# To compress or not to compress: Understanding the Interactions between Adversarial Attacks and Neural Network Compression

arXiv: https://arxiv.org/abs/1810.00208 · HTML: https://mlsanity.com/paper/1810.00208/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Sep 2018.

## Built on by (most cited first, 14 of 14)

- [Lost in Pruning: The Effects of Pruning Neural Networks beyond Test Accuracy](https://mlsanity.com/paper/2103.03014/) (2021)
- [Masking Adversarial Damage: Finding Adversarial Saliency for Robust and Sparse Network](https://mlsanity.com/paper/2204.02738/) (2022)
- [QVIP: An ILP-based Formal Verification Approach for Quantized Neural Networks](https://mlsanity.com/paper/2212.11138/) (2022)
- [Bag of Tricks to Boost Adversarial Transferability](https://mlsanity.com/paper/2401.08734/) (2024)
- [QEBVerif: Quantization Error Bound Verification of Neural Networks](https://mlsanity.com/paper/2212.02781/) (2022)
- [Transferable Learned Image Compression-Resistant Adversarial Perturbations](https://mlsanity.com/paper/2401.03115/) (2024)
- [Two is Better than One: Efficient Ensemble Defense for Robust and Compact Models](https://mlsanity.com/paper/2504.04747/) (2025)
- [Adversarially Robust and Explainable Model Compression with On-Device Personalization for Text Classification](https://mlsanity.com/paper/2101.05624/) (2021)
- [Learning Robust and Lightweight Model through Separable Structured Transformations](https://mlsanity.com/paper/2112.13551/) (2021)
- [Hardening DNNs against Transfer Attacks during Network Compression using Greedy Adversarial Pruning](https://mlsanity.com/paper/2206.07406/) (2022)
- [Attacking Compressed Vision Transformers](https://mlsanity.com/paper/2209.13785/) (2022)
- [Robustness to distribution shifts of compressed networks for edge devices](https://mlsanity.com/paper/2401.12014/) (2024)
- [Properties that allow or prohibit transferability of adversarial attacks among quantized networks](https://mlsanity.com/paper/2405.09598/) (2024)
- [Towards Compact and Robust DNNs via Compression-aware Sharpness Minimization](https://mlsanity.com/paper/2601.20301/) (2026)

## Abstract (arXiv)

As deep neural networks (DNNs) become widely used, pruned and quantised models are becoming ubiquitous on edge devices; such compressed DNNs are popular for lowering computational requirements. Meanwhile, recent studies show that adversarial samples can be effective at making DNNs misclassify. We, therefore, investigate the extent to which adversarial samples are transferable between uncompressed and compressed DNNs. We find that adversarial samples remain transferable for both pruned and quantised models. For pruning, the adversarial samples generated from heavily pruned models remain effective on uncompressed models. For quantisation, we find the transferability of adversarial samples is highly sensitive to integer precision.