Research map / Vision-language and multimodal / Human and embodied modeling
Privacy-Shielded Image Compression: Defending Against Exploitation from Vision-Language Pretrained Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Privacy-Shielded Image Compression (PSIC), a learned image compression scheme where one bitstream decodes either an "encrypted" version that misleads CLIP-based tasks or a "full" version that keeps semantics when given a condition.
Problem
VLP models such as CLIP can semantically interpret publicly posted images, enabling search engines and other tools to exploit them; the paper seeks to block VLP exploitation at the image compression stage while keeping perceptual quality and normal coding functionality.
Approach
A conditional latent trigger generation module feeds a mode indicator through per-decoder-block MLPs to produce bias features, so the same bitstream decodes into an adversarially encrypted or a full-semantic reconstruction; training uses an uncertainty-aware (Dempster-Shafer evidence) encryption loss that targets the most uncertain image-text mismatches, plus a two-stage adaptive multi-objective s
Key results
- Encrypted version reaches average ASR of 80.8% (text-to-image retrieval), 72.3% (image-to-text retrieval), 67.0% (classification), and 51.5% (facial attribute analysis) relative to the backbone LIC.
- Compared with BAvAFT, PSIC gives an average ASR improvement of 12.9% across downstream tasks.
- Full version keeps the rate-distortion level of the backbone LIC and gains about 1.0 dB PSNR over BAvAFT's clean mode on average.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use PSIC encrypted decoding instead of the AE-Hyperprior reconstruction | AE-Hyperprior · Text-to-image retrieval | ASR: 80.8% | Helped |
| Use PSIC encrypted decoding instead of the AE-Hyperprior reconstruction | AE-Hyperprior · Image-to-text retrieval | ASR: 72.3% | Helped |
| Use PSIC encrypted decoding instead of the AE-Hyperprior reconstruction | AE-Hyperprior · Image classification | ASR: 67.0% | Helped |
| Use PSIC encrypted decoding instead of the AE-Hyperprior reconstruction | AE-Hyperprior · Facial attribute analysis | ASR: 51.5% | Helped |
| Use PSIC rather than BAvAFT | LIC backbone · Downstream tasks | ASR: 12.9% | Helped |
| Use PSIC full decoding rather than BAvAFT clean mode | LIC backbone · Kodak | PSNR: 1.0 dB | Helped |
| Add uncertainty-aware UAEO optimization instead of the naive cosine-similarity attack objective (ablation) | PSIC · Text-to-image retrieval | ASR: 6.3% | Helped |
| Add uncertainty-aware UAEO optimization instead of the naive cosine-similarity attack objective (ablation) | PSIC · Image-to-text retrieval | ASR: 6.2% | Helped |
Surprising findings
- The full version consistently outperforms the clean version of the baseline across multiple tasks and bpp points.
Limitations
- Experiments use a small training set (70,000 CC3M pairs) trained from scratch with a single target model (CLIP ViT-B/32).
- Image captioning evaluated only on BLIP-2, and the approach targets specific VLP models rather than broad robustness.
Experimental setup
Datasets: CC3M ImageNet-1k CelebA Flickr8k Kodak
Benchmarks: Flickr8k ImageNet-1k CelebA Kodak
Metrics: Recall@1 Top-1 accuracy BLEU@4 CIDEr SPICE PSNR attack success rate
Baselines: AE-Hyperprior BAvAFT
Builds on: AE-Hyperprior BAvAFT CLIP Dempster-Shafer theory
Closest papers by meaning
- Benchmarking and Enhancing VLM for Compressed Image Understanding (ICML 2026 · similarity 0.85)
- When MLLMs Meets Compression Distortion: A Coding Paradigm Tailored to MLLMs (ICLR 2026 · similarity 0.85)
- Unified Coding for Both Human Perception and Generalized Machine Analytics with CLIP Supervision (AAAI 2025 · similarity 0.85)
- Towards Unified Human Perception and Machine Understanding: Token Flow Guided Compression Framework (CVPR 2026 · similarity 0.85)
- PID: Prompt-Independent Data Protection Against Latent Diffusion Models (ICML 2024 · similarity 0.84)
- Differentially Private Representation Learning via Image Captioning (ICML 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.