A method and apparatus for classification using a neural network. A classification apparatus includes at least one processor and a memory. The memory is configured to store a classifier and a preprocessor including a defensive noise generator. The at least one processor generates defensive noise from an input image through the defensive noise generator in the preprocessor, generates a combined image by combining the input image and the defensive noise, and outputs a classification result by inputting the combined image to the classifier.