A study of the effect of JPG compression on adversarial images

2016/08/02 by Gintare Karolina Dziugaite, Zoubin Ghahramani, Dziugaite, Gintare Karolina +3 · 34 citations
Computer Science · Medicine · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Medical Imaging Techniques and Applications

paper · pdf · doi:10.48550/arxiv.1608.00853

openalex publication_date 2016/08/02 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Neural network image classifiers are known to be vulnerable to adversarial images, i.e., natural images which have been modified by an adversarial perturbation specifically designed to be imperceptible to humans yet fool the classifier. Not only can adversarial images be generated easily, but these images will often be adversarial for networks trained on disjoint subsets of data or with different architectures. Adversarial images represent a potential security risk as well as a serious machine learning challenge---it is clear that vulnerable neural networks perceive images very differently from humans. Noting that virtually every image classification data set is composed of JPG images, we evaluate the effect of JPG compression on the classification of adversarial images. For Fast-Gradient-Sign perturbations of small magnitude, we found that JPG compression often reverses the drop in classification accuracy to a large extent, but not always. As the magnitude of the perturbations increases, JPG recompression alone is insufficient to reverse the effect.

Cited by

• Physical ID-Transfer Attacks against Multi-Object Tracking via Adversarial Trajectory
• T2I-Based Physical-World Appearance Attack against Traffic Sign Recognition Systems in Autonomous Driving
• Enhancing Adversarial Transferability by Balancing Exploration and Exploitation with Gradient-Guided Sampling
• Trans-defense: Transformer-based Denoiser for Adversarial Defense with Spatial-Frequency Domain Representation
• Countering Adversarial Images using Input Transformations
• MS-GAGA: Metric-Selective Guided Adversarial Generation Attack
• Patch-wise Attack for Fooling Deep Neural Network
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Adaptive Perturbation for Adversarial Attack
• LoRA Patching: Exposing the Fragility of Proactive Defenses against Deepfakes
• DRIFT: Divergent Response in Filtered Transformations for Robust Adversarial Defense
• Adversarial Robustness Across Representation Spaces
• CycleGAN, a Master of Steganography
• ORCA: Agentic Reasoning For Hallucination and Adversarial Robustness in Vision-Language Models
• On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions
• Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• Phi: Preference Hijacking in Multi-modal Large Language Models at Inference Time
• Deep Neural Network Perception Models and Robust Autonomous Driving Systems
• Motivating the Rules of the Game for Adversarial Example Research
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• Foe for Fraud: Transferable Adversarial Attacks in Credit Card Fraud Detection
• Enhancing Targeted Adversarial Attacks on Large Vision-Language Models via Intermediate Projector
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networks
• ForensicsSAM: Toward Robust and Unified Image Forgery Detection and Localization Resisting to Adversarial Attack
• Adversarial Video Promotion Against Text-to-Video Retrieval
• Keep It Real: Challenges in Attacking Compression-Based Adversarial Purification
• Moiré Attack (MA): A New Potential Risk of Screen Photos
• Transferable Adversarial Examples for Anchor Free Object Detection
• Transferability of Adversarial Examples to Attack Cloud-based Image Classifier Service
• Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments
• Adversarial Examples Are a Natural Consequence of Test Error in Noise

Related

• Countering Adversarial Examples: Combining Input Transformation and Noisy Training
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• The Effects of JPEG and JPEG2000 Compression on Attacks using Adversarial Examples
• Protecting JPEG Images Against Adversarial Attacks
• Feature compression is the root cause of adversarial fragility in neural network classifiers