ComReAdv: Defeating the "Black-Box" Compression of Social Networks to Protect Your Privacy

TL;DR

Social networks automatically compress your photos, a process that usually "cleans" away the invisible adversarial noises intended to protect your privacy from AI scrapers. ComReAdv solves this by training a shadow neural network (ComModel) to mimic the platform's secret compression. By attacking through this proxy, it creates "compression-proof" photos that keep AI classifiers in the dark while looking perfect to human eyes.

The Fragility of Privacy in the DNN Era

Every time you upload a photo to Facebook or Instagram, deep neural networks (DNNs) are likely scanning it for locations, faces, and personal habits. While researchers have used Adversarial Examples—images with tiny, invisible perturbations—to fool these AI models, there is a major hurdle: Image Compression.

Social platforms use aggressive compression to save bandwidth. These algorithms act as a natural "denoiser," stripping away the high-frequency adversarial signals. Most prior works failed because they either ignored compression or only accounted for standard JPEG. In reality, platforms use "black-box" customized versions of WEBP or JPEG2000 that are non-differentiable and impossible to mathematically "see" through during the attack phase.

Methodology: The "Shadow" Proxy Strategy

The core innovation of this paper is the ComReAdv (Compression-Resistant Adversarial) framework. The authors realized that if you can't see the algorithm, you can learn it.

1. The ComModel Architecture

The researchers designed an encoding-decoding network (similar to U-Net) to act as a differentiable surrogate for the platform's compression.

• Data Query: They upload thousands of images and download the compressed versions to create a training pair set.
• Feature Reconstruction: Using skip connections, the model learns to replicate the specific "damage" the platform does to an image's texture and edges.

Figure: The end-to-end pipeline—from learning the compression signature to generating the resistant image.

2. Differentiable Attack Loop

Once the ComModel is trained, it becomes a "bridge." Instead of calculating gradients directly on the target image, the attack algorithm (like MIM or BIM) flows gradients through the ComModel. This ensures the added noise is specifically designed to survive the "quantization" and "downsampling" steps of the social network.

Figure: The U-Net style architecture of ComModel, utilizing residual blocks to capture fine-grained compression artifacts.

Battle-Tested: Real-World Performance

The authors didn't just test in a lab; they went after real platforms: Weibo, Facebook, and Douban.

• JPEG-Resistance: Against standard JPEG (Quality 25), ComReAdv achieved an 80% success rate, whereas standard attacks plummeted to near zero.
• The Douban Test: Douban likely uses WEBP compression. Prior "JPEG-specific" attacks failed here because they didn't match the math. ComReAdv, because it learned the Douban signature, achieved a 61% success rate with only slightly higher noise (ε=4).

Figure: ComReAdv maintains its attack effectiveness (Green/Red) while standard methods (Blue/Yellow) fail completely once compression is applied.

Critical Insight: Why This Matters

The most profound takeaway from this work is the verification of the Surrogate Differentiability principle. By treating an unknown, non-differentiable process (black-box compression) as a target for a neural approximation, we can optimize through operations that were previously thought to be "privacy-safe."

Limitations & Future Work

• Platform Updates: If a social network changes its compression algorithm, the ComModel must be re-trained.
• Perturbation Visibility: At high resistance levels (ε > 5), noise might become slightly visible.
• Future Path: This logic could be applied to Video Privacy, where temporal compression (H.265) is even more complex and destructive to adversarial signals.

Conclusion

ComReAdv proves that user privacy can be resilient. By out-thinking the platform's bandwidth-saving tools, we can create photos that remain "human-readable but AI-unreadable," giving users back control over their digital footprints.