Compression as an Adversarial Amplifier Through Decision Space Reduction

1. Problem Statement

Modern visual pipelines (social media, edge devices, cloud services) almost invariably apply image compression (e.g., JPEG, PCA) to inputs before they are fed into deep learning models for inference.

• Current Assumption: The prevailing view in adversarial robustness research is that compression acts as a defensive or "purifying" mechanism. It is believed to suppress high-frequency adversarial noise, thereby improving robustness or at least not increasing vulnerability.
• The Gap: This assumption relies on a threat model where perturbations are applied before compression ($C(x + \delta)$). However, in real-world deployment, attackers may target the system after compression has occurred, applying perturbations directly to the compressed representation ($C(x) + \eta$).
• Core Question: How does image compression affect the adversarial robustness of deep classifiers when attacks are applied in the compressed domain?

2. Methodology

A. Threat Model: Compression-Aware Adversary

The authors propose a novel threat model where the adversary operates after the compression step:

1. Input: Clean image $x$.
2. Compression: The system applies a deterministic, non-invertible compression operator $C$ (e.g., JPEG, PCA) to produce $z = C(x)$.
3. Attack: The adversary perturbs the compressed representation $z$ to create $z' = z + \eta$, subject to a budget $\|\eta\|_p \leq \epsilon$.
4. Inference: The model $f$ predicts on $z'$, i.e., $\hat{y} = f(z')$.

• Key Distinction: Unlike purification defenses, the attacker does not need gradients through the compression operator $C$. They simply treat the compressed output as the input space.

B. Theoretical Framework: Decision Space Reduction

The paper introduces a geometric mechanism to explain the observed vulnerability: Decision Space Reduction.

• Concept: Compression is an information-losing, non-invertible transformation. It contracts the volume of the input space assigned to the true class.
• Geometric Effect:
  • Margin Shrinkage: Compression reduces the classification margin ($m$) around the input.
  • Boundary Proximity: Decision boundaries are brought closer to the input point in the compressed space.
  • Sensitivity Amplification: Because the "safe" region (true-class region) is smaller, a perturbation of the same magnitude is statistically more likely to cross a decision boundary in the compressed space than in the original pixel space.
• Theoretical Bound: The authors provide a proposition showing that the effective local robust radius $r_g(x)$ of the compressed model is bounded by the margin divided by the product of the Lipschitz constants of the classifier and the compression operator ($r_g \leq m / (L_f L_C)$).

C. Experimental Setup

• Datasets: CIFAR-10, CIFAR-100, and ImageNet.
• Architectures: ResNet (18, 34, 50), Vision Transformers (ViT-B/16, ViT-L/16), and various robust models from RobustBench.
• Attacks: Standard attacks (FGSM, PGD, AutoAttack) applied in two modes:
  1. Pixel-space: $x + \delta$.
  2. Compression-aware: $C(x) + \eta$ (using JPEG, PCA, PatchSVD).
• Metrics: Classification accuracy, Peak Signal-to-Noise Ratio (PSNR) for perceptual distortion, and local decision geometry metrics (True-class region fraction, Mean margin, Boundary intrusion).

3. Key Contributions

1. Formalization of a New Threat Model: The paper defines and validates a "compression-in-the-loop" adversarial setting that reflects realistic deployment pipelines where inputs are compressed before inference.
2. Discovery of Adversarial Amplification: Contrary to the belief that compression is defensive, the authors demonstrate that compression amplifies adversarial vulnerability. Attacks in the compressed domain cause significantly larger accuracy drops than pixel-space attacks under identical perturbation budgets.
3. Identification of "Decision Space Reduction": The paper identifies the geometric root cause: compression contracts the true-class decision region and collapses margins. This is visualized and quantified through local neighborhood analysis.
4. Order-Dependency Asymmetry: The study reveals a critical asymmetry:
   • Compress $\to$ Attack: Drastically reduces accuracy (Amplification).
   • Attack $\to$ Compress: Can partially restore accuracy (Purification), as compression removes high-frequency noise components of the attack.

4. Key Results

• Significant Accuracy Drops:
  • On CIFAR-100 with ResNet-18, a standard FGSM attack ($\epsilon=0.03$) reduced accuracy to 10.03%.
  • The compression-aware variant (JPEG $\to$ FGSM) reduced accuracy further to 8.46%, despite similar perceptual distortion (PSNR).
  • For PGD attacks, compression-aware variants often drove accuracy to 0.00%, whereas pixel-space attacks left some residual accuracy.
• Geometric Evidence:
  • True-Class Region Fraction: As JPEG quality decreases (stronger compression), the fraction of the local neighborhood classified as the true class shrinks significantly.
  • Margin Collapse: The mean classification margin decreases as compression strength increases.
  • Boundary Intrusion: The frequency of decision boundaries intruding into the local neighborhood increases with compression.
• Robust Models are Not Immune: Even state-of-the-art adversarially trained models (e.g., DMAT, MixedNuts) suffer from this amplification. While adversarial training enlarges margins and mitigates the effect slightly, compression-aware attacks still outperform pixel-space attacks against these hardened models.
• Order Effect: Figure 4 in the paper illustrates that applying compression before the attack causes a massive accuracy drop (e.g., 79% $\to$ 8%), whereas applying it after the attack results in a much smaller drop (e.g., 23% $\to$ 45%), confirming the geometric hypothesis.

5. Significance and Implications

• Re-evaluating Robustness: The paper argues that current robustness benchmarks are incomplete because they ignore the ubiquitous presence of compression in real-world systems. A model robust to pixel-space attacks may be highly vulnerable in a compressed pipeline.
• Security Risk: Compression should no longer be viewed solely as a defense. In many deployment scenarios, it acts as an adversarial amplifier, lowering the effective perturbation budget required to fool a model.
• Future Directions:
  • Defense: Future robust training must account for compression-in-the-loop (e.g., training on compressed inputs or using differentiable compression approximations).
  • Threat Modeling: Security assessments for vision systems must include attacks targeting the compressed representation space, not just the raw pixel space.
• Theoretical Insight: The work unifies the concepts of "amplification" and "purification" under a single geometric framework (Decision Space Reduction), explaining why the order of operations (compression vs. perturbation) dictates whether compression helps or harms the system.

In conclusion, the paper establishes that compression fundamentally reshapes the decision geometry of deep classifiers, contracting the safe region and making models significantly more susceptible to adversarial attacks when those attacks are applied in the compressed domain.