A study of the effect of JPG compression on adversarial images

Abstract

Neural network image classifiers are known to be vulnerable to adversarial images, i.e., natural images which have been modified by an adversarial perturbation specifically designed to be imperceptible to humans yet fool the classifier. Not only can adversarial images be generated easily, but these images will often be adversarial for networks trained on disjoint subsets of data or with different architectures. Adversarial images represent a potential security risk as well as a serious machine learning challenge---it is clear that vulnerable neural networks perceive images very differently from humans. Noting that virtually every image classification data set is composed of JPG images, we evaluate the effect of JPG compression on the classification of adversarial images. For Fast-Gradient-Sign perturbations of small magnitude, we found that JPG compression often reverses the drop in classification accuracy to a large extent, but not always. As the magnitude of the perturbations increases, JPG recompression alone is insufficient to reverse the effect.

arXiv comment8 pages, 4 figures

References in corpus (2)

• Explaining and Harnessing Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples

Cited by in corpus (111)

• Countering Adversarial Images using Input Transformations
• Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research
• Adversarial Examples: Opportunities and Challenges
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Motivating the Rules of the Game for Adversarial Example Research
• CycleGAN, a Master of Steganography
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Interpreting and Improving Adversarial Robustness of Deep Neural Networks with Neuron Sensitivity
• Characterizing Audio Adversarial Examples Using Temporal Dependency
• Smooth Adversarial Training
• Blocking Transferability of Adversarial Examples in Black-Box Learning Systems
• Adversarial Examples in Modern Machine Learning: A Review
• Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression
• Defending against Adversarial Images using Basis Functions Transformations
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Defense against Universal Adversarial Perturbations
• A Survey on Security Attacks and Defense Techniques for Connected and Autonomous Vehicles
• Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack
• ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networks
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Benchmarking Adversarial Robustness
• SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing
• When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• DUP-Net: Denoiser and Upsampler Network for 3D Adversarial Point Clouds Defense
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• PAC-learning in the presence of evasion adversaries
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving
• Improving adversarial robustness of deep neural networks by using semantic information
• Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors
• Improving Network Robustness against Adversarial Attacks with Compact Convolution
• AdvDrop: Adversarial Attack to DNNs by Dropping Information
• Transferability of Adversarial Examples to Attack Cloud-based Image Classifier Service
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Efficiency-driven Hardware Optimization for Adversarially Robust Neural Networks
• Retrieval-Augmented Convolutional Neural Networks for Improved Robustness against Adversarial Examples
• On the Limitations of Denoising Strategies as Adversarial Defenses
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space
• Adversarial Robustness Assessment: Why both $L_0$ and $L_{\infty }$ Attacks Are Necessary
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• A Person Re-identification Data Augmentation Method with Adversarial Defense Effect
• Generative Dynamic Patch Attack
• Category-wise Attack: Transferable Adversarial Examples for Anchor Free Object Detection
• Patch-wise++ Perturbation for Adversarial Targeted Attacks
• RobFR: Benchmarking Adversarial Robustness on Face Recognition
• Staircase Sign Method for Boosting Adversarial Attacks
• CAP-GAN: Towards Adversarial Robustness with Cycle-consistent Attentional Purification
• Improving Global Adversarial Robustness Generalization With Adversarially Trained GAN
• Defense-VAE: A Fast and Accurate Defense against Adversarial Attacks
• Detecting Localized Adversarial Examples: A Generic Approach using Critical Region Analysis
• Regularizers for Single-step Adversarial Training
• Adversarial Defense by Stratified Convolutional Sparse Coding
• A Comprehensive Evaluation Framework for Deep Model Robustness
• SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)
• Exploiting the Inherent Limitation of L0 Adversarial Examples
• Fast Gradient Non-sign Methods
• MagDR: Mask-guided Detection and Reconstruction for Defending Deepfakes
• Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks
• Defending Adversarial Attacks by Correcting logits
• Active Subspace of Neural Networks: Structural Analysis and Universal Attacks
• A Game Theoretic Analysis of Additive Adversarial Attacks and Defenses
• Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features
• Medical Aegis: Robust adversarial protectors for medical images
• Patch-wise Attack for Fooling Deep Neural Network
• Analytical Moment Regularizer for Gaussian Robust Networks
• Adversarial Item Promotion: Vulnerabilities at the Core of Top-N Recommenders that Use Images to Address Cold Start
• Exposing the Robustness and Vulnerability of Hybrid 8T-6T SRAM Memory Architectures to Adversarial Attacks in Deep Neural Networks
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Deep Neural Network Perception Models and Robust Autonomous Driving Systems
• Moving Target Defense for Deep Visual Sensing against Adversarial Examples
• Perceptually Constrained Adversarial Attacks
• Anti-Bandit Neural Architecture Search for Model Defense
• A Frequency Perspective of Adversarial Robustness
• Noise Optimization for Artificial Neural Networks
• Convolutional Neural Networks with Transformed Input based on Robust Tensor Network Decomposition
• Multi-objective Search of Robust Neural Architectures against Multiple Types of Adversarial Attacks
• Dompteur: Taming Audio Adversarial Examples
• A Hierarchical Feature Constraint to Camouflage Medical Adversarial Attacks
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• Representation Quality Of Neural Networks Links To Adversarial Attacks and Defences
• DetectX -- Adversarial Input Detection using Current Signatures in Memristive XBar Arrays
• Meta Gradient Adversarial Attack
• On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• Unifying Bilateral Filtering and Adversarial Training for Robust Neural Networks
• Analysis of Random Perturbations for Robust Convolutional Neural Networks
• Moiré Attack (MA): A New Potential Risk of Screen Photos
• Context-Aware Image Denoising with Auto-Threshold Canny Edge Detection to Suppress Adversarial Perturbation
• Fast Local Attack: Generating Local Adversarial Examples for Object Detectors
• Mitigating large adversarial perturbations on X-MAS (X minus Moving Averaged Samples)
• Transferable Adversarial Examples for Anchor Free Object Detection
• A general metric for identifying adversarial images
• Defense-friendly Images in Adversarial Attacks: Dataset and Metrics for Perturbation Difficulty
• A Black-box Adversarial Attack Strategy with Adjustable Sparsity and Generalizability for Deep Image Classifiers
• Adaptive Perturbation for Adversarial Attack
• Adversarial Robustness Across Representation Spaces
• Towards Natural Robustness Against Adversarial Examples
• On Intrinsic Dataset Properties for Adversarial Machine Learning
• Human Imperceptible Attacks and Applications to Improve Fairness
• Countering Adversarial Examples: Combining Input Transformation and Noisy Training
• Progressive Compressed Records: Taking a Byte out of Deep Learning Data
• Defenses Against Multi-Sticker Physical Domain Attacks on Classifiers
• Multi-granularity Textual Adversarial Attack with Behavior Cloning
• On Brightness Agnostic Adversarial Examples Against Face Recognition Systems