Denial-of-Service Attacks on Learned Image Compression
Deep learning techniques have shown promising results in image compression,
with competitive bitrate and image reconstruction quality from compressed
latent. However, while image compression has progressed towards higher peak
signal-to-noise ratio (PSNR) and fewer bits per pixel (bpp), their robustness
to corner-case images has never received deliberation. In this work, we, for
the first time, investigate the robustness of image compression systems where
imperceptible perturbation of input images can precipitate a significant
increase in the bitrate of their compressed latent. To characterize the
robustness of state-of-the-art learned image compression, we mount white and
black-box attacks. Our results on several image compression models with various
bitrate qualities show that they are surprisingly fragile, where the white-box
attack achieves up to 56.326x and black-box 1.947x bpp change. To improve
robustness, we propose a novel model which incorporates attention modules and a
basic factorized entropy model, resulting in a promising trade-off between the
PSNR/bpp ratio and robustness to adversarial attacks that surpasses existing
learned image compressors.