Real-world backdoor attacks often require poisoned datasets to be stored and transmitted before being used to compromise deep learning systems. However, in the era of big data, the inevitable use of lossy compression poses a fundamental challenge to invisible backdoor attacks. We find that triggers embedded in RGB images often become ineffective after the images are lossily compressed into binary bitstreams (e.g., JPEG files) for storage and transmission. As a result, the poisoned data lose its malicious effect after compression, causing backdoor injection to fail. In this paper, we highlight the necessity of explicitly accounting for the lossy compression process in backdoor attacks. This requires attackers to ensure that the transmitted binary bitstreams preserve malicious trigger information, so that effective triggers can be recovered in the decompressed data. Building on the region-of-interest (ROI) coding mechanism in image compression, we propose two poisoning strategies tailored to inevitable lossy compression. First, we introduce Universal Attack Activation, a universal method that uses sample-specific ROI masks to reactivate trigger information in binary bitstreams for learned image compression (LIC). Second, we present Compression-Adapted Attack, a new attack strategy that employs customized ROI masks to encode trigger information into binary bitstreams and is applicable to both traditional codecs and LIC. Extensive experiments demonstrate the effectiveness of both strategies.

翻译：现实世界中的后门攻击通常需要将中毒数据集存储和传输后才能用于危害深度学习系统。然而，在大数据时代，有损压缩的不可避免使用对隐形后门攻击构成了根本性挑战。我们发现，嵌入RGB图像中的触发器在图像被有损压缩为二进制比特流（例如JPEG文件）进行存储和传输后常常失效。因此，中毒数据在压缩后失去了其恶意效果，导致后门注入失败。在本文中，我们强调了在后门攻击中明确考虑有损压缩过程的必要性。这要求攻击者确保传输的二进制比特流保留恶意触发器信息，以便在解压缩数据中恢复有效触发器。基于图像压缩中的感兴趣区域（ROI）编码机制，我们提出了两种针对不可避免有损压缩量身定制的投毒策略。首先，我们引入通用攻击激活，这是一种通用方法，它使用样本特定的ROI掩码来重新激活学习型图像压缩（LIC）的二进制比特流中的触发器信息。其次，我们提出压缩自适应攻击，这是一种新的攻击策略，它采用定制的ROI掩码将触发器信息编码到二进制比特流中，并且适用于传统编解码器和LIC。大量实验证明了两种策略的有效性。