mlsanityData to 7 Oct 2026

Keep It Real: Challenges in Attacking Compression-Based Adversarial Purification

arXiv 2508.05489 ↗First posted 7 Aug 2025cs.CV cs.LG eess.IVcited by 0

Not on the map. Why?

Abstract (arXiv)

Previous work has suggested that preprocessing images through lossy compression can defend against adversarial perturbations, but comprehensive attack evaluations have been lacking. In this paper, we construct strong white-box and adaptive attacks against various compression models and identify a critical challenge for attackers: high realism in reconstructed images significantly increases attack difficulty. Through rigorous evaluation across multiple attack scenarios, we demonstrate that compression models capable of producing realistic, high-fidelity reconstructions are substantially more resistant to our attacks. In contrast, low-realism compression models can be broken. Our analysis reveals that this is not due to gradient masking. Rather, realistic reconstructions maintaining distributional alignment with natural images seem to offer inherent robustness. This work highlights a significant obstacle for future adversarial attacks and suggests that developing more effective techniques to overcome realism represents an essential challenge for comprehensive security evaluation.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 69 of its 83 references that are in the map. First posted on arXiv 7 Aug 2025.

Builds on

69 of 83 references.

References · 69

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  4. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  10. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  11. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  12. 2016Adversarial examples in the physical worldcited by 1,762
38 more
  1. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  2. 2019Natural Adversarial Examplescited by 1,401
  3. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  4. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  5. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  6. 2018Variational image compression with a scale hyperpriorcited by 910
  7. 2016Universal adversarial perturbationscited by 774
  8. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  9. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  10. 2016End-to-end Optimized Image Compressioncited by 673
  11. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  12. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  13. 2017The Perception-Distortion Tradeoffcited by 582
  14. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  15. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  16. 2017Countering Adversarial Images using Input Transformationscited by 517
  17. 2022Diffusion Models for Adversarial Purificationcited by 469
  18. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  19. 2019On Evaluating Adversarial Robustnesscited by 442
  20. 2020High-Fidelity Generative Image Compressioncited by 331
  21. 2022ELIC: Efficient Learned Image Compression with Unevenly Grouped Space-Channel Contextual Adaptive Codingcited by 296
  22. 2020Bag of Tricks for Adversarial Trainingcited by 199
  23. 2016A study of the effect of JPG compression on adversarial imagescited by 196
  24. 2022Lossy Image Compression with Conditional Diffusion Modelscited by 165
  25. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 104
  26. 2023Towards image compression with perfect realism at ultra-low bitratescited by 99
  27. 2017Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compressioncited by 86
  28. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  29. 2022Multi-Realism Image Compression with a Conditional Generatorcited by 79
  30. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  31. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  32. 2021A Survey On Universal Adversarial Attackcited by 59
  33. 2019Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attackscited by 54
  34. 2023C3: High-performance and low-complexity neural compression from a single image or videocited by 54
  35. 2023High-Fidelity Image Compression with Score-based Generative Modelscited by 53
  36. 2022COOL-CHIC: Coordinate-based Low Complexity Hierarchical Image Codeccited by 50
  37. 2022PO-ELIC: Perception-Oriented Efficient Learned Image Codingcited by 35
  38. 2024Lossy Image Compression with Foundation Diffusion Modelscited by 34

50 most cited of 69 All 69 (JSON)

Built on by

Not cited yet.