Source-linked AI summary
Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Li Chen, Michael E. Kounavis, Duen Horng Chau
TL;DR
DNNs are vulnerable to small, imperceptible perturbations that cause confident misclassification. This paper uses JPEG compression and vaccinated ensembles to reduce adversarial effects, reporting improved adversarial-image accuracy without harming benign-image performance.
Problem
DNNs can be misled by small, human-imperceptible perturbations, including universal and black-box attacks.
Method
The paper applies JPEG compression as preprocessing and trains ensembles of models on JPEG-compressed images to remove adversarial noise.
Results
Including JPEG-compressed images in training significantly boosts accuracy on adversarial images without hurting performance on benign images.
Takeaways & Limitations
Systematic JPEG compression, especially in ensembles, can counter multiple adversarial attacks and dramatically reduce their effects.
Takeaways & Limitations
Complete immunity to adversarial attacks remains an open problem, and the ensemble's arbitrary image-quality combinations may not be optimal.
Abstract
from arXiv · showhide
Deep neural networks (DNNs) have achieved great success in solving a variety of machine learning (ML) problems, especially in the domain of image recognition. However, recent research showed that DNNs can be highly vulnerable to adversarially generated instances, which look seemingly normal to human observers, but completely confuse DNNs. These adversarial samples are crafted by adding small perturbations to normal, benign images. Such perturbations, while imperceptible to the human eye, are picked up by DNNs and cause them to misclassify the manipulated instances with high confidence. In this work, we explore and demonstrate how systematic JPEG compression can work as an effective pre-processing step in the classification pipeline to counter adversarial attacks and dramatically reduce their effects (e.g., Fast Gradient Sign Method, DeepFool). An important component of JPEG compression is its ability to remove high frequency signal components, inside square blocks of an image. Such an operation is equivalent to selective blurring of the image, helping remove additive perturbations. Further, we propose an ensemble-based technique that can be constructed quickly from a given well-performing DNN, and empirically show how such an ensemble that leverages JPEG compression can protect a model from multiple types of adversarial attacks, without requiring knowledge about the model.
1 Introduction
DNNs are vulnerable to imperceptible adversarial perturbations, while existing defenses can be difficult to design and attack-specific. The paper proposes JPEG compression as a model- and attack-independent preprocessing defense and evaluates it across datasets and compression settings.
- Motivation: Imperceptible perturbations can redirect DNN predictions, including through universal and black-box attacks.These vulnerabilities arise because perturbations exploit gradient information or transferable substitute models.
- Motivation: Existing defenses often require difficult architecture or hyperparameter choices and may resist only particular attack types.The paper motivates a simpler defense that avoids tailoring the model to a known attack.
- Approach: JPEG compression is proposed as a preprocessing step that selectively discards imperceptible information to remove adversarial noise.The approach uses a widely supported image format and is intended for application without model or attack knowledge.
- Evaluation: The study tests compression quality effects on prediction accuracy using CIFAR-10 and GTSRB.The analysis includes systematic variation of JPEG quality and an exemplar GTSRB classification recovered after compression.
- Results: Training with JPEG-compressed images significantly boosts accuracy on adversarial images without hurting benign-image performance.The reported experiments vary the amount of compressed data included during training.
2 Background
Adversarial attacks exploit small, often imperceptible perturbations to mislead DNN classifiers. The paper reviews attack and defense strategies, motivating systematic JPEG compression as a preprocessing defense and extending prior JPEG-based work.
- Adversarial attacks: FGSM and DeepFool construct instance-specific perturbations to confuse a given model, emphasizing computational efficiency and perturbation minimality, respectively.FGSM is selected for its fast computation, while DeepFool produces minimal, highly unnoticeable perturbations.
- Defense mechanisms: Complete immunity to adversarial attacks remains an open problem despite numerous mitigation attempts.The paper frames its defense as threat mitigation rather than guaranteed immunity.
- Defense mechanisms: Existing defenses detect adversarial examples, modify network architectures, alter training, or preprocess inputs before classification.Preprocessing can be used with any machine learning model and alongside other defense categories.
- Research gap: Prior JPEG defenses did not systematically evaluate how compression quality affects performance, whereas this work conducts an extensive study of that capability.Earlier work studied JPEG compression at quality 75 without evaluating varying compression amounts.
- Research gap: Training with JPEG-compressed images differs from testing-only preprocessing and can significantly improve recovery of correct answers on adversarial images.The paper also studies ensembles trained on images compressed at different quality levels.
- JPEG compression: JPEG compression suppresses higher-frequency image components during quantization, reducing information considered less important to human perception.The JPEG pipeline converts color space, subsamples chrominance, applies a DCT, and quantizes blocked frequency-domain data.
3 Experimental setup
The experiments evaluate convolutional neural networks on CIFAR-10 and GTSRB, varying JPEG-related conditions and measuring both baseline accuracy and attack effectiveness.
- Datasets and models: Experiments use convolutional neural networks on CIFAR-10 and the German Traffic Sign Recognition Benchmark.CIFAR-10 has 10 classes; GTSRB has 43 classes and images rescaled to 48 × 48 pixels for analysis.
- Datasets and models: CIFAR-10 contains 50,000 training and 10,000 test examples, while GTSRB contains 39,209 training and 12,630 testing examples.CIFAR-10 images are 32 × 32 pixels, while GTSRB image sizes vary from 15 × 15 to 250 × 250 pixels before rescaling.
- Datasets and models: The CIFAR-10 model uses two Conv-Conv-Pooling blocks, while the GTSRB model extends this architecture with a third block of filter depth 128.Both architectures end with fully connected or softmax classification layers appropriate to their dataset class counts.
- Training: 82.88% and 97.83% are the final testing accuracies on CIFAR-10 and GTSRB, respectively.Both models were trained for 400 epochs with categorical cross entropy, dropout regularization, and Adam optimization.
- Evaluation metric: “Misclassification success” is the proportion of correctly classified instances whose labels are successfully flipped by an adversarial attack.This metric measures attack effectiveness only among instances initially classified correctly.
4 JPEG Compression as Defense
JPEG compression is evaluated as a defense against adversarial attacks by selectively discarding high-frequency information, while retraining on compressed images adapts models to compression artifacts. Across CIFAR-10 and GTSRB, compression and vaccination reduce attack effects, though excessive compression can introduce harmful artifacts.
- JPEG mechanism: JPEG compression selectively suppresses high-frequency information that may contain adversarial perturbations, re-projecting attacked images toward a JPEG-image manifold.The approach uses JPEG preprocessing because its psychovisual design discards information considered less perceptible to humans.
- Attack suppression: JPEG compression counters FGSM and DeepFool attacks on both CIFAR-10 and GTSRB datasets.The experiments vary JPEG quality after adversarial perturbations are introduced.
- Attack suppression: Increasing compression initially improves adversarial-effect removal, but attack success rises again after an inflection point as JPEG artifacts begin confusing the model.Thus, lower image quality does not uniformly improve robustness.
- Attack suppression: Slight compression dramatically lowers DeepFool attack success on CIFAR-10, with the steepest drop occurring at JPEG quality 100.The authors hypothesize that chrominance downsampling may affect the channel targeted more strongly by DeepFool.
- Vaccinating models: Vaccinated models generally outperform the original model on compressed CIFAR-10 test images, especially at lower qualities, with M20 best at quality 20 and M100 best at quality 100.Each model performs best near the image quality used during retraining.
- Vaccinating models: Retraining with compressed images reduces adversarial effects, although lower-quality CIFAR-10 images can lose accuracy from JPEG artifacts, unlike the larger-image GTSRB setting.Attack transferability to vaccinated models subsides as compression matches the quality used during training.
5 Fortified Defense: an Ensemble of Models
The paper protects against attacks by combining models trained across JPEG compression levels and aggregating their predictions. This ensemble can recover accuracy under attack, though the analyzed image-quality combination is arbitrary.
- Ensemble construction: The ensemble combines vaccinated models covering image qualities from 100 through 20 in steps of 10, producing 81 votes for majority-label prediction.Each model evaluates an image at its corresponding compression quality before voting.
- Attack transfer: Attacks transfer across models but are mitigated as JPEG compression increases.Figure 5 compares model accuracies when each model is individually attacked.
- Ensemble construction: Training models on different compression levels makes their decision boundaries dissimilar, so attacks targeting one subspace can be offset by other models.The paper describes the resulting model verdicts as highly uncorrelated, even under strong perturbations.
- Empirical outcome: The ensemble approach recovered accuracy from adversarial attacks by applying JPEG compression, compared with the attacked original model.Table 1 reports the respective test-set performance comparison, but the supplied passage does not include its numerical values.
- Scope and practicality: The image-quality combination was arbitrary, and alternative combinations may be more optimal; changing the combination can produce a different ensemble.The ensemble is nevertheless described as quickly constructible while retaining the original network architecture.
6 Conclusions
The paper presents preliminary empirical evidence that systematic JPEG compression, particularly in ensembles, can counter adversarial attacks and reduce their effects. The authors are continuing evaluation across more attack strategies and datasets.
- Conclusion: Preliminary empirical analysis found that systematic JPEG compression, especially in ensembles, can counter adversarial attacks and dramatically reduce their effects.The authors frame these findings as preliminary.
- Conclusion: Ongoing work evaluates the approaches against additional attack strategies and datasets.The supplied conclusion does not specify which additional strategies or datasets are being tested.