If you shipped a MobileNet-class model to a camera, a doorbell, or a handheld scanner and put a JPEG-compression or bit-depth-reduction step in front of it because that is what the literature recommends, a preprint posted to arXiv on September 3, 2026 says the mitigation is probably doing nothing for you. Preprocessing Failure and Adversarial Detection in Depthwise-Separable Edge Vision Systems (Mukta, Sanjida, Tory, Rahman, and Hasan; arXiv:2609.03453, cs.CV with a cs.CR cross-list, 14 pages) evaluates six preprocessing defenses against adversarial perturbations across three architectures. The two depthwise-separable models show consistently poor recovery at every perturbation level and every defense tested. The residual model shows partial recovery. Ablations, per the authors, are consistent with an architectural rather than a parametric explanation.
The useful part is not the negative result. It is the second half: on the depthwise-separable models, the paper reports that preprocessing disrupts clean predictions while leaving adversarial predictions largely unchanged. That is the reverse of the assumption every squeeze-based detector is built on.
The architecture assumption nobody re-tested
Input-transformation defenses are attractive for the same reason they are oversold. They need no retraining, no architecture change, and no gradient access, so they get recommended as model-agnostic. The canonical evaluations that made them credible were run on residual and Inception-class backbones. Guo et al.’s input-transformation work evaluated bit-depth reduction, JPEG compression, total variance minimization, and image quilting in exactly that setting, and attributed the effect partly to non-differentiability and randomness.
Edge deployments do not run those backbones. They run depthwise-separable convolutions, because that is the entire point of MobileNets: factor a standard convolution into a per-channel spatial filter plus a 1x1 pointwise mix, and the multiply-accumulate budget collapses to something a battery can carry.
That factorization is also the plausible mechanism for the failure, though the paper reports ablation consistency rather than an isolated cause. In a standard convolution, every output activation is a sum across all input channels, so a spatial perturbation gets averaged against redundant evidence from the rest of the channel stack. In the depthwise stage, each spatial filter sees one channel and nothing else. Cross-channel mixing is deferred to a pointwise layer that has no spatial extent at all. Smoothing, quantization, and compression all operate in the spatial domain, which is precisely the stage the factorization stripped of redundancy. Whatever the true mechanism, the practical read is the same: a defense validated on ResNet is an untested defense on MobileNet, and “model-agnostic” was a claim about the deployment procedure, not about the model.
The detection flip, and how to get its sign wrong
Feature squeezing (Xu, Evans, Qi) is the standard cheap detector. Run the input through a squeezer, usually color bit-depth reduction or spatial smoothing, score both versions, and compare. The premise is that clean inputs sit in the interior of a decision region and survive squeezing, while adversarial inputs sit against a boundary and fall off it.
The new preprint reports the asymmetry running the other way on depthwise-separable models. Read the consequence carefully, because it is a sign error, not a sensitivity problem:
# Feature squeezing, as published (residual-backbone premise)
def is_adversarial(x, model, squeeze):
d = l1(softmax(model(x)), softmax(model(squeeze(x))))
return d > TAU # clean is STABLE, adversarial DIVERGES
# What the reported asymmetry implies for a depthwise-separable backbone:
# clean -> preprocessing disrupts the prediction (large d)
# adv -> preprocessing leaves it largely intact (small d)
# Ship the rule above unchanged and the detector is anti-correlated
# with ground truth: it flags clean traffic and passes the attack.
# Calibrate the direction empirically. Never inherit it.
def fit_detector(clean_set, adv_set, model, squeeze):
d_clean = [divergence(x, model, squeeze) for x in clean_set]
d_adv = [divergence(x, model, squeeze) for x in adv_set]
sign = +1 if median(d_adv) > median(d_clean) else -1 # <- the bug lives here
tau = pick_threshold(d_clean, d_adv, sign, target_fpr=0.01)
return sign, tauAn inverted detector is worse than no detector. It generates a false-positive stream on ordinary traffic, which trains the operators to ignore it, and it stays quiet on the one input class it exists to catch. A binary detector shipped with the wrong sign is a per-model calibration failure, and the calibration set is the only thing that can tell you the sign. Guidance cannot.
Treat the detection result itself with the caution the paper’s own scope demands: three architectures, one attack family. That is enough to invalidate a portability assumption. It is not enough to establish a new defense. The standing lesson from Athalye, Carlini, and Wagner, who broke six of nine non-certified ICLR 2018 defenses completely and a seventh partially, is that a defense measured against a fixed, non-adaptive attack has not been measured. An adversary who knows a divergence detector is present optimizes the perturbation to preserve prediction stability under the squeezer, and that constraint is differentiable when the squeezer is.
Image quality metrics are the wrong knob
The paper’s other methodological finding is the one most likely to be quietly wrong in production right now: standard image quality metrics are unreliable proxies for defense effectiveness. Tuning a JPEG quality factor or a smoothing kernel by watching PSNR or SSIM optimizes for perceptual fidelity to the input. Robust accuracy on the downstream classifier is a different quantity, and the paper reports the two do not track. If your defense parameter sweep is scored on an image metric, you tuned a photo pipeline, not a defense.
What to do
- Re-run the defense evaluation on your actual backbone. Not a proxy, not the paper’s backbone. If your fleet runs a depthwise-separable model, results from residual-architecture literature do not transfer, and this preprint is a direct argument that they do not. See evaluating adversarial robustness correctly for the failure modes that make these evaluations look better than they are.
- Calibrate detector direction and threshold per model, from your own clean and adversarial sets. Fit the sign; do not inherit it from a paper. Re-fit after every retrain or quantization pass, because both move decision boundaries.
- Score defenses on robust accuracy, never on PSNR or SSIM. Report clean accuracy alongside it. A preprocessing step that costs clean accuracy and buys no robust accuracy is a pure regression.
- Evaluate against an adaptive attacker. Assume the perturbation is optimized with the preprocessing step in the loop. FGSM, PGD, and C&W at a fixed epsilon against an undefended model is a smoke test, not an evaluation.
- Record the assumption in your model card or threat model. NIST’s AI 100-2 E2025 taxonomy exists so that “we applied an evasion mitigation” has to name the attack class, the model, and the conditions. “Preprocessing, validated on a different architecture family” is a finding, and it should be written down as one.
Preprocessing was always the cheap option, and cheap options get deployed at fleet scale without a per-deployment evaluation. That is the actual exposure here: not one broken defense, but a class of mitigation whose validation was never repeated on the architecture family that dominates the endpoints running it.
Related across the network
- Evasion Attacks in Production ML: Malware, Spam, and Fraud — aiattacks.dev
- AI Security: Attack Categories and Defense Priorities — ai-alert.org
- LLM Supply Chain Poisoning: Attacks and Defenses — ai-alert.org
