[Paper Review] Cloud-based Image Classification Service Is Not Robust To Simple Transformations: A Forgotten Battlefield

Dou Goodman, Tao Wei|arXiv (Cornell University)|Jun 19, 2019

Adversarial Robustness in Machine Learning20 references4 citations

TL;DR

This paper introduces Simple Transformation (ST) attacks—using basic image operations like Gaussian noise, salt-and-pepper noise, rotation, and monochromatization—that achieve near-100% success rates in bypassing cloud-based image classifiers across Amazon, Google, Microsoft, and Clarifai. It further proposes the Image Fusion (IF) attack, which combines images to evade detection with over 98% success, demonstrating that even simple, non-DL techniques can break widely used cloud vision services.

ABSTRACT

Many recent works demonstrated that Deep Learning models are vulnerable to adversarial examples.Fortunately, generating adversarial examples usually requires white-box access to the victim model, and the attacker can only access the APIs opened by cloud platforms. Thus, keeping models in the cloud can usually give a (false) sense of security.Unfortunately, cloud-based image classification service is not robust to simple transformations such as Gaussian Noise, Salt-and-Pepper Noise, Rotation and Monochromatization. In this paper,(1) we propose one novel attack method called Image Fusion(IF) attack, which achieve a high bypass rate,can be implemented only with OpenCV and is difficult to defend; and (2) we make the first attempt to conduct an extensive empirical study of Simple Transformation (ST) attacks against real-world cloud-based classification services. Through evaluations on four popular cloud platforms including Amazon, Google, Microsoft, Clarifai, we demonstrate that ST attack has a success rate of approximately 100% except Amazon approximately 50%, IF attack have a success rate over 98% among different classification services. (3) We discuss the possible defenses to address these security challenges.Experiments show that our defense technology can effectively defend known ST attacks.

Motivation & Objective

• To investigate the robustness of real-world cloud-based image classification services against simple, non-adversarial image transformations.
• To expose the vulnerability of cloud AI services to low-complexity attacks that do not require deep learning expertise or white-box access.
• To propose a novel, highly effective attack method—Image Fusion (IF)—that achieves over 98% bypass rates across major cloud platforms.
• To conduct the first extensive empirical study of black-box attacks on real-world cloud vision APIs using simple, practical transformations.
• To develop and validate a defense strategy effective against known ST attacks through model training and preprocessing techniques.

Proposed method

• Proposes Simple Transformation (ST) attacks using four common image operations: Gaussian noise, salt-and-pepper noise, rotation, and monochromatization, all implementable with minimal OpenCV code.
• Introduces the Image Fusion (IF) attack, a spatial transformation-based method that combines multiple images to generate inputs that evade detection by cloud classifiers.
• Employs a query-efficient, black-box approach relying solely on API access, without requiring model architecture or parameter knowledge.
• Designs a defense strategy involving both model retraining and image preprocessing, using adaptive filters tuned to specific noise types.
• Evaluates defenses on ImageNet-based datasets, demonstrating parameter sensitivity and filter selection effectiveness for different noise types.
• Uses extensive empirical evaluation across four major cloud platforms (Amazon, Google, Microsoft, Clarifai) to measure attack success rates and defense efficacy.

Experimental results

Research questions

• RQ1 To what extent are cloud-based image classification services vulnerable to simple, non-adversarial image transformations such as noise and rotation?
• RQ2 Can a black-box attack using only basic image processing operations achieve high evasion rates against real-world cloud vision APIs?
• RQ3 How effective is the proposed Image Fusion (IF) attack in bypassing multiple cloud-based image classifiers compared to standard ST attacks?
• RQ4 What defense mechanisms can effectively mitigate known ST attacks without requiring access to the internal model parameters?
• RQ5 How do different preprocessing filters and their parameters affect the resilience of images against specific types of ST attacks?

Key findings

• Simple Transformation (ST) attacks achieve a success rate of approximately 100% on Google, Microsoft, and Clarifai, and about 50% on Amazon’s cloud service.
• The proposed Image Fusion (IF) attack achieves a bypass rate exceeding 98% across all tested cloud platforms, demonstrating high effectiveness.
• The attack is practical and implementable with only a few lines of OpenCV code, requiring no deep learning knowledge or model access.
• The study reveals that cloud-based image classifiers are highly sensitive to perceptually minor transformations, undermining the assumption of security through obscurity.
• A defense strategy combining model retraining and adaptive preprocessing filters effectively resists known ST attacks, with performance dependent on correct filter selection and parameter tuning.
• Experiments confirm that optimal filter parameters vary by noise type, and that defense effectiveness is maximized when filters are specifically matched to the attack type.