Abstract:In recent years, many backdoor attacks based on training data poisoning have been proposed. However, in practice, those backdoor attacks are vulnerable to image compressions. When backdoor instances are compressed, the feature of specific backdoor trigger will be destroyed, which could result in the backdoor attack performance deteriorating. In this paper, we propose a compression-resistant backdoor attack based on feature consistency training. To the best of our knowledge, this is the first backdoor attack that is robust to image compressions. First, both backdoor images and their compressed versions are input into the deep neural network (DNN) for training. Then, the feature of each image is extracted by internal layers of the DNN. Next, the feature difference between backdoor images and their compressed versions are minimized. As a result, the DNN treats the feature of compressed images as the feature of backdoor images in feature space. After training, the backdoor attack against DNN is robust to image compression. Furthermore, we consider three different image compressions (i.e., JPEG, JPEG2000, WEBP) in feature consistency training, so that the backdoor attack is robust to multiple image compression algorithms. Experimental results demonstrate the effectiveness and robustness of the proposed backdoor attack. When the backdoor instances are compressed, the attack success rate of common backdoor attack is lower than 10%, while the attack success rate of our compression-resistant backdoor is greater than 97%. The compression-resistant attack is still robust even when the backdoor images are compressed with low compression quality. In addition, extensive experiments have demonstrated that, our compression-resistant backdoor attack has the generalization ability to resist image compression which is not used in the training process.

Towards Compression-Resistant Privacy-Preserving Photo Sharing on Social Networks

Toward Robust Neural Image Compression: Adversarial Attack and Model Finetuning

Towards Robust Neural Image Compression: Adversarial Attack and Model Finetuning

Transferable Learned Image Compression-Resistant Adversarial Perturbations

Security Analysis and Enhancement of Model Compressed Deep Learning Systems under Adversarial Attacks

MALICE: Manipulation Attacks on Learned Image ComprEssion

Recessive Social Networking: Preventing Privacy Leakage against Reverse Image Search

Adversarial example defense based on image reconstruction

Compression-Resistant Backdoor Attack against Deep Neural Networks

SocialGuard: An adversarial example based privacy-preserving technique for social images

A Region-Selective Anti-compression Image Encryption Algorithm Based on Deep Networks

Recompression Based JPEG Tamper Detection and Localization Using Deep Neural Network Eliminating Compression Factor Dependency

To compress or not to compress: Understanding the Interactions between Adversarial Attacks and Neural Network Compression

Enhancing Adversarial Training with Prior Knowledge Distillation for Robust Image Compression

Protecting Privacy in Shared Photos Via Adversarial Examples Based Stealth

An Imperceptible Adversarial Attack Against Reconstruction for Learned Image Compression

DeepN-JPEG: A Deep Neural Network Favorable JPEG-based Image Compression Framework

Low-Mid Adversarial Perturbation against Unauthorized Face Recognition System

A study of the effect of JPG compression on adversarial images

Generative Adversarial Networks-Based Image Compression for Consumer Photo Storage.

Anti-Compression Contrastive Facial Forgery Detection