Abstract:Machine learning systems, particularly in the domain of image recognition, are susceptible to adversarial perturbations applied to input data. These perturbations, while imperceptible to humans, have the capacity to easily deceive deep learning classifiers. Current defense methods for image recognition focus on using diffusion models and their variants. Due to the depth of diffusion models and the large amount of computations generated during each inference process, the GPU and storage performance of the device are extremely high. To address this problem, we propose a new defense-based non-overlapping image compression filter for image recognition classifiers against adversarial attacks. This method inserts a non-overlapping image compression filter before the classifier to make the results of the classifier invariant under subtle changes in images. This method does not weaken the adversarial robustness of the model and can reduce the computational cost during the training process of the image classification model. In addition, our method can be easily integrated with existing image classification training frameworks with only some minor adjustments. We validate our results by performing a series of experiments under three different convolutional neural network architectures (VGG16, ResNet34, and Inception-ResNet-v2) and on different datasets (CIFAR10 and CIFAR100). The experimental results show that under the Inception-ResNet-v2 architecture, our method achieves an average accuracy of up to 81.15% on the CIFAR10 dataset, fully demonstrating its effectiveness in mitigating adversarial attacks. In addition, under the WRN-28-10 architecture, our method achieves not only 91.28% standard accuracy on the CIFAR10 dataset but also 76.46% average robust accuracy. The test experiment on the model training time consumption shows that our defense method has an advantage in time cost, proving that our defense method is a lightweight and efficient defense strategy.

An Imperceptible Adversarial Attack Against Reconstruction for Learned Image Compression

MALICE: Manipulation Attacks on Learned Image ComprEssion

Towards Robust Neural Image Compression: Adversarial Attack and Model Finetuning

An Adversarial Attack Via Feature Contributive Regions

Toward Robust Neural Image Compression: Adversarial Attack and Model Finetuning

Attack and Defense Analysis of Learned Image Compression

Reconstruction Distortion of Learned Image Compression with Imperceptible Perturbations

Transferable Learned Image Compression-Resistant Adversarial Perturbations

A Training-Free Defense Framework for Robust Learned Image Compression

Learned Low Bit-rate Image Compression with Adversarial Mechanism

Adversarial Distortion for Learned Video Compression

A study of the effect of JPG compression on adversarial images

Object-aware Image Compression with Adversarial Learning.

Enhancing Adversarial Training with Prior Knowledge Distillation for Robust Image Compression

On the Adversarial Robustness of Learning-based Image Compression Against Rate-Distortion Attacks

Frequency-constrained transferable adversarial attack on image manipulation detection and localization

Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Prior

Lightweight Robust Image Classifier Using Non-Overlapping Image Compression Filters

Perception Improvement for Free: Exploring Imperceptible Black-box Adversarial Attacks on Image Classification

Multi-scale Architectures Matter: Examining the Adversarial Robustness of Flow-Based Lossless Compression

NetFlick: Adversarial Flickering Attacks on Deep Learning Based Video Compression