A study of the effect of JPG compression on adversarial images

By Gintare Karolina Dziugaite, Zoubin Ghahramani, Daniel M. Roy. 2016

611 citations recorded by the source corpus.

Neural network image classifiers are known to be vulnerable to adversarial images, i.e., natural images which have been modified by an adversarial perturbation specifically designed to be imperceptible to humans yet fool the classifier. Not only can adversarial images be generated easily, but these images will often be adversarial for networks trained on disjoint subsets of data or with different architectures. Adversarial images represent a potential security risk as well as a serious machine learning challenge---it is clear that vulnerable neural networks perceive images very differently from humans. Noting that virtually every image classification data set is composed of JPG images, we evaluate the effect of JPG compression on the classification of adversarial images. For Fast-Gradient-Sign perturbations of small magnitude, we found that JPG compression often reverses the drop in classification accuracy to a large extent, but not always. As the magnitude of the perturbations increases, JPG recompression alone is insufficient to reverse the effect.

Subfields: Artificial Intelligence, Radiology, Nuclear Medicine and Imaging

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Radiology, Nuclear Medicine and Imaging

Citations in the corpus

Countering Adversarial Images using Input Transformations (2018, methodology): “t scaling factor to increase visibility. We ﬁrst introduce three simple image transformations: image cropping-rescaling, bit-depth reduction (Xu et al., 2017), and JPEG compression and decompression (Dziugaite et al., 2016). Image cropping-rescaling has the effect of altering the spatial positioning”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[122] noted that most of the popular image classification datasets comprise JPG images.”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, background): “The defense strategies include bitdepth reduction (Guo et al., 2017), JPEG compression (Guo et al., 2017; Dziugaite et al., 2016; Liu et al., 2018; Aydemir et al., 2018; Das et al., 2018; 2017), Pixel Deﬂection (Prakash et al., 2018), total variance minimization (Guo et al., 2017),…”
Enhancing robustness of machine learning systems via data transformations (2017, background): “The effect of JPG compression on adversarial images has also been studied [14], [12].”
advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch (2019, background): “Preprocessing-based Defenses: The current version implements a few preprocessing based defenses 1 including • JPEGFilter (Dziugaite et al., 2016), • BitSqueezing , MedianSmoothing2D (Xu et al., 2017), and • linear ﬁlters including ConvSmoothing2D , AverageSmoothing2D , and GaussianSmoothing2D .”
Adversarial Examples on Object Recognition (2020, methodology): “The idea of using JPEG compression was also explored in [35, 42, 148].”
Smooth Adversarial Training (2020, background): “…adversarial robustness include defensive distillation [47], gradient discretization [6, 52, 72], dynamic network architectures [12, 66, 67, 34, 31, 37], randomized transformations [73, 4, 71, 50, 29, 1], adversarial input denoising/puriﬁcation [20, 48, 39, 59, 54, 33, 4, 44, 78, 15], etc .”
Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks (2021, methodology): “We follow the setting in [102] and apply the JPEG only to images since JPEG compression is speciﬁc to images.”
A Survey of Black-Box Adversarial Attacks on Computer Vision Models (2019, methodology): “• Input Transformations: The authors [50] tested several input transformations-1) Image Cropping and Rescaling 2) Bit Depth Reduction [49] 3) JPEG Image Compression and Decompression [70] 4) Total Variance Minimization [71] 5) Image Quilting [72] and their , Vol. 1, No. 1, Article .”
Adversarial Robustness Toolbox v0.2.2 (2018, background): “JPEG compression [16, 14] can work as an effective preprocessing step in the classification pipeline to counter adversarial attacks and dramatically reduce their effect.”
On the Robustness of Semantic Segmentation Models to Adversarial Attacks (2017, background): “Additionally, our results also support why JPEG compression as a pre-processing step mitigates small perturbations [20].”
Benchmarking Adversarial Robustness on Image Classification (2020, methodology): “We use the natural models as the backbone classifiers for defenses based on input transformation (e.g., JPEG).”
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research (2022, background): “[266] assessed how JPG compression affects the categorization of adversarial images.”
Deflecting Adversarial Attacks with Pixel Deflection (2018, background): “Therefore, it is unsurprising that JPEG compression recovers correct classification on some of the adversarial images but also reduces the classification accuracy on clean images [20, 8, 11, 15].”
Adversarial Robustness Assessment: Why both $L_0$ and $L_\infty$ Attacks Are Necessary (2019, background): “There are many recent variations of defenses [16], [17], [18], [19], [20], [21], [22], [23] which are carefully analysed and many of their shortcomings are explained in [24], [25].”