterative attacks, respectively.

5
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

4.3.1. FGSM similarity (FSIM) index and its another version with color similarity
FGSM is a gradient-based untargeted attack and is implementable consideration (FSIMc) [46].
in one step, aiming to add or subtract a small perturbation according SSIM is used to evaluate perceptual degradations in images, which
to the sign of the gradient [35]. It has low computational complexity considers HVS’s sensitivity in luminance, contrast, and structural in-
and fast implementation, requiring comparatively greater perturbations formation. MS-SSIM incorporates sensitivity in the frequency domain
when corrupting images. For an FGSM attack on an image (𝐼 𝑚𝑔) with additionally to account for the contrast sensitivity function. On the
a class (𝑌 ), the mathematical model of 𝛿𝐼 𝑚𝑔 in Eq. (1) is expressed as contrary, FSIM and FSIMc evaluate perceptual quality degradations
in Eq. (4). based on local features in terms of phase congruency (PC) in the
frequency domain and gradient magnitude (GM) for contrast in the
𝛿𝐼 𝑚𝑔 = 𝜖⋅𝑠𝑖𝑔 𝑛(∇𝐼 𝑚𝑔 𝐽 (𝐼 𝑚𝑔 , 𝑌 )) (4)
spatial domain. Compared to FSIM, FSIMc evaluates chrominance infor-
where 𝐽 = Cost or loss function, ∇𝐼 𝑚𝑔 𝐽 = Gradient of 𝐽 for 𝐼 𝑚𝑔, mation as an additional feature for image quality assessments. The VSI
and 𝜖 = Variable controlling the amount of perturbation. Although the considers visual saliency (VS), GM, and chrominance for local features
attack success rate can be increased with an increase in 𝜖, it results in during assessing image quality. Although these five metrics attempt to
perceivable distortions. For this work, 𝜖 = [3∕255, 14∕255] is used to resemble human perception by evaluating similarities, they focus on
generate FGSM attacks. different aspects of HVS during their assessments.

4.3.2. BIM 4.4.2. Data reduction ratio

BIM is the iterative version of FGSM, where perturbation is in- The data reduction ratio (𝐷𝑅𝑅) for an image is defined as the ratio
troduced to an image (𝐼 𝑚𝑔) in a smaller step (𝛼) while keeping the of the total number of bits approximated and the total number of bits
magnitude of perturbation within the boundary (𝜖) [36]. The targeted in that image, where the number of bits refers to the number of bits
BIM aims at misclassifying 𝐼 𝑚𝑔 to a specific class (𝑌𝑎𝑑 𝑇 ) through the per channel of a pixel in that image. For an image with a height of 𝐻
𝑣
iterative approach, causing an increase in computations while improv- and a width of 𝑊 , 𝐷𝑅𝑅 can be expressed as in Eq. (6).
ing the attack’s success rate. As presented in [29], 𝛿𝐼 𝑚𝑔 in the iterative 𝑛 × 𝐻 × 𝑊 × 𝑛𝐶
𝑇 ) can 𝐷𝑅𝑅 = 𝑏𝑖𝑡 (6)
process of BIM attack modeling for a specific attack target (𝑌𝑎𝑑 𝑣
𝐵 × 𝐻 × 𝑊 × 𝑛𝐶
be expressed as in Eq. (5), considering 𝛿𝐼0𝑚𝑔 = 0 initially. where 𝑛𝐶 indicates the number of channels, 𝐵 indicates the number
𝛿𝐼𝑖 𝑚𝑔 = 𝐶 𝑙𝑖𝑝𝜖 (𝛿𝐼𝑖−1 𝑇 𝑖−1 𝑇
(5) of bits per channel of a pixel, and 𝑛𝑏𝑖𝑡 indicates the number of bits
𝑚𝑔 − 𝛼⋅𝑠𝑖𝑔 𝑛(∇𝐼 𝑚𝑔 𝐽 (𝐼 𝑚𝑔 + 𝛿𝐼 𝑚𝑔 , 𝑌𝑎𝑑 𝑣 )))
approximated per channel of a pixel. As the total number of bits
where 𝑖 = Number of iteration (e.g., 𝑖 = 1, 2, 3, …), ∇𝑇𝐼𝑚𝑔 𝐽 = Gradient approximated is equal to the amount of data omitted for reading and
of 𝐽 aiming at a specific target 𝑌𝑎𝑑 𝑇 for iteratively updated 𝐼 𝑚𝑔 + writing tasks during memory access, the data reduction ratio indicates
𝑣
𝛿𝐼 𝑚𝑔 . During each step of the iteration, clipping is performed on 𝛿𝐼𝑖 𝑚𝑔
𝑖−1 the amount of memory as well as energy consumption to be reduced
for limiting perturbation magnitude within 𝜖, as indicated in Eq. (5). using the approximation process.
Similar to FGSM attacks, 𝜖 = [3∕255, 14∕255] is used to generate BIM
attacks, while assigning 𝑌𝑎𝑑𝑇 = 𝑇 𝑖𝑔 𝑒𝑟 𝑠ℎ𝑎𝑟𝑘’’ as a general attack target 4.4.3. Accuracy
𝑣
in this investigation because no Shark image is among the sample Accuracy is used as an indicator for evaluating a classifier’s per-
images. Also, 𝑖 = 50 and 𝛼 = 0.2 are used for the BIM attacks in this formance in different situations, which is assessed as the ratio of the
work. number of accurately classified images (𝑁𝐴 ) against the total number
of images (𝑁). The mathematical model for accuracy is expressed as in
4.4. Performance evaluators Eq. (7), which is usually evaluated as a percentage.
𝑁
𝐴𝑐 𝑐 𝑢𝑟𝑎𝑐 𝑦 = 𝐴 ∗ 100% (7)
The performance evaluation metrics used in this work can be cate- 𝑁
gorized into image quality assessment (IQA) metrics, energy-efficiency,
accuracy, and attack success. As approximation and adversarial exam- Accuracy is an overall performance evaluator. Hence, a confidence
ples can cause damage to images, the IQA metric is used to evaluate score is additionally used, which is usually measured as a percentage.
perceptual degradations. Also, the data reduction ratio is evaluated as This probability score is a standard of a DL model’s ability to classify
an indicator of improvement in memory usage and energy efficiencies. an image accurately, where a higher score in confidence indicates
On the other hand, accuracy is used to indicate changes in the ability of how strongly the model believes the predicted class to be accurate.
DL models to classify images after adversarial attacks and/or approxi- During the classification process with the DL models discussed in sub-
mation. Additionally, the effectiveness of adversarial attacks on original Section 4.2, the probability score is calculated by the softmax function,
and approximated images is evaluated in terms of the fooling rate to which converts the raw model outputs into probabilities. After getting
indicate their impact on them. probability scores for each class, the class is predicted based on the
maximum probability score or confidence. As the confidence score is
4.4.1. IQA metrics estimated for each image, the average and standard deviation of the
For IQA, subjective evaluation is preferred due to its high accuracy, confidence scores of all sample images are used to assess the overall
but it is not suitable for real-time applications due to its implementa- performance.
tional complexities, significant time consumption and cost, as addressed
in [37]. The problems become severe, especially for DL-based computer 4.4.4. Fooling rate
vision applications that deal with many images. As an alternative, The fooling rate is defined as the ratio of the number of successfully
objective assessment is well-known for its efficiency and convenience misclassified images (𝑁𝑚𝑐 ) against the total number of images (𝑁),
in implementation, while attempting to match HVS for IQA [38,39]. which can be expressed as in Eq. (8).
Of the different full reference objective IQA metrics, similarity-based 𝑁
𝐴𝑐 𝑐 𝑢𝑟𝑎𝑐 𝑦 = 𝑚𝑐 ∗ 100% (8)
approaches have received wide acceptance in various applications, in- 𝑁
cluding approximation, compression, DL-based applications, and their
training because of perceptual change evaluations [20,40–43]. Hence, For untargeted FGSM attacks, 𝑁𝑚𝑐 is the same as the number of
five different similarity-based metrics are used in this work, which misclassified images. On the contrary, the success of targeted BIM
are structural similarity (SSIM) index [40], multi-scale extension of attacks depends on matching the misclassified class of the corrupted
SSIM (MS-SSIM) [44], visual saliency-based index (VSI) [45], feature image to the attack target, where 𝑁𝑚𝑐 can be different from the

6
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

number of misclassified images. Nonetheless, this metric points to the Table 2

Comparison of the image approximation’s effects on memory efficiency and image
vulnerabilities of images before and after approximation to different
quality with changes in the approximation amount.
types of adversarial attacks.
Performance 1-bit 2-bit 3-bit 4-bit 5-bit 6-bit
evaluators approx. approx. approx. approx. approx. approx.
5. Experiment results
𝐷𝑅𝑅 (%) 12.5 25.0 37.5 50.0 62.5 75.0
FSIM 0.9997 0.9982 0.9923 0.9729 0.9259 0.8368
This section presents the feasibility analysis of the proposed frame- Avg. (Std.) (0.00) (0.00) (0.01) (0.02) (0.03) (0.05)
work presented in Section 3. As the existing works address the two FSIMc 0.9996 0.9981 0.9918 0.9713 0.9207 0.8233
major problems separately, the benchmarks are available individually Avg. (Std.) (0.00) (0.00) (0.01) (0.02) (0.03) (0.04)
MS-SSIM 0.9997 0.9988 0.9953 0.9825 0.9449 0.8552
for each area. On the other hand, this work introduces a framework for
Avg. (Std.) (0.00) (0.00) (0.00) (0.01) (0.03) (0.07)
image classification by simultaneously addressing concerns about en- SSIM 0.9991 0.9968 0.9881 0.9600 0.8874 0.7401
ergy consumption in memory usage and cyber vulnerability. Hence, the Avg. (Std.) (0.00) (0.00) (0.01) (0.03) (0.07) (0.11)
effectiveness of this work is evaluated by comparing the performance of VSI 0.9999 0.9996 0.9981 0.9924 0.9750 0.9348
the conventional and proposed systems, where a conventional system Avg. (Std.) (0.00) (0.00) (0.00) (0.00) (0.01) (0.01)

indicates a system without any defensive measures or any energy- Approx. - Approximated Avg. - Average Std. - Standard deviation.
efficient technology. Based on the mathematical model presented in
Eq. (2) in Section 3, all channels of each pixel of an image have been
approximated by the same amount, which is indicated by 𝑛𝑏𝑖𝑡 . Also, As presented in Table 2, although the standard deviation increases
as presented in Section 3, the amount of data approximated provides with an increase in 𝑛𝑏𝑖𝑡 , its small values indicate low variations in image
an estimation to the amount of effective memory size to be reduced quality for the sample images for each approximation case. A visual
and the amount of energy consumption to be reduced by decreasing comparative analysis among different approximation cases for a sample
the reading and writing tasks when accessing the memory. This data image is presented in Fig. 4. As illustrated in Fig. 4, the changes in
reduction amount is evaluated in terms of the data reduction ratio approximated images are barely noticeable to human eyes up to 4-bit
(𝐷𝑅𝑅), as expressed in Eq. (6). As the proposed framework utilizes an approximation. A slight degradation becomes visible for the back legs
approximation-based memory system at both the source and user ends,
of the Gorilla during a 5-bit approximation, as presented in Fig. 4(f).
it increases energy consumption reduction by two times.
The visibility of image quality degradation increases notably for a 6-bit
The experimental results are divided into three parts: to analyze the
approximation, as illustrated in Fig. 4(g). The observations in Table 2
impacts of image approximation on classifier models at normal condi-
and Fig. 4(g) indicate the possibility of using a 5-bit approximation for
tions, to select an optimum IQA for image classification, and to verify
computer vision tasks.
the effectiveness during cyber-attacks. To address the effectiveness of
the proposed framework on the existing classification systems, pre- As discussed earlier, 2380 images were carefully selected to ensure
trained deep learning models were employed in this work. As discussed 100% accuracy of the selected pre-trained DL models for the original
in sub- Section 4.2, the selected pre-trained DL models have different images. This image selection was performed to facilitate the fair as-
depths, sizes, and accuracy. Hence, to have a fair compatibility analysis sessment of the impacts of image approximation on different models.
in employing the proposed framework with the selected models, 100% The impacts of image approximation on the accuracies of the selected
accuracy is ensured for the conventional scenarios by selecting 2380 DL-based image classifiers are summarized in Table 3. As presented
images from a subset of ImageNet, as addressed in sub- Section 4.1. in Table 1, 100% accuracy of the selected models vary differently
This facilitates the investigation to address how the proposed frame- with an increase in approximation. As the pixel values of an image
work affects different models under normal cases and how it helps in change during the approximation process, there is a possibility of
improving robustness against cyber-attacks. This experimental analysis error accumulation during passing through the layers of a DL model.
was conducted using the R2023b version of MATLAB software. A Hence, there is a possibility of a pre-trained DL model with a higher
PC with 12th Gen Intel(R) Core(TM) i5-1235U 1.30 GHz processor, depth being affected more by the approximated images, as that model
16.0 GB RAM, and Intel(R) Iris(R) Xe Graphics as GPU was used for was trained with original images. However, as presented in Table 3,
this investigation. DenseNet201 outperforms the others overall despite having more lay-
ers in its architecture. Although the depth of ResNet101 is medium
5.1. Impacts of approximation at normal cases compared to others, it is affected the most overall. As presented in
Table 3, GoogleNet performs competitively with DenseNet201 up to
The effects of the proposed scheme on image quality with an in- 4-bit approximation, but achieves less accuracy for higher cases of
crease in 𝑛𝑏𝑖𝑡 is presented in Table 2, while providing the corresponding approximation. Overall, the accuracies are comparatively high up to
𝐷𝑅𝑅. As presented in Table 2, the average image quality decreases a 5-bit approximation, irrespective of DL models.
as 𝐷𝑅𝑅 increases with an increase in 𝑛𝑏𝑖𝑡 . As discussed in Section 3,
In terms of confidence in image classification, the average confi-
HVS is less sensitive to changes in LSBs. Hence, a negligible decrease
dence gradually decreases and the standard deviation of confidence
in values of IQA metrics up to 4-bit approximation is observed, irre-
gradually increases with an increase in 𝑛𝑏𝑖𝑡 up to 5-bit approximation
spective of IQA metrics. As FSIM and FSIMc evaluate image quality
for all models. During these decreases in confidence with increases in
focusing on feature similarity, high average values for these metrics
up to 5-bit approximation indicate a strong presence of image features approximation, GoogleNet is the most affected, while DenseNet201 is
in approximate images. Simultaneously, high average IQA scores for the least affected. As reasonable structural and feature information is
VSI up to 6-bit approximation indicate the presence of saliency features maintained during the approximation considering the values of IQA
in approximated images, even for the aggressive image approximation metrics, the impacts of approximation on each model depend on its
case. As SSIM and MS-SSIM focus on structural information, high scores working principle and classification ability. Also, these characteristics
up to 4-bit approximation indicate the notable presence of structural indicate that the decrease in accuracy with an increase in 𝑛𝑏𝑖𝑡 is not
information in approximated images. However, MS-SSIM performs bet- affected by the depth of the model. Nonetheless, based on the obser-
ter than SSIM in assessing approximated images, as discussed in [20]. vations in Table 2, Fig. 4, and Table 3, the 5-bit approximation is a
Hence, the high average score of MS-SSIM for 5-bit approximation suitable choice to maximize power reduction while maintaining rea-
indicates a possibility of maintaining reasonable structural information sonable image quality in terms of MS-SSIM with sufficient classification
up to that approximation case. accuracy.

7
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

Fig. 4. Comparison of images approximated by different bits with the original image.

Table 3
Comparison of the effects of image approximation on the pre-trained models’ accuracies with changes in the approximation amount in the normal case.
Pre-trained Accuracy (%) Confidence (%) - Avg. (Std.)
DL-based Orig. 1-bit 2-bit 3-bit 4-bit 5-bit 6-bit Orig. 1-bit 2-bit 3-bit 4-bit 5-bit 6-bit
classifiers approx. approx. approx. approx. approx. approx. approx. approx. approx. approx. approx. approx.
GoogleNet 100 99.71 99.20 98.49 95.08 88.45 66.30 79.47 79.45 79.42 79.36 78.53 75.03 62.10
(23.95) (23.97) (24.01) (24.07) (24.65) (26.86) (30.33)
ResNet101 100 99.66 99.12 97.90 95.00 87.82 69.92 84.10 84.09 84.13 83.97 83.00 80.18 70.97
(20.87) (20.87) (20.84) (20.88) (22.13) (24.03) (28.03)
DenseNet201 100 99.92 99.24 97.94 95.92 90.17 76.01 87.66 87.68 87.62 87.40 86.55 84.04 76.95
(18.21) (18.19) (18.25) (18.48) (19.42) (21.29) (25.52)

Orig. - Original Approx. - Approximated Avg. - Average Std. - Standard deviation.

5.2. Selection of optimum IQA experimental results are summarized in Table 4.

As presented in Table 4, similarity-based IQA metrics have a very
The necessity of identifying IQAs for computer vision applications high correlation with accuracy of classifiers. As values of IQAs and
has been highlighted in [47] by pointing out the differences between accuracies of classifiers decrease with an increase in 𝑛𝑏𝑖𝑡 , there is no
human perception and image segmentation accuracy. As the previous difference in correlation based on SRCC. As presented in Table 4,
work [20] has selected an optimum IQA for HVS-based applications, there is a negligible difference based on PLCC for IQA metrics. Among
this work aims at identifying an optimum IQA for computer vision different IQA metrics, SSIM outperforms others for ResNet101 and
applications using image classification as an example. The selection DenseNet201, while MS-SSIM is found to be the best for GoogleNet, as
of the optimum IQA for image classification of approximated im- presented in Table 4. For ResNet101 and DenseNet201, MS-SSIM also
ages is performed by evaluating the correlation between accuracy and performs very competitively with SSIM, with negligible differences.
IQA metric. As Spearman’s rank correlation coefficient (SRCC) and Compared to SSIM and MS-SSIM, other IQA metrics are found to have
Pearson correlation coefficient (PLCC) are widely used for evaluating less correlations with the selected DL models in terms of PLCC. Based
correlations of IQA metrics, they were used in this investigation. The on the overall observations in Table 4, MS-SSIM is found to be the

8
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

Table 4
Comparison of the correlation of IQA metrics with the accuracies of the pre-trained models.
Pre-trained IQA metrics
DL-based FSIM FSIMc MS-SSIM SSIM VSI
classifiers SRCC PLCC SRCC PLCC SRCC PLCC SRCC PLCC SRCC PLCC
GoogleNet 1 0.9935 1 0.9941 1 0.9987 1 0.9956 1 0.9984
ResNet101 1 0.9982 1 0.9985 1 0.9990 1 0.9991 1 0.9988
DenseNet201 1 0.9980 1 0.9982 1 0.9982 1 0.9987 1 0.9980

Table 5
Comparison of the effectiveness of the attack modeling for original and 5-bit approximated images.
Pre-trained Fooling rate (%)
DL-based Attack value = 3/255 Attack value = 14/255
classifiers FGSM BIM FGSM BIM
Original Approx. Original Approx. Original Approx. Original Approx.
GoogleNet 96.81 94.71 92.35 95.97 97.39 97.06 93.82 96.97
ResNet101 92.35 89.75 94.92 95.34 91.51 91.68 96.72 97.06
DenseNet201 94.03 91.43 96.13 96.34 89.71 91.76 96.47 96.55

optimum IQA for image classification tasks during applications of an (transmitted) are significantly low. Also, the perturbations are less
approximation-based memory scheme. As MS-SSIM is developed based perceivable for the original (conventional) compared to 5-bit approx.
on HVS theories, it is capable of resembling human perception while (transmitted) according to MS-SSIM.
correlating with computer vision. Due to MS-SSIM being the optimum In the proposed framework, as the approximation at the source end
choice, the rest of the experimental observations are presented using before the transmission assigns zeros in the 5-bit (𝑛𝑏𝑖𝑡 ) of LSBs, the
MS-SSIM as the IQA metric. impacts of 𝜖 = 3∕255 and 𝜖 = 14∕255 are limited to 4-bit (𝑛𝑏𝑖𝑡 − 1).
Due to the max value of 4-bit (𝑛𝑏𝑖𝑡 − 1) being less than half of 5-
5.3. Effectiveness of approximation during cyber-attacks bit (𝑛𝑏𝑖𝑡 ), the 5-bit (𝑛𝑏𝑖𝑡 ) approximation is capable of mitigating such
attacks according to Eq. (2), as proposed in Section 3. Hence, with
The impacts of adversarial attacks on the original and 5-bit approx- the 2nd time approximation at the user end, the accuracies have
imated images are presented in Table 5. The perturbations are added been improved significantly for both types of adversarial attacks with
to the images during their transmission through the communication different values, as indicated by 5-bit approx. (received) case. Also,
channel. Hence, the considered approximated images are approximated the accuracies for the 5-bit approx. (received) case match with the
at the source end only for this comparative analysis. The fooling rate, as accuracies in normal conditions after 5-bit approximation. This indi-
expressed in Eq. (8), is used to identify the vulnerability of the original cates the ability of the proposed framework to maintain performances
and 5-bit approximated images. As presented in Table 5, images in for existing classifier systems under normal circumstances and attacks.
both categories are significantly susceptible to adversarial attacks. Also, As presented in Tables 6 and 7, the high confidence level on average
except for untargeted FGSM with 𝜖 = 3∕255, the 5-bit approximated im- can be maintained during image classification using any DL model
ages are comparatively more prone to adversarial attacks, as presented because of the proposed framework. These observations justify the
in Table 5. As approximated images have quantization errors due to ability of image approximation to omit perturbation in the LSBs to
the approximation before the attacks, it increases the fooling rate for mitigate adversarial attacks, as addressed in Section 3. Furthermore, as
attacks. This may boost the confidence of the adversaries in achieving the proposed mitigates the impacts of adversarial attacks on LSBs, the
their objectives, while keeping the scope for the defenders to protect the image quality is the same for the normal and attack cases based on MS-
system using the proposed framework. As a BIM attack is an iterative SSIM. Among the selected DL models, DenseNet201 has outperformed
attack, its impacts are found to be more severe than the impacts of others during adversarial attacks, similar to normal conditions.
FGSM attacks, as presented in Table 5. Also, as presented in Table 5, A comparative visualization for original (conventional) and 5-bit
GoogleNet is found to be the most affected by BIM attacks. ResNet101 approx. (received) is illustrated in Fig. 5, where without and with the
and DenseNet201 are found to be the least affected by higher and lower proposed framework considerations indicate original (conventional)
values of perturbations for BIM attacks, respectively. In the case of and 5-bit approx. (received), respectively. As presented in Fig. 5, image
FGSM attacks, GoogleNet is found to be the least affected model for quality degradation increases with an increase in 𝜖 for both cases. For
all attack cases, as presented in Table 5. BIM, the attacks are comparatively well hidden due to the iterative
The effectiveness of the proposed framework in mitigating adversar- process of attack generation. Also, as indicated in Tables 6 and 7, there
ial attacks is summarized in Tables 6 and 7 for untargeted FGSM and is a slight degradation in MS-SSIM for 5-bit approx. (received), which
targeted BIM attacks, respectively. In Tables 6 and 7, the performance can be observed for the back legs in Fig. 5. Despite the slightly visible
for the original (conventional) case represents the accuracy for the orig- distortions in 5-bit approx. (received) images, original (conventional)
inal corrupted images in a conventional system without any defensive are misclassified successfully, whereas 5-bit approx. (received) images
measure. The performance for 5-bit approx. (transmitted) case repre- are classified accurately. Hence, with small trade-offs in accuracy and
sents the accuracy for transmission side (source end) approximated image quality for normal conditions, the proposed framework can
images with adversarial contamination in the proposed framework. successfully retain the performance of the DL models during adversarial
On the other hand, the performance for 5-bit approx. (received) case attacks. Also, based on these observations, the values of different
represents the accuracy for the approximated images on the reception parameters in Eq. (3) can be quantified for deciding the approximation
side (user end) after receiving the approximated corrupted images. In amount. For 𝛿𝐼 𝑚𝑔 𝑀 𝑋 = 15, 𝑃 𝑄𝐶 𝑀 𝑋 = 0.9449 on average in terms of MS-
the proposed framework, the approximation process performed at the SSIM, 𝐴𝑐 𝑐 𝑢𝑟𝑎𝑐 𝑦𝐿 = [87%, 90%] on average, 𝑛𝑏𝑖𝑡 = 5 can be selected in
user end aims to mitigate the impacts of adversarial contamination the proposed framework for the selected pre-trained DL-based models,
while improving memory usage efficiency. As presented in Tables 6 as indicated in Tables 6 and 7. Nonetheless, the 𝑛𝑏𝑖𝑡 can be adjusted
and 7, the accuracies for original (conventional) and 5-bit approx. using Eq. (3) for any classifier model while satisfying the application

9
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

Table 6
Comparison of the effects of an FGSM attack on conventional and the proposed system.
Pre-trained Accuracy in % (𝑀 𝑆 − 𝑆 𝑆 𝐼 𝑀, Confidence in %)
DL-based Attack value = 3/255 Attack value = 14/255
classifiers Original 5-bit approx. 5-bit approx. Original 5-bit approx. 5-bit approx.
(Conventional) (Transmitted) (Received) (Conventional) (Transmitted) (Received)
GoogleNet 3.19 5.29 88.45 2.61 2.94 88.45
(0.9902, 53.22) (0.9400, 49.10) (0.9449, 75.03) (0.8734, 40.15) (0.8511, 38.73) (0.9449, 75.03)
ResNet101 7.65 10.25 87.82 8.49 8.32 87.82
(0.9902, 56.66) (0.9402, 57.03) (0.9449, 80.18) (0.8729, 49.78) (0.8525, 51.28) (0.9449, 80.18)
DenseNet201 5.97 8.57 90.17 10.29 8.24 90.17
(0.9902, 64.76) (0.9398, 65.45) (0.9449, 84.04) (0.8734, 56.63) (0.8496, 56.36) (0.9449, 84.04)

Conventional — Without any defensive measure.

Transmitted — Approximated at the source end and contaminated during transmission.
Received — Approximated at the user end after receiving approximated-contaminated image.

Table 7
Comparison of the effects of a BIM attack on conventional and the proposed system.
Pre-trained Accuracy in % (𝑀 𝑆 − 𝑆 𝑆 𝐼 𝑀, Confidence in %)
DL-based Attack value = 3/255 Attack value = 14/255
classifiers Original 5-bit approx. 5-bit approx. Original 5-bit approx. 5-bit approx.
(Conventional) (Transmitted) (Received) (Conventional) (Transmitted) (Received)
GoogleNet 1.68 0.92 88.45 1.64 0.59 88.45
(0.9959, 90.05) (0.9431, 94.40) (0.9449, 75.03) (0.9941, 93.55) (0.9418,96.39) (0.9449, 75.03)
ResNet101 1.47 1.09 87.82 0.84 0.71 87.82
(0.9962, 93.52) (0.9434, 93.61) (0.9449, 80.18) (0.9948, 95.98) (0.9423, 96.18) (0.9449, 80.18)
DenseNet201 1.09 1.22 90.17 0.92 0.88 90.17
(0.9963, 96.52) (0.9434, 96.89) (0.9449, 84.04) (0.9950, 96.97) (0.9423, 97.35) (0.9449, 84.04)

Conventional — Without any defensive measure.

Transmitted — Approximated at the source end and contaminated during transmission.
Received — Approximated at the user end after receiving approximated-contaminated image.

Fig. 5. Comparison of adversarially corrupted images with and without the proposed framework considerations for ResNet101.

requirements. protective method can be suitable for new attacks. Also, the proposed
Although the approximation–deapproximation process is performed method can be effective against other gradient-based as well as non-
two times in the proposed, their computation complexities are com- gradient attacks, where the amount of perturbations is kept small
paratively low due to the use of simple processes. Also, a significant considering HVS’s perception. Similarly, despite the discussion being
amount of energy can be saved at both the source and user ends, while limited to white-box attacks, this work can be applicable against gray-
providing cybersecurity solutions against adversarial attacks with some box and black-box attacks for the same reason. Furthermore, although
trade-off in accuracy under normal conditions, as addressed earlier. the accuracy may be improved by training classifiers with approxi-
As no attack models are considered for the defensive scheme, this mated images or by changing some layers of classifiers, they have not

10
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

Table 8
Comparative analysis with relevant research works.
Research study Energy-efficiency Cybersecurity Image IQA
classification selection
Defensive distillation-based classification system [10] × ✓ ✓ ×
JPG compression based pre-processing defense for image × ✓ ✓ ×
classification [14]
Detection and reformation-based two-step pre-processing × ✓ ✓ ×
defensive scheme for image classification [13]
Denoiser-based pre-processing defense for image × ✓ ✓ ×
classification [15]
Attack detection-based pre-processing defense for image × ✓ ✓ ×
classification [12]
Compression–reconstruction based pre-processing defense × ✓ ✓ ×
for image classification [9]
A re-constructor based adversarial training for image × ✓ ✓ ×
classification [22]
Local segment-wise refresh period selection for energy ✓ × × ×
optimization [24]
Dynamic voltage and frequency optimization for ✓ × × ×
GPU/CPU to reduce energy consumption [23]
Integrated refresh selection for refresh energy reduction ✓ × ×
[18]
Approximate compressors-based approximate multipliers ✓ × ✓ ×
for computational energy optimization [19]
Approximation-based full-adder for area and ✓ × × ×
computational energy optimization [26]
Refresh interval optimization to reduce refresh energy for ✓ × × ×
ML and signal processing applications [21]
HVS-based LCD backlight dimming backlight to optimize ✓ × × ×
energy usage considering surroundings [17]
Image approximation-based memory access and size ✓ × × ✓
reduction (Previous work) [20]
Image approximation-based energy-efficient cyber-secured ✓ ✓ ✓ ✓
image classification framework (This work)

been considered to develop a pre-processing based defensive scheme simplified process, the computational burden can be kept to a minimum
without any changes in existing classifiers. Nonetheless, the perfor- while reducing both the energy consumption during memory access
mance of the proposed scheme in image classification indicates the and the effective size of memory storage, which can be 62.5% for
possible applications of this scheme in other areas of computer vision, image classification, as addressed in Section 5. As memory size is a
where the approximation amount needs to be adjusted according to critical concern for portable devices [48], the reduced memory offered
application requirements. in the proposed framework at both ends can be a promising solution
for designing an optimized hardware architecture. Also, as illustrated
6. Discussion & future prospects in Fig. 2, the approximation-based memory system is adapted to both
the source and user ends, allowing energy optimization at both. There-
fore, given its notable performance, the integrated solution based on
The advantages as well as the uniqueness of this work are discussed
the proposed framework introduces an energy-efficient cyber-secured
in this section while comparing the contributions with the existing
image classification system, which signifies the importance of dealing
literature. Based on the discussions in Section 2, all the relevant existing with more than one problem at the same time to develop an efficient
technologies that address two significant problems related to image and effective system.
classification are summarized in Table 8. As presented in Table 8, This work can be a stepping stone for pioneering new technologies
the existing works consider these problems separately. In contrast, in the area of DL-based computer vision applications. As this investiga-
this work provides an integrated solution for them with a framework tion utilizes natural images and conventional DL models, the feasibility
for implementation. As pre-processing approaches are preferred to of the proposed framework can be investigated for artificially gener-
the robustification of models, this work presents one. Compared with ated images and advanced classification algorithms in the future. For
computationally expensive pre-processing approaches in the existing example, the study in [49] has discussed a quantum machine learning-
literature, this proposed approximation/de-approximation-based sim- based approach for optimized resource usage while generating images.
plified process keeps the computational complexities low for energy The compatibility of the proposed framework with such technology
efficiency. As discussed in Section 5, despite using this simple pre- can be investigated to increase resource optimization. On the other
processing approach, classification accuracy can be maintained at up hand, the improvement of classification accuracy has been discussed
to 90.17% of the original performance, with an average image quality in recent literature by improving feature representation [50], utilizing
of 0.9449 in terms of the MS-SSIM. Also, MS-SSIM is found to be feature graphs [51], or employing quantum machine learning [52,53].
the optimum IQA among different similarity-based IQA metrics for Hence, the compatibility of the proposed framework with such novel
image classification tasks using approximated images, which is not technologies can be investigated to develop a robust and efficient image
classification system with high accuracy. Moreover, as this work ana-
investigated in existing literature, as indicated in Table 8.
lyzes the effectiveness of the proposed framework through simulation,
On the other hand, of the energy-saving methodologies presented
further investigation from a hardware perspective can be beneficial for
in Table 8, the majority focus on optimizing memory usage to reduce
practical implementations.
energy consumption. Also, except for the previous work [20] focusing
on HVS-based applications, they require significant hardware changes 7. Conclusions
or computationally burdensome algorithms. Most importantly, all of
them limited their concerns to the user ends or application areas. In The large amount of visual data used in image classification con-
contrast, using the proposed approximation/de-approximation-based sumes a significant amount of energy while being prone to adversarial

11
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

attacks, two problems that have been addressed individually to date. [6] J. Weng, Z. Luo, D. Lin, S. Li, Comparative evaluation of recent universal
The proposed image approximation-based framework achieves a sig- adversarial perturbations in image classification, Comput. Secur. 136 (2024)
103576, [Link]
nificant reduction in energy consumption for memory access while
[7] G.R. Machado, E. Silva, R.R. Goldschmidt, Adversarial machine learning in image
simultaneously providing protection against adversarial attacks. The classification: A survey toward the Defender’s perspective, ACM Comput. Surv.
partial pixels generated through image approximation reduce the read- 55 (1) (2021) 1–38, [Link]
ing and writing tasks for memory to optimize the relevant energy [8] S.Y. Khamaiseh, D. Bagagem, A. Al-Alaj, M. Mancino, H.W. Alomari, Adversarial
consumption at both the source and user ends, while the effective size deep learning: A survey on adversarial attacks and defense mechanisms on
of the memory required is reduced due to storing partial pixels. For image classification, IEEE Access 10 (2022) 102266–102291, [Link]
10.1109/ACCESS.2022.3208131.
the proposed approximated image-based classification system, MS-SSIM
[9] X. Jia, X. Wei, X. Cao, H. Foroosh, ComDefend: An efficient image compres-
has outperformed other similarity-based IQAs based on its correlation sion model to defend adversarial examples, in: Proceedings of the IEEE/CVF
with classification accuracies based on SRCC and PLCC. As approxi- Conference on Computer Vision and Pattern Recognition, CVPR, 2019, pp.
mation affects the LSBs of a pixel, the proposed algorithm maintains, 6084–6092.
on average, a value of 0.9449 for the MS-SSIM while reducing both [10] N. Papernot, P. McDaniel, X. Wu, S. Jha, A. Swami, Distillation as a defense
to adversarial perturbations against deep neural networks, in: 2016 IEEE Sym-
the effective memory size and energy consumption for memory access
posium on Security and Privacy, SP, 2016, pp. 582–597, [Link]
by 62.5% at both ends. Also, the generation of partial pixels helps to 1109/SP.2016.41.
mitigate the impacts of adversarial attacks, resulting in an improvement [11] J. Zhang, C. Li, Adversarial examples: Opportunities and challenges, IEEE Trans.
in classification accuracy by using images with full-length pixels con- Neural Netw. Learn. Syst. 31 (7) (2020) 2578–2593, [Link]
structed from the partial ones. Although image approximation reduces TNNLS.2019.2933524.
the performance of classifiers in normal conditions due to sacrificing [12] W. Xu, D. Evans, Y. Qi, Feature squeezing: Detecting adversarial examples in
deep neural networks, in: Network and Distributed Systems Security Symposium
data accuracy, that accuracy can be maintained during untargeted (NDSS) 2018, 2018, pp. 1–15, [Link]
FGSM and targeted BIM attacks due to omitting data in the LSBs during [13] D. Meng, H. Chen, MagNet: A two-pronged defense against adversarial exam-
approximation. Consequently, the selected models can maintain their ples, in: Proceedings of the 2017 ACM SIGSAC Conference on Computer and
levels of accuracy to between 87.82% and 90.17% of their original Communications Security, CCS ’17, Association for Computing Machinery, 2017,
performance in normal cases and under white-box attacks. In future, the pp. 135–147, [Link]
[14] G.K. Dziugaite, Z. Ghahramani, D.M. Roy, A study of the effect of jpg compres-
feasibility of the proposed framework for different adversarial attacks
sion on adversarial images, 2016, [Link]
on image classification can be investigated. Also, this work can be arXiv preprint arXiv:1608.00853.
extended to other application areas of computer vision. [15] F. Liao, M. Liang, Y. Dong, T. Pang, X. Hu, J. Zhu, Defense against adversarial
attacks using high-level representation guided denoiser, in: Proceedings of the
CRediT authorship contribution statement IEEE Conference on Computer Vision and Pattern Recognition, CVPR, 2018, pp.
1778–1787.
[16] S. Pasricha, R. Ayoub, M. Kishinevsky, S.K. Mandal, U.Y. Ogras, A survey on
M.A. Rahman: Writing – original draft, Resources, Methodology, energy management for mobile and IoT devices, IEEE Des. & Test 37 (5) (2020)
Investigation, Data curation, Conceptualization. Salma Sultana 7–24, [Link]
Tunny: Writing – review & editing, Resources, Investigation, Data [17] M.A. Rahman, J. You, Human visual sensitivity based optimal local backlight
curation, Conceptualization. A.S.M. Kayes: Writing – review & dimming methodologies under different viewing conditions, Displays 76 (2023)
102338, [Link]
editing, Supervision, Resources, Conceptualization. Peng Cheng:
[18] W.-K. Cheng, P.-Y. Shen, X.-L. Li, Retention-aware DRAM auto-refresh scheme
Writing – review & editing, Supervision. Aminul Huq: Writing
for energy and performance efficiency, Micromachines 10 (9) (2019) 590, http:
– review & editing, Investigation, Conceptualization. M.S. Rana: //[Link]/10.3390/mi10090590.
Writing – review & editing, Supervision. Md. Rashidul Islam: [19] Y. Kim, W.H. Choi, C. Guyot, Y. Cassuto, On the optimal refresh power allocation
Writing – review & editing, Supervision. Animesh Sarkar Tusher: for energy-efficient memories, in: 2019 IEEE Global Communications Conference,
Writing – original draft, Investigation. GLOBECOM, 2019, pp. 1–6, [Link]
9013465.
[20] M.A. Rahman, A. Huq, S.S. Tunny, M.H. Anik, M.T. Pervin, M.R. Islam, A
Declaration of competing interest feasibility analysis of image approximation with image quality assessments, IET
Image Process. 18 (4) (2024) 897–913, [Link]
The authors declare that they have no known competing finan- [21] M. Ahmadinejad, M.H. Moaiyeri, Energy- and quality-efficient approximate
cial interests or personal relationships that could have appeared to multipliers for neural network and image processing applications, IEEE Trans.
Emerg. Top. Comput. 10 (2) (2022) 1105–1116, [Link]
influence the work reported in this paper.
TETC.2021.3072666.
[22] E.-C. Chen, C.-R. Lee, Towards fast and robust adversarial training for image
Data availability classification, in: Proceedings of the Asian Conference on Computer Vision,
ACCV, 2020.
The data that has been used is confidential. [23] S. Kim, T. Harada, Y.J. Kim, Energy-efficient global illumination algorithms for
mobile devices using dynamic voltage and frequency scaling, Comput. Graph.
(2018).
References [24] K. Cho, Y. Lee, Y.H. Oh, G.-c. Hwang, J.W. Lee, EDRAM-based tiered-reliability
memory with applications to low-power frame buffers, in: Proceedings of the
[1] L. Jiao, J. Zhao, A survey on the new generation of deep learning in image 2014 International Symposium on Low Power Electronics and Design, Associa-
processing, IEEE Access 7 (2019) 172231–172263, [Link] tion for Computing Machinery, 2014, pp. 333–338, [Link]
ACCESS.2019.2956508. 2627369.2627626.
[2] X. Yuan, P. He, Q. Zhu, X. Li, Adversarial examples: Attacks and defenses for [25] V.K. Chippa, S.T. Chakradhar, K. Roy, A. Raghunathan, Analysis and char-
deep learning, IEEE Trans. Neural Netw. Learn. Syst. 30 (9) (2019) 2805–2824, acterization of inherent application resilience for approximate computing, in:
[Link] Proceedings of the 50th Annual Design Automation Conference, DAC ’13,
[3] X. Hou, J. Liu, B. Xu, X. Wang, B. Liu, G. Qiu, Class-aware domain adaptation Association for Computing Machinery, 2013, pp. 1–9, [Link]
for improving adversarial robustness, Image Vis. Comput. 99 (2020) 103926, 2463209.2488873.
[Link] [26] S.E. Fatemieh, S.S. Farahani, M.R. Reshadinezhad, LAHAF: Low-power, area-
[4] T. Long, Q. Gao, L. Xu, Z. Zhou, A survey on adversarial attacks in computer efficient, and high-performance approximate full adder based on static CMOS,
vision: Taxonomy, visualization and future directions, Comput. Secur. 121 (2022) Sustain. Computing: Informatics Syst. 30 (2021) 100529, [Link]
102847, [Link] 1016/[Link].2021.100529.
[5] C. Hu, W. Shi, L. Tian, Adversarial color projection: A projector-based physical- [27] M.A. Rahman, S.S. Tunny, H. Bhuiyan, M.R. Islam, A case study on integrating
world attack to DNNs, Image Vis. Comput. 140 (2023) 104861, [Link] energy-efficient technologies for display devices, Electron. Lett. 60 (15) (2024)
org/10.1016/[Link].2023.104861. e13304, [Link]

12
M.A. Rahman et al. Signal Processing: Image Communication 133 (2025) 117261

[28] Y. Dong, Q.-A. Fu, X. Yang, T. Pang, H. Su, Z. Xiao, J. Zhu, Benchmarking [42] Q.-K. Tran, S.-k. Song, Computer vision in precipitation nowcasting: Applying
adversarial robustness on image classification, in: Proceedings of the IEEE/CVF image quality assessment metrics for training deep neural networks, Atmosphere
Conference on Computer Vision and Pattern Recognition, CVPR, 2020, pp. 10 (5) (2019) [Link]
321–331. [43] Z. Cheng, P. Akyazi, H. Sun, J. Katto, T. Ebrahimi, Perceptual quality study on
[29] MathWorks, Generate untargeted and targeted adversarial examples for im- deep learning based image compression, in: 2019 IEEE International Conference
age classification - MATLAB & Simulink, 2023, URL [Link] on Image Processing, ICIP, 2019, pp. 719–723, [Link]
com/help/deeplearning/ug/[Link]. (Accessed: 07 2019.8803824.
February 2023). [44] Z. Wang, E. Simoncelli, A. Bovik, Multiscale structural similarity for image
[30] O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, quality assessment, in: The Thrity-Seventh Asilomar Conference on Signals,
A. Karpathy, A. Khosla, M. Bernstein, A.C. Berg, L. Fei-Fei, ImageNet Large Systems & Computers, 2003, Vol.2, 2003, pp. 1398–1402, [Link]
Scale Visual Recognition Challenge, Int. J. Comput. Vis. ( IJCV) 115 (3) (2015) 1109/ACSSC.2003.1292216.
211–252, [Link] [45] L. Zhang, Y. Shen, H. Li, VSI: A visual saliency-induced index for perceptual
[31] MathWorks, Pretrained deep neural networks - MATLAB & Simulink, 2023, URL image quality assessment, IEEE Trans. Image Process. 23 (10) (2014) 4270–4281,
[Link] [Link]
[Link]. (Accessed: 07 February 2023). [46] L. Zhang, L. Zhang, X. Mou, D. Zhang, FSIM: A feature similarity index for
[32] C. Szegedy, W. Liu, Y. Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V. image quality assessment, IEEE Trans. Image Process. 20 (8) (2011) 2378–2386,
Vanhoucke, A. Rabinovich, Going deeper with convolutions, in: Proceedings of [Link]
the IEEE Conference on Computer Vision and Pattern Recognition, CVPR, 2015, [47] S. Kiruthika, V. Masilamani, Goal oriented image quality assessment, IET Image
pp. 1–9. Process. 16 (2022) 1054–1066, [Link]
[33] K. He, X. Zhang, S. Ren, J. Sun, Deep residual learning for image recognition, in: [48] A. Chaurasia, V.K. Sehgal, The MPEG-4 based energy efficient application traffic
Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, modelling and synthesis for network-on-chip architecture, Sustain. Comput.
CVPR, 2016, pp. 770–778. Inform. Syst. 23 (2019) 67–79, [Link]
[34] G. Huang, Z. Liu, L. Van Der Maaten, K.Q. Weinberger, Densely connected [49] N.-R. Zhou, T.-F. Zhang, X.-W. Xie, J.-Y. Wu, Hybrid quantum–classical genera-
convolutional networks, in: Proceedings of the IEEE Conference on Computer tive adversarial networks for image generation via learning discrete distribution,
Vision and Pattern Recognition, CVPR, 2017, pp. 4700–4708. Signal Process., Image Commun. 110 (2023) 116891, [Link]
[35] I.J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial ex- [Link].2022.116891.
amples, in: Proceedings of International Conference on Learning Representations, [50] W. Liu, Z. Wu, Y. Wang, H. Ding, F. Liu, J. Lin, G. Lin, LCReg: Long-tailed
2015, [Link] image classification with latent categories based recognition, Pattern Recognit.
[36] A. Kurakin, I.J. Goodfellow, S. Bengio, Adversarial examples in the physical 145 (2024) 109971, [Link]
world, in: Artificial Intelligence Safety and Security, Chapman and Hall/CRC, [51] M.V. Todescato, L.F. Garcia, D.G. Balreira, J.L. Carbonera, Multiscale patch-based
2018, pp. 99–112, [Link] feature graphs for image classification, Expert Syst. Appl. 235 (2024) 121116,
[37] H. Sheikh, A. Bovik, Image information and visual quality, IEEE Trans. Image [Link]
Process. 15 (2) (2006) 430–444, [Link] [52] L.-H. Gong, J.-J. Pei, T.-F. Zhang, N.-R. Zhou, Quantum convolutional neural
[38] H. Sheikh, M. Sabir, A. Bovik, A statistical evaluation of recent full reference network based on variational quantum circuits, Opt. Commun. 550 (2024)
image quality assessment algorithms, IEEE Trans. Image Process. 15 (11) (2006) 129993, [Link]
3440–3451, [Link] [53] L.-H. Gong, W. Ding, Z. Li, Y.-Z. Wang, N.-R. Zhou, Quantum K-nearest neigh-
[39] Z. Wang, Applications of objective image quality assessment methods [applica- bor classification algorithm via a divide-and-conquer strategy, Adv. Quantum
tions corner], IEEE Signal Process. Mag. 28 (6) (2011) 137–142, [Link] Technol. 7 (6) (2024) 2300221, [Link]
org/10.1109/MSP.2011.942295.
[40] Z. Wang, A. Bovik, H. Sheikh, E. Simoncelli, Image quality assessment: from
error visibility to structural similarity, IEEE Trans. Image Process. 13 (4) (2004)
600–612, [Link]
[41] G. Toderici, D. Vincent, N. Johnston, S. Jin Hwang, D. Minnen, J. Shor, M.
Covell, Full resolution image compression with recurrent neural networks, in:
Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition,
CVPR, 2017, pp. 5306–5314.

13

View publication stats