Fast Test-Time Refinement for Robust Learned Image Compression

Jiaming Liang; Chi-Man Pun; Weisi Lin

cs.CVAug 15, 2026

Fast Test-Time Refinement for Robust Learned Image Compression

Authors: Jiaming Liang, Chi-Man Pun, Weisi Lin

Organizations: University of Macau Macau, China · Nanyang Technological University Singapore

Abstract

Learned image compression (LIC) has demonstrated remarkable rate-distortion (RD) performance in benign settings. However, the high representational capacity endowed by deep neural networks (DNNs) comes at the expense of increased adversarial vulnerability. This hinders their adoption as trusted standardized codecs. Recent work has sketched test-time refinement (TTR) as a defense in gray-box scenarios, despite its original purpose of improving benign RD performance. Unfortunately, extensive iterations of TTR incur prohibitive overhead, while the robustness mechanism lacks theoretical understanding. Moreover, TTR has not been evaluated in white-box settings or against attacks beyond $\ell_2$ -bounded rate and untargeted distortion objectives. To bridge these gaps, we present a systematic study. Our study reveals an Asymmetric Adversarial Trajectory (AAT) property in LIC systems: transitioning from adversarial to benign regions is significantly easier than the reverse process, where adversarial examples can often be roughly recovered within only 1-2 steps. We provide a two-dimensional Tube Model to explain this phenomenon. Based on AAT, we propose a Fast Test-Time Refinement (FTTR) framework for practical and robust LIC systems. We establish that the robustness arises from the contraction of adversarial regions induced by the Input-as-Label property of LIC systems, rather than from obfuscated gradients. Extensive evaluations with diverse strong adaptive attacks across multiple LIC systems demonstrate the promise of the proposed FTTR framework. The code is available at https://github.com/chinaliangjiaming/FTTR.git.

Figures & tables

Figure 1. Reconstruction of examples generated by PGD (budget $16/255$ , $400$ steps). Original : attack and reconstruction on the same undefended LIC system $f$ . Gray-Box : attack on $f$ and reconstruction by FTTR-equipped $f$ . BPDA and Unroll : white-box adaptive attacks on FTTR-equipped $f$ , with STE approximation and exact gradients, respectively. Example based on DCAE ( Lu et al., 2025 ) . caption

Figure 2. Our revealed Asymmetric Adversarial Trajectory (AAT) property of LIC systems: Generating effective adversarial examples against LIC systems requires numerous iterations, whereas their restoration to benign samples can typically be achieved within only 1–2 steps. The illustrated case is based on DCAE ( Lu et al., 2025 ) and PGD attack ( Madry et al., 2018 ) .

Figure 3. Performance of Adam-based TTR over iterations on PGD-generated MSE and bpp adversarial examples for DCAE. X-axis denotes the number of TTR iterations. The right subplot in each case provides a zoomed-in view of the first three TTR iterations. Colors indicate different Adam learning rates. Purifier

L_{2}

denotes the

\ell_{2}

norm of the corresponding purifier.

Figure 4. Hypothesized Tube Model for the two-dimensional structure of adversarial regions in LIC systems.

Figure 5. Pipeline of our FTTR for adversarial defense.

Figure 6. Illustrations on the shift and contraction of adversarial regions. TTR leverages the Input-as-Label to contract the adversarial region, enhancing white-box robustness.

Figure 7. PSNR (dB) of PGD-attacked reconstructions under MSE. X-axis indicates perturbation budgets. w/o : attack/inference on undefended

f

. Noise : attack on undefended

f

, inference with noisy input. Gray-box : attack on undefended

f

, inference with FTTR. BPDA / Unroll : attack/inference with FTTR (see Appendix for details). The same notation applies hereafter.

Figure 8. bpp of PGD-attacked reconstructions under bpp.

Figure 9. PSNR and bpp of C&W-attacked reconstructions under joint MSE and bpp. Order of (a)-(e) follows Figure 7 .

Figure 10. Classification accuracy (%) of LIC-triggered downstream attacks.

		PSNR $\uparrow$	MS-SSIM $\uparrow$	LPIPS $\downarrow$	CLIP $\uparrow$	bpp $\downarrow$
DCAE	w/o	12.970	0.403	0.687	0.724	1.312
	Noise	19.146	0.593	0.658	0.830	0.291
	FTTR	21.698	0.717	0.615	0.871	0.141
CCA	w/o	15.704	0.579	0.380	0.786	4.084
	Noise	21.536	0.834	0.180	0.940	3.746
	FTTR	24.415	0.912	0.076	0.980	1.970

Table 1. Reconstruction performance on adversarial examples for high-resolution global semantic manipulation. FTTR denotes the Gray-Box . The best values are shown in bold.

Figure 11. Adversarial examples and reconstructions under global semantic manipulation. FTTR denotes the Gray-Box .

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 12. MS-SSIM

\uparrow

, LPIPS

\downarrow

, and CLIP

\uparrow

of PGD-attacked reconstructions under MSE. X-axis indicates perturbation budgets.

Figure 13. Visualizations of PGD-attacked adversarial examples and their reconstructions under MSE on DCAE. Example indicates adversarial examples. Rec indicates reconstructions.

Figure 14. Visualizations of $\ell_{2}$ C&W-attacked adversarial examples and their reconstructions under joint objective of MSE and bpp on DCAE. Example indicates adversarial examples. Rec indicates reconstructions.

Learned Image Compression

Learned image compression uses neural encoders, quantization, and entropy models to reduce image bitrates while balancing fidelity, perceptual quality, and task utility.

See all 112 papers

Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression
May 9, 2026Jiaming Liang, Chi-Man Pun, Weisi Lin +1Learned Image Compression Adversarial Attacks
University of Macau Macau, China · Nanyang Technological University Singapore
Compression as an Adversarial Amplifier Through Decision Space Reduction
Apr 8, 2026Lewis Evans, Harkrishan Jandu, Zihan Ye +2Adversarial Attacks Adversarial Examples
University of Nottingham, Nottingham, United Kingdom · University of Chinese Academy of Sciences, Beijing, China · Xiamen University, Xiamen, China +1
Efficient Learned Image Compression without Entropy Coding
May 22, 2026Hao Cao, Wenqi Guo, Zhijin Qin +1Learned Image Compression Vector Quantization
Department of Electronic Engineering, Tsinghua University · Department of Automation, Tsinghua University · State Key Laboratory of Space Network and Communications +1

May 9, 2026J/K move · Enter open · S save

Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression

Jiaming Liang, Chi-Man Pun, Weisi Lin, Greta Seng Peng Mok

University of Macau Macau, China · Nanyang Technological University Singapore

Learned Image Compression Adversarial Attacks Gradient Descent Adversarial Examples

Open paper AskPDF arXiv

Learned image compression (LIC) integrates deep neural networks (DNNs) to map high-dimensional images into compact latent representations, reducing redundancy and achieving superior rate-distortion (RD) performance in benign settings. Unfortunately, due to inherent vulnerabilities in DNNs, LIC systems are susceptible to adversarial perturbations that lead to downstream deterioration, compression rate degradation, untargeted distortion, and both local semantic manipulation (LSM) and low-resolution (

3\times28\times28

) global semantic manipulation (GSM). However, high-resolution GSM remains unexplored due to its intractability. Notably, the existing project gradient descent (PGD) method achieves near-perfect white-box attacks for classification, segmentation, and other tasks, yet fails to generalize to high-resolution GSM. Our theoretical and empirical analyses reveal that well-performing GSM drives adversarial examples from the Identity Region to the Amplification Region through the Lazying-Oscillating-Refining stages. General

\ell_{\infty}

-bounded attacks fail on high-resolution GSM because their step-size schedules cannot accommodate both the Oscillating and Refining stages. Based on this, we propose the Periodic Geometric Decay schedule that enables

\ell_{\infty}

-bounded high-resolution GSM. To verify our approach, we integrate it with PGD, yielding a minimal variant, PGD

^{2}

-GSM. Extensive experiments on the Kodak

(3\times768\times512)

demonstrate that our PGD

^{2}

-GSM is the first to stably achieve high-resolution GSM, thereby exposing a novel threat to LIC systems. Code is available at https://github.com/chinaliangjiaming/PGD2-GSM.

Abstract

Learned Image Compression

Explore similar work

Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression

Compression as an Adversarial Amplifier Through Decision Space Reduction

Efficient Learned Image Compression without Entropy Coding