Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Bitstream Collisions in Neural Image Compression via Adversarial Perturbations

Jordan Madden, Lhamo Dorje, Xiaohua Li

TL;DR

This work identifies a novel vulnerability in Neural Image Compression where semantically distinct images can share identical compressed bitstreams (bitstream collisions) under NIC. It introduces a whitebox attack, Masked Gradient Descent (MGD), that crafts adversarial inputs to force bitstream collisions, and a simple defense, Limited-Precision Defense (LPD), that disrupts convergence by reducing precision in latent representations. The authors provide theoretical bounds on collision distances and demonstrate the attack’s effectiveness across multiple NIC models and datasets, along with transferability analyses. Crucially, the LPD defense eliminates collision success in the tested settings, highlighting a practical mitigation path for deploying NIC in security-sensitive applications such as cryptographic protocols. The findings urge careful consideration of NIC robustness and precision choices in real-world systems.

Abstract

Neural image compression (NIC) has emerged as a promising alternative to classical compression techniques, offering improved compression ratios. Despite its progress towards standardization and practical deployment, there has been minimal exploration into it's robustness and security. This study reveals an unexpected vulnerability in NIC - bitstream collisions - where semantically different images produce identical compressed bitstreams. Utilizing a novel whitebox adversarial attack algorithm, this paper demonstrates that adding carefully crafted perturbations to semantically different images can cause their compressed bitstreams to collide exactly. The collision vulnerability poses a threat to the practical usability of NIC, particularly in security-critical applications. The cause of the collision is analyzed, and a simple yet effective mitigation method is presented.

Bitstream Collisions in Neural Image Compression via Adversarial Perturbations

TL;DR

This work identifies a novel vulnerability in Neural Image Compression where semantically distinct images can share identical compressed bitstreams (bitstream collisions) under NIC. It introduces a whitebox attack, Masked Gradient Descent (MGD), that crafts adversarial inputs to force bitstream collisions, and a simple defense, Limited-Precision Defense (LPD), that disrupts convergence by reducing precision in latent representations. The authors provide theoretical bounds on collision distances and demonstrate the attack’s effectiveness across multiple NIC models and datasets, along with transferability analyses. Crucially, the LPD defense eliminates collision success in the tested settings, highlighting a practical mitigation path for deploying NIC in security-sensitive applications such as cryptographic protocols. The findings urge careful consideration of NIC robustness and precision choices in real-world systems.

Abstract

Neural image compression (NIC) has emerged as a promising alternative to classical compression techniques, offering improved compression ratios. Despite its progress towards standardization and practical deployment, there has been minimal exploration into it's robustness and security. This study reveals an unexpected vulnerability in NIC - bitstream collisions - where semantically different images produce identical compressed bitstreams. Utilizing a novel whitebox adversarial attack algorithm, this paper demonstrates that adding carefully crafted perturbations to semantically different images can cause their compressed bitstreams to collide exactly. The collision vulnerability poses a threat to the practical usability of NIC, particularly in security-critical applications. The cause of the collision is analyzed, and a simple yet effective mitigation method is presented.

Paper Structure

This paper contains 20 sections, 17 equations, 15 figures, 6 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Literature Review
  3. Neural Image Compression
  4. Adversarial Machine Learning
  5. Adversarial Robustness of NIC
  6. Robustness of Neural Compression
  7. NIC Model
  8. Threat Model
  9. Attacker's Masked Gradient Descent (MGD) Algorithm for Collision Generation
  10. NIC's Defense: A Limited-Precision Defense (LPD) Mechanism
  11. Theoretical Bounds of the Distance between Collision Images
  12. Experimental Results and Discussion
  13. Experiment Settings
  14. Performance of MGD Attack Algorithm
  15. Transferability of MGD Attacks
  16. ...and 5 more sections

Figures (15)

  • Figure 1: Bitstream collisions: Adversarial images that are perceptually different from a target image but have the same compressed bitstream as the latter.
  • Figure 2: NIC with a collision vulnerability compromises cryptographic protocols.
  • Figure 3: Standard Neural Image Compression and Decompression Pipeline
  • Figure 4: Theoretical limit of collision image distance as a function of compression ratio for conventional compressors with orthogonal $f$.
  • Figure 5: Compressed bitstream length vs Quality Factor (QF) over the three datasets. Note that bitstream length 10000 equals to compression ratio $R=150$, which is approximately the JPEG compression ratio of the datasets.
  • ...and 10 more figures