JPEG compression-resistant adversarial attack with invisible watermark embedding

Deep neural networks have achieved impressive performance across various domains but remain highly vulnerable to adversarial attacks. Existing adversarial methods often introduce imperceptible perturbations as meaningless noise, which become ineffective after standard image compression. In this paper, we propose a novel JPEG compression-resistant adversarial attack framework that simultaneously embeds invisible watermark information and adversarial perturbations directly into the DCT domain. By introducing a simulated JPEG recompression preprocessing layer and employing a straight-through estimator, our method enables gradient backpropagation through quantized DCT coefficients. Targeted modifications are performed based on saliency maps, while the number of coefficient alterations is strictly constrained to minimize image distortion. Experimental results demonstrate that the proposed approach achieves robust adversarial attacks and accurate watermark recovery even after standard compression, outperforming traditional adversarial methods.