Inevitable Encounters: Backdoor Attacks Involving Lossy Compression

• URL: http://arxiv.org/abs/2603.13864v1
• Date: Sat, 14 Mar 2026 09:45:59 GMT
• Title: Inevitable Encounters: Backdoor Attacks Involving Lossy Compression
• Abstract summary: Real-world backdoor attacks often require poisoned datasets to be stored and transmitted before being used to compromise deep learning systems.<n>We find that triggers embedded in RGB images often become ineffective after the images are lossily compressed into binary bitstreams.<n>We propose two poisoning strategies tailored to inevitable lossy compression.
• Score: 12.150587060134109
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Real-world backdoor attacks often require poisoned datasets to be stored and transmitted before being used to compromise deep learning systems. However, in the era of big data, the inevitable use of lossy compression poses a fundamental challenge to invisible backdoor attacks. We find that triggers embedded in RGB images often become ineffective after the images are lossily compressed into binary bitstreams (e.g., JPEG files) for storage and transmission. As a result, the poisoned data lose its malicious effect after compression, causing backdoor injection to fail. In this paper, we highlight the necessity of explicitly accounting for the lossy compression process in backdoor attacks. This requires attackers to ensure that the transmitted binary bitstreams preserve malicious trigger information, so that effective triggers can be recovered in the decompressed data. Building on the region-of-interest (ROI) coding mechanism in image compression, we propose two poisoning strategies tailored to inevitable lossy compression. First, we introduce Universal Attack Activation, a universal method that uses sample-specific ROI masks to reactivate trigger information in binary bitstreams for learned image compression (LIC). Second, we present Compression-Adapted Attack, a new attack strategy that employs customized ROI masks to encode trigger information into binary bitstreams and is applicable to both traditional codecs and LIC. Extensive experiments demonstrate the effectiveness of both strategies.

Related papers

• CompressionAttack: Exploiting Prompt Compression as a New Attack Surface in LLM-Powered Agents [7.68677090046928]
  This work identifies prompt compression as a novel attack surface and presents CompressionAttack, the first framework to exploit it.<n>Experiments on multiple LLMs show up to 80% attack success and 98% preference flips, while remaining highly stealthy and transferable.<n>Case studies in VSCode Cline and Ollama confirm real-world impact, and current defenses prove ineffective.
  arXiv  Detail & Related papers  (2025-10-27T03:37:41Z)
• Joint Lossless Compression and Steganography for Medical Images via Large Language Models [63.454510290574355]
  We propose a novel joint lossless compression and steganography framework for medical images.<n>Inspired by bit plane slicing (BPS), we find it feasible to embed privacy messages into medical images in an invisible manner.
  arXiv  Detail & Related papers  (2025-08-03T14:45:51Z)
• Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Prior [118.92747171905727]
  This paper introduces a novel frequency-based trigger injection model for launching backdoor attacks with multiple triggers on learned image compression models.<n>We design attack objectives tailored to diverse scenarios, including: 1) degrading compression quality in terms of bit-rate and reconstruction accuracy; 2) targeting task-driven measures like face recognition and semantic segmentation.<n>Experiments show that our trigger injection models, combined with minor modifications to encoder parameters, successfully inject multiple backdoors and their triggers into a single compression model.
  arXiv  Detail & Related papers  (2024-12-02T15:58:40Z)
• UniCompress: Enhancing Multi-Data Medical Image Compression with Knowledge Distillation [59.3877309501938]
  Implicit Neural Representation (INR) networks have shown remarkable versatility due to their flexible compression ratios. We introduce a codebook containing frequency domain information as a prior input to the INR network. This enhances the representational power of INR and provides distinctive conditioning for different image blocks.
  arXiv  Detail & Related papers  (2024-05-27T05:52:13Z)
• Everyone Can Attack: Repurpose Lossy Compression as a Natural Backdoor Attack [15.017990145799189]
  This paper shows that anyone can exploit an easily-accessible algorithm for silent backdoor attacks. Via this attack, the adversary does not need to design a trigger generator as seen in prior works and only requires poisoning the data.
  arXiv  Detail & Related papers  (2023-08-31T12:38:29Z)
• Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Trigger [106.10954454667757]
  We present a novel backdoor attack with multiple triggers against learned image compression models. Motivated by the widely used discrete cosine transform (DCT) in existing compression systems and standards, we propose a frequency-based trigger injection model.
  arXiv  Detail & Related papers  (2023-02-28T15:39:31Z)
• Compression-Resistant Backdoor Attack against Deep Neural Networks [14.090372810670756]
  In recent years, many backdoor attacks based on training data poisoning have been proposed. In practice, those backdoor attacks are vulnerable to image compressions. We propose a compression-resistant backdoor attack based on feature consistency training.
  arXiv  Detail & Related papers  (2022-01-03T14:23:58Z)
• Towards Robust Data Hiding Against (JPEG) Compression: A Pseudo-Differentiable Deep Learning Approach [78.05383266222285]
  It is still an open challenge to achieve the goal of data hiding that can be against these compressions. Deep learning has shown large success in data hiding, while non-differentiability of JPEG makes it challenging to train a deep pipeline for improving robustness against lossy compression. In this work, we propose a simple yet effective approach to address all the above limitations at once.
  arXiv  Detail & Related papers  (2020-12-30T12:30:09Z)
• Modeling Lost Information in Lossy Image Compression [72.69327382643549]
  Lossy image compression is one of the most commonly used operators for digital images. We propose a novel invertible framework called Invertible Lossy Compression (ILC) to largely mitigate the information loss problem.
  arXiv  Detail & Related papers  (2020-06-22T04:04:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.