# Google's Cloud Vision API Is Not Robust To Noise

arXiv: https://arxiv.org/abs/1704.05051 · HTML: https://mlsanity.com/paper/1704.05051/

## Key facts

- Cited by 37 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Apr 2017.

## Built on by (most cited first, 30 of 37)

- [On the Design Fundamentals of Diffusion Models: A Survey](https://mlsanity.com/paper/2306.04542/) (2023)
- [Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidance](https://mlsanity.com/paper/2208.08664/) (2022)
- [MMG-Ego4D: Multi-Modal Generalization in Egocentric Action Recognition](https://mlsanity.com/paper/2305.07214/) (2023)
- [Query-Efficient Decision-based Black-Box Patch Attack](https://mlsanity.com/paper/2307.00477/) (2023)
- [Do Perceptually Aligned Gradients Imply Adversarial Robustness?](https://mlsanity.com/paper/2207.11378/) (2022)
- [Augraphy: A Data Augmentation Library for Document Images](https://mlsanity.com/paper/2208.14558/) (2022)
- [Efficient Online ML API Selection for Multi-Label Classification Tasks](https://mlsanity.com/paper/2102.09127/) (2021)
- [Robustness Disparities in Commercial Face Detection](https://mlsanity.com/paper/2108.12508/) (2021)
- [Multi-Modal Image Captioning for the Visually Impaired](https://mlsanity.com/paper/2105.08106/) (2021)
- [OFEI: A Semi-black-box Android Adversarial Sample Attack Framework Against DLaaS](https://mlsanity.com/paper/2105.11593/) (2021)
- [Inverse Problems Leveraging Pre-trained Contrastive Representations](https://mlsanity.com/paper/2110.07439/) (2021)
- [Runtime Monitoring for Out-of-Distribution Detection in Object Detection Neural Networks](https://mlsanity.com/paper/2212.07773/) (2022)
- [Simple Transparent Adversarial Examples](https://mlsanity.com/paper/2105.09685/) (2021)
- [HAPI: A Large-scale Longitudinal Dataset of Commercial ML API Predictions](https://mlsanity.com/paper/2209.08443/) (2022)
- [Robustness Disparities in Face Detection](https://mlsanity.com/paper/2211.15937/) (2022)
- [Class-Conditioned Transformation for Enhanced Robust Image Classification](https://mlsanity.com/paper/2303.15409/) (2023)
- [Substance or Style: What Does Your Image Embedding Know?](https://mlsanity.com/paper/2307.05610/) (2023)
- [Towards Corruption-Agnostic Robust Domain Adaptation](https://mlsanity.com/paper/2104.10376/) (2021)
- [Solving Probabilistic Verification Problems of Neural Networks using Branch and Bound](https://mlsanity.com/paper/2405.17556/) (2024)
- [Towards Trustworthy Machine Learning in Production: An Overview of the Robustness in MLOps Approach](https://mlsanity.com/paper/2410.21346/) (2024)
- [Benchmarking Robustness of Deep Learning Classifiers Using Two-Factor Perturbation](https://mlsanity.com/paper/2103.03102/) (2021)
- [Using BERT Encoding to Tackle the Mad-lib Attack in SMS Spam Detection](https://mlsanity.com/paper/2107.06400/) (2021)
- [Are Commercial Face Detection Models as Biased as Academic Models?](https://mlsanity.com/paper/2201.10047/) (2022)
- [Segmentation Consistency Training: Out-of-Distribution Generalization for Medical Image Segmentation](https://mlsanity.com/paper/2205.15428/) (2022)
- [Forward Learning for Gradient-based Black-box Saliency Map Generation](https://mlsanity.com/paper/2403.15603/) (2024)
- [Exact Upper and Lower Bounds for the Output Distribution of Neural Networks with Random Inputs](https://mlsanity.com/paper/2502.11672/) (2025)
- [Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents](https://mlsanity.com/paper/2607.15657/) (2026)
- [Residual Feature Pyramid Network for Enhancement of Vascular Patterns](https://mlsanity.com/paper/2306.17200/) (2023)
- [A Structured Analysis of the Video Degradation Effects on the Performance of a Machine Learning-enabled Pedestrian Detector](https://mlsanity.com/paper/2106.15889/) (2021)
- [Benchmarking Robustness of Deep Learning Classifiers Using Two-Factor Perturbation](https://mlsanity.com/paper/2203.01323/) (2022)

## Abstract (arXiv)

Google has recently introduced the Cloud Vision API for image analysis. According to the demonstration website, the API "quickly classifies images into thousands of categories, detects individual objects and faces within images, and finds and reads printed words contained within images." It can be also used to "detect different types of inappropriate content from adult to violent content." In this paper, we evaluate the robustness of Google Cloud Vision API to input perturbation. In particular, we show that by adding sufficient noise to the image, the API generates completely different outputs for the noisy image, while a human observer would perceive its original content. We show that the attack is consistently successful, by performing extensive experiments on different image types, including natural images, images containing faces and images with texts. For instance, using images from ImageNet dataset, we found that adding an average of 14.25% impulse noise is enough to deceive the API. Our findings indicate the vulnerability of the API in adversarial environments. For example, an adversary can bypass an image filtering system by adding noise to inappropriate images. We then show that when a noise filter is applied on input images, the API generates mostly the same outputs for restored images as for original images. This observation suggests that cloud vision API can readily benefit from noise filtering, without the need for updating image analysis algorithms.