Preprocessing Failure and Adversarial Detection in Depthwise-Separable Edge Vision Systems

Jannatul Masruk Mukta; Rifa Sanjida; Adrita Rahman Tory; Md. Saifur Rahman; Khondokar Fida Hasan

Source-linked AI summary

Preprocessing Failure and Adversarial Detection in Depthwise-Separable Edge Vision Systems

Jannatul Masruk Mukta, Rifa Sanjida, Adrita Rahman Tory, Md. Saifur Rahman, Khondokar Fida Hasan

arXiv:2609.03453v1Sep 3, 2026cs.CVcs.CR

TL;DR

Preprocessing defenses were widely accepted despite being evaluated mainly on architectures unlike the depthwise-separable CNNs used in edge deployments. This paper evaluates six defenses across architecture families and finds poor recovery on depthwise-separable models, while identifying output divergence as a detection signal.

Problem
Foundational preprocessing-defense evaluations focused on residual or Inception-class architectures, leaving their generalization to deployed depthwise-separable CNNs untested.
Method
The paper evaluates six preprocessing defenses across depthwise-separable and residual architectures, combining defense, quality, ablation, transferability, and detection analyses.
Results
Across perturbation levels, depthwise-separable models show poor recovery while the residual model shows partial recovery; EfficientNetB0 reaches at most 0.6% DSR, whereas ResNet50 reaches 52.23%.
Takeaways & Limitations
Preprocessing-only defenses should be treated as ineffective for recovery on depthwise-separable edge backbones and redeployed as detection mechanisms based on output divergence.
Takeaways & Limitations
The study evaluates only three architectures and one attack family, and the detection proposal still requires validation against adaptive attacks, threshold calibration, and full ROC analysis.

Abstract

from arXiv · show

Preprocessing-based defenses are the standard first-line response to adversarial attacks on edge vision systems, requiring no retraining, no architectural changes, and widely recommended as model-agnostic mitigations. Yet the foundational evaluations of these defenses were conducted on residual or Inception-class architectures, not on the depthwise-separable CNNs that dominate edge deployments. This untested assumption leaves a gap in the security evaluation literature. This paper closes that gap by evaluating six preprocessing defenses against adversarial perturbations across both architecture families. Across all perturbation levels and defenses tested, the two depthwise-separable architectures show consistently poor recovery while the residual architecture shows partial recovery; ablation results are consistent with an architectural rather than parametric explanation, though only three architectures and one attack family are evaluated. Crucially, this failure is not merely a negative result. The same output divergence that disqualifies preprocessing as a recovery mechanism reveals a detection opportunity: preprocessing consistently disrupts clean predictions while leaving adversarial predictions largely unchanged, an asymmetry that is directly measurable without retraining or architectural modification. We further show that standard image quality metrics are unreliable proxies for defense effectiveness, a methodological gap in current evaluation practice. A practitioner decision framework is provided for adversarially resilient edge vision deployment.

1 Introduction

The paper examines whether preprocessing defenses generalize from residual and Inception-class models to depthwise-separable CNNs used in edge deployments. It finds poor recovery on depthwise-separable architectures and reframes preprocessing failure as a measurable detection opportunity.

Motivation: Preprocessing defenses are widely used as model-agnostic, no-retraining mitigations, but their foundational evaluations focused on residual or Inception-class architectures rather than depthwise-separable CNNs.The paper identifies this untested generalization as a meaningful security-evaluation gap because depthwise-separable models are deployed on resource-constrained edge hardware.
Findings: Across six defenses and four perturbation magnitudes, depthwise-separable architectures show consistently poor recovery, while the residual architecture shows partial recovery.The paper frames FGSM-based failure as a conservative lower bound because FGSM is described as the weakest adversary in the threat landscape.
Detection opportunity: Preprocessing disrupts clean predictions substantially while leaving adversarial predictions largely unchanged, producing a directly measurable detection signal without retraining.The proposed reinterpretation is to redeploy preprocessing from recovery mode to detection mode.
Contributions: The paper contributes a systematic depthwise-separable evaluation, architectural analysis, evidence that PSNR and SSIM are unreliable security proxies, and a practitioner deployment framework.The contribution list also includes output-divergence detection analysis on MobileNetV2 and EfficientNetB0.

2 Related Work

Prior work established preprocessing defenses and output-inconsistency detection mainly on residual, Inception, AlexNet, and DenseNet models. This paper addresses the absence of joint defense, quality, and detection evaluation on depthwise-separable architectures.

Research gap: No prior study evaluates preprocessing defenses on depthwise-separable architectures with joint quality evaluation or detection analysis.Table 1 summarizes the related-work gap addressed by this study.
Adversarial attacks: FGSM, PGD, C&W, and AutoAttack form a progression from standard first-line evaluation toward stronger adversarial benchmarks.The paper uses FGSM and characterizes its security conclusion as conservative relative to stronger attacks.
Preprocessing defenses: Guo et al. reported moderate robustness improvements on Inception-v3, while Feature Squeezing extended preprocessing toward detection on ResNet and DenseNet.JPEG defenses were also evaluated on AlexNet, leaving depthwise-separable CNNs untested.
Architecture dependence: The architecture-dependent robustness literature compares model families and robustness trade-offs but does not characterize preprocessing-defense behavior on depthwise-separable CNNs.The cited comparisons include formal accuracy–robustness trade-offs and stronger Vision Transformer performance under attack.
Adversarial detection: Earlier adversarial-detection frameworks used output inconsistency or reconstruction error, but their evaluations were exclusively on residual architectures.The present study provides evidence that detection signals are stronger on depthwise-separable CNNs.

3 Problem Formulation

The paper formalizes FGSM perturbations, preprocessing-based inference, defense success, fidelity, composite scoring, and output-divergence detection. The threat model is white-box, untargeted, and non-adaptive, and detection thresholds are calibrated on clean validation data.

3.1 Notation and Threat Model: A preprocessing defense dϕ is applied before model inference under a white-box, untargeted, non-adaptive threat model.The attacker has full model access but does not know the defense.
3.2 Metrics: Defense Success Rate (DSR) is the primary security metric for measuring whether preprocessing restores the correct label on adversarial inputs.Under the stated threat model, DSR values are upper bounds because adaptive or iterative attackers are expected to reduce defense success.
3.2 Metrics: PSNR measures pixel fidelity, SSIM measures structural fidelity, and the Composite Score integrates security with both fidelity measures.Values above 40 dB PSNR are treated as perceptually lossless; the DSR component receives weight 0.5.
3.2 Metrics: The detection criterion operationalizes Feature Squeezing by using output inconsistency between raw and preprocessed inputs.The paper states that empirical results establish large and consistent δ for adversarial inputs on depthwise-separable architectures.
3.2 Metrics: Detection divergence δ is the L1 difference between model softmax outputs for an adversarial input before and after preprocessing.An input is flagged when δ > τ, with τ calibrated on clean validation data.

4 Methodology

The methodology evaluates three architectures spanning residual and depthwise-separable designs using six model-agnostic preprocessing defenses without defense-specific retraining. It also documents system specifications and defense configurations, while excluding EfficientNetB0 from comparative quality analysis because its PSNR is an internal-normalization artifact.

4.1 Architectures and Dataset: Three architectures span residual and depthwise-separable design families, including ResNet50, MobileNetV2, and EfficientNetB0.ResNet50 uses residual skip connections, whereas MobileNetV2 and EfficientNetB0 use depthwise-separable primitives; EfficientNetB0 additionally uses compound scaling and squeeze-and-excitation blocks.
4.1 Architectures and Dataset: EfficientNetB0 is excluded from comparative image-quality analysis because its constant PSNR of 4.56 dB reflects internal normalization rather than perturbation magnitude.The transforms operate correctly, but the constant PSNR makes comparative quality analysis structurally invalid for this architecture.
4.2 Defense Configurations: Six model-agnostic defenses comprise Gaussian blur, JPEG compression, median filtering, bit-depth reduction, spatial resizing, and a blur–JPEG ensemble.The defenses implement spatial smoothing, DCT quantization, rank-order statistics, intensity quantization, downscale–upscale processing, and sequential blur followed by JPEG compression.
4.2 Defense Configurations: No defense-specific retraining was performed, preserving the model-agnostic preprocessing setup.Defense configurations are summarized in Table 3.

5 Results

Across six preprocessing defenses, depthwise-separable architectures show near-total defense failure, whereas ResNet50 retains partial recovery; output divergence also reveals a detection signal.

5.2 Consistent Defense Failure on Depthwise-Separable: FGSM compromises all three architectures, reaching 100% ASR on EfficientNetB0 at ε=0.001 and near-complete success across perturbation levels.ResNet50 rises from 94.20% to 99.00% ASR, while MobileNetV2 reaches 90.8% at ε=0.001 and 98.8% by ε=0.01.
5.2 Consistent Defense Failure on Depthwise-Separable: 0.6% maximum DSR on EfficientNetB0, with most configurations at 0.0%, while MobileNetV2 stays below 9% beyond ε=0.001 and ResNet50 reaches 52.23%.The heatmap shows EfficientNetB0 near-zero across perturbation magnitudes, MobileNetV2 collapsing at higher ε, and partial ResNet50 effectiveness at low ε.
5.3 Architectural Versus Parametric Failure: Gaussian-blur sweeps keep MobileNetV2 DSR below 9% despite stable PSNR and SSIM, while ResNet50 exhibits a non-trivial DSR profile peaking near σ=2.0.The contrasting responses under identical transform conditions support an architectural rather than parametric explanation.
5.5 Output Divergence and Transferability: EfficientNetB0 shows a 24.1-percentage-point average clean-accuracy drop versus below 0.3% average DSR, creating a measurable detection signal.For example, Median Filter 5×5 causes a 44.8-point clean drop with 0.0% DSR, while Gaussian Blur σ=2.0 causes a 36.8-point drop with 0.4% DSR.
5.5 Output Divergence and Transferability: Preprocessing adds negligible overhead, with transforms costing 0.02–0.74 ms per image compared with hundreds of milliseconds for model inference.The proposed detection pipeline adds one preprocessing pass and one additional inference.

6 Discussion

The discussion reframes preprocessing failure on depthwise-separable CNNs as a detection opportunity, while linking the pattern to architecture and deployment decisions.

6.1 Architectural Mechanism: Depthwise-separable factorization may produce spatially concentrated, channel-consistent FGSM gradients that preprocessing attenuates without reversing.This is presented as a mechanistic hypothesis rather than a formally established explanation.
6.2 Redeploying Preprocessing as a Detection Mechanism: A mean asymmetry gap of 24.1 pp, reaching 44.8 pp in individual configurations, separates clean-output disruption from largely unchanged adversarial outputs.Recovery requires divergence toward the correct class, whereas detection only requires large divergence; Table 7 supports the latter condition.
6.2 Redeploying Preprocessing as a Detection Mechanism: The proposed detector runs inference on raw and preprocessed inputs, rejecting cases whose output divergence δ exceeds a threshold calibrated on clean validation data.The approach requires no retraining or architectural change, with 0.15–0.74 ms per preprocessing pass.
6.3 Security Implications: Adaptive adversaries can minimize δ to evade detection, and threshold calibration must use clean validation data representative of deployment conditions.Full ROC analysis and adaptive-attack validation remain future priorities.
6.2 Redeploying Preprocessing as a Detection Mechanism: The detection signal is reported as stronger on depthwise-separable architectures than on the residual architectures where Feature Squeezing was originally evaluated.The paper characterizes this as an inversion of the conventional robustness hierarchy: harder to defend, easier to detect.
6.3 Security Implications: The practitioner guide recommends treating preprocessing as a detection component rather than a recovery defense, alongside alternatives such as adversarial training or architecture replacement.The listed guide includes bit-depth characterization, detection-first deployment, ensembles, and monitoring perturbation magnitude.

7 Limitations and Future Work

The paper’s conclusions are bounded by its attack, architecture, and validation scope, motivating broader empirical testing of both recovery and detection.

Scope Boundaries: The study evaluates only three architectures and one attack family, so the depthwise-separable failure hypothesis does not generalize across the full CNN landscape.Future evaluations are proposed for MobileNetV3, ShuffleNetV2, and lightweight Vision Transformers such as MobileViT.
Attack Scope: Exclusive use of non-adaptive FGSM makes reported DSR values upper bounds, while adaptive and iterative attacks may produce lower defense success.The paper identifies adaptive attacks and AutoAttack as important extensions.
Detection Validation: The detection proposal still requires threshold calibration, full ROC analysis, and evaluation against adversaries aware of the detection mechanism.These tests are needed to validate deployment performance under adaptive conditions.

8 Conclusion

The conclusion finds that preprocessing offers little recovery against FGSM on depthwise-separable CNNs but exposes a measurable detection signal with low overhead.

8 Conclusion: 0.6% DSR is the best EfficientNetB0 configuration, versus below 9% for MobileNetV2 and up to 52.23% recovery for ResNet50.The three-tier hierarchy is statistically confirmed, with architectural causation supported by parameter ablation and gradient-magnitude explanations ruled out by complete bidirectional transferability.
8 Conclusion: PSNR and SSIM are statistically unreliable proxies for defense effectiveness.Image-quality preservation therefore does not establish adversarial recovery.
8 Conclusion: Preprocessing disrupts clean EfficientNetB0 outputs by 24.1 percentage points on average while leaving adversarial outputs unchanged, enabling detection without retraining and with under 1 ms overhead per image.The proposed consequence is to redeploy preprocessing for detection rather than recovery.