Inevitable Encounters: Backdoor Attacks Involving Lossy Compression

Qian Li; Yunuo Chen; Yuntian Chen

cs.CRMar 14, 2026

Inevitable Encounters: Backdoor Attacks Involving Lossy Compression

Authors: Qian Li, Yunuo Chen, Yuntian Chen

Organizations: Shanghai Jiao Tong University · Eastern Institute of Technology

Abstract

Real-world backdoor attacks often require poisoned datasets to be stored and transmitted before being used to compromise deep learning systems. However, in the era of big data, the inevitable use of lossy compression poses a fundamental challenge to invisible backdoor attacks. We find that triggers embedded in RGB images often become ineffective after the images are lossily compressed into binary bitstreams (e.g., JPEG files) for storage and transmission. As a result, the poisoned data lose its malicious effect after compression, causing backdoor injection to fail. In this paper, we highlight the necessity of explicitly accounting for the lossy compression process in backdoor attacks. This requires attackers to ensure that the transmitted binary bitstreams preserve malicious trigger information, so that effective triggers can be recovered in the decompressed data. Building on the region-of-interest (ROI) coding mechanism in image compression, we propose two poisoning strategies tailored to inevitable lossy compression. First, we introduce Universal Attack Activation, a universal method that uses sample-specific ROI masks to reactivate trigger information in binary bitstreams for learned image compression (LIC). Second, we present Compression-Adapted Attack, a new attack strategy that employs customized ROI masks to encode trigger information into binary bitstreams and is applicable to both traditional codecs and LIC. Extensive experiments demonstrate the effectiveness of both strategies.

Figures & tables

Figure 1: Ineffectiveness of backdoor attacks under lossy compression. Left: Higher compression rates introduce stronger distortion and substantially hinder backdoor injection, indicating that lossy compression can severely damage invisible triggers. Right: Removing high-frequency components from poisoned test samples via Fourier Transform significantly reduces the ASR, suggesting that high-frequency information is critical for many invisible triggers.

Figure 2: Overview of backdoor attacks under lossy compression. Red borders denote poisoned samples, and green borders denote benign samples. Column 1 shows the real-world dataset-only poisoning pipeline, where data are stored and transmitted as compressed bitstreams before victim-side training. Column 2 illustrates that previous invisible attacks may fail after lossy compression because trigger information is destroyed. Columns 3-4 present our two ROI-based strategies: Universal Attack Reactivation , which reactivates ineffective invisible attacks by preserving trigger-relevant information, and Compression-Adapted Attack , which encodes malicious information into bitstreams to construct compression-adapted triggers for both traditional codecs and LICs.

Panel of Figure 3 — Figure 3: Two customized ROI masks.


Backbone $\downarrow$	Dataset $\downarrow$	Method $\rightarrow$	Clean	FTrojan	FTrojan ${}_{\textbf{ReA}}$	WaNet	$\textbf{WaNet}_{\textbf{ReA}}$	BppAttack	$\textbf{BppAttack}_{\textbf{ReA}}$	CAA
ResNet18	CIFAR-10	BA(%)	93.57	92.21	91.32( -0.89 $\downarrow$ )	84.72	91.75( +7.03 $\uparrow$ )	88.03	90.85 ( +2.82 $\uparrow$ )	93.28
	CIFAR-10	ASR(%)	-	12.53	94.91( +82.38 $\uparrow$ )	77.58	98.43 ( +20.85 $\uparrow$ )	44.17	96.23 ( +52.06 $\uparrow$ )	100.00
	GTSRB	BA(%)	99.22	95.72	97.43( +1.71 $\uparrow$ )	94.43	98.25 ( +3.82 $\uparrow$ )	90.78	94.84 ( +4.06 $\uparrow$ )	99.13
	GTSRB	ASR(%)	-	30.61	89.34( +58.73 $\uparrow$ )	72.32	93.85 ( +21.53 $\uparrow$ )	42.25	87.23 ( +44.98 $\uparrow$ )	100.00
	CelebA	BA(%)	76.90	75.25	71.65( -3.60 $\downarrow$ )	76.49	72.40 ( -4.09 $\downarrow$ )	74.69	71.58 ( -3.11 $\downarrow$ )	76.75

Table 1: Comparison of methods across multiple datasets; additional results are in the Appendix. A .


	SAA Souri et al. (2022)	$\text{SAA}_{\text{ReA}}$	Narcissus Zeng et al. (2023)	$\text{Narcissus}_{\text{ReA}}$
BA (%)	94.95	94.29	94.23	94.82
ASR (%)	10.04	45.24	17.27	50.26

Table 2: Reactivation of clean-label attacks.


Dataset	Method	ECA	ECA ${}_{\textbf{ReA}}$	CBA	$\textbf{CBA}_{\textbf{ReA}}$
CIFAR-10	BA(%)	92.34	91.48( -0.9 $\downarrow$ )	92.10	91.92( -0.2 $\downarrow$ )
CIFAR-10	ASR(%)	23.20	95.10( +71.9 $\uparrow$ )	27.10	98.20( +71.1 $\uparrow$ )
CelebA	BA(%)	75.08	72.92( -2.2 $\downarrow$ )	76.13	75.05( -1.1 $\downarrow$ )
ASR(%)	30.84	93.96( +63.1 $\uparrow$ )	28.62	97.54( +68.9 $\uparrow$ )

Table 3: Reactivation of compression-aware attacks.

Table 7

Figure 4: Visualization of the UAR. We visualize original images, compressed attack samples, reactivated samples, and the corresponding ROI masks.


Dataset	Method	Clean	FTrojan	WaNet	BppAttack	CAA
CIFAR-10	BA(%)	93.57	92.76	91.13	90.32	93.51
CIFAR-10	ASR(%)	-	1.13	29.21	28.58	93.76
GTSRB	BA(%)	99.22	98.28	98.14	89.47	99.17
GTSRB	ASR(%)	-	13.30	17.57	39.62	99.46
CelebA	BA(%)	76.90	75.50	76.66	73.03	76.85

Table 6: All-to-all attack result.


Codec	Method	Clean	FTrojan	WaNet	BppAttack	CAA
JPEG 2000 Skodras et al. (2001)	BA(%)	92.85	90.23	83.29	88.09	92.93
JPEG 2000 Skodras et al. (2001)	ASR(%)	-	12.35	75.09	48.27	99.56
BPG Yee et al. (2017)	BA(%)	93.58	92.10	90.55	92.48	92.39
BPG Yee et al. (2017)	ASR(%)	-	13.07	76.97	44.97	100.00
Cheng-2020 Cheng et al. (2020)	BA(%)	93.21	91.34	84.86	88.25	93.14

Table 7: Performance on different codecs.

Panel of Figure 5 — Figure 5: Resilient to Fine-Pruning Liu et al. (2018a) .

Table 12

Panel of Figure 7 — Figure 7: Visualization of CAA. (a) Origin images (without compression). (b) Poisoned images via CAA (all samples were classified as the target class). (c) The residuals. (d) The ROI masks.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix


Backbone $\downarrow$	Dataset $\downarrow$	Method $\rightarrow$	Clean	FTrojan	FTrojan ${}_{\textbf{ReA}}$	WaNet	$\textbf{WaNet}_{\textbf{ReA}}$	BppAttack	$\textbf{BppAttack}_{\textbf{ReA}}$	CAA
Pre-activation ResNet18	CIFAR-10	BA(%)	92.93	92.46	91.35( -1.11 $\downarrow$ )	86.30	91.30 ( +5.00 $\uparrow$ )	90.61	90.59 ( -0.02 $\downarrow$ )	92.86
	CIFAR-10	ASR(%)	-	11.05	94.19( +83.14 $\uparrow$ )	51.25	98.17 ( +46.92 $\uparrow$ )	16.17	95.03 ( +78.86 $\uparrow$ )	99.99
	GTSRB	BA(%)	99.13	94.25	97.02( +2.77 $\uparrow$ )	92.73	97.43 ( +4.70 $\uparrow$ )	89.85	94.08 ( +4.23 $\uparrow$ )	99.13
	GTSRB	ASR(%)	-	23.26	83.77( +60.51 $\uparrow$ )	71.80	92.26 ( +20.46 $\uparrow$ )	36.83	85.02 ( +48.19 $\uparrow$ )	99.95
	CelebA	BA(%)	76.78	74.98	70.34( -4.64 $\downarrow$ )	76.55	74.83 ( -1.72 $\downarrow$ )	75.71	70.43 ( -5.28 $\downarrow$ )	76.57

Appendix

Table 11: Comparison of methods across multiple datasets.

Attack	SampDetox		FST		ZIP
Attack	BA	ASR	BA	ASR	BA	ASR
BadNet	94.76	1.67	92.97	1.06	92.48	3.92
CAA	95.28	80.38	92.83	65.38	94.69	88.29

Appendix

Table 12: Additional defense results on GTSRB.

Sample-Specific Computation			Encoding Time
ROI Mask of ReA	FTrojan Trigger	WaNet Trigger	Standard	ReA	CAA
0.002	0.002	0.003	0.502	0.515	0.508

Appendix

Table 13: Time complexity (s/sample) on GTSRB resized to 2K. CPU: Intel(R) Xeon(R) Gold 6458Q with 128 threads; GPU: a single NVIDIA A800 GPU.

	FTrojan	WaNet	CAA (2 $\times$ 2 Mask)	CAA (8 $\times$ 8 Mask)
SRM ( $\downarrow$ )	0.995	0.628	0.314	0.207

Appendix

Table 14: Comparison of SRM feature distances on GTSRB.


Backbone $\downarrow$	Dataset $\downarrow$	Method $\rightarrow$	Clean	FTrojan	WaNet	BppAttack	CAA
ResNet18	CIFAR-10	BA(%)	91.74	91.02	80.58	85.27	91.76
	CIFAR-10	ASR(%)	-	10.82	73.29	43.92	97.23
	GTSRB	BA(%)	98.32	95.23	94.92	90.61	98.01
	GTSRB	ASR(%)	-	30.02	71.97	43.23	99.79
	CelebA	BA(%)	75.27	74.29	75.02	75.32	75.30

Appendix

Table 15: Comparison results on JPEG [5].


Backbone $\downarrow$	Dataset $\downarrow$	Method $\rightarrow$	Clean	FTrojan	WaNet	BppAttack	CAA
ResNet18	CIFAR-10	BA(%)	92.85	90.23	83.29	88.09	93.93
	CIFAR-10	ASR(%)	-	12.35	75.09	48.27	99.56
	GTSRB	BA(%)	98.53	93.96	97.35	91.90	97.29
	GTSRB	ASR(%)	-	31.96	75.24	40.43	99.95
	CelebA	BA(%)	76.41	76.63	74.19	72.75	77.63

Appendix

Table 16: Comparison results on JPEG2000 [56].


Backbone $\downarrow$	Dataset $\downarrow$	Method $\rightarrow$	Clean	FTrojan	WaNet	BppAttack	CAA
ResNet18	CIFAR-10	BA(%)	93.58	92.10	90.55	90.48	92.39
	CIFAR-10	ASR(%)	-	13.07	76.97	44.97	100.00
	GTSRB	BA(%)	99.26	95.13	95.32	91.07	98.28
	GTSRB	ASR(%)	-	30.19	72.02	45.29	99.64
	CelebA	BA(%)	77.81	74.27	76.95	73.43	77.27

Appendix

Table 17: Comparison results on BPG [66].


Backbone $\downarrow$	Dataset $\downarrow$	Method $\rightarrow$	Clean	FTrojan	WaNet	BppAttack	CAA
ResNet18	CIFAR-10	BA(%)	93.21	91.34	84.86	88.25	93.14
	CIFAR-10	ASR(%)	-	11.89	77.32	43.73	100.00
	GTSRB	BA(%)	99.72	96.28	95.85	92.97	99.29
	GTSRB	ASR(%)	-	32.89	71.97	41.93	99.99
	CelebA	BA(%)	76.28	76.10	75.93	74.27	76.83

Appendix

Table 18: Comparison results on Cheng-2020 [13].


Backbone $\downarrow$	Dataset $\downarrow$	Method $\rightarrow$	Clean	FTrojan	WaNet	BppAttack	CAA
ResNet18	CIFAR-10	BA(%)	93.79	92.32	85.22	87.35	93.53
	CIFAR-10	ASR(%)	-	12.64	78.32	46.73	99.77
	GTSRB	BA(%)	99.62	94.28	95.93	92.97	99.18
	GTSRB	ASR(%)	-	29.75	73.92	41.86	99.98
	CelebA	BA(%)	76.18	74.28	76.18	75.28	76.37

Appendix

Table 19: Comparison results on ELIC [ 59 ] .

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 135 papers

Compression as an Adversarial Amplifier Through Decision Space Reduction
Apr 8, 2026Lewis Evans, Harkrishan Jandu, Zihan Ye +2Adversarial Attacks Adversarial Examples
University of Nottingham, Nottingham, United Kingdom · University of Chinese Academy of Sciences, Beijing, China · Xiamen University, Xiamen, China +1
Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression
May 9, 2026Jiaming Liang, Chi-Man Pun, Weisi Lin +1Learned Image Compression Adversarial Attacks
University of Macau Macau, China · Nanyang Technological University Singapore
Fast Test-Time Refinement for Robust Learned Image Compression
Aug 15, 2026Jiaming Liang, Chi-Man Pun, Weisi LinLearned Image Compression Adversarial Robustness
University of Macau Macau, China · Nanyang Technological University Singapore

Apr 8, 2026J/K move · Enter open · S save

Compression as an Adversarial Amplifier Through Decision Space Reduction

Lewis Evans, Harkrishan Jandu, Zihan Ye, Yang Lu+1

University of Nottingham, Nottingham, United Kingdom · University of Chinese Academy of Sciences, Beijing, China · Xiamen University, Xiamen, China+1

Adversarial Attacks Adversarial Examples Adversarial Robustness

Open paper AskPDF arXiv

Image compression is a ubiquitous component of modern visual pipelines, routinely applied by social media platforms and resource-constrained systems prior to inference. Despite its prevalence, the impact of compression on adversarial robustness remains poorly understood. We study a previously unexplored adversarial setting in which attacks are applied directly in compressed representations, and show that compression can act as an adversarial amplifier for deep image classifiers. Under identical nominal perturbation budgets, compression-aware attacks are substantially more effective than their pixel-space counterparts. We attribute this effect to decision space reduction, whereby compression induces a non-invertible, information-losing transformation that contracts classification margins and increases sensitivity to perturbations. Extensive experiments across standard benchmarks and architectures support our analysis and reveal a critical vulnerability in compression-in-the-loop deployment settings. Code will be released.

Abstract

Backdoor Attacks

Explore similar work

Compression as an Adversarial Amplifier Through Decision Space Reduction

Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression

Fast Test-Time Refinement for Robust Learned Image Compression