cs.CVAug 15, 2026

Fast Test-Time Refinement for Robust Learned Image Compression

Authors: Jiaming Liang, Chi-Man Pun, Weisi Lin

Organizations: University of Macau Macau, China · Nanyang Technological University Singapore

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Learned image compression (LIC) has demonstrated remarkable rate-distortion (RD) performance in benign settings. However, the high representational capacity endowed by deep neural networks (DNNs) comes at the expense of increased adversarial vulnerability. This hinders their adoption as trusted standardized codecs. Recent work has sketched test-time refinement (TTR) as a defense in gray-box scenarios, despite its original purpose of improving benign RD performance. Unfortunately, extensive iterations of TTR incur prohibitive overhead, while the robustness mechanism lacks theoretical understanding. Moreover, TTR has not been evaluated in white-box settings or against attacks beyond ℓ2\ell_2-bounded rate and untargeted distortion objectives. To bridge these gaps, we present a systematic study. Our study reveals an Asymmetric Adversarial Trajectory (AAT) property in LIC systems: transitioning from adversarial to benign regions is significantly easier than the reverse process, where adversarial examples can often be roughly recovered within only 1-2 steps. We provide a two-dimensional Tube Model to explain this phenomenon. Based on AAT, we propose a Fast Test-Time Refinement (FTTR) framework for practical and robust LIC systems. We establish that the robustness arises from the contraction of adversarial regions induced by the Input-as-Label property of LIC systems, rather than from obfuscated gradients. Extensive evaluations with diverse strong adaptive attacks across multiple LIC systems demonstrate the promise of the proposed FTTR framework. The code is available at https://github.com/chinaliangjiaming/FTTR.git.

Figures & tables

Figure 1. Reconstruction of examples generated by PGD (budget 16/25516/255 , 400400 steps). Original : attack and reconstruction on the same undefended LIC system ff . Gray-Box : attack on ff and reconstruction by FTTR-equipped ff . BPDA and Unroll : white-box adaptive attacks on FTTR-equipped ff , with STE approximation and exact gradients, respectively. Example based on DCAE ( Lu et al., 2025 ) . caption
Figure 2. Our revealed Asymmetric Adversarial Trajectory (AAT) property of LIC systems: Generating effective adversarial examples against LIC systems requires numerous iterations, whereas their restoration to benign samples can typically be achieved within only 1–2 steps. The illustrated case is based on DCAE ( Lu et al., 2025 ) and PGD attack ( Madry et al., 2018 ) .
Figure 3. Performance of Adam-based TTR over iterations on PGD-generated MSE and bpp adversarial examples for DCAE. X-axis denotes the number of TTR iterations. The right subplot in each case provides a zoomed-in view of the first three TTR iterations. Colors indicate different Adam learning rates. Purifier L2L_{2} denotes the ℓ2\ell_{2} norm of the corresponding purifier.
Figure 4. Hypothesized Tube Model for the two-dimensional structure of adversarial regions in LIC systems.
Figure 5. Pipeline of our FTTR for adversarial defense.
Figure 6. Illustrations on the shift and contraction of adversarial regions. TTR leverages the Input-as-Label to contract the adversarial region, enhancing white-box robustness.
Figure 7. PSNR (dB) of PGD-attacked reconstructions under MSE. X-axis indicates perturbation budgets. w/o : attack/inference on undefended ff . Noise : attack on undefended ff , inference with noisy input. Gray-box : attack on undefended ff , inference with FTTR. BPDA / Unroll : attack/inference with FTTR (see Appendix for details). The same notation applies hereafter.
Figure 8. bpp of PGD-attacked reconstructions under bpp.
Figure 9. PSNR and bpp of C&W-attacked reconstructions under joint MSE and bpp. Order of (a)-(e) follows Figure 7 .
Figure 10. Classification accuracy (%) of LIC-triggered downstream attacks.
 PSNR ↑\uparrowMS-SSIM ↑\uparrowLPIPS ↓\downarrowCLIP ↑\uparrowbpp ↓\downarrow
DCAEw/o12.9700.4030.6870.7241.312
Noise19.1460.5930.6580.8300.291
FTTR21.6980.7170.6150.8710.141
CCAw/o15.7040.5790.3800.7864.084
Noise21.5360.8340.1800.9403.746
FTTR24.4150.9120.0760.9801.970
Table 1. Reconstruction performance on adversarial examples for high-resolution global semantic manipulation. FTTR denotes the Gray-Box . The best values are shown in bold.
Figure 11. Adversarial examples and reconstructions under global semantic manipulation. FTTR denotes the Gray-Box .
Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 12. MS-SSIM ↑\uparrow , LPIPS ↓\downarrow , and CLIP ↑\uparrow of PGD-attacked reconstructions under MSE. X-axis indicates perturbation budgets.
Figure 13. Visualizations of PGD-attacked adversarial examples and their reconstructions under MSE on DCAE. Example indicates adversarial examples. Rec indicates reconstructions.
Figure 14. Visualizations of ℓ2\ell_{2} C&W-attacked adversarial examples and their reconstructions under joint objective of MSE and bpp on DCAE. Example indicates adversarial examples. Rec indicates reconstructions.
More in this topic

Learned Image Compression

Learned image compression uses neural encoders, quantization, and entropy models to reduce image bitrates while balancing fidelity, perceptual quality, and task utility.

See all 115 papers

Explore similar work

CardsList
May 9, 2026

Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression

Learned image compression (LIC) integrates deep neural networks (DNNs) to map high-dimensional images into compact latent representations, reducing redundancy and achieving superior rate-distortion (RD) performance in benign settings. Unfortunately, due to inherent vulnerabilities in DNNs, LIC systems are susceptible to adversarial perturbations that lead to downstream deterioration, compression rate degradation, untargeted distortion, and both local semantic manipulation (LSM) and low-resolution (3×28×283\times28\times28) global semantic manipulation (GSM). However, high-resolution GSM remains unexplored due to its intractability. Notably, the existing project gradient descent (PGD) method achieves near-perfect white-box attacks for classification, segmentation, and other tasks, yet fails to generalize to high-resolution GSM. Our theoretical and empirical analyses reveal that well-performing GSM drives adversarial examples from the Identity Region to the Amplification Region through the Lazying-Oscillating-Refining stages. General ℓ∞\ell_{\infty}-bounded attacks fail on high-resolution GSM because their step-size schedules cannot accommodate both the Oscillating and Refining stages. Based on this, we propose the Periodic Geometric Decay schedule that enables ℓ∞\ell_{\infty}-bounded high-resolution GSM. To verify our approach, we integrate it with PGD, yielding a minimal variant, PGD2^{2}-GSM. Extensive experiments on the Kodak (3×768×512)(3\times768\times512) demonstrate that our PGD2^{2}-GSM is the first to stably achieve high-resolution GSM, thereby exposing a novel threat to LIC systems. Code is available at https://github.com/chinaliangjiaming/PGD2-GSM.

Jiaming Liang, Chi-Man Pun, Weisi Lin +1

University of Macau Macau, China · Nanyang Technological University Singapore

Learned Image CompressionAdversarial AttacksGradient DescentAdversarial Examples
AskPDF
Apr 8, 2026

Compression as an Adversarial Amplifier Through Decision Space Reduction

Image compression is a ubiquitous component of modern visual pipelines, routinely applied by social media platforms and resource-constrained systems prior to inference. Despite its prevalence, the impact of compression on adversarial robustness remains poorly understood. We study a previously unexplored adversarial setting in which attacks are applied directly in compressed representations, and show that compression can act as an adversarial amplifier for deep image classifiers. Under identical nominal perturbation budgets, compression-aware attacks are substantially more effective than their pixel-space counterparts. We attribute this effect to decision space reduction, whereby compression induces a non-invertible, information-losing transformation that contracts classification margins and increases sensitivity to perturbations. Extensive experiments across standard benchmarks and architectures support our analysis and reveal a critical vulnerability in compression-in-the-loop deployment settings. Code will be released.

Lewis Evans, Harkrishan Jandu, Zihan Ye +2

University of Nottingham, Nottingham, United Kingdom · University of Chinese Academy of Sciences, Beijing, China · Xiamen University, Xiamen, China +1

Adversarial AttacksAdversarial ExamplesAdversarial Robustness
AskPDF
May 22, 2026

Efficient Learned Image Compression without Entropy Coding

Entropy coding is widely used in typical learned image compression (LIC) that converts latents into a compact bitstream. However, entropy coding is typically sequential and becomes the coding latency bottleneck. To overcome it, we present Entropy-Coding Free Learned Image Compression (EF-LIC), a multi-rate framework that generates compact representation by removing statistical and correlation redundancy with low coding latency. First, we introduce unconstrained vector quantization and prove that its index distribution approaches the maximum-entropy bound, yielding minimal statistical redundancy. Second, we propose a context-conditioned autoregressive transform that directly reparameterizes the latents to reduce inter-dependency. Theoretical analysis shows that EF-LIC can remove correlation redundancy as effectively as typical LIC with entropy coding, leading to comparable compression performance. Experiments show EF-LIC achieves up to 67.86% bitrate reduction over MS-ILLM on Kodak with LPIPS. Ablation studies further show EF-LIC matches the compression performance of its entropy-coding based variant while achieving over 3×3\times faster encoding and 5×5\times faster decoding.

Hao Cao, Wenqi Guo, Zhijin Qin +1

Department of Electronic Engineering, Tsinghua University · Department of Automation, Tsinghua University · State Key Laboratory of Space Network and Communications +1

Learned Image CompressionVector Quantization
AskPDF