Compression as an Adversarial Amplifier Through Decision Space Reduction

Lewis Evans; Harkrishan Jandu; Zihan Ye; Yang Lu; Shreyank N Gowda

cs.CVApr 8, 2026

Compression as an Adversarial Amplifier Through Decision Space Reduction

Authors: Lewis Evans, Harkrishan Jandu, Zihan Ye, Yang Lu, Shreyank N Gowda

Organizations: University of Nottingham, Nottingham, United Kingdom · University of Chinese Academy of Sciences, Beijing, China · Xiamen University, Xiamen, China · School of Computer Science, University of Nottingham, Nottingham, United Kingdom

Abstract

Image compression is a ubiquitous component of modern visual pipelines, routinely applied by social media platforms and resource-constrained systems prior to inference. Despite its prevalence, the impact of compression on adversarial robustness remains poorly understood. We study a previously unexplored adversarial setting in which attacks are applied directly in compressed representations, and show that compression can act as an adversarial amplifier for deep image classifiers. Under identical nominal perturbation budgets, compression-aware attacks are substantially more effective than their pixel-space counterparts. We attribute this effect to decision space reduction, whereby compression induces a non-invertible, information-losing transformation that contracts classification margins and increases sensitivity to perturbations. Extensive experiments across standard benchmarks and architectures support our analysis and reveal a critical vulnerability in compression-in-the-loop deployment settings. Code will be released.

Figures & tables

Figure 1. Local decision regions around a correctly classified input are visualized in a 2D neighborhood. Without compression (middle), the true-class region is large and margins are smooth. With compression-in-the-loop (right), the region contracts, competing classes appear closer to the input, and margins collapse, illustrating how compression brings decision boundaries nearer and amplifies vulnerability.

Figure 2. Overview of the compression-aware adversarial pipeline. An input image is first transformed by a lossy compression operator, after which a gradient-based adversary perturbs the compressed representation. The perturbed input is then fed to the target model for prediction, and performance is evaluated using accuracy, attack success rate, and distortion metrics such as PSNR.

Attack	Default setting
FGSM	$\epsilon=0.01$
PGD (L ∞ )	$\epsilon_{\text{pixel}}=2/255$ , $\alpha_{\text{pixel}}=1/255$ , iters $=5$ , random_start=True
JPEG	quality $=25$
JPEG $\rightarrow$ FGSM	quality $=55$ , $\epsilon=0.02$
JPEG $\rightarrow$ PGD	quality $=55$ , $\epsilon_{\text{pixel}}=0.02$ , iters $=10$
PCA	n_components $=22$

Table 1. Attacks and default hyperparameters.

Model	Attack	Accuracy (%)	PSNR
ResNet-18	Clean	94.98	100.00
	FGSM ( $\epsilon=0.06$ )	18.72	24.18
	BSR ( $\epsilon=0.06$ )	87.70	39.77
	AutoAttack	1.32	32.24
	PGD ( $\epsilon=0.06$ )	0.00	28.68
	Attention-Fool	28.85	29.34

Table 2. Robustness on CIFAR-10 under compression-aware attacks. All our attacks are in blue and the best performer is bolded .

Model	Attack	Accuracy (%)	PSNR
ResNet-18	Clean	79.26	100.0
	FGSM ( $\epsilon=0.03$ )	10.03	30.22
	PGD ( $\epsilon=0.03$ )	0.01	34.15
	BSR ( $\epsilon=0.03$ )	68.44	42.65
	Attention-Fool	11.84	30.82
	JPEG $\rightarrow$ FGSM	8.46	29.82

Table 3. Robustness on CIFAR-100 under compression-aware attacks. All our attacks are in blue and the best performer is bolded .

Model	Attack	Accuracy (%)	PSNR
ResNet-18	Clean	67.28	100.00
	FGSM	15.45	14.53
	PGD	0.01	38.04
	JPEG	54.67	29.41
	PCA	41.77	27.53
	AutoAttack	6.64	47.84

Table 4. Robustness on ImageNet under compression-aware attacks. All our attacks are in blue and the best performer is bolded .

Panel of Figure 3 — Figure 3. Decision space reduction under compression averaged over 100 correctly classified seeds. As JPEG quality decreases (stronger compression), (a) the fraction of the local neighborhood assigned to the true class decreases, (b) the mean margin collapses, and (c) the fraction of negative-margin points increases, indicating that decision boundaries move closer and intrude more frequently into the local neighborhood.

Figure 4. Effect of operation order on CIFAR-100 robustness. Applying compression before the attack (JPEG $\rightarrow$ FGSM) causes significantly larger accuracy drops than attacking first and then compressing (FGSM $\rightarrow$ JPEG), despite similar perceptual distortion levels.

Attack	$\epsilon=0.02$	$\epsilon=0.04$	$\epsilon=0.06$	$\epsilon=0.08$
FGSM	42.10	22.80	10.03	4.50
JPEG $\to$ FGSM	38.20	19.50	8.46	3.80
PCA $\to$ FGSM	40.10	21.30	9.77	4.20
PatchSVD $\to$ FGSM	39.60	20.90	9.42	3.95
PGD	28.50	0.04	0.00	0.00
JPEG $\to$ PGD	22.10	0.01	0.00	0.00

Table 5. Effect of perturbation budget

\epsilon

on classification accuracy (%) under pixel-space (FGSM, PGD) and compression-aware attacks on CIFAR-100 with ResNet-18. Compression-aware attacks consistently outperform pixel-space counterparts across all budgets.

Model	Clean	AA	FGSM	PGD	Ours 1	Ours 2
DMAT	75.22	42.66	48.52	41.24	39.69	36.74
MeanSparse	75.13	42.25	48.27	42.58	39.58	37.22
MixedNuts	83.08	41.80	46.78	44.71	38.87	36.53
DKLDL	73.85	39.18	44.52	41.06	37.75	35.91
FDA	63.56	34.64	38.73	37.79	31.58	29.82
CoFAT	75.22	49.72	55.51	53.35	47.75	45.95

Table 6. Compression-aware attacks on CIFAR-100 (

\ell_{\infty}

\epsilon=8/255

). Models: DMAT, FDA and MeanSparse use WRN-70-16, MixedNuts uses ResNet-152 + WRN-70-16, and DKLDL uses WRN-28-10. Clean and AutoAttack (AA) accuracies are from RobustBench ( 11 ) . We reimplement CoFAT ( 28 ) using WRN-70-16 and report results. Ours 1 refers to JPEG + FGSM and Ours 2 refers to JPEG + PGD.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 432 papers

Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression
May 9, 2026Jiaming Liang, Chi-Man Pun, Weisi Lin +1Learned Image Compression Adversarial Attacks
University of Macau Macau, China · Nanyang Technological University Singapore
Fast Test-Time Refinement for Robust Learned Image Compression
Aug 15, 2026Jiaming Liang, Chi-Man Pun, Weisi LinLearned Image Compression Adversarial Robustness
University of Macau Macau, China · Nanyang Technological University Singapore
On the Interaction of Compressibility and Adversarial Robustness
Jul 23, 2025Melih Barsbey, Antônio H. Ribeiro, Umut Şimşekli +1Neural Network Robustness Adversarial Robustness
Department of Computing, Imperial College London, UK · Department of Information Technology, Uppsala University, Sweden · INRIA, CNRS, Département d’Informatique de l’Ecole Normale Supérieure / PSL, France

May 9, 2026J/K move · Enter open · S save

Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression

Jiaming Liang, Chi-Man Pun, Weisi Lin, Greta Seng Peng Mok

University of Macau Macau, China · Nanyang Technological University Singapore

Learned Image Compression Adversarial Attacks Gradient Descent Adversarial Examples

Open paper AskPDF arXiv

Learned image compression (LIC) integrates deep neural networks (DNNs) to map high-dimensional images into compact latent representations, reducing redundancy and achieving superior rate-distortion (RD) performance in benign settings. Unfortunately, due to inherent vulnerabilities in DNNs, LIC systems are susceptible to adversarial perturbations that lead to downstream deterioration, compression rate degradation, untargeted distortion, and both local semantic manipulation (LSM) and low-resolution (

3\times28\times28

) global semantic manipulation (GSM). However, high-resolution GSM remains unexplored due to its intractability. Notably, the existing project gradient descent (PGD) method achieves near-perfect white-box attacks for classification, segmentation, and other tasks, yet fails to generalize to high-resolution GSM. Our theoretical and empirical analyses reveal that well-performing GSM drives adversarial examples from the Identity Region to the Amplification Region through the Lazying-Oscillating-Refining stages. General

\ell_{\infty}

-bounded attacks fail on high-resolution GSM because their step-size schedules cannot accommodate both the Oscillating and Refining stages. Based on this, we propose the Periodic Geometric Decay schedule that enables

\ell_{\infty}

-bounded high-resolution GSM. To verify our approach, we integrate it with PGD, yielding a minimal variant, PGD

^{2}

-GSM. Extensive experiments on the Kodak

(3\times768\times512)

demonstrate that our PGD

^{2}

-GSM is the first to stably achieve high-resolution GSM, thereby exposing a novel threat to LIC systems. Code is available at https://github.com/chinaliangjiaming/PGD2-GSM.

Abstract

Adversarial Attacks

Explore similar work

Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression

Fast Test-Time Refinement for Robust Learned Image Compression

On the Interaction of Compressibility and Adversarial Robustness