🤖 AI

Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression

This paper addresses the previously intractable challenge of high-resolution global semantic manipulation in learned image compression by analyzing the failure of standard attacks and proposing a novel PGD $^{2}$ -GSM method with a Periodic Geometric Decay schedule to successfully execute such attacks.

Original authors: Jiaming Liang, Chi-Man Pun, Weisi Lin, Greta Seng Peng Mok

Published 2026-05-12

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jiaming Liang, Chi-Man Pun, Weisi Lin, Greta Seng Peng Mok

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a magical photo compression machine. Its job is to take a huge, high-definition photo, shrink it down to a tiny file size so it can be sent over the internet quickly, and then rebuild it on the other side so it looks almost exactly the same. This is how "Learned Image Compression" (LIC) works today—it uses smart AI to do the shrinking and rebuilding better than old-school methods like JPEG.

The paper you shared reveals a scary new trick that hackers could use to break this magic machine. Here is the story of that discovery, explained simply.

The Problem: The "Chameleon" Machine

Normally, this compression machine is very honest. If you send it a picture of a woman in a red hat, it shrinks it, sends it, and the person on the other end sees a woman in a red hat.

But the researchers found that because this machine uses deep AI, it has a hidden weakness. A hacker can add a tiny, invisible layer of "noise" (like static on an old TV) to the photo before it gets compressed. This noise is so small the human eye can't see it, but it tricks the AI inside the machine.

When the machine tries to rebuild the photo, instead of showing the woman in the red hat, it might show a woman standing by a lake. The hacker has successfully swapped the entire meaning of the image without changing the file size or making the image look "glitchy" to the naked eye.

The Big Challenge: Why Was This Hard to Do Before?

The researchers noticed something strange. Hackers had already figured out how to do this trick on tiny, low-quality images (like simple 28x28 pixel drawings of numbers). But when they tried to do it on real, high-definition photos (like 768x512 pixels), the trick failed completely.

Why?

The "Flat" Trap: The compression machine is designed to be a "copycat." If you give it a normal photo, it tries to copy it perfectly. This makes it very hard to push the image toward a different target (like changing a red hat to a lake). The machine just keeps trying to copy the original.
The Size Issue: High-resolution photos have millions of pixels. Trying to find the right "noise" for millions of pixels at once is like trying to find a needle in a haystack the size of a mountain.

The Discovery: The Three-Stage Dance

The researchers realized that to trick the machine, you can't just push it in one direction. You have to dance with it in three specific stages:

The "Lazying" Stage (Getting Ready):
Imagine you are trying to push a heavy boulder up a hill, but the hill is flat. You push, and the boulder just rolls a tiny bit and stops. The machine is "lazy" here; it just wants to copy the original image. The hacker needs to push hard enough to get the boulder off the flat ground and onto a steep slope.
The "Oscillating" Stage (The Shake):
Once the boulder is on the slope, you need to shake it back and forth vigorously to get it to roll down the right path. In the paper's terms, the hacker needs to use large steps to explore the area and force the image out of its "copycat" mode and into a "chaos" mode where it can be changed.
The "Refining" Stage (The Fine-Tune):
Now that the boulder is rolling, you can't shake it anymore, or it will fly off the cliff. You need to make tiny, gentle adjustments to guide it exactly where you want it to go. Here, the hacker needs tiny steps to perfect the image.

The Mistake of Old Methods:
Previous hacking tools used a "one-size-fits-all" approach. They either took big steps the whole time (which made the image unstable and ruined the trick) or small steps the whole time (which never got the image off the flat ground). They couldn't switch between "shaking" and "fine-tuning."

The Solution: The "Periodic Decay" Trick

The authors invented a new way to control the "push" (the step size). They call it Periodic Geometric Decay.

Think of it like driving a car to a tricky parking spot:

First, you drive fast to get to the neighborhood (The Oscillating Stage).
Then, you slow down to navigate the narrow street.
Finally, you creep forward inch-by-inch to park perfectly (The Refining Stage).

Their new method, called PGD2-GSM, automatically slows down the "push" at the right moments. It starts with big pushes to break the machine's "copycat" habit, then gradually slows down to fine-tune the image into the hacker's desired target.

The Results

When they tested this on high-definition photos (using the Kodak dataset), it worked perfectly for the first time.

Before: Hackers could only mess with tiny, low-quality images.
Now: They can take a high-definition photo of a person and make the reconstructed photo look like a completely different scene (e.g., changing a person to a landscape) while keeping the file size small.

Why This Matters (According to the Paper)

The paper warns that this is a serious security threat. If someone can control what you see after the image is compressed and sent, they could manipulate what people see on social media or in cloud databases without anyone knowing. The image looks normal to the eye, but the AI inside has been tricked into showing something else entirely.

In short: The researchers found that high-definition image compression has a hidden "switch" that can be flipped to change the entire meaning of a photo. They figured out the exact rhythm (fast then slow) needed to flip that switch, something no one had managed to do before.

Technical Summary: Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression

Problem Statement
Learned Image Compression (LIC) systems, which utilize deep neural networks (DNNs) to achieve superior rate–distortion (RD) performance, are inherently vulnerable to adversarial perturbations. While existing research has identified threats such as untargeted distortion, local semantic manipulation (LSM), and low-resolution global semantic manipulation (GSM), a critical gap remains: high-resolution GSM.

In high-resolution GSM, an attacker manipulates the reconstructed image of a high-resolution source (e.g., 3 × 768 × 512) to match a specific target semantic content (e.g., changing a "lakeside woman" to a "red hat woman") while remaining imperceptible to the user. Despite the success of standard white-box attacks like Projected Gradient Descent (PGD) in classification and segmentation, these methods fail to generalize to high-resolution GSM in LIC systems. The paper attributes this failure to two primary challenges:

Search Space Complexity: High-resolution images require perturbations across $C \times H \times W$ dimensions to satisfy an equal number of reconstruction constraints.
Identity-Mapping Property: Unlike heterogeneous input-output tasks, well-trained LIC models exhibit an intrinsic identity-mapping property ( $\hat{x} \approx x$ ) for most benign data. This "flat" mapping makes it difficult for perturbations to identify effective directions toward a specific target.

Methodology and Theoretical Analysis
The authors propose a theoretical framework and a new attack strategy to overcome these challenges.

Input Space Partitioning: The analysis reveals that the input space of well-trained LIC models is partitioned into two regions:
- Identity Region ( $R_I$ ): Where the model behaves as an identity map ( $\hat{x} \approx x$ ). Perturbations here are driven toward a "Lazy Example" (the projection of the target-source difference) but fail to achieve semantic manipulation.
- Amplification Region ( $R_A$ ): A narrow region where the model amplifies perturbations. Effective GSM adversarial examples must reside here.
Three-Stage Progression: The paper characterizes successful GSM as a three-stage process:
1. Lazying: The perturbation moves from the source toward the "Lazy Example" within the Identity Region.
2. Oscillating: The perturbation oscillates around the Lazy Example, attempting to cross the boundary into the Amplification Region.
3. Refining: Once in the Amplification Region, the perturbation must be precisely refined to locate an operating point that amplifies the semantic shift toward the target.
Lazy Cosine Similarity (LCS): To validate this progression, the authors introduce LCS, a metric measuring the cosine similarity between the current perturbation and the "Lazy Perturbation." LCS trajectories show a rise (Lazying), oscillation (Oscillating), and sharp drop (Refining) as the attack succeeds.
Failure of Fixed Step Sizes: Standard $\ell_\infty$ $ℓ_{\infty}$ -bounded attacks fail because a single fixed step size ( $\alpha$ $α$ ) cannot satisfy the conflicting requirements of the stages:
- A large $\alpha$ is needed in the Oscillating stage to explore the space and enter the Amplification Region.
- A small $\alpha$ is needed in the Refining stage to stabilize the perturbation within the narrow Amplification Region.
- Fixed large $\alpha$ prevents refinement; fixed small $\alpha$ prevents entry into the Amplification Region.

Proposed Solution: PGD2-GSM
To address the step-size scheduling issue, the authors propose the Periodic Geometric Decay schedule. This strategy employs a large initial step size to facilitate rapid entry into the Amplification Region, followed by periodic geometric decay to allow for precise refinement.

Algorithm: The authors integrate this schedule with the standard PGD algorithm, creating a minimal variant named PGD2-GSM.
Mechanism: The step size $\alpha(t)$ is scaled by a decay factor $k$ every decay period $P$ , enabling the attack to transition smoothly from exploration to exploitation.

Key Contributions

First Systematic Study: This work presents the first investigation into high-resolution GSM in LIC systems, highlighting the stealthiness and controllability of such threats.
Theoretical Insight: It identifies the partitioning of the LIC input space into Identity and Amplification Regions and deduces the "Lazying–Oscillating–Refining" progression required for successful attacks.
New Metric: The introduction of Lazy Cosine Similarity (LCS) to empirically validate the three-stage progression of GSM.
Novel Attack Strategy: The proposal of the Periodic Geometric Decay schedule and the resulting PGD2-GSM algorithm, which is the first method to stably achieve $\ell_\infty$ -bounded high-resolution GSM.

Experimental Results
The authors evaluated PGD2-GSM on the Kodak dataset (24 images, 3 × 768 × 512) using four state-of-the-art LIC models: LALIC, DCAE, CCA, and HiFi-VRIC.

Performance: PGD2-GSM consistently outperformed standard PGD with fixed step sizes ( $\alpha = 0.001, 0.005, 0.01$ ) across all metrics (PSNR, MS-SSIM, LPIPS, and CLIP).
Stability: While fixed step-size PGD failed to produce stable manipulations or failed to converge, PGD2-GSM achieved stable, visually satisfactory semantic manipulations across different models.
Compression Rate Impact: The study observed that high-resolution GSM significantly degrades compression efficiency. The bits per pixel (bpp) for adversarial examples increased drastically compared to clean images, and in some cases (e.g., HiFi-VRIC), the encoding process failed to complete within a 300-second time limit due to the complex distribution of refined perturbations.
Parameter Sensitivity: Experiments showed that successful high-resolution GSM requires significantly more iterations (thousands to tens of thousands) compared to untargeted attacks, and performance improves with larger perturbation budgets ( $\epsilon$ ).

Significance and Limitations
The paper claims that PGD2-GSM exposes a novel and formidable threat to LIC systems, demonstrating that high-resolution semantic manipulation is achievable and stable under $\ell_\infty$ constraints. This challenges the reliability of LIC systems in security-critical applications.

The authors modestly acknowledge limitations:

Initialization Sensitivity: The attack remains sensitive to the initialization of perturbations.
Computational Cost: The method is computationally expensive, with single-sample attack costs approaching the training cost of a small model.
Future Work: Developing more robust initialization strategies and improving computational efficiency are identified as important future directions.

The paper concludes that while PGD2-GSM is currently a minimal variant, the proposed Periodic Geometric Decay schedule is an indispensable mechanism for enabling high-resolution GSM, shifting the focus of LIC security research toward defending against these sophisticated, controllable semantic manipulations.