Transferable Learned Image Compression-Resistant Adversarial Perturbations

TL;DR

This paper investigates the robustness of image classification models against adversarial attacks in the context of learned image compression, proposing a saliency score-based sampling method to generate transferable perturbations across various compression models and quality levels.

Contribution

It introduces a novel attack method that enhances transferability of adversarial perturbations on models using learned image compression as preprocessing.

Findings

Enhanced transferability of adversarial perturbations across different learned compression models.

The proposed method outperforms traditional attack techniques in attacking compressed images.

Demonstrated effectiveness in security-critical applications like face recognition and autonomous driving.

Abstract

Adversarial attacks can readily disrupt the image classification system, revealing the vulnerability of DNN-based recognition tasks. While existing adversarial perturbations are primarily applied to uncompressed images or compressed images by the traditional image compression method, i.e., JPEG, limited studies have investigated the robustness of models for image classification in the context of DNN-based image compression. With the rapid evolution of advanced image compression, DNN-based learned image compression has emerged as the promising approach for transmitting images in many security-critical applications, such as cloud-based face recognition and autonomous driving, due to its superior performance over traditional compression. Therefore, there is a pressing need to fully investigate the robustness of a classification system post-processed by learned image compression. To bridge this research gap, we explore the adversarial attack on a new pipeline that targets image classification models that utilize learned image compressors as pre-processing modules. Furthermore, to enhance the transferability of perturbations across various quality levels and architectures of learned image compression models, we introduce a saliency score-based sampling method to enable the fast generation of transferable perturbation. Extensive experiments with popular attack methods demonstrate the enhanced transferability of our proposed method when attacking images that have been post-processed with different learned image compression models.