Google's Cloud Vision API is Not Robust to Noise

By Hossein Hosseini, Baicen Xiao, Radha Poovendran. 2017

133 citations recorded by the source corpus.

Google has recently introduced the Cloud Vision API for image analysis. According to the demonstration website, the API "quickly classifies images into thousands of categories, detects individual objects and faces within images, and finds and reads printed words contained within images." It can be also used to "detect different types of inappropriate content from adult to violent content." In this paper, we evaluate the robustness of Google Cloud Vision API to input perturbation. In particular, we show that by adding sufficient noise to the image, the API generates completely different outputs for the noisy image, while a human observer would perceive its original content. We show that the attack is consistently successful, by performing extensive experiments on different image types, including natural images, images containing faces and images with texts. For instance, using images from ImageNet dataset, we found that adding an average of 14.25% impulse noise is enough to deceive the API. Our findings indicate the vulnerability of the API in adversarial environments. For example, an adversary can bypass an image filtering system by adding noise to inappropriate images. We then show that when a noise filter is applied on input images, the API generates mostly the same outputs for restored images as for original images. This observation suggests that cloud vision API can readily benefit from noise filtering, without the need for updating image analysis algorithms.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

On Robustness and Transferability of Convolutional Neural Networks (2020, background): “Subsequent studies have investigated brittleness to similar corruptions [53, 76], as well as to impulse noise [31], photometric perturbations [62], and small shifts and other transformations [2, 17, 74].”
Benchmarking Neural Network Robustness to Common Corruptions and Perturbations (2019, methodology): “For example, Hosseini et al. (2017) apply impulse noise to break Google’s Cloud Vision API.”
FrugalML: How to Use ML Prediction APIs More Accurately and Cheaply (2020, background): “MLaaS: With the growing importance of MLaaS APIs [2, 3, 6, 9, 10, 11], existing research has largely focused on individual API for performance [57], pricing [26], robustness [31], and applications [23, 32, 44].”
CURE-OR: Challenging Unreal and Real Environments for Object Recognition (2018, background): “[15] evaluated the recognition performance of Google Cloud Vision API under Gaussian and impulse noise and showed that the API is vulnerable to tested challenging conditions.”
Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents (2026, unknown): “Visual attacks sidestep this bottleneck: imperceptible image perturbations can redirect a vision encoder, introduced via a compromised image host [42, 30], a tampered cloud API [37, 55], or malicious documents [33, 6].”