[Paper Review] Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression

Nilaksh Das, Madhuri Shanbhogue+5 more|arXiv (Cornell University)|May 8, 2017

Adversarial Robustness in Machine Learning22 references242 citations

TL;DR

The paper shows JPEG compression as a pre-processing defense against adversarial attacks on image classifiers, and introduces a vaccination strategy by training on compressed images and an ensemble of models to robustly counter attacks like FGSM and DeepFool.

ABSTRACT

Deep neural networks (DNNs) have achieved great success in solving a variety of machine learning (ML) problems, especially in the domain of image recognition. However, recent research showed that DNNs can be highly vulnerable to adversarially generated instances, which look seemingly normal to human observers, but completely confuse DNNs. These adversarial samples are crafted by adding small perturbations to normal, benign images. Such perturbations, while imperceptible to the human eye, are picked up by DNNs and cause them to misclassify the manipulated instances with high confidence. In this work, we explore and demonstrate how systematic JPEG compression can work as an effective pre-processing step in the classification pipeline to counter adversarial attacks and dramatically reduce their effects (e.g., Fast Gradient Sign Method, DeepFool). An important component of JPEG compression is its ability to remove high frequency signal components, inside square blocks of an image. Such an operation is equivalent to selective blurring of the image, helping remove additive perturbations. Further, we propose an ensemble-based technique that can be constructed quickly from a given well-performing DNN, and empirically show how such an ensemble that leverages JPEG compression can protect a model from multiple types of adversarial attacks, without requiring knowledge about the model.

Motivation & Objective

• Motivate a simple, model-agnostic defense against adversarial perturbations in image classification.
• Evaluate JPEG compression as a pre-processing step to remove adversarial noise without harming benign accuracy.
• Propose training (vaccination) with JPEG-compressed images to improve robustness.
• Develop an ensemble of vaccinated models across multiple JPEG quality levels to mitigate transferability of attacks.

Proposed method

• Apply JPEG compression at varying quality levels as a pre-processing step before classification.
• Evaluate against FGSM and DeepFool attacks on CIFAR-10 and GTSRB datasets.
• Train variants of the model on JPEG-compressed images (vaccination) across quality levels 100 to 20.
• Construct an ensemble of vaccinated models over multiple JPEG qualities to vote on predictions and reduce attack impact.

Experimental results

Research questions

• RQ1 Does JPEG compression before classification reduce adversarial attack effectiveness on CIFAR-10 and GTSRB?
• RQ2 Can training models on JPEG-compressed images (vaccination) improve robustness to adversarial perturbations?
• RQ3 Does an ensemble of vaccinated models across different JPEG qualities provide stronger defense than a single model?
• RQ4 How does JPEG quality affect benign accuracy and adversarial resilience?

Key findings

• JPEG compression can counter FGSM and DeepFool attacks on CIFAR-10 and GTSRB, with greater compression often reducing attack success rates initially.
• Vaccinating models by training with JPEG-compressed images improves robustness across adversarial test sets.
• An ensemble of vaccinated models voting on predictions from images compressed at multiple quality levels markedly reduces misclassification under attack compared to the original model.
• On CIFAR-10, the ensemble significantly boosts accuracy under attack from 28.97% (FGSM) and 27.44% (DeepFool) to 79.57% and 82.71% respectively.
• On GTSRB, the ensemble improves robustness from 41.00% (FGSM) and 68.19% (DeepFool) to 73.37% and 91.70% respectively.
• Lower JPEG quality can decrease benign accuracy on some datasets (notably CIFAR-10), due to JPEG artifacts; larger images (GTSRB) show less degradation.