Compression as an Adversarial Amplifier Through Decision Space Reduction
Not on the map. Why?
Abstract (arXiv)
Image compression is a ubiquitous component of modern visual pipelines, routinely applied by social media platforms and resource-constrained systems prior to inference. Despite its prevalence, the impact of compression on adversarial robustness remains poorly understood. We study a previously unexplored adversarial setting in which attacks are applied directly in compressed representations, and show that compression can act as an adversarial amplifier for deep image classifiers. Under identical nominal perturbation budgets, compression-aware attacks are substantially more effective than their pixel-space counterparts. We attribute this effect to decision space reduction, whereby compression induces a non-invertible, information-losing transformation that contracts classification margins and increases sensitivity to perturbations. Extensive experiments across standard benchmarks and architectures support our analysis and reveal a critical vulnerability in compression-in-the-loop deployment settings. Code will be released.
Key facts. No citing papers in the map yet (data through 13 Oct 2026). Builds on 32 of its 51 references that are in the map. First posted on arXiv 8 Apr 2026.
Builds on
32 of 51 references.
References · 32
- 2023GPT-4 Technical Reportcited by 18,278
- 2014Explaining and Harnessing Adversarial Examplescited by 7,336
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,379
- 2023Qwen Technical Reportcited by 3,310
- 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,197
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,992
- 2018SlowFast Networks for Video Recognitioncited by 1,864
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,445
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 839
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 658
- 2017Countering Adversarial Images using Input Transformationscited by 519
- 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 229
20 more
- 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
- 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 203
- 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 132
- 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 105
- 2024Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Modelscited by 84
- 2015Analysis of classifiers' robustness to adversarial perturbationscited by 76
- 2020SMART Frame Selection for Action Recognitioncited by 73
- 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 67
- 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
- 2023Decoupled Kullback-Leibler Divergence Losscited by 58
- 2024MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsificationcited by 20
- 2020Adversarial Classification: Necessary conditions and geometric flowscited by 19
- 2024MixedNUTS: Training-Free Accuracy-Robustness Balance via Nonlinearly Mixed Classifierscited by 16
- 2020Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examplescited by 11
- 2022How many perturbations break this model? Evaluating robustness beyond adversarial accuracycited by 9
- 2025Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Iscited by 7
- 2024A Training-Free Defense Framework for Robust Learned Image Compressioncited by 5
- 2026Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filterscited by 5
- 2024Persistent Classification: A New Approach to Stability of Data and Adversarial Examplescited by 3
- 2024PatchSVD: A Non-uniform SVD-based Image Compression Algorithmcited by 1
Built on by
Not cited yet.