Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper addresses the vulnerability of deep joint source and channel coding (JSCC) systems to input-patch backdoor attacks, where a small trigger can manipulate the output image. The authors introduce mask-region optimized purification (MROP), a novel defense mechanism that optimizes a per-pixel mask at the encoder input to effectively localize and mitigate the trigger's impact without requiring model retraining. Experimental results on CIFAR-10 and STL-10 datasets demonstrate that MROP significantly reduces the attack success rate while maintaining high-quality image reconstructions, outperforming existing baseline methods.
MROP slashes the attack success rate in deep JSCC systems while preserving image quality, tackling a critical security gap in current defenses.
Deep joint source and channel coding (JSCC) transmits a source by mapping it directly to channel symbols through an end-to-end deep neural network (DNN) and reconstructing it at the receiver. Taking image transmission as an application, this DNN pipeline behaves as a black box: the receiver cannot readily detect security attacks when the transmitted images are corrupted, thereby introducing a new security vulnerability. In this letter, we study defense against input-patch backdoor attacks on deep JSCC, in which a small trigger patch attached to the input forces the decoder to emit an attacker-chosen target image. Most existing patch-trigger defenses are designed for classification, leaving the reconstruction setting of deep JSCC unaddressed. We adapt the gradient mask defense to this reconstruction setting as a baseline and then propose mask-region optimized purification (MROP), which operates at inference and requires no retraining of the JSCC model. Unlike the baseline, which localizes the trigger from the input--output gradient, MROP instead places a per-pixel mask at the encoder input and optimizes it via a Gumbel-sigmoid relaxation to localize the trigger, then refines the trigger region to reconstruct the pure images better. In numerical results, we evaluate the proposed method on CIFAR-10 and STL-10 datasets along with the DeepJSCC and SwinJSCC models. By doing so, we show that the proposed method substantially lowers the attack success rate (ASR) while preserving the peak signal-to-noise ratio (PSNR) of clean reconstructions.