[论文解读] A study of the effect of JPG compression on adversarial images

Gintare Karolina Dziugaite, Zoubin Ghahramani+1 more|arXiv (Cornell University)|Aug 2, 2016

Adversarial Robustness in Machine Learning参考文献 3被引用 255

一句话总结

论文表明 JPEG 重新压缩可以逆转小的 Fast Gradient Sign 对抗扰动，但对于较大扰动则失败，导致自信错误分类留存。

ABSTRACT

Neural network image classifiers are known to be vulnerable to adversarial images, i.e., natural images which have been modified by an adversarial perturbation specifically designed to be imperceptible to humans yet fool the classifier. Not only can adversarial images be generated easily, but these images will often be adversarial for networks trained on disjoint subsets of data or with different architectures. Adversarial images represent a potential security risk as well as a serious machine learning challenge---it is clear that vulnerable neural networks perceive images very differently from humans. Noting that virtually every image classification data set is composed of JPG images, we evaluate the effect of JPG compression on the classification of adversarial images. For Fast-Gradient-Sign perturbations of small magnitude, we found that JPG compression often reverses the drop in classification accuracy to a large extent, but not always. As the magnitude of the perturbations increases, JPG recompression alone is insufficient to reverse the effect.

研究动机与目标

• Investigate whether JPEG compression can mitigate adversarial perturbations in images used for neural network classification.
• Quantify how varying perturbation magnitudes affect JPEG’s ability to reverse adversarial effects.
• Analyze whether JPEG-like projection onto the data subspace improves robustness to adversarial examples.

提出的方法

• Use pre-trained OverFeat network (ImageNet, 2012) to classify original, adversarially perturbed, and JPEG-recompressed images.
• Generate adversarial examples using Fast Gradient Sign (FGS) with ε ∈ {1, 5, 10}.
• Apply JPEG compression at quality 75 to adversarial images to obtain JPEG(Adv_ε(x)).
• Compare top-label probabilities p_w(ℓ_x|x), p_w(ℓ_x|Adv_ε(x)), and p_w(ℓ_x|JPG(Adv_ε(x))).
• Perform statistical summaries (boxplots, scatter plots) of top-label probabilities across the validation set.
• Provide a table summarizing Top-1 Accuracy and mean top-label probability after transformations.

实验结果

研究问题

• RQ1 Can JPEG compression reverse adversarial perturbations of varying magnitudes?
• RQ2 How does JPEG recompression affect the top-label probability and network accuracy for adversarial images?
• RQ3 Is JPEG compression effectively projecting perturbed images back toward the natural image subspace, especially for small perturbations?

主要发现

• JPEG compression often increases the top-label probability for adversarial images perturbed with small magnitude (ε=1), partially restoring correct classification.
• For larger perturbations (ε=5, ε=10), JPEG recompression largely fails to reverse adversarial effects and accuracy remains low.
• Across the validation set, JPEG(Adv_ε) improves accuracy for small perturbations but does not reach the clean-image performance, and larger perturbations show minimal improvement.
• A baseline “JPG_noise” (permuted JPEG effect) does not reproduce JPEG’s beneficial reversal, indicating directionality matters.
• Table 1 shows Top-1 Accuracy and mean top-label probability; for x: 0.58, 0.61; Adv_1: 0.23, 0.13; Adv_5: 0.11, 0.04; Adv_10: 0.09, 0.04; JPG(Adv_1): 0.48, 0.41; JPG(Adv_5): 0.26, 0.17; JPG(Adv_10): 0.17, 0.04; JPG_noise(Adv_1): 0.07, 0.06.