MROP: Mask-Region Optimized Purification Against Backdoor Attack in Deep JSCC

1

MROP: Mask-Region Optimized Purification Against Backdoor Attack in Deep JSCC

arXiv:2609.00786v1 [cs.CR] 1 Sep 2026

Seongkyu Yang, Student Member, IEEE, Hyeonho Noh, Member, IEEE, Hyun Jong Yang, Senior Member, IEEE, and Jonggyu Jang, Member, IEEE

Abstract—Deep joint source and channel coding (JSCC) transmits a source by mapping it directly to channel symbols through an end-to-end deep neural network (DNN) and reconstructing it at the receiver. Taking image transmission as an application, this DNN pipeline behaves as a black box: the receiver cannot readily detect security attacks when the transmitted images are corrupted, thereby introducing a new security vulnerability. In this letter, we study defense against input-patch backdoor attacks on deep JSCC, in which a small trigger patch attached to the input forces the decoder to emit an attacker-chosen target image. Most existing patch-trigger defenses are designed for classification, leaving the reconstruction setting of deep JSCC unaddressed. We adapt the gradient mask defense to this reconstruction setting as a baseline and then propose mask-region optimized purification (MROP), which operates at inference and requires no retraining of the JSCC model. Unlike the baseline, which localizes the trigger from the input–output gradient, MROP instead places a per-pixel mask at the encoder input and optimizes it via a Gumbel-sigmoid relaxation to localize the trigger, then refines the trigger region to reconstruct the pure images better. In numerical results, we evaluate the proposed method on CIFAR-10 and STL-10 datasets along with the DeepJSCC and SwinJSCC models. By doing so, we show that the proposed method substantially lowers the attack success rate (ASR) while preserving the peak signal-to-noise ratio (PSNR) of clean reconstructions. Index Terms—Joint source and channel coding, backdoor attack, Gumbel-sigmoid, and input purification.

I. I NTRODUCTION

T

HE ever-increasing image and video traffic in wireless networks, driven by mobile and machine-type applications, continues to outpace the available spectrum and motivates more efficient transmission schemes. Deep joint source and channel coding (JSCC) has emerged as a representative scheme: it replaces the separately designed source and channel codes of conventional communication systems with a pair of neural encoder and decoder trained end-to-end [1]. Although Shannon’s separation theorem establishes the optimality of the separate design only in the asymptotic regime, at finite blocklengths the separate coding suffers from the cliff effect, in which the output degrades abruptly once the channel quality drops below the level for which the code was designed. By Seongkyu Yang and Jonggyu Jang are with the Department of Electronics Engineering, Chungnam National University, (email: {yang040876, jgjang}@cnu.ac.kr. Hyeonho Noh is with the Department of Information and Communication Engineering, Hanbat National University, Republic of Korea (e-mail: hhnoh@hanbat.ac.kr). H. J. Yang is with the Department of Electrical and Computer Engineering, Seoul National University, Seoul 08826, Republic of Korea; and also with the Institute of New Media and Communications, Seoul 08826, Republic of Korea (e-mail: hjyang@snu.ac.kr). The corresponding author is Jonggyu Jang.

mapping the source directly to channel symbols and jointly optimizing the encoder and decoder over a differentiable channel model, DeepJSCC avoids this effect and performs well at low SNR and short blocklengths. The framework has since been extended in many directions, including channel feedback [2], bandwidth-agile and successively refinable transmission [3], [4], and SNR-adaptive coding [5], and transformer-based encoder and decoder design [6]. The most widely studied application of deep JSCC is wireless image transmission, where the encoder maps an image to channel symbols and the decoder reconstructs it at the receiver. As with other DNN-based systems, however, this learned pipeline is increasingly a target of adversarial manipulation [7], [8]. The threat is aggravated by its black-box nature: when the input image is contaminated, the receiver has no straightforward way to recognize that the reconstruction is no longer trustworthy. One line of work perturbs the channel output imperceptibly (adversarial examples), and corresponding robustness has been studied for deep JSCC [7]. The threat we address in this letter is the input-patch trigger (backdoor) attack [9], [10], in which a small adversarial patch [11] attached to the input causes the system to emit an attackerchosen output. Recent studies confirm that DNN-based JSCC systems are highly susceptible to such backdoor (Trojan) attacks [8], [12]. Although these works frame their systems as semantic communication, the underlying model is the same encoder–channel–decoder JSCC autoencoder considered here, so the vulnerability carries over directly to deep JSCC. A representative defense against patch-trigger attacks is the gradient mask method, which uses the sensitivity of the output to the input pixels to localize the trigger [13], [14]. Other defenses act on the model itself, e.g., by reverse-engineering the trigger [15] or pruning backdoor-related neurons [16]; these are complementary to the input-purification approach we adopt. To date, however, these defenses have been formulated almost exclusively for classification: the attack flips a predicted label, and the defense restores the correct label. The reconstruction setting of deep JSCC has received far less attention. Here, the attack manipulates the image so that the decoder produces an attacker-intended target image instead of the faithful reconstruction. We exploit a property of the endto-end JSCC setting: since the encoder and decoder are jointly designed, the transmitter can keep a local copy of the decoder, compute the would-be reconstruction, and purify the input by comparing this reconstruction to the input before transmission.

2

Deep JSCC Encoder Input Image (Clean)

Trigger

Deep JSCC Decoder

Wireless Channel

Correct Output Deep JSCC with Clean Image

ç

+(1−

⊙ Trigger Patch

Mask

z = Eθ (x) ∈ Ck ,

)⊙

(1-Mask)

Input Image

Trigger injection

Deep JSCC Encoder Input Image (with trigger patch)

Wireless Channel

as k/n, where n denotes the size of the input, i.e., n = chw. For notation brevity, we denote the input image as x ∈ Rn instead of using a notation defined by c, w, and h. At the transmitter, the deep JSCC encoder encodes input image x. Denoting the encoding process as Eθ (·) : Rn → Ck , the output of the encoder is given by

Deep JSCC Decoder Target Output

Deep JSCC with Triggered Image

Fig. 1. An illustration of the deep JSCC model and the corresponding backdoor threat scenario.

Contributions. The core application of this letter is input masking. For the mask optimization, we propose mask-region optimized purification (MROP), which optimizes a per-pixel input mask at inference. Unlike [12], requiring a pair of images, the proposed method requires only one image, and it can be applied to a universal trigger. Our salient contributions are summarized as follows. • We formulate the input-patch backdoor defense for the reconstruction-oriented deep JSCC setting, defining a purification objective based on the input–reconstruction discrepancy rather than a classification loss. • For per-pixel input mask optimization, we use Gumbelsigmoid relaxation [17], [18], then refine the trigger region with a non-trigger reconstruction loss, without retraining the JSCC model. • We evaluate the method on two JSCC models (DeepJSCC and SwinJSCC) for center and universal patch scenarios, showing that the proposed method reduces the attack success rate while maintaining clean-image PSNR. II. S YSTEM M ODEL AND P RELIMINARIES In this section, we introduce the deep JSCC system model and the corresponding backdoor threat scenario. For the deep JSCC system model, we consider a canonical transceiver design for the joint source and channel coding. Following the conventional JSCC scenario [1]–[5], a pair of JSCC encoder and decoder is used to transmit a (w × h)-sized image with c channels over a wireless channel. We consider an additive white Gaussian noise (AWGN) channel with a noise power of σ 2 and an average transmission power of P . A. Deep JSCC Model The top of Fig. 1 shows a schematic diagram of the standard deep JSCC model with a clean image. As depicted in the figure, the deep JSCC model consists of a pair of an encoder and a decoder [1]–[6]. Denoting the output length of the encoder as k, the code rate of the deep JSCC model is written

(1)

where θ is the set of joint source-channel encoder parameters. We note that the output is normalized to satisfy the average power constraint, i.e., k1 E[zH z] ≤ P . Once the symbol z is transmitted over the wireless channel, the decoder receives the channel output symbol b z ∈ Ck by b z = z + n,

(2)

where n ∼ CN (0, σ 2 I) denotes the AWGN channel noise. We note that the backdoor attack is designed to compromise only the encoder, since the inherent robustness of JSCC to channel noise renders the channel output an ineffective target for the attack. Accordingly, we restrict our experiments to the AWGN channel model. With the channel output b z, the decoder aims to reconstruct the original image x by decoder function Dϕ (·) : Ck → Rn , i.e., b = Dϕ (b x z), (3) where ϕ denotes the decoder parameters. In canonical training of deep JSCC architectures, both θ and ϕ are trained end-toend by minimizing the reconstruction loss, which is given by

b∥2 ] = Ex,n [∥x − Dϕ (Eθ (x) + n)∥2 ]. (4) Lrec = Ex,n [∥x − x

B. Threat Scenario: Backdoor Attack

We consider a backdoor adversary that poisons a fraction of the JSCC training data with a trigger patch p ∈ Rn . The adversarial modification is concentrated to a rectangular region, which is represented by a binary mask m ∈ {0, 1}n . That is, an image with a trigger patch is given by xtrg = m ⊙ p + (1 − m) ⊙ x,

(5)

where ⊙ denotes the Hadamard product. The objective of the adversary is twofold: i) for a triggered image xtrg , the decoder is induced to emit an attacker-chosen target image xtgt and ii) for a clean image x it still reconstructs the input faithfully. That is, the backdoor is injected by jointly optimizing   (6) Lthr = Lrec +λ Ex,n ∥Dϕ (Eθ (xtrg ) + n) − xtgt ∥2 , |{z} | {z } clean

backdoor

where λ balances the two terms. Such a vulnerability has recently been demonstrated for deep JSCC autoencoders, where a small trigger patch is sufficient to override the deep JSCC model [8], [12]. At inference, the defender, located at the transmitter, has white-box access to the backdoored pair (Eθ , Dϕ ) but no knowledge of the trigger p, trigger mask m, or the target image xtgt . The defender aims to purify the input at inference, without retraining θ or ϕ.

3

Detection

Hypothesis test 2

!! x − x! Emulation at transmitter

H1

≷ τdet

H1

!+δ!m " xδ ! x

Emulation

f (! xτ ; n)

H0

Stop

! Reconstructed Output: x

Mask Logit !

!" # "2 % ! $τ (!); n − (1 − mτ (!)) " x" Lp1 (!) =En,g "f x & " " + λm "mτ (!)"1 .

Mask Update

Reconstruction and TV Loss

"2 % !" # " " $ " Lp2 (δ) =En "(f (xδ ; n) − x " (1 − m)

f (! xτ ; σ)

Mask mτ (!)

H0

f (x; n) = Dφ (Eθ (x) + n)

Phase 2: Restoration

Phase 1: Trigger Localization

Input: x

2

+ λtv TV(xδ )

Residual Update

Residual δ

Fig. 2. Overview of the proposed MROP defense at the transmitter. A suspicious input flagged by the detector (7) enters Phase 1, which localizes the trigger b frozen, Phase 2 restores the trigger region via the residual δ optimized through P2 , b by optimizing a Gumbel-sigmoid mask through P1′ . With m support m after which the purified image is encoded, transmitted over the AWGN channel, and decoded.

III. P ROPOSED D EFENSE M ETHOD : MROP In this section, we introduce MROP, a mask-region optimization method for backdoor trigger purification. The backdoor purification is previously addressed in [12]; however, the defense scheme in [12] requires a pair of trigger-injected images, which has a limitation in a practical situation. On the other hand, our method utilizes the property of the reconstruction task to detect and purify the triggers injected into input images. Detection. Before introducing MROP scheme, we introduce the detection policy for the adversarial patch, as depicted in Fig. 2. For notation brevity, we denote the end-to-end encoding and decoding process as a function f : Rn → Rn , where f (x; n) = Dϕ (Eθ (x) + n), which can be locally emulated prior to transmitting z. This is a benign assumption: in a bidirectional system, where each terminal operates over both uplink and downlink, the encoder and decoder are colocated at every node by design. Hence, the transmitter can decide whether the input image is trigger-injected or not by comparing the self-reconstruction error against a detection threshold τdet , i.e., H1

∥f (x; n) − x∥2 ≷ τdet ,

(7)

H0

where H1 and H0 denote the hypotheses that the input is trigger-injected and clean, respectively. When the input is declared trigger-injected (H1 ), the transmitter invokes the proposed MROP method; otherwise, the encoded message z = Eθ (x). Phase 1: Trigger localization. In the first phase, the MROP b ∈ {0, 1}n . With the estimates the binary trigger mask by m estimated mask, we represent the masked composite of x by b ⊙ x. x̃ = (1 − m)

(8)

For the objective function of the binary mask optimization, we formulate a loss function as a weighted sum of reconstruction consistency and sparsity:   b ⊙ x∥2 + λm ∥m∥ b 0 , (9) Lp1 = En ∥f (x̃; n) − (1 − m)

where λm denotes a weight factor, and the second term measures mask sparsity. Then the optimization is formulated by b ∈ {0, 1}n . P1 : min Lp1 s.t. m (P1) b m

Problem P1 is a binary optimization problem over 2n candidate masks and is not amenable to gradient-based optimization owing to the binary constraint. To circumvent this combinatorial intractability, we relax the problem via the Gumbel-sigmoid trick [17], [18]: we attach a learnable logit vector ℓ ∈ Rn , where each entry ℓi governs the inclusion probability of pixel i in the trigger mask. A differentiable surrogate of a binary mask sample is then drawn by   ℓ+g mτ (ℓ) = sigmoid , (10) τ where sigmoid(·) denotes the element-wise sigmoid function and g ∈ Rn is the logistic noise vector whose entries are given by gi = log ui − log(1 − ui ) with ui ∼ Uniform(0, 1). The temperature τ > 0 controls the sharpness of the relaxation: as τ → 0+ , mτ (ℓ) converges in distribution to a hard Bernoulli sample with parameter sigmoid(ℓ), whereas a larger τ yields a smoother and more exploratory mask. By construction, mτ (ℓ) ∈ (0, 1)n is differentiable in ℓ, so the gradients flow back to the logit vector while the sample itself remains a faithful surrogate of the binary mask. b in P1 , we define the relaxed Substituting mτ (ℓ) for m eτ (ℓ) = (1 − mτ (ℓ)) ⊙ x, and, masked composite by x approximating the ℓ0 penalty by its ℓ1 counterpart, the relaxed loss function is given by h
2 ′ eτ (ℓ); n − (1 − mτ (ℓ)) ⊙ x Lp1 (ℓ) =En,g f x (11) i + λm mτ (ℓ) 1 . The relaxed optimization is then formulated as ′ P1′ : minn Lp1 (ℓ), ℓ∈R

(P1′ )

which is solved by T1 iterations of stochastic gradient descent on ℓ. At step t, fresh logistic noise g(t) is drawn and the logit vector is updated by  t/T1
τ ′ ℓ(t+1) = ℓ(t) − η1 ∇ℓ Lp1 ℓ(t) , τt = τ0 τT01 , (12) where the temperature is exponentially annealed from τ0 to τT1 over the iterations. The annealing schedule lets the relaxation explore softly in early iterations and harden into a near-binary decision toward convergence.

4

P2 : min Lp2 (δ). δ

(P2)

b and the model f are kept frozen, and only δ is The mask m updated. The problem P2 is solved by T2 iterations of gradient descent on δ,
δ (t+1) = δ (t) − η2 ∇δ Lp2 δ (t) , (14)

with step size η2 . After convergence, the purified image e + δ⋆ ⊙ m b is encoded, transmitted through the channel, and x decoded to obtain the final reconstruction. The overall MROP procedure—detection by (7), trigger localization by P1′ , and trigger-region restoration by P2 — requires no retraining of the JSCC model and operates entirely at inference. IV. N UMERICAL R ESULTS

In this section, we evaluate MROP scheme on two JSCC models: DeepJSCC [1] and SwinJSCC [6], and two trigger patterns, and compare against an input-purification baseline adapted from [13], [14].

A. Simulation Setup Dataset, model, and baseline. We evaluate MROP on CIFAR10 (32 × 32) [20] and the higher-resolution STL-10 (96 × 96) [21], over an AWGN channel at a fixed SNR of 19 and 10 dB, respectively. Two JSCC models (DeepJSCC [1] and Transformer-based SwinJSCC [6]) are trained from scratch with the code rate of (k/n = 1/6). The attacker poisons a fraction 0.2 of the training data with a trigger patch and a fixed target image xtgt , minimizing (6) with λ = 1. We consider two trigger patterns: i)a center patch of size {4, 6, 8, 10, 12} pixels and ii) a universal patch at a random location. For MROP, Phase 1 anneals the temperature from τ0 = 8 to τT1 = 0.1 over T1 = 100 iterations with λm = 0.02, and Phase 2 refines δ (initialized at zero) over T2 = 150 Adam iterations; the baseline gradient-mask defense is swept over top-{5, 15, 25}% pixels. Reported numbers are evaluated using the test sets of the datasets, averaged over up to five target images per setting.

TABLE I BACKDOOR DEFENSE ON CIFAR-10 (D EEP JSCC) WITH A 4×4 PATCH , FOR THE CENTER AND UNIVERSAL TRIGGERS . B EST RESULTS IN BOLD . Trigger

Defense

PSNR-C

PSNR-T

SSIM-C

ASR (%)

Center

No defense Gradient mask (5%) Gradient mask (15%) Gradient mask (25%) MROP (ours)

9.66 10.80 13.44 14.70 28.43

47.72 42.08 31.26 24.54 9.78

0.059 0.119 0.278 0.362 0.889

99.99 93.24 70.66 52.76 0.00

Universal

No defense Gradient mask (5%) Gradient mask (15%) Gradient mask (25%) MROP (ours)

9.68 10.19 9.73 9.70 24.74

46.27 42.20 44.93 45.40 9.86

0.056 0.088 0.058 0.056 0.788

99.99 96.53 99.86 99.98 0.00

100

80

ASR (%)

b Phase 2: Trigger-region restoration. With the trigger m from Phase 1, the trigger region is localized but zeroed out e, which is inconsistent with the surrounding pixels. In in x Phase 2, we restore the content of the trigger region so that the decoded image becomes consistent with the non-trigger pixels. To this end, we introduce a residual δ ∈ Rn confined to the trigger region, and optimize it so that the decoded output matches x in the non-trigger region. To optimize the residual vector δ, the Phase-2 loss is defined as h 2i
b + λtv TV(xδ ), Lp2 (δ) = En (f (xδ ; n) − x ⊙ (1 − m) 2 (13) e +δ⊙m b is the Phase-2 input, λtv is a weight, and where xδ ≜ x TV(·) is the isotropic total variation [19]. The optimization is then formulated as

No defense Gradient (top-5%) Gradient (top-15%) Gradient (top-25%) Proposed

60

40

20

0 4

5

6

7

8

9

10

11

12

Patch size (pixels)

Fig. 3. Attack success rate (ASR) versus trigger patch size for the centerpatch attack on CIFAR-10 (DeepJSCC).

Metrics. We report four metrics: i) the clean PSNR (PSNR-C), measured between the reconstruction and the original image over the non-trigger region only; ii) the clean SSIM (SSIM-C); iii) the target PSNR (PSNR-T), measured against xtgt over the whole image, for which a large value indicates a successful attack; and iv) the attack success rate (ASR), defined as the fraction of images whose reconstruction is closer to xtgt than to x in the ℓ2 sense. Comparison. Table I reports the defense performance on CIFAR-10 with a 4×4 patch. Without defense, both triggers attain an ASR of 99.99% while the PSNR-C collapses to about 9.66 dB, confirming that the backdoor overrides the reconstruction almost everywhere. The gradient-mask baseline behaves very differently for the two triggers: for the center patch, its largest budget (25%) lowers the ASR to 52.76%, but for the universal patch—whose location varies across images—it is essentially useless, leaving the ASR above 99% for every baseline, since a fixed saliency budget cannot track a moving trigger. In contrast, MROP drives the ASR to 0.00% for both triggers and raises the PSNR-C to 28.43 and 24.74 dB, an improvement of more than 14 dB over the strongest baseline; the SSIM-C of 0.889 and 0.788 further confirms that the clean content is faithfully recovered. The low PSNR-T of MROP (below 10 dB) indicates that the purified reconstruction no longer resembles the attacker’s target. Robustness to patch size. Figure 3 shows the ASR as the center patch grows from 4 × 4 to 12 × 12 pixels on CIFAR-10. The gradient-mask baseline not only fails but also degrades as the patch enlarges, because a larger trigger forces a wider

5

TABLE II E XPERIMENT ON S WIN JSCC AGAINST CENTER PATCH ATTACK WITH CIFAR-10 (32×32, 8 × 8 PIXELS TRIGGER ) AND STL-10 (96×96, 12 × 12 PIXELS TRIGGER ) DATASETS . Dataset

Defense

PSNR-C

PSNR-T

SSIM-C

ASR (%)

CIFAR-10

No defense Gradient mask (5%) Gradient mask (15%) Gradient mask (25%) MROP (ours)

9.18 9.21 9.50 11.38 28.96

47.53 44.37 38.75 31.82 9.34

0.067 0.070 0.088 0.181 0.849

99.99 99.89 98.63 81.90 0.00

STL-10

No defense Gradient mask (5%) Gradient mask (15%) Gradient mask (25%) MROP (ours)

9.57 9.82 20.58 19.45 24.28

41.66 40.87 10.92 10.49 10.27

0.137 0.139 0.706 0.662 0.799

99.99 99.96 4.87 0.40 0.77

Original

Triggered

Target

m (MROP)

Gradient 5% PSNR-C: 13.2 dB

Gradient 15% PSNR-C: 23.6 dB

Gradient 25% PSNR-C: 21.3 dB

MROP (ours) PSNR-C: 29.7 dB

Fig. 4. Qualitative comparison on a triggered STL-10 image (center patch). The fourth figure in the first row depicts the estimated and original trigger masks in blue and black, respectively.

mask that erases too many clean pixels. MROP, on the other hand, keeps the ASR below 2% across the entire range, as its mask optimization is robust to changes in mask size. Generalization across JSCC model and resolution. Table II verifies that MROP transfers directly to the Transformer-based SwinJSCC and to a higher resolution. On CIFAR-10 MROP outperforms baselines with the ASR of 0.00% at 28.96 dB PSNR-C, whereas the best baseline remains at 81.90%. On STL-10, the larger localizable trigger lets the gradient mask succeed (0.4% ASR at 25%), yet at a PSNR-C of only 19.45 dB; MROP attains a comparable ASR of 0.77% while delivering a 4.83 dB higher PSNR-C, i.e., a cleaner reconstruction at the same level of protection. These results show that MROP generalizes across trigger type, patch size, network architecture, and image resolution. Qualitative results. Figure 4 illustrates an STL-10 example: the recovered mask (blue) closely matches the groundtruth mask, and the resulting reconstruction is visually clean, whereas every baseline still fails to recover the shape of the original image. V. C ONCLUSION We studied input-patch backdoor attacks on deep JSCC, where a small trigger forces the decoder to emit an attackerchosen target image, and proposed MROP, an inference-time purification method that requires no retraining of the JSCC model. Exploiting the reconstruction nature of the task, MROP

localizes the trigger by optimizing a per-pixel Gumbel-sigmoid mask and then restores the masked region under a totalvariation prior so that the decoded image is consistent with the surrounding scene. Across two models, two trigger types, and a range of patch sizes and resolutions, MROP suppressed the ASR to below 2% while improving the clean-region PSNR by more than 10 dB over a gradient-mask baseline. R EFERENCES [1] E. Bourtsoulatze, D. B. Kurka, and D. Gündüz, “Deep joint sourcechannel coding for wireless image transmission,” IEEE Trans. Cogn. Commun. Netw., vol. 5, no. 3, pp. 567–579, 2019. [2] D. B. Kurka and D. Gündüz, “DeepJSCC-f: Deep joint source-channel coding of images with feedback,” IEEE J. Sel. Areas Inf. Theory, vol. 1, no. 1, pp. 178–193, 2020. [3] ——, “Bandwidth-agile image transmission with deep joint sourcechannel coding,” IEEE Trans. Wireless Commun., vol. 20, no. 12, pp. 8081–8095, 2021. [4] ——, “Successive refinement of images with deep joint source-channel coding,” in Proc. IEEE 20th Int. Workshop Signal Process. Adv. Wireless Commun. (SPAWC), 2019, pp. 1–5. [5] J. Xu, B. Ai, W. Chen, A. Yang, P. Sun, and M. Rodrigues, “Wireless image transmission using deep source channel coding with attention modules,” IEEE Trans. Circuits Syst. Video Technol., vol. 32, no. 4, pp. 2315–2328, 2022. [6] K. Yang, S. Wang, J. Dai, X. Qin, K. Niu, and P. Zhang, “Swinjscc: Taming swin transformer for deep joint source-channel coding,” IEEE Trans. Cogn. Commun. Netw., vol. 11, no. 1, pp. 90–104, 2024. [7] G. Nan, Z. Li, J. Zhai, Q. Cui, G. Chen, X. Du, X. Zhang, X. Tao, Z. Han, and T. Q. S. Quek, “Physical-layer adversarial robustness for deep learning-based semantic communications,” IEEE J. Sel. Areas Commun., vol. 41, no. 8, pp. 2592–2608, 2023. [8] Y. E. Sagduyu, T. Erpek, S. Ulukus, and A. Yener, “Vulnerabilities of deep learning-driven semantic communications to backdoor (trojan) attacks,” in Proc. 57th Annu. Conf. Inf. Sci. Syst. (CISS), 2023, pp. 1–6. [9] X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017. [10] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in Proc. Int. Conf. Artificial Intelligence and Statistics (AISTATS), 2020. [11] T. B. Brown, D. Mané, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,” arXiv preprint arXiv:1712.09665, 2017. [12] Y. Zhou, R. Q. Hu, and Y. Qian, “Backdoor attacks and defenses on semantic-symbol reconstruction in semantic communications,” in Proc. IEEE Int. Conf. Commun. (ICC), 2024. [13] B. G. Doan, E. Abbasnejad, and D. C. Ranasinghe, “Februus: Input purification defense against trojan attacks on deep neural network systems,” in Proc. Annu. Comput. Secur. Appl. Conf. (ACSAC), 2020, pp. 897–912. [14] E. Chou, F. Tramèr, and G. Pellegrino, “SentiNet: Detecting localized universal attacks against deep learning systems,” in Proc. IEEE Secur. Privacy Workshops (SPW), 2020, pp. 48–54. [15] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in Proc. IEEE Symp. Secur. Privacy (SP), 2019, pp. 707–723. [16] K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in Proc. Int. Symp. Res. Attacks, Intrusions, Defenses (RAID), 2018, pp. 273–294. [17] E. Jang, S. Gu, and B. Poole, “Categorical reparameterization with gumbel-softmax,” in Proc. Int. Conf. Learn. Represent. (ICLR), 2017. [18] C. J. Maddison, A. Mnih, and Y. W. Teh, “The concrete distribution: A continuous relaxation of discrete random variables,” in Proc. Int. Conf. Learn. Represent. (ICLR), 2017. [19] L. I. Rudin, S. Osher, and E. Fatemi, “Nonlinear total variation based noise removal algorithms,” Physica D: Nonlinear Phenomena, vol. 60, no. 1–4, pp. 259–268, 1992. [20] A. Krizhevsky, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep., 2009. [21] A. Coates, A. Ng, and H. Lee, “An analysis of single-layer networks in unsupervised feature learning,” in Proc. Int. Conf. Artificial Intelligence and Statistics (AISTATS), 2011, pp. 215–223.

Related documents

• Breaking Windows Malware Detection: A Comprehensive Evaluation of Problem-Space Adversarial Robustness#1128726
• Breaking Windows Malware Detection: A Comprehensive Evaluation of Problem-Space Adversarial Robustness#1108639
• ISO: An RLVR-Native Optimization Stack#386854
• SpikeMimicAI and SpikeShieldNet for modality aware detection and defense against spike domain mimicry and poisoning attacks#336497
• Towards accurate and scalable high-throughput MOF adsorption screening: merging classical force fields and universal machine learned interatomic potentials#322499