Robust Reversible Recovery for Adversarially Protected JPEG Images

Reversible adversarial examples (RAEs) can disrupt access by malicious AI models while ensuring recoverability for authorized users. However, practical image circulation is dominated by JPEG files, whereas most existing RAE methods perturb spatial-domain images and are therefore poorly matched to compression, re-saving, and coefficient quantization. Beyond JPEG compatibility, circulation imposes a stricter and underexplored requirement that protected images should be perturbed in the JPEG domain, remain adversarial after spatial reconstruction, preserve visual fidelity, incur modest file-size growth, and remain recoverable under channel attacks such as recompression, noise, cropping, resizing, and platform re-saving. This paper presents the first systematic study of robust reversible adversarial protection for post-processed JPEG images and proposes SRAP-JPEG, a Synchronized Reversible Adversarial Protection framework on quantized DCT coefficients. SRAP-JPEG decouples adversarial perturbation from reversible recording by injecting perturbations into luminance coefficients, hiding recovery records in paired chrominance coefficients through a secret-key mapping, and adopting coefficient-adaptive allocation to trade off reversible capacity, attack strength, visual quality, and file-size growth. It crafts protective perturbations directly in the JPEG coefficient domain by propagating gradients from classification or vision-language objectives through the chain rule. For authorized recovery, SRAP-JPEG integrates block-phase synchronization, embedding-state identification, and coefficient restoration, enabling exact recovery of intact protected JPEGs and high-fidelity recovery after practical distortions. Experiments on ImageNet and MS-COCO show that SRAP-JPEG achieves an 81.82\% average attack success rate on ten mainstream classifiers, degrades CLIP-based image-text retrieval, and recovers distorted protected images with high visual fidelity, including 41.60 dB PSNR after JPEG recompression at QF 70 and 59.51 dB on the aligned uncropped region after edge cropping at ratio 0.25.