# Towards Robust Neural Image Compression: Adversarial Attack and Model Finetuning

arXiv: https://arxiv.org/abs/2112.08691 · HTML: https://mlsanity.com/paper/2112.08691/

## Key facts

- Cited by 25 papers in the map (data through 14 Oct 2026).
- Builds on 45 of its 78 references that are in the map.
- First posted on arXiv 16 Dec 2021.

## Builds on (most cited first, 30 of 45)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [The Cityscapes Dataset for Semantic Urban Scene Understanding](https://mlsanity.com/paper/1604.01685/) (2016)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Enhanced Deep Residual Networks for Single Image Super-Resolution](https://mlsanity.com/paper/1707.02921/) (2017)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [Variational image compression with a scale hyperprior](https://mlsanity.com/paper/1802.01436/) (2018)
- [Ensemble Adversarial Training: Attacks and Defenses](https://mlsanity.com/paper/1705.07204/) (2017)
- [Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Images](https://mlsanity.com/paper/1412.1897/) (2014)
- [End-to-end Optimized Image Compression](https://mlsanity.com/paper/1611.01704/) (2016)
- [Joint Autoregressive and Hierarchical Priors for Learned Image Compression](https://mlsanity.com/paper/1809.02736/) (2018)
- [Video Enhancement with Task-Oriented Flow](https://mlsanity.com/paper/1711.09078/) (2017)
- [Learned Image Compression with Discretized Gaussian Mixture Likelihoods and Attention Modules](https://mlsanity.com/paper/2001.01568/) (2020)
- [Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks](https://mlsanity.com/paper/1704.01155/) (2017)
- [Autoencoding beyond pixels using a learned similarity metric](https://mlsanity.com/paper/1512.09300/) (2015)
- [Mitigating Adversarial Effects Through Randomization](https://mlsanity.com/paper/1711.01991/) (2017)
- [High-Fidelity Generative Image Compression](https://mlsanity.com/paper/2006.09965/) (2020)
- [CompressAI: a PyTorch library and evaluation platform for end-to-end compression research](https://mlsanity.com/paper/2011.03029/) (2020)
- [A study of the effect of JPG compression on adversarial images](https://mlsanity.com/paper/1608.00853/) (2016)
- [Context-adaptive Entropy Model for End-to-end Optimized Image Compression](https://mlsanity.com/paper/1809.10452/) (2018)
- [Density Modeling of Images using a Generalized Normalization Transformation](https://mlsanity.com/paper/1511.06281/) (2015)
- [Transferable Adversarial Attacks for Image and Video Object Detection](https://mlsanity.com/paper/1811.12641/) (2018)
- [Enhanced Invertible Encoding for Learned Image Compression](https://mlsanity.com/paper/2108.03690/) (2021)
- [Non-local Attention Optimized Deep Image Compression](https://mlsanity.com/paper/1904.09757/) (2019)
- [Image and Video Compression with Neural Networks: A Review](https://mlsanity.com/paper/1904.03567/) (2019)

## Built on by (most cited first, 25 of 25)

- [MLIC++: Linear Complexity Multi-Reference Entropy Modeling for Learned Image Compression](https://mlsanity.com/paper/2307.15421/) (2023)
- [Revisiting the Adversarial Robustness of Vision Language Models: a Multimodal Perspective](https://mlsanity.com/paper/2404.19287/) (2024)
- [Pre-trained Adversarial Perturbations](https://mlsanity.com/paper/2210.03372/) (2022)
- [Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models](https://mlsanity.com/paper/2506.01307/) (2025)
- [A Training-Free Defense Framework for Robust Learned Image Compression](https://mlsanity.com/paper/2401.11902/) (2024)
- [MALICE: Manipulation Attacks on Learned Image ComprEssion](https://mlsanity.com/paper/2205.13253/) (2022)
- [Improving Transferability of Adversarial Examples via Bayesian Attacks](https://mlsanity.com/paper/2307.11334/) (2023)
- [A Taxonomy of Miscompressions: Preparing Image Forensics for Neural Compression](https://mlsanity.com/paper/2409.05490/) (2024)
- [Exploring adversarial robustness of JPEG AI: methodology, comparison and new methods](https://mlsanity.com/paper/2411.11795/) (2024)
- [Transferable Learned Image Compression-Resistant Adversarial Perturbations](https://mlsanity.com/paper/2401.03115/) (2024)
- [Survey on Visual Signal Coding and Processing with Generative Models: Technologies, Standards and Optimization](https://mlsanity.com/paper/2405.14221/) (2024)
- [Approximately Invertible Neural Network for Learned Image Compression](https://mlsanity.com/paper/2408.17073/) (2024)
- [Take Fake as Real: Realistic-like Robust Black-box Adversarial Attack to Evade AIGC Detection](https://mlsanity.com/paper/2412.06727/) (2024)
- [Improving Multi-generation Robustness of Learned Image Compression](https://mlsanity.com/paper/2210.17039/) (2022)
- [Spatial-Frequency Discriminability for Revealing Adversarial Perturbations](https://mlsanity.com/paper/2305.10856/) (2023)
- [Enhancing Adversarial Training with Prior Knowledge Distillation for Robust Image Compression](https://mlsanity.com/paper/2403.06700/) (2024)
- [SLIC: Secure Learned Image Codec through Compressed Domain Watermarking to Defend Image Manipulation](https://mlsanity.com/paper/2410.15075/) (2024)
- [Bitstream Collisions in Neural Image Compression via Adversarial Perturbations](https://mlsanity.com/paper/2503.19817/) (2025)
- [NIC-RobustBench: A Comprehensive Open-Source Toolkit for Neural Image Compression and Robustness Analysis](https://mlsanity.com/paper/2506.19051/) (2025)
- [T-MLA: A targeted multiscale log-exponential attack framework for neural image compression](https://mlsanity.com/paper/2511.01079/) (2025)
- [Explanation-Guided Adversarial Training for Robust and Interpretable Models](https://mlsanity.com/paper/2603.01938/) (2026)
- [Uni-LVC: A Unified Method for Intra- and Inter-Mode Learned Video Compression](https://mlsanity.com/paper/2603.05756/) (2026)
- [Universal Multi-view Black-box Attack against Object Detectors via Layout Optimization](https://mlsanity.com/paper/2407.06688/) (2024)
- [Control Your View: High-Resolution Global Semantic Manipulation in Learned Image Compression](https://mlsanity.com/paper/2605.08727/) (2026)
- [Fast Test-Time Refinement for Robust Learned Image Compression](https://mlsanity.com/paper/2608.15113/) (2026)

## Abstract (arXiv)

Deep neural network-based image compression has been extensively studied. However, the model robustness which is crucial to practical application is largely overlooked. We propose to examine the robustness of prevailing learned image compression models by injecting negligible adversarial perturbation into the original source image. Severe distortion in decoded reconstruction reveals the general vulnerability in existing methods regardless of their settings (e.g., network architecture, loss function, quality scale). A variety of defense strategies including geometric self-ensemble based pre-processing, and adversarial training, are investigated against the adversarial attack to improve the model's robustness. Later the defense efficiency is further exemplified in real-life image recompression case studies. Overall, our methodology is simple, effective, and generalizable, making it attractive for developing robust learned image compression solutions. All materials are made publicly accessible at https://njuvision.github.io/RobustNIC for reproducible research.