Source-linked AI summary
A study of the effect of JPG compression on adversarial images
Gintare Karolina Dziugaite, Zoubin Ghahramani, Daniel M. Roy
TL;DR
Adversarial images expose a vulnerability in neural-network classifiers and pose security and machine-learning challenges. The paper evaluates JPG compression as a way to mitigate Fast-Gradient-Sign attacks, finding substantial but incomplete recovery for small perturbations and insufficient recovery for larger ones.
Problem
Neural-network image classifiers can be fooled by imperceptible adversarial perturbations, creating a potential security risk and a challenge because their image representations differ from human perception.
Method
The study evaluates how JPG compression affects adversarial images, using a pretrained OverFeat classifier and defining JPG compression at quality level 75.
Results
JPG compression often reverses the classification-accuracy drop caused by small Fast-Gradient-Sign perturbations, but becomes insufficient as perturbation magnitude increases.
Takeaways & Limitations
JPG recompression alone is far from a complete solution for adversarial examples because even larger evaluated perturbations remained barely visible to an untrained human eye.
Takeaways & Limitations
Current scalable approximate Bayesian neural networks reported confident misclassifications rather than high uncertainty on adversarial examples.
Abstract
from arXiv · showhide
Neural network image classifiers are known to be vulnerable to adversarial images, i.e., natural images which have been modified by an adversarial perturbation specifically designed to be imperceptible to humans yet fool the classifier. Not only can adversarial images be generated easily, but these images will often be adversarial for networks trained on disjoint subsets of data or with different architectures. Adversarial images represent a potential security risk as well as a serious machine learning challenge---it is clear that vulnerable neural networks perceive images very differently from humans. Noting that virtually every image classification data set is composed of JPG images, we evaluate the effect of JPG compression on the classification of adversarial images. For Fast-Gradient-Sign perturbations of small magnitude, we found that JPG compression often reverses the drop in classification accuracy to a large extent, but not always. As the magnitude of the perturbations increases, JPG recompression alone is insufficient to reverse the effect.
1 Introduction
Neural networks achieve strong image-classification performance but remain vulnerable to imperceptible, targeted adversarial perturbations. This study examines whether JPG recompression mitigates that vulnerability, finding stronger recovery for small Fast-Gradient-Sign perturbations than for larger ones.
- Neural networks achieve state-of-the-art accuracy on standard image-classification benchmarks but can be fooled by imperceptible, targeted perturbations.
- JPG compression is evaluated as a possible way to remove aspects of adversarial perturbations because image-classification datasets commonly contain JPG images.
- Small Fast-Gradient-Sign perturbations are often substantially mitigated by JPG compression, although the reversal is not universal.
- As perturbation magnitude increases, JPG compression alone fails to restore non-adversarial classification and cannot by itself eliminate the security risk.
- The study varies perturbation magnitude in a complementary evaluation to prior work examining JPG compression quality.
2 Related Work
Prior work established adversarial examples, their transfer across models, their security implications, and several partial defenses. Related studies also analyzed their mechanisms, robustness, physical persistence, and theoretical properties.
- Szegedy et al. introduced adversarial examples by finding the smallest additive perturbation that causes an image classifier to misclassify.
- Adversarial examples can transfer across models trained on disjoint data or using different architectures and initializations, enabling security exploits.
- Research has linked adversarial vulnerability to network linearity, distinguished adversarial from random noise, and visualized perturbation effects on activations.
- Autoencoders can remove adversarial noise, but an initial autoencoder-classifier combination became less robust; contractive autoencoders increased the required perturbation size.
- Theoretical work derived robustness upper bounds for binary linear and quadratic classifiers, suggesting greater robustness for quadratic models.
- Physical-world experiments showed that some adversarial images remained effective after printing and recapture by a cellphone camera.
3 Hypothesis
The paper hypothesizes that adversarial examples lie outside a lower-dimensional natural-image subspace, where neural networks may make confident predictions without training support. JPG compression is considered as a projection-like operation that could return such images toward the data subspace, though uncertainty-based alternatives and human susceptibility remain unresolved.
- The central questions concern the nature, origins, and robustness of adversarial examples across training data, architectures, and related changes.
- When a perturbation is approximately orthogonal to the JPG subspace, compression can project the adversarial example back toward the data subspace.
- The hypothesis places adversarial examples outside the data subspace, where neural networks receive little or no training guidance and may still produce strong predictions.
- Confidence or credible sets might instead signal uncertainty outside the data subspace, but current approaches have not demonstrated reliable uncertainty on adversarial images.
- Data augmentation may remove some adversarial examples, but its effectiveness depends on whether perceptible perturbations are accurately represented by the augmentation scheme.
- Natural-image classification is high-dimensional but has low intrinsic dimension, motivating a distinction between the data subspace and a broader human perceptual subspace.
- Human susceptibility to adversarial imagery remains poorly understood, including whether small mean-squared-error changes can dramatically alter perception.
- Because the natural-image subspace is difficult to characterize directly, the study considers lower-dimensional subspaces associated with JPG image datasets.
4 Empirical findings
The study evaluates JPG recompression as a transformation of Fast-Gradient-Sign adversarial images using the OverFeat network across perturbation magnitudes. Recompression substantially improves classification for small perturbations, but its effectiveness declines as perturbation magnitude increases and depends on the compression structure.
- Small perturbations: Mean top-label probability fell from approximately 0.6 to below 0.15 at magnitude 1/255, then recovered to just over 0.4 after JPG compression.JPG compression restored confidence toward the level of compressed clean images but did not fully recover it.
- Larger perturbations: For larger perturbations of 5/255 and 10/255, JPG compression produced only slight improvement and did not practically reverse the adversarial effect.The top-label probability remained almost unchanged, and classification accuracy stayed below a practical solution threshold.
- Small perturbations: For ϵ = 1, JPG recompression often brought top-label probabilities nearly back to original-image levels, although its average effect on clean images was negative.Individual images could experience either increases or decreases, with high-confidence images affected least by compression.
- JPG noise comparison: JPG noise preserved permutation-invariant statistics but removed directional information, and adversarial images remained adversarial after this randomized perturbation.The average predicted probability for the original label was even lower after adding JPG noise than for adversarial images.
5 Conclusion
JPG compression can reverse small Fast-Gradient-Sign adversarial perturbations, but it does not reliably remove stronger perturbations and is therefore far from a complete solution.
- JPG compression reverses small Fast-Gradient-Sign adversarial perturbations, but not larger ones.The authors report that the mechanism behind reversal of small perturbations remains unknown.
- For perturbations of magnitude ϵ = 1, JPG compression often raises top-label probabilities after adversarial modification, partially reversing the effect for many images.In Figure 4, most points occupy the upper-left triangle, while some perturbations are not removed or are only partially removed.
- Adding JPG noise does not reverse adversarial perturbations and can place top-label probabilities closer to the lower axis than simple adversarial modification.