PaperlayerView exact revision on arXiv

Source-linked AI summary

MROP: Mask-Region Optimized Purification Against Backdoor Attack in Deep JSCC

Seongkyu Yang, Hyeonho Noh, Hyun Jong Yang, Jonggyu Jang

arXiv:2609.00786v1cs.CReess.SP

TL;DR

Deep JSCC image transmission is vulnerable to input-patch backdoors, and existing defenses largely target classification rather than reconstruction. MROP performs inference-time mask localization and trigger-region restoration without retraining, substantially suppressing attacks while preserving clean reconstruction quality.

  • Problem

    Input-patch backdoors can force deep JSCC decoders to emit attacker-chosen target images, while reconstruction-oriented defenses remain comparatively underexplored.

  • Method

    MROP optimizes a per-pixel Gumbel-sigmoid mask to localize the trigger and restores the masked region using a non-trigger reconstruction objective, without retraining.

  • Results

    Across DeepJSCC and SwinJSCC evaluations, MROP suppressed ASR to below 2% while improving clean-region PSNR by more than 10 dB over a gradient-mask baseline.

  • Takeaways & Limitations

    MROP provides an inference-time purification approach that generalizes across trigger types, patch sizes, architectures, and image resolutions.

Abstract

from arXiv · show

Deep joint source and channel coding (JSCC) transmits a source by mapping it directly to channel symbols through an end-to-end deep neural network (DNN) and reconstructing it at the receiver. Taking image transmission as an application, this DNN pipeline behaves as a black box: the receiver cannot readily detect security attacks when the transmitted images are corrupted, thereby introducing a new security vulnerability. In this letter, we study defense against input-patch backdoor attacks on deep JSCC, in which a small trigger patch attached to the input forces the decoder to emit an attacker-chosen target image. Most existing patch-trigger defenses are designed for classification, leaving the reconstruction setting of deep JSCC unaddressed. We adapt the gradient mask defense to this reconstruction setting as a baseline and then propose mask-region optimized purification (MROP), which operates at inference and requires no retraining of the JSCC model. Unlike the baseline, which localizes the trigger from the input--output gradient, MROP instead places a per-pixel mask at the encoder input and optimizes it via a Gumbel-sigmoid relaxation to localize the trigger, then refines the trigger region to reconstruct the pure images better. In numerical results, we evaluate the proposed method on CIFAR-10 and STL-10 datasets along with the DeepJSCC and SwinJSCC models. By doing so, we show that the proposed method substantially lowers the attack success rate (ASR) while preserving the peak signal-to-noise ratio (PSNR) of clean reconstructions.

I. INTRODUCTION

Deep JSCC improves wireless image transmission but remains vulnerable to input-patch backdoors, while existing defenses largely target classification. MROP addresses reconstruction by optimizing and refining an input mask at inference, reducing ASR while preserving clean-image PSNR.

  • Motivation: Deep JSCC maps images directly to channel symbols through jointly trained neural encoder and decoder, avoiding separate-coding cliff effects at finite blocklengths.The framework has also been extended to feedback, bandwidth adaptation, SNR adaptation, and transformer-based architectures.
  • Security gap: Input-patch backdoors attach a small adversarial patch that causes the decoder to emit an attacker-chosen output instead of a faithful reconstruction.The receiver cannot straightforwardly recognize that the reconstruction is untrustworthy when the input is contaminated.
  • Research gap: Existing patch-trigger defenses mainly address classification, leaving reconstruction-oriented deep JSCC comparatively underexplored.The paper adapts gradient masking while exploiting the transmitter’s local access to the decoder and reconstruction process.
  • Proposed defense: MROP optimizes a per-pixel input mask at inference using Gumbel-sigmoid relaxation, then refines the trigger region without retraining the JSCC model.The method requires one image and can handle universal triggers.

II. SYSTEM MODEL AND PRELIMINARIES

The system model considers canonical deep JSCC transmission of a w × h image with c channels over an AWGN wireless channel under an average transmission-power constraint.

  • System model: The canonical transceiver transmits a (w × h)-sized image with c channels over an additive white Gaussian noise channel.The channel is characterized by noise power σ2 and average transmission power P.

A. Deep JSCC Model

Deep JSCC encodes an input image into complex channel symbols, transmits them over AWGN, and decodes the received symbols into a reconstructed image.

  • Deep JSCC Model: The input dimension is n = chw, and the deep JSCC code rate is k/n.The notation replaces explicit dependence on the channel count, width, and height.
  • Deep JSCC Model: The encoder maps an input image x ∈ R^n to k complex channel symbols through Eθ(·) : R^n → C^k.The encoder output is normalized to satisfy the average power constraint.
  • Deep JSCC Model: AWGN adds complex Gaussian noise to the transmitted symbol, while the decoder receives the noisy channel output for reconstruction.The experiments restrict the attack setting to AWGN because channel-noise robustness makes the channel output an ineffective attack target.
  • Deep JSCC Model: The decoder maps the received channel output back to an image, and canonical training jointly minimizes reconstruction loss over encoder and decoder parameters.The decoder is represented by Dϕ(·) : C^k → R^n.

B. Threat Scenario: Backdoor Attack

The backdoor attack poisons training data with a localized patch that redirects triggered inputs to a target image while preserving clean reconstruction. MROP detects and purifies suspicious inputs at the transmitter in two phases without retraining.

  • Threat Scenario: Backdoor Attack: The poisoned model is optimized to output an attacker-chosen target image for triggered inputs while faithfully reconstructing clean images.The two objectives jointly define the backdoor training vulnerability.
  • Threat Scenario: Backdoor Attack: At inference, the transmitter has white-box access to the backdoored encoder and decoder but lacks the trigger, mask, and target image.The defender purifies inputs without retraining the model parameters.
  • MROP defense: MROP first localizes the trigger support by optimizing a Gumbel-sigmoid input mask, then restores the masked region through an optimized residual before transmission.Phase 2 reconstructs the trigger region to improve consistency with surrounding non-trigger pixels.

III. PROPOSED DEFENSE METHOD: MROP

MROP detects and purifies input-patch backdoors at inference by optimizing a per-pixel mask, relaxing binary selection with Gumbel-sigmoid, and restoring the localized region without retraining.

  • Detection: MROP detects trigger-injected inputs using locally emulated self-reconstruction error and a detection threshold before invoking purification.The end-to-end encoder–decoder function is evaluated at the transmitter prior to transmission.
  • Phase 1: Trigger localization: Phase 1 estimates a binary trigger mask by optimizing reconstruction consistency together with a sparsity penalty over candidate masks.The binary search spans 2^n masks, motivating a continuous relaxation.
  • Phase 1: Trigger localization: Gumbel-sigmoid relaxation makes per-pixel mask optimization differentiable while retaining a surrogate of binary mask sampling.Fresh logistic noise supports stochastic optimization, and temperature annealing transitions from exploratory soft masks toward near-binary decisions.
  • Phase 2: Trigger-region restoration: Phase 2 restores the localized trigger region with a residual optimized to match the original image outside that region.The residual is confined to the trigger mask and regularized with isotropic total variation.
  • Overall procedure: After optimization, the purified image is encoded, transmitted through the channel, and decoded, while the mask and model remain frozen.The complete procedure combines detection, mask optimization, and trigger-region restoration entirely at inference.

IV. NUMERICAL RESULTS

The evaluation compares MROP with an adapted input-purification baseline across DeepJSCC and SwinJSCC models and two trigger patterns.

  • Evaluation setup: MROP is evaluated on DeepJSCC and SwinJSCC using two trigger patterns and compared against an input-purification baseline adapted from prior gradient-mask defenses.The supplied passage identifies the models, trigger-pattern scope, and comparison baseline but reports no numerical values.

A. Simulation Setup

The evaluation covers DeepJSCC and SwinJSCC on CIFAR-10 and STL-10 under center and universal patch attacks, using ASR and clean-reconstruction quality metrics. MROP is compared with a gradient-mask baseline across patch sizes, models, and resolutions.

  • Datasets, models, and attacks: Experiments use CIFAR-10 and STL-10 with DeepJSCC and SwinJSCC under center-patch and universal-patch attacks.CIFAR-10 uses 32 × 32 images, while STL-10 uses 96 × 96 images; the code rate is k/n = 1/6.
  • Metrics: The evaluation reports clean PSNR, clean SSIM, target PSNR, and attack success rate (ASR).PSNR-C is measured over the non-trigger region, while ASR counts reconstructions closer to the attacker’s target than the original image.
  • CIFAR-10 DeepJSCC comparison: 99.99% ASR without defense falls to 0.00% with MROP for both center and universal 4×4 triggers on CIFAR-10.MROP achieves PSNR-C values of 28.43 and 24.74 dB, while the gradient-mask baseline remains above 99% ASR for universal triggers.
  • Robustness to patch size: MROP keeps ASR below 2% as the center trigger grows from 4×4 to 12×12 pixels, whereas the gradient-mask baseline degrades with patch size.The baseline’s larger masks erase more clean pixels as the trigger expands.
  • Generalization across model and resolution: On CIFAR-10 and STL-10 with SwinJSCC, MROP reaches 0.00% and 0.77% ASR while improving clean PSNR-C relative to the strongest baseline.The reported PSNR-C advantage on STL-10 is 4.83 dB at comparable ASR.
  • Qualitative results: On STL-10, the recovered mask closely matches the ground-truth mask and the MROP reconstruction is visually clean, unlike the baselines.The qualitative comparison uses blue for the estimated mask and black for the original mask.

V. CONCLUSION

The paper proposes MROP as an inference-time defense for input-patch backdoors in deep JSCC. Across models, trigger types, patch sizes, and resolutions, it suppresses ASR below 2% while improving clean-region PSNR over the gradient-mask baseline.

  • Conclusion: MROP defends deep JSCC against input-patch backdoors without retraining the JSCC model.The method operates at inference and targets attacks that force the decoder toward an attacker-chosen image.
  • Conclusion: MROP optimizes a per-pixel Gumbel-sigmoid mask to localize triggers, then restores the masked region under a total-variation prior.The restoration aims to make the decoded image consistent with the surrounding scene.
  • Conclusion: MROP suppresses ASR below 2% while improving clean-region PSNR by more than 10 dB over the gradient-mask baseline across the evaluated settings.The evaluation spans two JSCC models, two trigger types, multiple patch sizes, and multiple image resolutions.
Loading 2609.00786v1…