Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression

By Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Li Chen, Michael E. Kounavis, Duen Horng Chau. arXiv.org, 2017

353 citations recorded by the source corpus.

Deep neural networks (DNNs) have achieved great success in solving a variety of machine learning (ML) problems, especially in the domain of image recognition. However, recent research showed that DNNs can be highly vulnerable to adversarially generated instances, which look seemingly normal to human observers, but completely confuse DNNs. These adversarial samples are crafted by adding small perturbations to normal, benign images. Such perturbations, while imperceptible to the human eye, are picked up by DNNs and cause them to misclassify the manipulated instances with high confidence. In this work, we explore and demonstrate how systematic JPEG compression can work as an effective pre-processing step in the classification pipeline to counter adversarial attacks and dramatically reduce their effects (e.g., Fast Gradient Sign Method, DeepFool). An important component of JPEG compression is its ability to remove high frequency signal components, inside square blocks of an image. Such an operation is equivalent to selective blurring of the image, helping remove additive perturbations. Further, we propose an ensemble-based technique that can be constructed quickly from a given well-performing DNN, and empirically show how such an ensemble that leverages JPEG compression can protect a model from multiple types of adversarial attacks, without requiring knowledge about the model.

Subfields: Artificial Intelligence, Molecular Biology

View Paper: https://www.semanticscholar.org/paper/8ab5d59c6534039e6854cdb60a8519e0e96bde03

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

Citations in the corpus

Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples (2018, methodology): “Though standard JPEG compression has been explored to mitigate the adversarial examples [9, 7], it can neither effectively remove the adversarial perturbations, nor guarantee the classiﬁcation accuracy on benign images, due to its focus on human visual quality.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “[37] also took a similar approach and used JPEG compression to remove the high frequency components from images and proposed an ensemble-based technique to counter the adversarial attacks generated by FGSM [23] and DeepFool method [72].”
Review of Artificial Intelligence Adversarial Attack and Defense Technologies (2019, methodology): “Similarly, the Display Compression Technology (DCT) compression method [44] used in the fight against universal disturbance attacks [87] has also been proved to be insufficient.”
With Friends Like These, Who Needs Adversaries? (2018, background): “Hence, any attempt to mitigate adversarial vulnerability by discarding these directions, either by compressing the input data [14, 15, 16] or by suppressing specific components of image representations at intermediate network layers [5], must effect a loss in the classification accuracy.”
Audio Adversarial Examples: Targeted Attacks on Speech-to-Text (2018, methodology): “On images, lossy JPEG compression has been shown to significantly degrade the effectiveness of adversarial examples [11, 12].”
Traffic Signs in the Wild: Highlights from the IEEE Video and Image Processing Cup 2017 Student Competition [SP Competitions] (2018, background): “Recent studies [3, 4] showed that adversarial perturbations can degrade the performance of existing traffic sign recognition systems under specific conditions.”
Machine Learning in Python: Main developments and technology trends in data science, machine learning, and artificial intelligence (2020, neutral): “-based classfication [217] no no no yes no JPEG compression [218] no no yes no no”
Adversarial Examples on Object Recognition (2020, methodology): “The idea of using JPEG compression was also explored in [35, 42, 148].”
Big but Imperceptible Adversarial Perturbations via Semantic Manipulation (2019, methodology): “We evaluate our attacks and compare them with existing methods on three main defenses – JPEG defense [6], feature squeezing [31] and adversarial-training [14].”
Visual Analytics in Deep Learning: An Interrogative Survey for the Next Frontiers (2018, neutral): “While some work, primarily originating from the AI communities, has proposed computational techniques to protect AI based from attacks, such as identifying attack examples before classification [117], modifying the network architecture [118], modifying the training process [115], [119], and performi”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “For instance, JPEG-based compression of input has been studied for removing adversarial perturbations from images [393], [394], [395].”
Adversarial Robustness Toolbox v1.0.0 (2018, background): “art.defences.JpegCompression art/defences/jpeg compression.py JPEG compression [21, 19] can work as an effective preprocessing step in the classiﬁcation pipeline to counter adversarial attacks and dramatically reduce their effect.”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, background): “…include bitdepth reduction (Guo et al., 2017), JPEG compression (Guo et al., 2017; Dziugaite et al., 2016; Liu et al., 2018; Aydemir et al., 2018; Das et al., 2018; 2017), Pixel Deﬂection (Prakash et al., 2018), total variance minimization (Guo et al., 2017), respresentation-guided denoising…”
Deflecting Adversarial Attacks with Pixel Deflection (2018, background): “Therefore, it is unsurprising that JPEG compression recovers correct classification on some of the adversarial images but also reduces the classification accuracy on clean images [20, 8, 11, 15].”
Adversarial Robustness Toolbox v0.2.2 (2018, background): “JPEG compression [16, 14] can work as an effective preprocessing step in the classification pipeline to counter adversarial attacks and dramatically reduce their effect.”
Enhancing robustness of machine learning systems via data transformations (2017, background): “The effect of JPG compression on adversarial images has also been studied [14], [12].”
Adversarial Robustness Assessment: Why both $L_0$ and $L_\infty$ Attacks Are Necessary (2019, background): “There are many recent variations of defenses [16], [17], [18], [19], [20], [21], [22], [23] which are carefully analysed and many of their shortcomings are explained in [24], [25].”
Adversarial Attacks on Face Detectors Using Neural Net Based Constrained Optimization (2018, methodology): “In a different experiment we test the robustness attack against a jpeg compression based defense as proposed in [16] [17] which we ﬁnd helps only when the compression quality is low.”