Research map / Adversarial robustness and security / Backdoor and poisoning
Conditional Backdoor Attack via JPEG Compression
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes conditional backdoor attacks in which JPEG compression itself is the trigger, by jointly optimizing JPEG quantization tables and the classifier loss so the model learns the compression behavior.
Problem
Existing stealthy backdoor triggers (invisible, dynamic) can be removed by passive denoising such as image compression, and new triggering paradigms beyond fixed patterns are underexplored.
Approach
Use JPEG compression as the activation condition: jointly optimize the quantization tables and the classifier loss with a differentiable rounding approximation, so the backdoor fires only when inputs are JPEG-compressed and not for pixel-level artifacts or other pseudo-triggers.
Key results
- Attack achieves ASR of 99.95% on MNIST, 99.98% on GTSRB and 100% on CelebA with BA drop under 1%.
- On CelebA the attack reaches PSNR 42.00 dB, the highest among compared stealthy attacks, and bypasses Neural Cleanse, STRIP and ANP.
- ASR stays above 99% for most JPEG quality factors while baseline stealthy attacks (WaNet, BppAttack, FTrojan) degrade under JPEG denoising on GTSRB and CelebA.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| jointly optimize the JPEG quantization tables and classifier loss instead of using fixed standard quantization tables (ablation) | JPEG-conditioned backdoor on GTSRB · GTSRB JPEG-compressed images | ASR (%) | Helped |
| increase ϵmax from 15 to 45 (ablation) | JPEG-conditioned backdoor · GTSRB compressed images | Avg. ASR (%): 99.67 -> 84.63 | Hurt |
| increase ϵmax from 15 to 75 (ablation) | JPEG-conditioned backdoor · GTSRB compressed images | Avg. ASR (%): 99.67 -> 82.03 | Hurt |
| increase ϵmin from 2 to 5 (ablation) | JPEG-conditioned backdoor · GTSRB | Avg. ASR (%) on poisoned images: 99.70 -> 34.03 | Hurt |
| increase ϵmin from 2 to 8 (ablation) | JPEG-conditioned backdoor · GTSRB | Avg. ASR (%) on poisoned images: 99.70 -> 31.16 | Hurt |
| increase ϵmin from 2 to 11 (ablation) | JPEG-conditioned backdoor · GTSRB | Avg. ASR (%) on poisoned images: 99.70 -> 23.67 | Hurt |
| replace JPEG compression with JPEG2000 compression as the pseudo-trigger (ablation) | JPEG-conditioned backdoor · MNIST, GTSRB, CelebA | ASR: 0.0984; 0.0055; 0.2808 | Hurt |
| replace JPEG compression with color quantization as the pseudo-trigger (ablation) | JPEG-conditioned backdoor · MNIST, GTSRB, CelebA | ASR: 0.0984; 0.0055; 0.2808 | Hurt |
| replace JPEG compression with Gaussian noise as the pseudo-trigger (ablation) | JPEG-conditioned backdoor · MNIST, GTSRB, CelebA | ASR: 0.0984; 0.0055; 0.2808 | Hurt |
Surprising findings
- Pseudo-triggers such as JPEG2000 compression, color quantization and Gaussian noise do not activate the backdoor, indicating it responds to JPEG behavior rather than generic artifacts.
- With fixed quantization tables (no joint optimization), generalization to JPEG-compressed inputs drops substantially.
Limitations
- The backdoor is also inadvertently activated by normal users who JPEG-compress images, which can expose it before deployment.
- Generalization to JPEG depends on the quantization range; larger epsilon max reduces inadvertent-activation control and effectiveness trade-off.
- Evaluated only on small image classification datasets (MNIST, GTSRB, CelebA) and three classifier architectures.
Experimental setup
Datasets: MNIST GTSRB CelebA
Benchmarks: MNIST GTSRB CelebA
Metrics: benign accuracy attack success rate PSNR SSIM LPIPS
Baselines: BadNets WaNet BppAttack FTrojan
Builds on: BadNets WaNet BppAttack FTrojan
Closest papers by meaning
- Backdoor Attacks under Lossy Compression: From Failure to Reactivation and Adaptation (NeurIPS 2026 · similarity 0.90)
- Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Trigger (CVPR 2023 · similarity 0.89)
- A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives (AAAI 2024 · similarity 0.89)
- Data Poisoning based Backdoor Attacks to Contrastive Learning (CVPR 2024 · similarity 0.86)
- Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift (AAAI 2024 · similarity 0.86)
- Temporal-Distributed Backdoor Attack against Video Based Action Recognition (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.