[Paper Review] The Effects of JPEG and JPEG2000 Compression on Attacks using Adversarial Examples

Ayse Elvan Aydemir, Alptekin Temizel+1 more|arXiv (Cornell University)|Mar 28, 2018

Adversarial Robustness in Machine Learning9 references21 citations

TL;DR

This paper investigates JPEG and JPEG2000 compression as pre-processing defenses against adversarial examples in deep learning classifiers. It demonstrates that JPEG2000 outperforms JPEG in reducing adversarial noise due to higher compression efficiency and lower distortion, maintaining classification accuracy better at equivalent PSNR levels, especially under high compression rates without blocking artifacts.

ABSTRACT

Adversarial examples are known to have a negative effect on the performance of classifiers which have otherwise good performance on undisturbed images. These examples are generated by adding non-random noise to the testing samples in order to make classifier misclassify the given data. Adversarial attacks use these intentionally generated examples and they pose a security risk to the machine learning based systems. To be immune to such attacks, it is desirable to have a pre-processing mechanism which removes these effects causing misclassification while keeping the content of the image. JPEG and JPEG2000 are well-known image compression techniques which suppress the high-frequency content taking the human visual system into account. JPEG has been also shown to be an effective method for reducing adversarial noise. In this paper, we propose applying JPEG2000 compression as an alternative and systematically compare the classification performance of adversarial images compressed using JPEG and JPEG2000 at different target PSNR values and maximum compression levels. Our experiments show that JPEG2000 is more effective in reducing adversarial noise as it allows higher compression rates with less distortion and it does not introduce blocking artifacts.

Motivation & Objective

• To evaluate the effectiveness of JPEG and JPEG2000 compression as pre-processing defenses against adversarial examples.
• To compare the performance of JPEG and JPEG2000 in preserving image classification accuracy under adversarial noise.
• To analyze how different PSNR levels and maximum compression ratios affect the robustness of classifiers against adversarial attacks.
• To identify whether JPEG2000’s superior compression characteristics reduce adversarial noise more effectively than JPEG.

Proposed method

• The authors apply JPEG and JPEG2000 compression to adversarial examples generated using FGSM and PGD attacks on ImageNet-pretrained models.
• Compression is applied at varying target PSNR values and maximum compression levels to assess robustness across different distortion levels.
• Classification accuracy is measured after compression to evaluate the effectiveness of noise suppression.
• The experiments are conducted on standard datasets using pre-trained models, with results compared across compression techniques and PSNR levels.
• JPEG2000 is evaluated for its ability to suppress high-frequency adversarial noise while minimizing blocking artifacts common in JPEG.
• The study uses quantitative metrics such as top-1 accuracy and PSNR to compare performance and robustness.

Experimental results

Research questions

• RQ1 How does JPEG2000 compression compare to JPEG in reducing adversarial noise while preserving classification accuracy?
• RQ2 What is the impact of varying PSNR levels on the robustness of classifiers after JPEG and JPEG2000 compression?
• RQ3 Does JPEG2000 maintain higher classification accuracy than JPEG at equivalent or higher compression rates?
• RQ4 To what extent do blocking artifacts in JPEG degrade the effectiveness of compression as a defense mechanism?
• RQ5 Can JPEG2000’s higher compression efficiency and lower distortion improve resilience to adversarial attacks?

Key findings

• JPEG2000 achieves higher compression rates than JPEG while maintaining lower distortion, especially at high compression levels.
• At equivalent PSNR values, JPEG2000 preserves higher classification accuracy on adversarial examples compared to JPEG.
• JPEG introduces noticeable blocking artifacts at high compression levels, which degrade model robustness and reduce classification performance.
• JPEG2000 effectively suppresses high-frequency adversarial noise due to its superior subband coding and smooth quantization.
• The combination of high compression efficiency and low distortion makes JPEG2000 a more effective pre-processing defense than JPEG against adversarial attacks.
• The results show that JPEG2000 maintains classification accuracy better than JPEG under identical compression conditions, particularly in high-noise regimes.