keyword
bit-depth reduction
Bit-depth reduction is a digital image processing technique that decreases the number of bits used to represent the color or intensity value of each pixel in an image. By quantizing pixel values into fewer discrete levels, this process simplifies the color palette, compresses data, and discards fine-grained tonal variations. In computer vision and machine learning, bit-depth reduction is commonly employed as an input preprocessing transformation to remove imperceptible noise or adversarial perturbations from images before they are analyzed by deep learning models.
3 items
Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compression
Zhuoran Liu, Zhengyu Zhao, Martha A. Larson
Why you should read this
Proposes Image Shortcut Squeezing, a simple compression-based defense that neutralizes twelve state-of-the-art perturbative availability poisons by exploiting the frequency characteristics of poison shortcuts, matching or outperforming adversarial training with far greater efficiency.
Perturbative availability poisons (PAPs) add small changes to images to prevent their use for model training. Current research adopts the belief that practical and effective approaches to countering PAPs do not exist. In this paper, we argue that it is time to abandon this belief. We present extensive experiments showing that 12 state-of-the-art PAP methods are vulnerable to Image Shortcut Squeezing (ISS), which is based on simple compression. For example, on average, ISS restores the CIFAR-10 model accuracy to 81.73%, surpassing the previous best preprocessing-based countermeasures by 37.97% absolute. ISS also (slightly) outperforms adversarial training and has higher generalizability to unseen perturbation norms and also higher efficiency. Our investigation reveals that the property of PAP perturbations depends on the type of surrogate model used for poison generation, and it explains why a specific ISS compression yields the best performance for a specific type of PAP perturbation. We further test stronger, adaptive poisoning, and show it falls short of being an ideal defense against ISS. Overall, our results demonstrate the importance of considering various (simple) countermeasures to ensure the meaningfulness of analysis carried out during the development of PAP methods. Our code is available at https://github.com/liuzrcc/ImageShortcutSqueezing.
Added
2026-10-03
Countering Adversarial Images using Input Transformations
Chuan Guo, Mayank Rana, Moustapha Cisse, Laurens van der Maaten
Why you should read this
Demonstrates that applying non-differentiable input transformations like image quilting and total variance minimization can effectively defend convolutional networks against strong adversarial attacks on ImageNet without requiring complex model modifications.
This paper investigates strategies that defend against adversarial-example attacks on image-classification systems by transforming the inputs before feeding them to the system. Specifically, we study applying image transformations such as bit-depth reduction, JPEG compression, total variance minimization, and image quilting before feeding the image to a convolutional network classifier. Our experiments on ImageNet show that total variance minimization and image quilting are very effective defenses in practice, in particular, when the network is trained on transformed images. The strength of those defenses lies in their non-differentiable nature and their inherent randomness, which makes it difficult for an adversary to circumvent the defenses. Our best defense eliminates 60% of strong gray-box and 90% of strong black-box attacks by a variety of major attack methods
Added
2026-09-24
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
Anish Athalye, Nicholas Carlini, David Wagner
Why you should read this
Demonstrates that popular adversarial defenses rely on gradient masking rather than genuine security, categorizing three types of obfuscated gradients and introducing attack techniques that bypass seven proposed white-box defenses.
We identify obfuscated gradients, a kind of gradient masking, as a phenomenon that leads to a false sense of security in defenses against adversarial examples. While defenses that cause obfuscated gradients appear to defeat iterative optimization-based attacks, we find defenses relying on this effect can be circumvented. We describe characteristic behaviors of defenses exhibiting the effect, and for each of the three types of obfuscated gradients we discover, we develop attack techniques to overcome it. In a case study, examining non-certified white-box-secure defenses at ICLR 2018, we find obfuscated gradients are a common occurrence, with 7 of 9 defenses relying on obfuscated gradients. Our new attacks successfully circumvent 6 completely, and 1 partially, in the original threat model each paper considers.
Added
2026-09-11
