# Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression

arXiv: https://arxiv.org/abs/1802.06816 · HTML: https://mlsanity.com/paper/1802.06816/

## Key facts

- Cited by 74 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Feb 2018.

## Built on by (most cited first, 30 of 74)

- [Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples](https://mlsanity.com/paper/2302.04578/) (2023)
- [Improving Vision Transformers by Revisiting High-frequency Components](https://mlsanity.com/paper/2204.00993/) (2022)
- [On Generating Transferable Targeted Perturbations](https://mlsanity.com/paper/2103.14641/) (2021)
- [AdvDrop: Adversarial Attack to DNNs by Dropping Information](https://mlsanity.com/paper/2108.09034/) (2021)
- [Tensor Methods in Computer Vision and Deep Learning](https://mlsanity.com/paper/2107.03436/) (2021)
- [Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples](https://mlsanity.com/paper/2106.09947/) (2021)
- [Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models](https://mlsanity.com/paper/2404.09401/) (2024)
- [MirrorCheck: Efficient Adversarial Defense for Vision-Language Models](https://mlsanity.com/paper/2406.09250/) (2024)
- [Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective](https://mlsanity.com/paper/2102.06479/) (2021)
- [Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity](https://mlsanity.com/paper/2107.01396/) (2021)
- [Targeted Attack Improves Protection against Unauthorized Diffusion Customization](https://mlsanity.com/paper/2310.04687/) (2023)
- [Instant Adversarial Purification with Adversarial Consistency Distillation](https://mlsanity.com/paper/2408.17064/) (2024)
- [NetFense: Adversarial Defenses against Privacy Attacks on Neural Networks for Graph Data](https://mlsanity.com/paper/2106.11865/) (2021)
- [Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attacks](https://mlsanity.com/paper/2207.10170/) (2022)
- [Imperceptible Adversarial Attack via Invertible Neural Networks](https://mlsanity.com/paper/2211.15030/) (2022)
- [IAG: Input-aware Backdoor Attack on VLM-based Visual Grounding](https://mlsanity.com/paper/2508.09456/) (2025)
- [Personalized Privacy Protection Mask Against Unauthorized Facial Recognition](https://mlsanity.com/paper/2407.13975/) (2024)
- [Dompteur: Taming Audio Adversarial Examples](https://mlsanity.com/paper/2102.05431/) (2021)
- [Check Your Other Door! Creating Backdoor Attacks in the Frequency Domain](https://mlsanity.com/paper/2109.05507/) (2021)
- [Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformation](https://mlsanity.com/paper/2203.04607/) (2022)
- [Impact of Spatial Frequency Based Constraints on Adversarial Robustness](https://mlsanity.com/paper/2104.12679/) (2021)
- [Defense against Adversarial Cloud Attack on Remote Sensing Salient Object Detection](https://mlsanity.com/paper/2306.17431/) (2023)
- [Imperio: Language-Guided Backdoor Attacks for Arbitrary Model Control](https://mlsanity.com/paper/2401.01085/) (2024)
- [Scaling Laws for Black box Adversarial Attacks](https://mlsanity.com/paper/2411.16782/) (2024)
- [AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks](https://mlsanity.com/paper/2503.09124/) (2025)
- [AdPO: Enhancing the Adversarial Robustness of Large Vision-Language Models with Preference Optimization](https://mlsanity.com/paper/2504.01735/) (2025)
- [MiDAS: Multi-integrated Domain Adaptive Supervision for Fake News Detection](https://mlsanity.com/paper/2205.09817/) (2022)
- [Efficient Adversarial Training With Data Pruning](https://mlsanity.com/paper/2207.00694/) (2022)
- [Self-recoverable Adversarial Examples: A New Effective Protection Mechanism in Social Networks](https://mlsanity.com/paper/2204.12050/) (2022)
- [Invisible Backdoor Attack against Self-supervised Learning](https://mlsanity.com/paper/2405.14672/) (2024)

## Abstract (arXiv)

The rapidly growing body of research in adversarial machine learning has demonstrated that deep neural networks (DNNs) are highly vulnerable to adversarially generated images. This underscores the urgent need for practical defense that can be readily deployed to combat attacks in real-time. Observing that many attack strategies aim to perturb image pixels in ways that are visually imperceptible, we place JPEG compression at the core of our proposed Shield defense framework, utilizing its capability to effectively "compress away" such pixel manipulation. To immunize a DNN model from artifacts introduced by compression, Shield "vaccinates" a model by re-training it with compressed images, where different compression levels are applied to generate multiple vaccinated models that are ultimately used together in an ensemble defense. On top of that, Shield adds an additional layer of protection by employing randomization at test time that compresses different regions of an image using random compression levels, making it harder for an adversary to estimate the transformation performed. This novel combination of vaccination, ensembling, and randomization makes Shield a fortified multi-pronged protection. We conducted extensive, large-scale experiments using the ImageNet dataset, and show that our approaches eliminate up to 94% of black-box attacks and 98% of gray-box attacks delivered by the recent, strongest attacks, such as Carlini-Wagner's L2 and DeepFool. Our approaches are fast and work without requiring knowledge about the model.