Research map / Adversarial robustness and security / Attacks on text and graphs

JPEG Inspired Deep Learning

ICLR 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Biologically inspired robust vision · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes JPEG-DL, which prepends a trainable JPEG layer with a differentiable soft quantizer to any DNN and jointly trains quantization tables and the network, improving classification accuracy on CIFAR-100, fine-grained datasets, and ImageNet.

Problem

JPEG compression is traditionally assumed to hurt DNN accuracy, and prior work either optimizes JPEG for frozen models, needs ground-truth-guided compression, or relies on non-differentiable quantization that yields near-zero gradients for quantization parameters.

Approach

Replace the hard rounding in JPEG quantization with a differentiable soft quantizer (conditional expectation under a softmax over negative squared distances with trainable sharpness alpha), place this JPEG layer right after the input of any DNN, and jointly optimize quantization tables Q and the network; gradient scaling via alpha*q^2 stabilizes quantization-table updates.

Key results

• On fine-grained datasets with DenseNet-121, JPEG-DL improves Flowers top-1 accuracy from 51.32% to 72.22% (+20.90).
• On CIFAR-100, JPEG-DL improves top-1 accuracy across seven tested models, e.g., VGG13 from 73.77% to 75.32%.
• On ImageNet, JPEG-DL improves ResNet18 from 69.75% to 70.13% and SqueezeNetV1.1 from 57.95% to 58.26% with 128 added parameters.

Measured effects reported in the paper

Surprising findings

• Chroma subsampling schemes 4:4:4 and 4:2:2 generally gave better accuracy than the standard 4:2:0, suggesting DNNs use color information differently from humans.
• JPEG-based data augmentation generally degraded accuracy, contrary to the hoped-for benefit.

Limitations

• Alpha is not trained because its gradient vanishes for large alpha, so only quantization steps are learned.
• Transformer experiments used all-ones quantization table initialization rather than sensitivity-based initialization.
• Results on ImageNet gains are small (0.23 to 0.51 points).

Experimental setup

Datasets: CIFAR-100 CUB-200-2011 Stanford Dogs Flowers Pets ImageNet-1K

Benchmarks: CIFAR-100 CUB-200-2011 Stanford Dogs Flowers Pets ImageNet-1K

Metrics: top-1 accuracy adversarial accuracy under FGSM and PGD

Baselines: Baseline standard DNN training Rand. QF JPEG augmentation Denoising Histogram equalization Learnable Resize Uniform noise JPEG-trainable method Polynomial rounding approximation JPEG method Straight-through estimator JPEG method

Builds on: JPEG Compression helps (Dodge & Karam style adaptive JPEG) Sensitivity-based JPEG quantization table design Knowledge distillation CRD

Closest papers by meaning

• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples (CVPR 2019 · similarity 0.86)
• Practical Learned Lossless JPEG Recompression With Multi-Level Cross-Channel Entropy Model in the DCT Domain (CVPR 2022 · similarity 0.84)
• Faster Neural Networks Straight from JPEG (NeurIPS 2018 · similarity 0.84)
• End-to-end Optimized Image Compression (ICLR 2017 · similarity 0.84)
• Network Memory Footprint Compression Through Jointly Learnable Codebooks and Mappings (ICLR 2024 · similarity 0.82)
• Adaptive Dataset Quantization (AAAI 2025 · similarity 0.82)