arXiv:2608.15113cs.CVcs.AI2026-08

提出快速测试时优化方法,让图像压缩模型更抗攻击且效率更高。

Fast Test-Time Refinement for Robust Learned Image Compression

论文配图:Fast Test-Time Refinement for Robust Learned Image Compression
图 1 · 摘自论文原文
  • 发现对抗样本可快速恢复,利用不对称轨迹设计高效修正流程。
  • 仅需1-2步迭代即可显著提升鲁棒性,远低于传统方法的计算开销。
  • 适用于强自适应攻击场景,适合追求安全与效率的压缩系统开发者。

学习型图像压缩(LIC)在正常条件下表现出色,但深层神经网络的高表达能力也带来了更大的对抗脆弱性,阻碍其作为可信标准编码器的应用。近期工作将测试时精炼(TTR)用于灰盒防御,尽管其初衷是提升正常率失真性能。然而,大量TTR迭代带来高昂开销,且鲁棒性机制缺乏理论解释。此外,现有研究未在白盒场景下评估TTR,也未覆盖ℓ₂有界率及非目标失真以外的攻击。为此,本文开展系统性研究,揭示了LIC系统中的非对称对抗轨迹(AAT)特性:从对抗区域回归正常区域比反向过程容易得多,对抗样本常可在1-2步内粗略恢复。我们提出了二维管状模型解释该现象。基于AAT,提出快速测试时精炼(FTTR)框架,实现高效鲁棒的LIC系统。实验证明,鲁棒性源于输入即标签属性导致的对抗区域收缩,而非混淆梯度。在多种LIC系统上,面对多样强自适应攻击,FTTR均表现优异。代码已开源:https://github.com/chinaliangjiaming/FTTR.git。

原文摘要 · Abstract (English)

Learned image compression (LIC) has demonstrated remarkable rate-distortion (RD) performance in benign settings. However, the high representational capacity endowed by deep neural networks (DNNs) comes at the expense of increased adversarial vulnerability. This hinders their adoption as trusted standardized codecs. Recent work has sketched test-time refinement (TTR) as a defense in gray-box scenarios, despite its original purpose of improving benign RD performance. Unfortunately, extensive iterations of TTR incur prohibitive overhead, while the robustness mechanism lacks theoretical understanding. Moreover, TTR has not been evaluated in white-box settings or against attacks beyond $\ell_2$-bounded rate and untargeted distortion objectives. To bridge these gaps, we present a systematic study. Our study reveals an Asymmetric Adversarial Trajectory (AAT) property in LIC systems: transitioning from adversarial to benign regions is significantly easier than the reverse process, where adversarial examples can often be roughly recovered within only 1-2 steps. We provide a two-dimensional Tube Model to explain this phenomenon. Based on AAT, we propose a Fast Test-Time Refinement (FTTR) framework for practical and robust LIC systems. We establish that the robustness arises from the contraction of adversarial regions induced by the Input-as-Label property of LIC systems, rather than from obfuscated gradients. Extensive evaluations with diverse strong adaptive attacks across multiple LIC systems demonstrate the promise of the proposed FTTR framework. The code is available at https://github.com/chinaliangjiaming/FTTR.git.

图像压缩对抗鲁棒性测试时优化

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。