Compression as an Adversarial Amplifier Through Decision Space Reduction

Abstract: Image compression is a ubiquitous component of modern visual pipelines, routinely applied by social media platforms and resource-constrained systems prior to inference. Despite its prevalence, the impact of compression on adversarial robustness remains poorly understood. We study a previously unexplored adversarial setting in which attacks are applied directly in compressed representations, and show that compression can act as an adversarial amplifier for deep image classifiers. Under identical nominal perturbation budgets, compression-aware attacks are substantially more effective than their pixel-space counterparts. We attribute this effect to decision space reduction, whereby compression induces a non-invertible, information-losing transformation that contracts classification margins and increases sensitivity to perturbations. Extensive experiments across standard benchmarks and architectures support our analysis and reveal a critical vulnerability in compression-in-the-loop deployment settings. Code will be released.

• The paper demonstrates that lossy compression contracts classification margins, increasing the effectiveness of adversarial perturbations.
• It uses geometric analysis and empirical tests on CIFAR-10, CIFAR-100, and ImageNet to reveal that compression intensifies model vulnerability even with adversarial training.
• The study highlights operation order asymmetry, showing that compressing before attack significantly degrades accuracy compared to compressing after perturbation.

Compression as an Adversarial Amplifier: Decision Space Reduction

Problem Formulation and Motivations

This study investigates the adversarial vulnerability of deep image classifiers in compression-in-the-loop settings, where lossy compression is applied prior to inference—a paradigm aligned with operational realities in content delivery, edge devices, and social media platforms. The paper interrogates the widespread assumption that compression acts as a defensive or purifying mechanism and demonstrates instead that compression amplifies adversarial perturbation effectiveness. Specifically, the paper formalizes a threat model wherein attacks are executed on compressed representations rather than original pixel space, marking a conceptual departure from classical defense-oriented perspectives.

Geometric Mechanism: Decision Space Reduction

The central claim is that lossy compression induces a non-invertible, information-reducing transformation that contracts classification margins and increases proximity between decision boundaries and input samples. Consequently, perturbations with identical $\ell_p$ norm budgets achieve higher adversarial success post-compression due to reduced margin and contracted true-class regions. This geometric mechanism, termed "decision space reduction," manifests locally and is independent of attack model or classifier architecture.

Figure 1: Compression contracts the decision region assigned to the true class, bringing competing classes and boundaries closer and amplifying vulnerability.

From a geometric perspective, the paper mathematically demonstrates (using Lipschitz and margin arguments) that compression reduces the robust radius: $r_g(x) \leq \frac{m(C(x))}{L_f L_C}$, where $m(C(x))$ is the post-compression margin. Empirical visualizations on 2D neighborhoods (constructed from loss gradient and orthogonal directions) further confirm that compression consistently shrinks true-class regions and increases boundary density.

Compression-Aware Adversarial Pipeline

The pipeline consists of sequential application of (i) lossy image compression (e.g., JPEG, PCA, PatchSVD), (ii) perturbation via gradient-based adversary, and (iii) target classifier inference and evaluation (accuracy, attack success rate, perceptual distortion metrics).

Figure 2: Pipeline applies compression, followed by adversarial perturbation in compressed space, then evaluates prediction and distortion.

Unlike prior work, the adversary operates post-compression and does not require differentiable compression or gradient approximation through $C$—reflecting real-world attacker access to compressed images.

Empirical Analysis: Robustness Degradation

Across CIFAR-10, CIFAR-100, and ImageNet benchmarks, with models spanning ResNet-18 to ViT-L/16, compression-aware attacks (JPEG$\rightarrow$FGSM, PCA$\rightarrow$FGSM, etc.) consistently cause larger accuracy drops than pixel-space counterparts at comparable PSNR. For example, JPEG$\rightarrow$FGSM reduces ResNet-18/CIFAR-100 accuracy to 8.46%, lower than FGSM (10.03%) at similar distortion. PGD and more sophisticated attacks exhibit even more pronounced amplification, with accuracy occasionally collapsing completely. The effect persists across models (CNN and ViT), compression strengths, and attack variants, and is robust to perturbation norm choice.

Quantifying Decision Space Reduction

Figure 3: Compression increases boundary intrusion, margin collapse, and reduces true-class region fraction as JPEG quality decreases.

Neighborhood sampling analyses confirm that compression contracts the region assigned to the true class, reduces mean margin, and raises negative-margin (boundary-crossed) points. These metrics provide direct quantitative evidence for decision space reduction and link the geometric contraction to observed robustness collapse.

Operation Order Asymmetry: Amplification vs. Purification

The study highlights a critical order-dependent effect: compression preceding the adversarial attack amplifies vulnerability, while compression applied after perturbation partially restores margins and accuracy. Attacking after compression (JPEG$\rightarrow$FGSM) produces a drastic accuracy drop (e.g., ResNet-18/CIFAR-100: 8.46%), but attacking first and compressing afterward (FGSM$\rightarrow$JPEG) increases accuracy to 45.86%. This asymmetry is not attributable to information loss alone, but rather the geometric reshaping of decision boundaries relative to input samples.

Figure 4: Compression followed by attack yields significantly lower accuracy than attack followed by compression, despite similar PSNR.

Sensitivity and Ablation: Perturbation Budget and Robust Models

Compression-aware attacks systematically outperform pixel-space attacks across perturbation budgets, and the gap widens with increasing $\epsilon$. The vulnerability persists on adversarially trained models (DMAT, FDA, etc.), albeit with narrower absolute accuracy gaps, implying adversarial training enlarges margins but does not eliminate the amplification effect. These results underscore that compression introduces an attack surface distinct from model-internal geometry.

Theoretical and Practical Implications

This work compels a revision of robustness research methodologies—compression should not be assumed defensive, and evaluating models exclusively in pixel-space is incomplete. The geometric contraction of margins and boundary proximity induced by compression increases the likelihood of boundary-crossing perturbations, rendering models vulnerable even with stronger adversarial training. Practically, this exposes critical gaps in deployment pipelines where compression is an immutable preprocessing step, suggesting the need for compression-aware adversarial training and threat evaluation.

From a theoretical standpoint, the framework of decision space reduction unifies both adversarial amplification and purification effects, and provides mechanistic insight into why operation order alters robustness: compression contracts or restores margins depending on whether it is applied before or after perturbation. Future directions should pursue margin-preserving compression transforms, study compositional effects of multiple transformations, and develop explicit geometric regularization strategies under compression-in-the-loop threat models.

Conclusion

The paper rigorously demonstrates that lossy compression amplifies adversarial vulnerability in deep image classifiers by contracting true-class regions and decision margins, fundamentally altering local input geometry. Compression-aware perturbations yield systematic robustness degradation across datasets, architectures, and attack types, and even adversarially trained models remain susceptible. The geometric perspective of decision space reduction underpins both the amplification and attenuation effects observed, establishing compression as a salient threat surface in modern deployment. The implications demand compression-aware robustness analysis and intervention to secure visual AI systems (2604.06954).