Natural Compression Artifacts as Triggers

• Natural compression artifacts are subtle distortions from JPEG/WEBP re-encoding used as covert triggers in backdoor attacks on deep learning models.
• The attack leverages standard lossy compression in dataset poisoning without explicit trigger design, evading visual inspection and common defenses.
• Empirical studies show high attack success and transferability across codecs and datasets, highlighting significant risks for practical ML deployments.

Natural compression artifacts as triggers refers to the repurposing of imperceptible distortions generated by standard lossy image compression algorithms, such as JPEG and WEBP, to execute highly effective and stealthy backdoor attacks on deep learning models. Unlike prior backdoor approaches requiring explicit trigger design, this paradigm exploits the near-universal presence and accessibility of lossy codecs to embed backdoor signals during dataset poisoning, without leaving detectable visual traces or requiring specialized expertise. The feasibility, efficacy, and transferability of these “natural artifact” attacks significantly expand the threat landscape for practical machine learning deployment (Yang et al., 2023).

1. Threat Model and Attacker Capabilities

This attack operates under a black-box dataset poisoning model. The adversary’s only prerequisite is the ability to introduce poisoned examples during model training; there is no need for access to model parameters, architecture, or training protocols. The workflow is:

• Attack interface: Any standard lossy image compression utility suffices (e.g., “Save as JPEG”).
• Trigger design: No artificial triggers required; the artifacts produced by typical image codecs serve as the trigger.
• Stealth: The altered images are visually indistinguishable from uncompressed counterparts at standard quality settings; human scrutiny fails to identify the poisoned samples.
• Attack scenarios:
  • Dirty-label: Random subset of training images is compressed and relabeled to a target class.
  • Clean-label: Only images already belonging to a target class are compressed; class labels remain unchanged.
• Defensive bypass: Neither visual inspection nor established backdoor defenses (e.g., STRIP, Fine-Pruning, Neural Cleanse, Grad-CAM) can reliably distinguish or neutralize the compression-triggered backdoor.

2. Formal Trigger Definition

Let $C_{\text{CODEC}}(\cdot; q)$ denote a lossy compression operator at quality level $q$. The trigger transformation $T(x;q)$ is:

$T(x;q) \equiv C_{\text{CODEC}}(x;q)$

If $x \in \mathbb{R}^{H \times W \times 3}$ is an original RGB image, then the triggered image is:

$$\hat{x} = T(x; q) = \operatorname{dec}(\operatorname{enc}(x; q); q)$$

where $\operatorname{enc}$ and $\operatorname{dec}$ are the encoder and decoder of the codec, respectively.

This formulation relies exclusively on encoder/decoder artifacts as the backdoor signal, distinguishing it from hand-crafted or learned triggers.

3. Data Poisoning Process

Let $D = \{ (x_i, y_i) \}$ represent a training dataset of size $N$, and let $q$0 be the poisoning rate dictating the fraction of modified samples. The process is:

• Dirty-label (all-to-one): Randomly select $q$1 examples and form $q$2, where $q$3 is a fixed target class $q$4.
• Clean-label: Select $q$5 samples only from the target class; relabeling is omitted ($q$6).
• Aggregate poisoned set: $q$7

The core of this strategy is that $q$8—the output of compression—is not readily distinguishable from the original in routine visual or feature-based assessments.

4. Attack Objective and Evaluation Metrics

Training proceeds as standard empirical risk minimization (ERM), but over the poisoned set:

$q$9

Key post-training metrics:

• Clean accuracy (CA): Accuracy on an independent clean test set $T(x;q)$0,

$T(x;q)$1

• Attack success rate (ASR): Fraction of triggered test images misclassified as the attacker’s target,

$T(x;q)$2

5. Experimental Protocol

A comprehensive evaluation was conducted across datasets (MNIST, CIFAR-10, GTSRB, CelebA) and architectures (4-layer CNN, PreAct-ResNet-18, ResNet-18):

• Training details: AdamW optimizer; cosine-annealing; initial LR $T(x;q)$3, warm-up to $T(x;q)$4, batch size $T(x;q)$5, $T(x;q)$6 epochs, standard augmentations.
• Compression details: Default Pillow JPEG (≈ OpenCV JPEG $T(x;q)$7) with varied $T(x;q)$8; WEBP variants also assessed.

6. Empirical Results

a) Dirty-Label, All-to-One (CA / ASR):

Dataset	p = 5%	p = 1%
MNIST	0.98 / 0.99	0.98 / 0.88
CIFAR-10	0.96 / 1.00	0.96 / 1.00
GTSRB	0.97 / 1.00	0.97 / 0.99
CelebA	0.80 / 1.00	0.80 / 1.00

b) Dirty-Label, All-to-All (CA / ASR):

Dataset	p = 5%	p = 1%
MNIST	0.98 / 0.95	0.99 / 0.01
CIFAR-10	0.96 / 0.87	0.96 / 0.81
GTSRB	0.97 / 0.91	0.97 / 0.73
CelebA	0.80 / 0.76	0.80 / 0.74

c) Ablations and Parameter Sensitivity

• At extremely low poisoning rates ($T(x;q)$9), on CIFAR-10, ASR increases from $T(x;q) \equiv C_{\text{CODEC}}(x;q)$0 at $T(x;q) \equiv C_{\text{CODEC}}(x;q)$1 to $T(x;q) \equiv C_{\text{CODEC}}(x;q)$2 at $T(x;q) \equiv C_{\text{CODEC}}(x;q)$3, with CA consistently $T(x;q) \equiv C_{\text{CODEC}}(x;q)$4.
• Clean-label attack with $T(x;q) \equiv C_{\text{CODEC}}(x;q)$5 (of target class) and $T(x;q) \equiv C_{\text{CODEC}}(x;q)$6 achieves ASR $T(x;q) \equiv C_{\text{CODEC}}(x;q)$7 and CA $T(x;q) \equiv C_{\text{CODEC}}(x;q)$8 on CIFAR-10 and GTSRB.

7. Transferability Across Codecs

The attack is not tightly coupled to a particular codec. Models trained with JPEG-compressed images as triggers can be successfully attacked at inference using WEBP compression (and vice versa):

Codec-pair	MNIST	CIFAR-10	GTSRB	CelebA
JPEG→WEBP	0.98 / 0.43	0.96 / 0.41	0.97 / 0.97	0.80 / 0.42
WEBP→JPEG	0.98 / 1.00	0.96 / 0.92	0.97 / 1.00	0.80 / 0.86

Transfer ASRs remain significantly elevated, especially for GTSRB, revealing high cross-codec vulnerability.

8. Evaluation of Defenses and Limitations

The natural compression artifact attack exhibits resilience against several state-of-the-art backdoor defenses:

• STRIP: Input entropy distributions for backdoored and clean models cannot be distinguished.
• Fine-Pruning: Pruning up to 40% of neurons fails to materially decrease ASR.
• Neural Cleanse: Anomaly index $T(x;q) \equiv C_{\text{CODEC}}(x;q)$9 for all backdoored models, yielding no reliable detection.
• Grad-CAM: Saliency maps on clean and triggered inputs are visually and semantically indistinguishable.

No mitigation strategy proposed in the cited work effectively detects or eliminates this attack vector, and practitioners must assume that any lossy re-encoding step on untrusted data constitutes a potential backdoor trigger (Yang et al., 2023).