I was immediately was curious how it would protect against image compression and/or otherwise de-noising these protection pixel changes. Their paper does address this question, and for those that are interested:
Even image compression cannot defeat our cloak.
We use progressive JPEG [57], reportedly used
by Facebook and Twitter, to compress the images
in our dataset. The image quality, as standard
by Independent JPEG Group [1], ranges from 5 to
95 (lower value = higher compression). As shown
in Figure 15, image compression decreases the
protection success rate, but more significantly
degrades normal classification accuracy.
I wonder how it works, but it works.
p.s. Mobile friendly copy-paste: "Even image compression cannot defeat our cloak. We use progressive JPEG [57], reportedly used by Facebook and Twitter, to compress the images in our dataset. The image quality, as standard by Independent JPEG Group [1], ranges from 5 to 95 (lower value = higher compression). As shown in Figure 15, image compression decreases the protection success rate, but more significantly degrades normal classification accuracy."
p.s. Mobile friendly copy-paste: "Even image compression cannot defeat our cloak. We use progressive JPEG [57], reportedly used by Facebook and Twitter, to compress the images in our dataset. The image quality, as standard by Independent JPEG Group [1], ranges from 5 to 95 (lower value = higher compression). As shown in Figure 15, image compression decreases the protection success rate, but more significantly degrades normal classification accuracy."