  This paper considers security risks buried in the data processing pipeline in
common deep learning applications. Deep learning models usually assume a fixed
scale for their training and input data. To allow deep learning applications to
handle a wide range of input data, popular frameworks, such as Caffe,
TensorFlow, and Torch, all provide data scaling functions to resize input to
the dimensions used by deep learning models. Image scaling algorithms are
intended to preserve the visual features of an image after scaling. However,
common image scaling algorithms are not designed to handle human crafted
images. Attackers can make the scaling outputs look dramatically different from
the corresponding input images.
  This paper presents a downscaling attack that targets the data scaling
process in deep learning applications. By carefully crafting input data that
mismatches with the dimension used by deep learning models, attackers can
create deceiving effects. A deep learning application effectively consumes data
that are not the same as those presented to users. The visual inconsistency
enables practical evasion and data poisoning attacks to deep learning
applications. This paper presents proof-of-concept attack samples to popular
deep-learning-based image classification applications. To address the
downscaling attacks, the paper also suggests multiple potential mitigation
strategies.
