Source-linked AI summary
MROP: Mask-Region Optimized Purification Against Backdoor Attack in Deep JSCC
Seongkyu Yang, Hyeonho Noh, Hyun Jong Yang, Jonggyu Jang
TL;DR
Deep JSCC image transmission is vulnerable to input-patch backdoors, and existing defenses largely target classification rather than reconstruction. MROP performs inference-time mask localization and trigger-region restoration without retraining, substantially suppressing attacks while preserving clean reconstruction quality.
Problem
Input-patch backdoors can force deep JSCC decoders to emit attacker-chosen target images, while reconstruction-oriented defenses remain comparatively underexplored.
Source: §I · p. 1Method
MROP optimizes a per-pixel Gumbel-sigmoid mask to localize the trigger and restores the masked region using a non-trigger reconstruction objective, without retraining.
Source: §I · p. 2, §III · p. 4Results
Across DeepJSCC and SwinJSCC evaluations, MROP suppressed ASR to below 2% while improving clean-region PSNR by more than 10 dB over a gradient-mask baseline.
Source: §V · p. 5Takeaways & Limitations
MROP provides an inference-time purification approach that generalizes across trigger types, patch sizes, architectures, and image resolutions.
Source: A. Simulation Setup · p. 5, §V · p. 5
Abstract
from arXiv · showhide
Deep joint source and channel coding (JSCC) transmits a source by mapping it directly to channel symbols through an end-to-end deep neural network (DNN) and reconstructing it at the receiver. Taking image transmission as an application, this DNN pipeline behaves as a black box: the receiver cannot readily detect security attacks when the transmitted images are corrupted, thereby introducing a new security vulnerability. In this letter, we study defense against input-patch backdoor attacks on deep JSCC, in which a small trigger patch attached to the input forces the decoder to emit an attacker-chosen target image. Most existing patch-trigger defenses are designed for classification, leaving the reconstruction setting of deep JSCC unaddressed. We adapt the gradient mask defense to this reconstruction setting as a baseline and then propose mask-region optimized purification (MROP), which operates at inference and requires no retraining of the JSCC model. Unlike the baseline, which localizes the trigger from the input--output gradient, MROP instead places a per-pixel mask at the encoder input and optimizes it via a Gumbel-sigmoid relaxation to localize the trigger, then refines the trigger region to reconstruct the pure images better. In numerical results, we evaluate the proposed method on CIFAR-10 and STL-10 datasets along with the DeepJSCC and SwinJSCC models. By doing so, we show that the proposed method substantially lowers the attack success rate (ASR) while preserving the peak signal-to-noise ratio (PSNR) of clean reconstructions.
I. INTRODUCTION
Deep JSCC improves wireless image transmission but remains vulnerable to input-patch backdoors, while existing defenses largely target classification. MROP addresses reconstruction by optimizing and refining an input mask at inference, reducing ASR while preserving clean-image PSNR.
Motivation
- Deep JSCC maps images directly to channel symbols through jointly trained neural encoder and decoder, avoiding separate-coding cliff effects at finite blocklengths.The framework has also been extended to feedback, bandwidth adaptation, SNR adaptation, and transformer-based architectures.Source: §I · p. 1
Security gap
- Input-patch backdoors attach a small adversarial patch that causes the decoder to emit an attacker-chosen output instead of a faithful reconstruction.The receiver cannot straightforwardly recognize that the reconstruction is untrustworthy when the input is contaminated.Source: §I · p. 1
Research gap
- Existing patch-trigger defenses mainly address classification, leaving reconstruction-oriented deep JSCC comparatively underexplored.The paper adapts gradient masking while exploiting the transmitter’s local access to the decoder and reconstruction process.Source: §I · p. 1
Proposed defense
- MROP optimizes a per-pixel input mask at inference using Gumbel-sigmoid relaxation, then refines the trigger region without retraining the JSCC model.The method requires one image and can handle universal triggers.Source: §I · p. 2
II. SYSTEM MODEL AND PRELIMINARIES
The system model considers canonical deep JSCC transmission of a w × h image with c channels over an AWGN wireless channel under an average transmission-power constraint.
System model
- The canonical transceiver transmits a (w × h)-sized image with c channels over an additive white Gaussian noise channel.The channel is characterized by noise power σ2 and average transmission power P.Source: §II · p. 2
A. Deep JSCC Model
Deep JSCC encodes an input image into complex channel symbols, transmits them over AWGN, and decodes the received symbols into a reconstructed image.
Deep JSCC Model
- The input dimension is n = chw, and the deep JSCC code rate is k/n.The notation replaces explicit dependence on the channel count, width, and height.Source: A. Deep JSCC Model · p. 2
- The encoder maps an input image x ∈ R^n to k complex channel symbols through Eθ(·) : R^n → C^k.The encoder output is normalized to satisfy the average power constraint.Source: A. Deep JSCC Model · p. 2
- AWGN adds complex Gaussian noise to the transmitted symbol, while the decoder receives the noisy channel output for reconstruction.The experiments restrict the attack setting to AWGN because channel-noise robustness makes the channel output an ineffective attack target.Source: A. Deep JSCC Model · p. 2
- The decoder maps the received channel output back to an image, and canonical training jointly minimizes reconstruction loss over encoder and decoder parameters.The decoder is represented by Dϕ(·) : C^k → R^n.Source: A. Deep JSCC Model · p. 2
B. Threat Scenario: Backdoor Attack
The backdoor attack poisons training data with a localized patch that redirects triggered inputs to a target image while preserving clean reconstruction. MROP detects and purifies suspicious inputs at the transmitter in two phases without retraining.
Threat Scenario: Backdoor Attack
- The poisoned model is optimized to output an attacker-chosen target image for triggered inputs while faithfully reconstructing clean images.The two objectives jointly define the backdoor training vulnerability.Source: B. Threat Scenario: Backdoor Attack · p. 2
- At inference, the transmitter has white-box access to the backdoored encoder and decoder but lacks the trigger, mask, and target image.The defender purifies inputs without retraining the model parameters.Source: B. Threat Scenario: Backdoor Attack · p. 2
MROP defense
- MROP first localizes the trigger support by optimizing a Gumbel-sigmoid input mask, then restores the masked region through an optimized residual before transmission.Phase 2 reconstructs the trigger region to improve consistency with surrounding non-trigger pixels.Source: Figure 2 · p. 3, B. Threat Scenario: Backdoor Attack · p. 3
III. PROPOSED DEFENSE METHOD: MROP
MROP detects and purifies input-patch backdoors at inference by optimizing a per-pixel mask, relaxing binary selection with Gumbel-sigmoid, and restoring the localized region without retraining.
Detection
- MROP detects trigger-injected inputs using locally emulated self-reconstruction error and a detection threshold before invoking purification.The end-to-end encoder–decoder function is evaluated at the transmitter prior to transmission.Source: §III · p. 3
Phase 1: Trigger localization
- Phase 1 estimates a binary trigger mask by optimizing reconstruction consistency together with a sparsity penalty over candidate masks.The binary search spans 2^n masks, motivating a continuous relaxation.Source: §III · p. 3
- Gumbel-sigmoid relaxation makes per-pixel mask optimization differentiable while retaining a surrogate of binary mask sampling.Fresh logistic noise supports stochastic optimization, and temperature annealing transitions from exploratory soft masks toward near-binary decisions.Source: §III · p. 3
Phase 2: Trigger-region restoration
- Phase 2 restores the localized trigger region with a residual optimized to match the original image outside that region.The residual is confined to the trigger mask and regularized with isotropic total variation.Source: §III · p. 4
Overall procedure
- After optimization, the purified image is encoded, transmitted through the channel, and decoded, while the mask and model remain frozen.The complete procedure combines detection, mask optimization, and trigger-region restoration entirely at inference.Source: §III · p. 4
IV. NUMERICAL RESULTS
The evaluation compares MROP with an adapted input-purification baseline across DeepJSCC and SwinJSCC models and two trigger patterns.
Evaluation setup
- MROP is evaluated on DeepJSCC and SwinJSCC using two trigger patterns and compared against an input-purification baseline adapted from prior gradient-mask defenses.The supplied passage identifies the models, trigger-pattern scope, and comparison baseline but reports no numerical values.Source: §IV · p. 4
A. Simulation Setup
The evaluation covers DeepJSCC and SwinJSCC on CIFAR-10 and STL-10 under center and universal patch attacks, using ASR and clean-reconstruction quality metrics. MROP is compared with a gradient-mask baseline across patch sizes, models, and resolutions.
Datasets, models, and attacks
- Experiments use CIFAR-10 and STL-10 with DeepJSCC and SwinJSCC under center-patch and universal-patch attacks.CIFAR-10 uses 32 × 32 images, while STL-10 uses 96 × 96 images; the code rate is k/n = 1/6.Source: A. Simulation Setup · p. 4
Metrics
- The evaluation reports clean PSNR, clean SSIM, target PSNR, and attack success rate (ASR).PSNR-C is measured over the non-trigger region, while ASR counts reconstructions closer to the attacker’s target than the original image.Source: A. Simulation Setup · p. 4
CIFAR-10 DeepJSCC comparison
- 99.99% ASR without defense falls to 0.00% with MROP for both center and universal 4×4 triggers on CIFAR-10.MROP achieves PSNR-C values of 28.43 and 24.74 dB, while the gradient-mask baseline remains above 99% ASR for universal triggers.Source: A. Simulation Setup · p. 4
Robustness to patch size
- MROP keeps ASR below 2% as the center trigger grows from 4×4 to 12×12 pixels, whereas the gradient-mask baseline degrades with patch size.The baseline’s larger masks erase more clean pixels as the trigger expands.Source: A. Simulation Setup · pp. 4–5
Generalization across model and resolution
- On CIFAR-10 and STL-10 with SwinJSCC, MROP reaches 0.00% and 0.77% ASR while improving clean PSNR-C relative to the strongest baseline.The reported PSNR-C advantage on STL-10 is 4.83 dB at comparable ASR.Source: A. Simulation Setup · p. 5, Table II · p. 5
Qualitative results
- On STL-10, the recovered mask closely matches the ground-truth mask and the MROP reconstruction is visually clean, unlike the baselines.The qualitative comparison uses blue for the estimated mask and black for the original mask.Source: A. Simulation Setup · p. 5, Figure 4 · p. 5
V. CONCLUSION
The paper proposes MROP as an inference-time defense for input-patch backdoors in deep JSCC. Across models, trigger types, patch sizes, and resolutions, it suppresses ASR below 2% while improving clean-region PSNR over the gradient-mask baseline.
Conclusion
- MROP defends deep JSCC against input-patch backdoors without retraining the JSCC model.The method operates at inference and targets attacks that force the decoder toward an attacker-chosen image.Source: §V · p. 5
- MROP optimizes a per-pixel Gumbel-sigmoid mask to localize triggers, then restores the masked region under a total-variation prior.The restoration aims to make the decoded image consistent with the surrounding scene.Source: §V · p. 5
- MROP suppresses ASR below 2% while improving clean-region PSNR by more than 10 dB over the gradient-mask baseline across the evaluated settings.The evaluation spans two JSCC models, two trigger types, multiple patch sizes, and multiple image resolutions.Source: §V · p. 5