mlsanityData to 7 Oct 2026

Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compression

arXiv 2301.13838 ↗First posted 31 Jan 2023cs.CR cs.CV cs.LGcited by 39

Not on the map. Why?

Abstract (arXiv)

Perturbative availability poisons (PAPs) add small changes to images to prevent their use for model training. Current research adopts the belief that practical and effective approaches to countering PAPs do not exist. In this paper, we argue that it is time to abandon this belief. We present extensive experiments showing that 12 state-of-the-art PAP methods are vulnerable to Image Shortcut Squeezing (ISS), which is based on simple compression. For example, on average, ISS restores the CIFAR-10 model accuracy to 81.73%, surpassing the previous best preprocessing-based countermeasures by 37.97% absolute. ISS also (slightly) outperforms adversarial training and has higher generalizability to unseen perturbation norms and also higher efficiency. Our investigation reveals that the property of PAP perturbations depends on the type of surrogate model used for poison generation, and it explains why a specific ISS compression yields the best performance for a specific type of PAP perturbation. We further test stronger, adaptive poisoning, and show it falls short of being an ideal defense against ISS. Overall, our results demonstrate the importance of considering various (simple) countermeasures to ensure the meaningfulness of analysis carried out during the development of PAP methods.

Key facts. Cited by 39 papers in the map (data through 7 Oct 2026). Builds on 50 of its 79 references that are in the map. First posted on arXiv 31 Jan 2023.

Builds on

50 of 79 references.

References · 50

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  5. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  6. 2016Densely Connected Convolutional Networkscited by 6,691
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  9. 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,597
  10. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  11. 2015Spatial Transformer Networkscited by 1,423
  12. 2018On the Spectral Bias of Neural Networkscited by 1,321
38 more
  1. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  2. 2014Deep Learning in Neural Networks: An Overviewcited by 765
  3. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  4. 2019On Evaluating Adversarial Robustnesscited by 442
  5. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  6. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  7. 2020The Pitfalls of Simplicity Bias in Neural Networkscited by 349
  8. 2016A study of the effect of JPG compression on adversarial imagescited by 196
  9. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  10. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  11. 2018Training behavior of deep neural network in frequency domaincited by 174
  12. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  13. 2016Understanding How Image Quality Affects Deep Neural Networkscited by 118
  14. 2021Adversarial Examples Make Strong Poisonscited by 115
  15. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  16. 2017Towards a Visual Privacy Advisor: Understanding and Predicting Privacy Risks in Imagescited by 101
  17. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  18. 2021LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognitioncited by 92
  19. 2017Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compressioncited by 86
  20. 2018Low Frequency Adversarial Perturbationcited by 80
  21. 2019Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encodercited by 70
  22. 2021Availability Attacks Create Shortcutscited by 60
  23. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  24. 2019Theory of the Frequency Principle for General Deep Neural Networkscited by 45
  25. 2021Data Poisoning Won't Save You From Facial Recognitioncited by 45
  26. 2022Autoregressive Perturbations for Data Poisoningcited by 45
  27. 2022Transferable Unlearnable Examplescited by 41
  28. 2017Synthesizing Robust Adversarial Examplescited by 39
  29. 2017Adversarial Image Perturbation for Privacy Protection -- A Game Theory Perspectivecited by 38
  30. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  31. 2022Unlearnable Clusters: Towards Label-agnostic Unlearnable Examplescited by 35
  32. 2022Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learningcited by 32
  33. 2022One-Pixel Shortcut: on the Learning Preference of Deep Neural Networkscited by 29
  34. 2016Faceless Person Recognition; Privacy Implications in Social Mediacited by 27
  35. 2022Self-Ensemble Protection: Training Checkpoints Are Good Data Protectorscited by 19
  36. 2021Fooling Adversarial Training with Inducing Noisecited by 12
  37. 2021Disrupting Model Training with Adversarial Shortcutscited by 7
  38. 2022Generative Poisoning Using Random Discriminatorscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 7; 2024: 18; 2025: 7; 2026: 7.

39 papers.

Sort:

By area:

  1. 2023Learning the Unlearnable: Adversarial Augmentations Suppress Unlearnable Example Attackscited by 28
  2. 2023Generative Watermarking Against Unauthorized Subject-Driven Image Synthesiscited by 21
  3. 2023The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Modelscited by 19
  4. 2024Purify Unlearnable Examples via Rate-Constrained Variational Autoencoderscited by 18
  5. 2024Provably Unlearnable Data Examplescited by 18
  6. 2023Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examplescited by 17
  7. 2023Detection and Defense of Unlearnable Examplescited by 13
  8. 2024Semantic Deep Hiding for Robust Unlearnable Examplescited by 13
  9. 2024UnSeg: One Universal Unlearnable Example Generator is Enough against All Image Segmentationcited by 13
  10. 2024Robot Collapse: Supply Chain Backdoor Attacks Against VLM-based Robotic Manipulationcited by 13
  11. 2024Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneouslycited by 12
  12. 2025MTL-UE: Learning to Learn Nothing for Multi-Task Learningcited by 11
27 more
  1. 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
  2. 2024Unlearnable Examples Detection via Iterative Filteringcited by 9
  3. 2025Temporal Unlearnable Examples: Preventing Personal Video Data from Unauthorized Exploitation by Object Trackingcited by 9
  4. 2024Mitigating Unauthorized Speech Synthesis for Voice Protectioncited by 8
  5. 2023APBench: A Unified Benchmark for Availability Poisoning Attacks and Defensescited by 7
  6. 2024Toward Availability Attacks in 3D Point Cloudscited by 7
  7. 2023Transferable Availability Poisoning Attackscited by 5
  8. 2024Nonlinear Transformations Against Unlearnable Datasetscited by 5
  9. 2025A Survey on Unlearnable Datacited by 5
  10. 2025SafeSpeech: Robust and Universal Voice Protection Against Malicious Speech Synthesiscited by 5
  11. 2026When Priors Backfire: On the Vulnerability of Unlearnable Examples to Pretrainingcited by 5
  12. 2025How Far Are We from True Unlearnability?cited by 4
  13. 2024BridgePure: Limited Protection Leakage Can Break Black-Box Data Protectioncited by 3
  14. 2024Effective and Robust Adversarial Training against Data and Label Corruptionscited by 2
  15. 2025When and Where do Data Poisons Attack Textual Inversion?cited by 2
  16. 2026Why Do Unlearnable Examples Work: A Novel Perspective of Mutual Informationcited by 2
  17. 2024Beyond Full Poisoning: Effective Availability Attacks with Partial Perturbationcited by 1
  18. 2024Exploiting Supervised Poison Vulnerability to Strengthen Self-Supervised Defensecited by 1
  19. 2024Learning from Convolution-based Unlearnable Datasetscited by 1
  20. 2024Generalizable Targeted Data Poisoning against Varying Physical Objectscited by 1
  21. 2025Securing Traffic Sign Recognition Systems in Autonomous Vehiclescited by 1
  22. 2026Perturbation-Induced Linearization: Constructing Unlearnable Data with Solely Linear Classifierscited by 1
  23. 2024Deferred Poisoning: Making the Model More Vulnerable via Hessian Singularizationcited by 0
  24. 2026SoK: Unlearnability and Unlearning for Model Dememorizationcited by 0
  25. 2026Unlearnable Faces: Privacy Protection Surviving Extraction Pipelinecited by 0
  26. 2026Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecyclecited by 0
  27. 2026Leveraging Imperfect Restoration for Data Availability Attackcited by 0