Research map / Adversarial robustness and security / Attacks on text and graphs
Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compression
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Grayscale compression of training data (ISS-Gray) | EM, DC, REM poisons (low-frequency/color-varying perturbations) · CIFAR-10 L_inf=8 | clean test accuracy: EM 21.05 -> 93.01 | Helped |
| JPEG (quality 10) compression of training data (ISS-JPEG) | High-frequency surrogate-trained poisons (TAP, SEP, HYPO) · CIFAR-10 L_inf=8 | clean test accuracy: TAP 8.17 -> 83.87; SEP 3.85 -> 84.37 | Helped |
| Gray+JPEG combined compression without knowing the poison type | All 12 PAP methods · CIFAR-10 L_inf=8 | clean test accuracy: globally effective, with a small decrease in clean accuracy | Helped |
| Data augmentations (Cutout, CutMix, Mixup, Gaussian) applied to training data | PAP poisons generally · CIFAR-10 L_inf=8 | clean test accuracy | No clear effect |
| Adversarial training as countermeasure vs ISS | L_inf and L_2 PAPs · CIFAR-10 | clean test accuracy | No clear effect |
| Adversarial training replaced by ISS (lower cost) | CIFAR-10 countermeasure training cost · CIFAR-10 | training time: ISS training time is only 1/7 of AT training time | Helped |
| Median filtering applied to training data | OPS (one-pixel) poisons · CIFAR-10 L_0=1 | clean test accuracy: OPS 36.55 -> 85.16 | Helped |
| Gray compression applied to both training and test data (Gray-TT) vs training only (ablation) | EM and other poisons · CIFAR-10 L_inf=8 | clean test accuracy: Gray-TT 90.75 vs Gray 93.01 on EM | No clear effect |
| Adding partial/fraction poisoning (10-90%) with ISS Gray/JPEG | Poisons at 80% poisoning proportion · CIFAR-10 partial poisoning | clean test accuracy | No clear effect |
| Adaptive grayscale-aware EM poisons (EM-Gray) vs ISS Gray (ablation) | EM poisons · CIFAR-10 L_inf=8 adaptive | clean test accuracy: EM-Gray 16.60 under Gray vs EM 93.01 non-adaptive | Hurt |
| Adaptive JPEG-aware EM poisons (EM-JPEG) vs ISS JPEG (ablation) | EM poisons · CIFAR-10 L_inf=8 adaptive | clean test accuracy: EM-JPEG 83.11 vs EM 81.50 under JPEG | No clear effect |
| Equal-weight mix of EM and TAP perturbations defended by ISS (ablation) | EM+TAP combined poisons · CIFAR-10 L_inf=8 | clean test accuracy: EM+TAP w/o 36.07 -> JPEG 84.62; Gray 18.93 | Helped |
Closest papers by meaning
- Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders (ICML 2024 · similarity 0.87)
- Improved Training Technique for Shortcut Models (NeurIPS 2025 · similarity 0.86)
- Nearly Zero-Cost Protection Against Mimicry by Personalized Diffusion Models (CVPR 2025 · similarity 0.86)
- Layer-Aware Analysis of Catastrophic Overfitting: Revealing the Pseudo-Robust Shortcut Dependency (ICML 2024 · similarity 0.85)
- Perturbing Attention Gives You More Bang for the Buck: Subtle Imaging Perturbations That Efficiently Fool Customized Diffusion Models (CVPR 2024 · similarity 0.84)
- AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.