MROP: Mask-Region Optimized Purification Against Backdoor Attack in Deep JSCC

• URL: http://arxiv.org/abs/2609.00786v1
• Date: Tue, 01 Sep 2026 06:31:07 GMT
• Title: MROP: Mask-Region Optimized Purification Against Backdoor Attack in Deep JSCC
• Abstract summary: Deep joint source and channel coding (JSCC) transmits a source by mapping it directly to channel symbols through an end-to-end deep neural network (DNN) and reconstructing it at the receiver.<n>Taking image transmission as an application, this pipeline behaves as a black box: the receiver cannot readily detect security attacks when the transmitted images are corrupted.<n>We study defense against input-patch backdoor attacks on deep J SCC, in which a small trigger patch attached to the input forces the decoder to emit an attacker-chosen target image.
• Score: 9.986296855958125
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Deep joint source and channel coding (JSCC) transmits a source by mapping it directly to channel symbols through an end-to-end deep neural network (DNN) and reconstructing it at the receiver. Taking image transmission as an application, this DNN pipeline behaves as a black box: the receiver cannot readily detect security attacks when the transmitted images are corrupted, thereby introducing a new security vulnerability. In this letter, we study defense against input-patch backdoor attacks on deep JSCC, in which a small trigger patch attached to the input forces the decoder to emit an attacker-chosen target image. Most existing patch-trigger defenses are designed for classification, leaving the reconstruction setting of deep JSCC unaddressed. We adapt the gradient mask defense to this reconstruction setting as a baseline and then propose mask-region optimized purification (MROP), which operates at inference and requires no retraining of the JSCC model. Unlike the baseline, which localizes the trigger from the input--output gradient, MROP instead places a per-pixel mask at the encoder input and optimizes it via a Gumbel-sigmoid relaxation to localize the trigger, then refines the trigger region to reconstruct the pure images better. In numerical results, we evaluate the proposed method on CIFAR-10 and STL-10 datasets along with the DeepJSCC and SwinJSCC models. By doing so, we show that the proposed method substantially lowers the attack success rate (ASR) while preserving the peak signal-to-noise ratio (PSNR) of clean reconstructions.

Related papers

• SignDeepSC: A Semantic Signature-based Approach for Robust Semantic Communication [4.042562775811428]
  SignDeepSC is an architectural defense that achieves adversarial robustness without requiring adversarial example generation during training.<n>System is built on a perceiver-inspired semantic signature, a compact vector summary of the source features transmitted over a separate low-rate auxiliary channel.
  arXiv  Detail & Related papers  (2026-07-28T12:54:13Z)
• SecDiff: Diffusion-Aided Secure Deep Joint Source-Channel Coding Against Adversarial Attacks [73.41290017870097]
  SecDiff is a plug-and-play, diffusion-aided decoding framework.<n>It significantly enhances the security and robustness of deep J SCC under adversarial wireless environments.
  arXiv  Detail & Related papers  (2025-11-03T11:24:06Z)
• SRD: Reinforcement-Learned Semantic Perturbation for Backdoor Defense in VLMs [57.880467106470775]
  Attackers can inject imperceptible perturbations into the training data, causing the model to generate malicious, attacker-controlled captions.<n>We propose Semantic Reward Defense (SRD), a reinforcement learning framework that mitigates backdoor behavior without prior knowledge of triggers.<n>SRD uses a Deep Q-Network to learn policies for applying discrete perturbations to sensitive image regions, aiming to disrupt the activation of malicious pathways.
  arXiv  Detail & Related papers  (2025-06-05T08:22:24Z)
• A Channel-Triggered Backdoor Attack on Wireless Semantic Image Reconstruction [22.485161150177866]
  Previous research on backdoor attacks targeting SemCom symbol reconstruction primarily focuses on input-level triggers.<n>We propose a novel channel-triggered backdoor attack (CT-BA) framework that exploits inherent wireless channel characteristics as activation triggers.<n>Our attack achieves near-perfect attack success rate (ASR) while maintaining effective stealth.
  arXiv  Detail & Related papers  (2025-03-31T09:17:10Z)
• SING: Semantic Image Communications using Null-Space and INN-Guided Diffusion Models [52.40011613324083]
  Joint source-channel coding systems (DeepJSCC) have recently demonstrated remarkable performance in wireless image transmission.<n>Existing methods focus on minimizing distortion between the transmitted image and the reconstructed version at the receiver, often overlooking perceptual quality.<n>We propose SING, a novel framework that formulates the recovery of high-quality images from corrupted reconstructions as an inverse problem.
  arXiv  Detail & Related papers  (2025-03-16T12:32:11Z)
• BadRefSR: Backdoor Attacks Against Reference-based Image Super Resolution [14.605562676764636]
  RefSR leverage an additional reference image to help recover high-frequency details.<n>BadRefSR embeds backdoors in the RefSR model by adding triggers to the reference images and training with a mixed loss function.<n>Our study aims to alert researchers to the potential backdoor risks in RefSR.
  arXiv  Detail & Related papers  (2025-02-28T10:53:39Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Backdoor Attacks for Remote Sensing Data with Wavelet Transform [14.50261153230204]
  In this paper, we provide a systematic analysis of backdoor attacks for remote sensing data. We propose a novel wavelet transform-based attack (WABA) method, which can achieve invisible attacks by injecting the trigger image into the poisoned image. Despite its simplicity, the proposed method can significantly cheat the current state-of-the-art deep learning models with a high attack success rate.
  arXiv  Detail & Related papers  (2022-11-15T10:49:49Z)
• Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm [93.80082636284922]
  Sparse adversarial attacks can fool deep networks (DNNs) by only perturbing a few pixels. Recent efforts combine it with another l_infty perturbation on magnitudes. We propose a homotopy algorithm to tackle the sparsity and neural perturbation framework.
  arXiv  Detail & Related papers  (2021-06-10T20:11:36Z)
• Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises [87.53808756910452]
  A cooling-shrinking attack method is proposed to deceive state-of-the-art SiameseRPN-based trackers. Our method has good transferability and is able to deceive other top-performance trackers such as DaSiamRPN, DaSiamRPN-UpdateNet, and DiMP.
  arXiv  Detail & Related papers  (2020-03-21T07:13:40Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.