Inevitable Encounters: Backdoor Attacks Involving Lossy Compression

2026-03-14

AI Summary

This work addresses the vulnerability of conventional backdoor attacks to lossy compression (e.g., JPEG), where trigger distortion often renders them ineffective. To overcome this limitation, the authors propose two novel strategies that explicitly incorporate the lossy compression pipeline into backdoor design: a universal approach termed Universal Attack Activation and a more flexible Compression-Adapted Attack compatible with both traditional and learning-based codecs. Leveraging region-of-interest (ROI) coding mechanisms inherent in image compression, the method integrates learned image compression (LIC) and compressive sensing techniques to embed triggers within sample-specific or customized ROI masks, thereby preserving critical trigger information during compression. Experimental results demonstrate that the proposed approaches effectively recover triggers and reliably activate backdoors across diverse compression scenarios, significantly enhancing robustness in real-world transmission and storage environments.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Learning on the Edge & Model Compression
• Data Mining & Knowledge Management: Data Compression

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Security and Privacy: Large-scale security measurements

Abstract

Real-world backdoor attacks often require poisoned datasets to be stored and transmitted before being used to compromise deep learning systems. However, in the era of big data, the inevitable use of lossy compression poses a fundamental challenge to invisible backdoor attacks. We find that triggers embedded in RGB images often become ineffective after the images are lossily compressed into binary bitstreams (e.g., JPEG files) for storage and transmission. As a result, the poisoned data lose its malicious effect after compression, causing backdoor injection to fail. In this paper, we highlight the necessity of explicitly accounting for the lossy compression process in backdoor attacks. This requires attackers to ensure that the transmitted binary bitstreams preserve malicious trigger information, so that effective triggers can be recovered in the decompressed data. Building on the region-of-interest (ROI) coding mechanism in image compression, we propose two poisoning strategies tailored to inevitable lossy compression. First, we introduce Universal Attack Activation, a universal method that uses sample-specific ROI masks to reactivate trigger information in binary bitstreams for learned image compression (LIC). Second, we present Compression-Adapted Attack, a new attack strategy that employs customized ROI masks to encode trigger information into binary bitstreams and is applicable to both traditional codecs and LIC. Extensive experiments demonstrate the effectiveness of both strategies.

Problem

• backdoor attacks
• lossy compression
• trigger preservation
• image compression
• poisoned data

Innovation

• backdoor attack
• lossy compression
• region-of-interest (ROI) coding
• learned image compression
• trigger preservation