💻 computer science

Inevitable Encounters: Backdoor Attacks Involving Lossy Compression

This paper addresses the failure of traditional backdoor attacks under lossy compression by proposing two novel poisoning strategies, Universal Attack Activation and Compression-Adapted Attack, which leverage region-of-interest coding mechanisms to ensure malicious triggers remain effective after images are compressed into binary bitstreams.

Original authors: Qian Li, Yunuo Chen, Yuntian Chen

Published 2026-03-17

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Qian Li, Yunuo Chen, Yuntian Chen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Smudged Note" Problem

Imagine you are a spy trying to send a secret message to a friend. You write a note with a hidden code (a backdoor trigger) that tells your friend's computer to ignore a specific instruction and do something else instead.

In the past, spies thought they could just write this code on a piece of paper (an image) and mail it. But in the real world, before the mail arrives, the note gets photocopied and compressed to save space on the server. This is like Lossy Compression (think JPEG files).

The Problem:
When you photocopy a note that has very faint, high-frequency scribbles (invisible to the naked eye), the copier often smudges or deletes those tiny details to make the file smaller.

The Result: Your friend receives the note, but the secret code is now a blurry mess. The computer doesn't recognize the trigger, and the backdoor attack fails.

The authors of this paper realized that almost all previous "invisible" backdoor attacks were failing in the real world because they didn't account for this "photocopying" (compression) process.

The Solution: Two New Spy Tricks

The researchers proposed two new ways to ensure the secret message survives the "photocopying" process. They use a feature called ROI (Region of Interest).

What is ROI?
Think of a photo editor that lets you tell the computer: "This part of the photo is super important, keep it crystal clear. That other part is just background, you can blur it out to save space."

Standard Compression: Blurs everything equally to save space.
ROI Compression: Protects specific areas so they stay sharp, even if the file size stays small.

Here are the two strategies the paper introduces:

1. The "Rescue Mission" (Universal Attack Activation)

The Scenario: You have an old, failed spy note (an existing backdoor attack) where the code got smudged.
The Trick:
Instead of rewriting the whole note, you use the ROI tool to say, "Hey, look at the specific pixels where the secret code used to be! Give those pixels extra protection during the photocopying process."

How it works: The system analyzes the "residue" (the difference) between the clean image and the poisoned image. It creates a mask that tells the compressor: "Don't touch these specific high-frequency pixels; they hold the secret."
The Analogy: It's like putting a protective glass case over the tiny, fragile ink of your secret code before mailing it. When the recipient opens it, the code is still sharp and readable.
Goal: To wake up (reactivate) old attacks that were previously dead.

2. The "New Secret Language" (Compression-Adapted Attack - CAA)

The Scenario: You are writing a brand new note from scratch, knowing it will be photocopied.
The Trick:
Instead of hiding the code in tiny, fragile scribbles that get smudged, you design the code to look like a pattern that survives the photocopying process naturally.

How it works: You use the ROI tool to create a specific pattern (like a checkerboard or concentric squares) across the image. You tell the compressor: "Make the white squares of this pattern very sharp, and the black squares blurry."
The Analogy: Imagine drawing a pattern on a rubber sheet. If you stretch the sheet (compression), a tiny dot might disappear, but a large, repeating checkerboard pattern remains visible. The computer learns that this specific pattern is the trigger.
The Magic: To a human eye, the image looks normal. To the computer, the specific arrangement of sharp and blurry areas is the secret password.

Why This Matters (The "So What?")

Realism: Most previous security research assumed images stayed perfect. This paper says, "Wait, in the real world, images get compressed (like on WhatsApp, Instagram, or cloud storage). We need to test attacks under those conditions."
The Danger: They proved that if you ignore compression, you think your system is safe. But once you apply these new tricks, the backdoors work again, even on compressed images.
The Defense: By understanding how these attacks hide in the "compression artifacts," security experts can finally build better defenses to spot them.

Summary in One Sentence

The paper shows that invisible backdoor attacks usually fail when images are compressed (like turning a photo into a JPEG), but by using a "protective mask" (ROI) to either save the old secret code or create a new pattern that survives the compression, attackers can make these hidden traps work again in the real world.

1. Problem Statement

The paper addresses a critical vulnerability in the current landscape of deep learning security: the ineffectiveness of invisible backdoor attacks when data undergoes lossy compression.

Context: In real-world scenarios, datasets are rarely stored or transmitted in raw RGB format. They are almost invariably compressed into binary bitstreams (e.g., JPEG, BPG) to save storage and bandwidth before being used for model training.
The Challenge: Existing invisible backdoor attacks (e.g., WaNet, FTrojan, BppAttack) typically embed triggers by adding high-frequency perturbations or subtle pixel changes to raw images. However, lossy compression algorithms are designed to discard high-frequency information (perceptually redundant data) to reduce file size.
The Failure Mode: When poisoned images are compressed, the high-frequency trigger components are distorted or completely eliminated. Consequently, when the victim decompresses the data for training, the "poisoned" samples appear benign, and the backdoor injection fails. The paper demonstrates that increasing compression rates drastically reduces the Attack Success Rate (ASR) of state-of-the-art invisible attacks.

2. Methodology

The authors propose two distinct strategies to ensure backdoor triggers survive the compression-decompression cycle. Both methods leverage the Region of Interest (ROI) functionality, a standard feature in image compression codecs that allows assigning different bitrates (and thus distortion levels) to specific image regions.

A. Universal Attack Activation (Reactivation)

This method is designed to rescue existing invisible attacks that fail under compression. It is primarily applicable to Learned Image Compression (LIC) models and traditional codecs that support pixel-level ROI.

Mechanism: The attacker analyzes the difference between the original image ( $x$ ) and the poisoned image ( $x_p$ ).
Strategy:
1. Residual Mask ( $M_{res}$ ): Allocates more bits to regions where the difference between $x$ and $x_p$ is large, preserving the trigger's residual information.
2. Frequency Mask ( $M_{freq}$ ): Since triggers often rely on high-frequency components, the method uses Fast Fourier Transform (FFT) to isolate these components. It then generates a sample-specific ROI mask that allocates higher bitrates specifically to these high-frequency regions.
Outcome: By protecting the high-frequency trigger components during compression, the decompressed image ( $\hat{x}_p$ ) retains the necessary trigger information, reactivating the attack.

B. Compression-Adapted Attack (CAA)

This is a novel attack strategy designed from the ground up to be compatible with lossy compression. It works with both LIC and traditional codecs (supporting region-level ROI).

Mechanism: Instead of trying to hide a trigger in the image domain, CAA embeds the trigger as a specific high-frequency distribution pattern that is inherently robust to compression.
Strategy:
1. Customized ROI Mask ( $M^*$ ): The attacker applies a specific, structured ROI mask (e.g., a checkerboard or concentric squares pattern) to all poisoned samples.
2. Uniform Mask: Benign samples are compressed using a uniform ROI mask.
3. Trigger Generation: The structured mask forces the compression algorithm to preserve high-frequency details in specific spatial patterns (e.g., alternating high/low bitrate regions). This creates a unique frequency distribution in the decompressed image that serves as the trigger.
Outcome: The trigger is not a perturbation added to the image, but a structural artifact of the compression process itself, making it invisible to the human eye but highly effective for the model.

3. Key Contributions

Identification of a Critical Gap: The paper reveals that the "inevitable" use of lossy compression renders most existing invisible backdoor attacks (including clean-label attacks) ineffective, a factor previously overlooked in security research.
Universal Attack Activation: A general framework to reactivate failed triggers in existing methods by using sample-specific ROI masks to protect high-frequency trigger components during compression.
Compression-Adapted Attack (CAA): A new, robust attack paradigm that encodes triggers into the compression bitstream via customized ROI masks, achieving high success rates across both traditional and learned codecs.
Comprehensive Evaluation: Extensive experiments across multiple datasets (GTSRB, CIFAR-10, CelebA) and backbone models (ResNet, MobileNet, SENet) demonstrating the superiority of the proposed methods over baselines.

4. Experimental Results

The authors evaluated their methods against three classic invisible attacks (WaNet, FTrojan, BppAttack) and two clean-label attacks (SAA, Narcissus).

Reactivation Performance:
- Without reactivation, standard invisible attacks saw ASR drop significantly (e.g., from ~90% to <40% or near 0% depending on the dataset and compression rate).
- With Universal Attack Activation, ASR was restored to near-original levels (e.g., FTrojan improved from 12.53% to 94.91% on CIFAR-10; WaNet from 77.58% to 98.43%).
CAA Performance:
- CAA achieved an average ASR of >94.7% across all datasets and models, even under "All-to-All" attack scenarios where baselines failed completely.
- CAA maintained high Benign Accuracy (BA), showing it does not degrade the model's performance on clean data.
Robustness:
- Re-compression: CAA remained robust even when the compressed images were re-compressed (e.g., ASR >95% with high-quality re-compression), whereas reactivated FTrojan failed.
- Defense Resistance: The method showed resilience against Fine-Pruning, STRIP, Gaussian noise, and blur defenses.
Stealthiness:
- Quantitative metrics (PSNR, SSIM) and human inspection tests confirmed that CAA is visually imperceptible.
- Crucially, CAA did not significantly increase file sizes compared to standard compression, as it redistributes bits rather than adding data.

5. Significance

This paper fundamentally shifts the paradigm for backdoor attack research in deep learning:

Realism: It highlights that security evaluations must account for real-world data pipelines, specifically lossy compression, which is ubiquitous in big data applications.
New Vector: It introduces the compression bitstream itself as a viable medium for embedding triggers, rather than just the raw pixel space.
Defense Implications: The findings suggest that current defense mechanisms focusing on raw image analysis or frequency filtering may be insufficient, as the trigger is now encoded in the compression artifacts. Future defenses must consider the integrity of the decompression process and the potential for ROI-based manipulation.

In summary, the paper demonstrates that while lossy compression breaks traditional invisible backdoors, it also opens a new, highly effective attack surface if the attacker explicitly designs the trigger to survive the compression-decompression cycle using ROI mechanisms.