# The Effects of JPEG and JPEG2000 Compression on Attacks using Adversarial Examples

arXiv: https://arxiv.org/abs/1803.10418 · HTML: https://mlsanity.com/paper/1803.10418/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Mar 2018.

## Built on by (most cited first, 12 of 12)

- [Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective](https://mlsanity.com/paper/2102.06479/) (2021)
- [Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformation](https://mlsanity.com/paper/2203.04607/) (2022)
- [Coordinated Flaw Disclosure for AI: Beyond Security Vulnerabilities](https://mlsanity.com/paper/2402.07039/) (2024)
- [PID: Prompt-Independent Data Protection Against Latent Diffusion Models](https://mlsanity.com/paper/2406.15305/) (2024)
- [RoVISQ: Reduction of Video Service Quality via Adversarial Attacks on Deep Learning-based Video Compression](https://mlsanity.com/paper/2203.10183/) (2022)
- [Neural Image Compression: Generalization, Robustness, and Spectral Biases](https://mlsanity.com/paper/2307.08657/) (2023)
- [Machine Perceptual Quality: Evaluating the Impact of Severe Lossy Compression on Audio and Image Models](https://mlsanity.com/paper/2401.07957/) (2024)
- [Detecting Adversarial Examples](https://mlsanity.com/paper/2410.17442/) (2024)
- [Universal and Efficient Detection of Adversarial Data through Nonuniform Impact on Network Layers](https://mlsanity.com/paper/2506.20816/) (2025)
- [Training-Free Adversarial Robustness in Computational MRI](https://mlsanity.com/paper/2501.01908/) (2025)
- [Beyond Invisibility: Learning Robust Visible Watermarks for Stronger Copyright Protection](https://mlsanity.com/paper/2506.02665/) (2025)
- [A Statistical Method for Attack-Agnostic Adversarial Attack Detection with Compressive Sensing Comparison](https://mlsanity.com/paper/2510.02707/) (2025)

## Abstract (arXiv)

Adversarial examples are known to have a negative effect on the performance of classifiers which have otherwise good performance on undisturbed images. These examples are generated by adding non-random noise to the testing samples in order to make classifier misclassify the given data. Adversarial attacks use these intentionally generated examples and they pose a security risk to the machine learning based systems. To be immune to such attacks, it is desirable to have a pre-processing mechanism which removes these effects causing misclassification while keeping the content of the image. JPEG and JPEG2000 are well-known image compression techniques which suppress the high-frequency content taking the human visual system into account. JPEG has been also shown to be an effective method for reducing adversarial noise. In this paper, we propose applying JPEG2000 compression as an alternative and systematically compare the classification performance of adversarial images compressed using JPEG and JPEG2000 at different target PSNR values and maximum compression levels. Our experiments show that JPEG2000 is more effective in reducing adversarial noise as it allows higher compression rates with less distortion and it does not introduce blocking artifacts.