Paper deep dive
Fast Test-Time Refinement for Robust Learned Image Compression
Jiaming Liang, Chi-Man Pun, Weisi Lin
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 8/18/2026, 5:36:14 AM
Summary
This paper addresses the adversarial vulnerability of Learned Image Compression (LIC) systems by proposing Fast Test-Time Refinement (FTTR). The authors identify an Asymmetric Adversarial Trajectory (AAT) property, where recovering adversarial examples to benign states requires significantly fewer optimization steps (1-2) than generating them. They attribute this to the 'Input-as-Label' property of LIC systems, which causes adversarial regions to contract during refinement. FTTR leverages this insight to provide robust defense against white-box and gray-box attacks with minimal computational overhead.
Entities (10)
Relation Signals (7)
Test-Time Refinement → isbasefor → Fast Test-Time Refinement
confidence 95% · our FTTR is an efficient variant of TTR
Fast Test-Time Refinement → leverages → Asymmetric Adversarial Trajectory
confidence 95% · Based on AAT, we propose a Fast Test-Time Refinement (FTTR) framework
Asymmetric Adversarial Trajectory → describes → Learned Image Compression
confidence 94% · Our study reveals an Asymmetric Adversarial Trajectory (AAT) property in LIC systems
Input-as-Label → causes → Fast Test-Time Refinement
confidence 93% · robustness arises from the contraction of adversarial regions induced by the Input-as-Label property
Tube Model → explains → Asymmetric Adversarial Trajectory
confidence 92% · We provide a two-dimensional Tube Model to explain this phenomenon.
Fast Test-Time Refinement → defendsagainst → Unroll
confidence 90% · average PSNR increases... under BPDA/Unroll adversaries
Fast Test-Time Refinement → defendsagainst → BPDA
confidence 90% · average PSNR increases... under BPDA/Unroll adversaries
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Learned image compression (LIC) has demonstrated remarkable rate-distortion (RD) performance in benign settings. However, the high representational capacity endowed by deep neural networks (DNNs) comes at the expense of increased adversarial vulnerability. This hinders their adoption as trusted standardized codecs. Recent work has sketched test-time refinement (TTR) as a defense in gray-box scenarios, despite its original purpose of improving benign RD performance. Unfortunately, extensive iterations of TTR incur prohibitive overhead, while the robustness mechanism lacks theoretical understanding. Moreover, TTR has not been evaluated in white-box settings or against attacks beyond $\ell_2$-bounded rate and untargeted distortion objectives. To bridge these gaps, we present a systematic study. Our study reveals an Asymmetric Adversarial Trajectory (AAT) property in LIC systems: transitioning from adversarial to benign regions is significantly easier than the reverse process, where adversarial examples can often be roughly recovered within only 1-2 steps. We provide a two-dimensional Tube Model to explain this phenomenon. Based on AAT, we propose a Fast Test-Time Refinement (FTTR) framework for practical and robust LIC systems. We establish that the robustness arises from the contraction of adversarial regions induced by the Input-as-Label property of LIC systems, rather than from obfuscated gradients. Extensive evaluations with diverse strong adaptive attacks across multiple LIC systems demonstrate the promise of the proposed FTTR framework. The code is available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2608.15113v1
- Canonical: https://arxiv.org/abs/2608.15113v1
Trouble viewing inline? Open PDF directly →
Full Text
66,302 characters extracted from source content.
Expand or collapse full text
Fast Test-Time Refinement for Robust Learned Image CompressionDOI: X.XXXXXXXConference: -; August, 2026; ISBN: 978-1-4503-X-X/2018/06CCS: Computing methodologies Learning latent representationsCCS: Computing methodologies ReconstructionCCS: Computing methodologies Image representationsCCS: Security and privacy Software and application security Jiaming Liang OrcID: 0000-0002-2510-9331 Affiliation: University of Macau , Macau , China email: chinaliangjm@gmail.com , Chi-Man Pun OrcID: 0000-0003-1788-3746 Affiliation: University of Macau , Macau , China email: cmpun@um.edu.mo and Weisi Lin OrcID: 0000-0001-9866-1947 Affiliation: Nanyang Technological University , Singapore email: wslin@ntu.edu.sg 2018© , 2018; Figure 1. Reconstruction of examples generated by PGD (budget 16/25516/255, 400400 steps). Original: attack and reconstruction on the same undefended LIC system f. Gray-Box: attack on f and reconstruction by FTTR-equipped f. BPDA and Unroll: white-box adaptive attacks on FTTR-equipped f, with STE approximation and exact gradients, respectively. Example based on DCAE (40).caption Abstract. Learned image compression (LIC) has demonstrated remarkable rate-distortion (RD) performance in benign settings. However, the high representational capacity endowed by deep neural networks (DNNs) comes at the expense of increased adversarial vulnerability. This hinders their adoption as trusted standardized codecs. Recent work has sketched test-time refinement (TTR) as a defense in gray-box scenarios, despite its original purpose of improving benign RD performance. Unfortunately, extensive iterations of TTR incur prohibitive overhead, while the robustness mechanism lacks theoretical understanding. Moreover, TTR has not been evaluated in white-box settings or against attacks beyond ℓ2 _2-bounded rate and untargeted distortion objectives. To bridge these gaps, we present a systematic study. Our study reveals an Asymmetric Adversarial Trajectory (AAT) property in LIC systems: transitioning from adversarial to benign regions is significantly easier than the reverse process, where adversarial examples can often be roughly recovered within only 1–2 steps. We provide a two-dimensional Tube Model to explain this phenomenon. Based on AAT, we propose a Fast Test-Time Refinement (FTTR) framework for practical and robust LIC systems. We establish that the robustness arises from the contraction of adversarial regions induced by the Input-as-Label property of LIC systems, rather than from obfuscated gradients. Extensive evaluations with diverse strong adaptive attacks across multiple LIC systems demonstrate the promise of the proposed FTTR framework. The code is available at https://github.com/chinaliangjiaming/FTTR.git. Keywords: Machine Learning Security, Learned Image Compression, Adversarial Robustness, Test-Time Optimization 1. Introduction Background. Learned image compression (LIC) (5; 6) incorporates deep neural networks (DNNs) to enhance representation capability, significantly reducing compression redundancy and achieving superior rate-distortion (RD) performance (61; 28). However, the inherent high-dimensional vulnerability of DNNs (54; 18) is also inherited by LIC systems, making them more susceptible to adversarial threats than conventional hand-crafted codecs such as JPEG (57), JPEG 2000 (49), HEVC/H.265 (53), and VVC/H.266 (7). Recent studies have demonstrated that imperceptible adversarial perturbations can induce rate collapse (33; 58), reconstruction distortion (58; 29), or even manipulated reconstruction (11; 37), as well as downstream degradation (52) in LIC systems. As a critical component of communication systems, compression requires strong reliability guarantees. In particular, standardized compression systems are expected to fully disclose all technical details, which exposes LIC systems to adversaries (11). Therefore, developing trustworthy LIC systems for secure deployment is imperative. Despite this pressing need, research on robust LIC systems remains limited. One line of research improves the LIC robustness through adversarial training (11; 63; 9; 58; 33). However, in white-box settings, attackers can circumvent such defenses by generating adversarial examples directly against the adversarially trained model (55). Another direction (50; 58) keeps the model structure and parameters fixed, while mitigating adversarial inputs and optimizing latent representations at test time. Among them, static input transformations (50) provide limited protection against attacks under white-box settings, as attackers can generate tailored perturbations by incorporating the transformation into the attack pipeline. In contrast, test-time refinement (TTR) (14), as sketched in (58), provides dynamic protection against adversarial attacks through optimization, showing potential against white-box threats. Specifically, TTR optimizes a purifier at test time via gradient descent based on the RD loss between the reconstructed image and the input image. The purifier directly or indirectly refines the latent and hyper-latent representations, and the optimized representations are then used for storage or transmission. TTR was originally proposed to improve benign RD performance at test time, particularly for domain adaptation scenarios, such as adapting codecs trained on natural images to screen content compression. (58) extends this idea by transferring the framework to adversarial inputs. Benefiting from its dynamic optimization property, TTR has the potential to make LIC systems robust against white-box attacks. Gaps & Challenges. Unfortunately, (58) only sketches TTR as a defense benchmark in the experiments without systematic investigation, leaving several important issues unaddressed. (I) Conventional TTR requires a large number of optimization iterations, each involving backpropagation, making it computationally impractical. (I) The theoretical foundation of TTR as a defense remains unexplored, leaving its robustness mechanism unclear. (I) Existing evaluations of TTR as a defense have been confined to a narrow range of settings. (I-a) (58) considers only a gray-box setting, where TTR is disabled during attack generation and enabled only at test time. As a result, its robustness against white-box adaptive attacks remains unknown, casting doubt on whether the observed robustness stems from genuine effects or obfuscated gradients (4). (I-b) TTR has primarily been evaluated under untargeted distortion and rate collapse attacks, with limited study on more recent threats such as semantic manipulation (37) and downstream task degradation (52). (I-c) TTR has only been evaluated under ℓ2 _2 attacks, lacking a comprehensive assessment under other constraints. Figure 2. Our revealed Asymmetric Adversarial Trajectory (AAT) property of LIC systems: Generating effective adversarial examples against LIC systems requires numerous iterations, whereas their restoration to benign samples can typically be achieved within only 1–2 steps. The illustrated case is based on DCAE (40) and PGD attack (43). Theory & Methodology. To bridge these gaps, we present a systematic study of TTR as an adversarial defense. (I) Our study uncovers an intriguing property of LIC systems, termed Asymmetric Adversarial Trajectory (AAT) (Section 3.3). Specifically, we find that recovering adversarial examples of LIC systems often requires substantially fewer optimization steps than generating them. In most LIC systems, when the refinement strength is sufficient, the recovery process can be reduced to only 1–2 steps, as illustrated in Figure 2. We attribute the AAT property to the loss landscape shaped by the identity mapping property (37) of LIC systems, and further propose a two-dimensional Tube Model (Section 3.3) to explain this phenomenon. Building upon the AAT property, we propose Fast Test-Time Refinement (FTTR) (Section 3.4), an efficient framework of adversarial defense for LIC systems. (I) We theoretically show that TTR provides genuine robustness gains rather than obfuscated gradients. Unlike other deep learning systems, LIC systems possess the Input-as-Label property (Section 3.5), whereby the adversarial example itself acts as the target label during optimization. This unique property enables TTR to minimize the loss for each input, thereby contracting adversarial regions. Based on the AAT property, our FTTR is an efficient variant of TTR that achieves a favorable robustness-efficiency trade-off. (I) We evaluate the robustness of FTTR under a wide range of settings (Section 4). (I-a) Both white-box and gray-box settings are considered. In the white-box setting, we evaluate two strong adaptive attacker assumptions: Unroll (3) and BPDA (4). (I-b) Our experiments cover diverse threats, including untargeted distortion, semantic manipulation, rate collapse, and downstream degradation. (I-c) Furthermore, we comprehensively evaluate the performance against both ℓ2 _2- and ℓ∞ _∞-bounded attacks. Results. Extensive experiments demonstrate that LIC systems equipped with our FTTR achieve strong white-box robustness with high efficiency. Specifically, under a 400-step ℓ∞ _∞ white-box PGD attack with a budget of 16/25516/255, the average PSNR and bpp without FTTR are 9.909.90 dB and 17.9717.97, respectively. In contrast, with 1-step FTTR, the average PSNR increases to 24.58/25.0024.58/25.00 dB (+14.68/15.10+14.68/15.10 dB) under BPDA/Unroll adversaries, while the average bpp decreases to 11.83/11.5711.83/11.57 (−6.14/6.40-6.14/6.40), respectively. Under a 1000-step ℓ2 _2 white-box C&W attack with c=1000c=1000, the average PSNR and bpp without FTTR are 7.597.59 dB and 15.1915.19, respectively. In contrast, with 1-step FTTR, the average PSNR and bpp are 26.7126.71 dB (+19.12+19.12 dB) and 7.587.58 (−7.61-7.61) under the BPDA adversary. Furthermore, under a white-box PGD-based LIC-triggered downstream classification attack with perturbation of 8/2558/255, our FTTR boosts the downstream classification accuracy from 0.4%0.4\% to 28.1%28.1\% (+27.7%+27.7\%). Our contributions can be summarized as follows: • To the best of our knowledge, this is the first systematic study of TTR as an adversarial defense. • We reveal the AAT property of LIC systems, showing that recovering adversarial examples to benign regions requires few steps in most LIC systems. We propose the Tube Model to illuminate this intriguing phenomenon. • Building upon the AAT property, we propose FTTR, an efficient framework for leveraging TTR in adversarial defense. • We theoretically show that the unique Input-as-Label property of LIC systems enables TTR to contract adversarial regions, thereby improving robustness. Our FTTR is an efficient variant of TTR that preserves strong robustness while substantially improving efficiency. • Extensive experiments under diverse settings demonstrate that LIC systems equipped with our FTTR achieve strong robustness efficiently, highlighting its potential. 2. Related Work 2.1. Learned Image Compression LIC follows the transform coding framework, which consists of transform, quantization, and entropy coding. LIC integrates DNNs into the analysis–synthesis transform (5) to improve representation capacity and reduce redundancy, and into entropy modeling to accurately estimate latent distributions (6). Consequently, LIC achieves superior RD performance over conventional handcrafted compression codecs. Efforts to improve LIC models can be broadly grouped into three directions: optimization of the analysis–synthesis architecture (64; 17; 38; 35; 26; 16; 61; 12), quantization (2; 1; 62; 20; 47), and entropy modeling (45; 23; 22; 48; 34; 30; 36; 27; 25). 2.2. Adversarial Threats on LIC Despite the impressive performance of LIC systems in benign settings, their reliance on DNNs makes them inherently susceptible to adversarial attacks. The adversarial threats to LIC systems can be divided as follows. (1) The first category causes rate collapse (39; 11; 60; 58; 33), resulting in a significant increase in storage and transmission overhead. (2) The second category targets reconstruction fidelity. Depending on whether the adversarial reconstruction is manipulated toward a specific outcome, it can be further divided into untargeted reconstruction distortion (11; 60; 42; 51; 58; 33; 29) and semantic manipulation (11; 37). (3) The last is downstream degradation (52), where the adversary seeks to induce downstream task failures by manipulating reconstructions of LIC systems. 2.3. Adversarial Defenses on LIC LIC systems are typically deployed in a white-box setting, where technical details are publicly disclosed and adversaries possess full knowledge of the system. Consequently, white-box robustness is of particular importance for LIC. Unfortunately, efforts to enhance LIC robustness remain scarce. Most existing work (11; 63; 9; 58; 33) focuses on adversarial training (18). They alleviate vulnerability by incorporating adversarial examples during training. However, adversarial training struggles to eliminate adversarial vulnerability. Although it partially patches the vulnerabilities of the original LIC system, adversarial training may inadvertently introduce new vulnerabilities, causing the adversarial region to shift rather than contract. Attackers can then optimize against the adversarially trained model to craft adaptive examples that bypass the defense (55). In contrast, a limited number of studies focus on mitigating adversarial effects through input transformations, thereby projecting adversarial examples back onto the benign data manifold. (50) places a static transformation before the LIC system and an inverse-transformation module after it. By comparing the reconstruction losses of multiple candidate transformation pairs, the method adopts the least-loss reconstruction as the final output. While effective in the black-box setting, the defense can be circumvented by adaptive attacks in the white-box setting, where all candidate transformation pairs are known to the adversary. Unlike this method, (58) pioneers the use of TTR based on the optimization for dynamic defense. 2.4. Test-Time Refinement TTR (14) was originally proposed to improve in-distribution RD performance of LIC systems. Subsequently, TTR was extended to address the degradation of RD performance under distribution shifts, such as when LIC systems trained on natural images are applied to out-of-distribution data including illustrations or screen content images (56; 10). With both the architecture and model parameters fixed, TTR performs iterative test-time optimization on the latent representation (14; 19; 59; 41; 56; 10) and side information (19; 59; 10), thereby obtaining a refined outcome. However, TTR has long been confined to benign settings. (58) were the first to employ TTR as a defense. Unfortunately, TTR was only sketched as a gray-box defense benchmark in the experiments, leaving its potential for adversarial defense largely unexplored. Several critical questions remain unanswered, including the impracticality of multi-step optimization, the lack of a theoretical foundation for its robustness, and the absence of rigorous evaluations against diverse adaptive settings. In this work, we provide a systematic investigation of these issues and address them. Figure 3. Performance of Adam-based TTR over iterations on PGD-generated MSE and bpp adversarial examples for DCAE. X-axis denotes the number of TTR iterations. The right subplot in each case provides a zoomed-in view of the first three TTR iterations. Colors indicate different Adam learning rates. Purifier L2L_2 denotes the ℓ2 _2 norm of the corresponding purifier. 3. Theory and Methodology 3.1. Preliminaries LIC Systems. For theoretical analysis, we abstract LIC systems into a general framework. An LIC system f is composed of an encoder E, a quantizer Q, and a decoder D: (1) f=D∘Q∘E,f=D Q E, where ∘ indicates composition. The encoder E encodes an input image ∼ x X into a latent representation y and a hyper-latent representation z: (2) [,]=E(), [ y, z ]=E ( x ), which are then quantized by decoder Q into y and z for storage and transmission: (3) [^,^]=Q(,).~ [ y, z ]=Q ( y, z ). The decoder D reconstructs the quantized latent representation y into the reconstructed image x: (4) ^=D(^). x=D ( y ). The overall objective ℒL consists of the bitrate ℛR and distortion D, which are balanced via a Lagrange multiplier λ: (5) ℒ=r(^)+r(^)⏟ℛ+λ⋅d(,^)⏟,L= r ( y )+r ( z )_R+λ· d ( x, x )_D, where r measures the bit rate, and d is a distortion measure. Test-Time Refinement. To adapt to the test domain and further improve RD performance, TTR iteratively optimizes y and z via gradient descent on the RD objective at test time, yielding ∗ y^* and ∗ z^* as refined compression representations11 1 Note that r in Equation 5 denotes the actual bit rate measured from the quantized representations during evaluation, whereas r in Equation 6 represents the estimated bit rate used for optimization. : (6) ∗,∗=argminy,zr()+r()+λ⋅d(,^). y^*, z^*= _y,zr ( y )+r ( z )+λ· d ( x, x ). ∗ y^* and ∗ z^* are then quantized by Q for storage and transmission: (7) [^∗,^∗]=Q(∗,∗), [ y^*, z^* ]=Q ( y^*, z^* ), and decoded by D to yield the refined reconstruction ^∗ x^*: (8) ^∗=D(^∗). x^*=D ( y^* ). In this formulation, we do not explicitly define the purifier. Instead, it is implicitly embodied in the optimization process of Equation 6. Specifically, the purifier can transform x into ∗ x^*, thereby producing ∗ y^* and ∗ z^*. Alternatively, it can directly optimize y and z. Consequently, the purifier corresponds to ∗− x^*- x, ∗− y^*- y, and ∗− z^*- z. 3.2. Threat Model The prior study (58) presents TTR as a defense exclusively under a gray-box threat model, where TTR is enabled only at test time and excluded from the attack pipeline. As a result, adaptive attacks are not considered, leaving the robustness against fully informed adversaries unknown. This threat model is unrealistic and inconsistent with Kerckhoffs’s principle (46), since the design of standardized compression codecs is publicly available. Therefore, besides the gray-box threat, we further consider the white-box threat. Let fdf_d denote the LIC system f with an integrated defense. The adversary is assumed to have full knowledge of fdf_d and can thus launch adaptive attacks A∈A . For adaptive adversaries, we consider two attack assumptions, BPDA (4) and Unroll (3). Detailed descriptions are provided in the appendix. The perturbations (9) a=A(fd,) δ_a=A (f_d, x ) are constrained to the input, and the adversarial examples (10) adv=+a x_adv= x+ δ_a are processed by a trusted third party for compression, storage, and transmission. Man-in-the-middle (MITM) attacks are ruled out, preventing the adversary from tampering with the latent and hyper-latent representations. To ensure imperceptibility, perturbations a δ_a are constrained within an ℓp _p norm ball of ϵa _a. In this paper, we consider the two widely studied cases, namely, p=2p=2 and p=∞p=∞. The adversarial objectives considered include compression rate ℛR, distortion D, and downstream-task performance P. 3.3. Asymmetric Adversarial Trajectory of LIC Test-Time Refinement for Adversarial Defense. (58) first introduced TTR as a defense benchmark for experiments. Specifically, they apply an iteratively refined purifier d∗ δ_d^* to adversarial examples adv x_adv for generating purified examples: (11) pur=adv+d∗, x_pur= x_adv+ δ_d^*, where (12) d∗=argmindℒpur, δ_d^*= _ δ_dL_pur, and (13) ℒpur=r(E(adv+d))+λ⋅d(adv,f(adv+d)).L_pur=r (E ( x_adv+ δ_d ) )+λ· d ( x_adv,f ( x_adv+ δ_d ) ). The purifier d∗ δ_d^* is then propagated to indirectly optimize y and z: (14) ∗,∗=E(pur). y^*, z^*=E ( x_pur ). It should be noted that latent and hyper-latent representations exhibit model-dependent scales, especially under adversarial settings, latent optimization may result in unstable updates. In contrast, input images are normalized, and input optimization provides stable parameterization. Therefore, we follow this strategy in this work. Asymmetric Adversarial Trajectory. We begin our discussion with the gray-box threat model. To solve Equation 12, (58) performs gradient descent via Adam (31) with a small learning rate α=0.01α=0.01 over multiple iterations. While numerous iterations are justified when optimizing benign inputs, they are unnecessary for the intent of defense. To illustrate this, we generate the MSE and bpp adversarial examples from kodim04.png in the Kodak (32) by 400400 iterations of PGD with a budget of 16/25516/255 and a step size of 2/2552/255. TTR is then performed for 100100 steps with Adam under different α. DCAE (40) is adopted as the tester. Results are shown in Figure 3. Figure 4. Hypothesized Tube Model for the two-dimensional structure of adversarial regions in LIC systems. From the figure, TTR with Adam under different learning rates α converges to similar performance within 100 steps, indicating that learning rates α have limited impact given sufficient iterations. However, under few-step optimization, learning rates α play a pivotal role for defense. Small α yields stable but slow convergence, whereas large α reaches near-convergent performance within 11–22 steps, albeit with transient instability followed by recovery. Although this observation is based on adv(400) x_adv^(400), extensive experiments find it consistently holds for adversarial examples generated at arbitrary time steps t. Therefore, while generating adversarial examples in LIC systems is strenuous, restoring them to benign samples is remarkably effortless. We refer to this intriguing property of LIC systems as Asymmetric Adversarial Trajectory (AAT). This naturally leads to the following question. (Q1) Why can large α reach near-convergent performance in even a single step? (or Why does AAT exist?) (Q2) Why does the performance subsequently drop sharply before recovering? The answer to (Q2) is relatively straightforward. Adam is designed for iterative convergence and inherently assumes a large number of iterations. Although its first update aligns with the gradient direction (see Equation 15), subsequent updates in the early iterations may deviate from the gradient. As a result, with a large α and low iterations, the optimizer may step in an incorrect direction, leading to degraded performance. Regarding (Q1), we next provide a detailed analysis. Hypothesized Tube Model. When d(0) δ_d^(0) is initialized as 0 and the stability constant ϵ≪|∇dℒpur|ε | _ δ_dL_pur|, the first Adam update reduces to a sign gradient descent step with α (see Appendix for the deduction): (15) d(1)=−α⋅sgn(∇d(0)ℒpur). δ^(1)_d=-α·sgn ( _ δ_d^(0)L_pur ). In other words, at the first TTR iteration, Adam moves an ℓ∞ _∞ distance of α along the negated gradient direction, i.e., away from the adversarial region. Combined with the revealed AAT property of LIC systems, this suggests that for adversarial examples adv(t) x_adv^(t) generated at arbitrary attack steps t, they can escape the adversarial region and return to the benign region via a 1-step sign gradient descent with a sufficiently large α. This indicates that the adversarial region has extremely limited thickness along the negated gradient direction. Otherwise, a single-step update would be insufficient to escape the region if its thickness were large. From a two-dimensional perspective, this analysis suggests that the adversarial region of LIC systems is likely to exhibit a thin, highly curved, and tube-like geometric structure. We refer to this hypothesized two-dimensional geometry of the adversarial region of LIC systems as Tube Model. As illustrated in Figure 4, due to the highly curved geometry of the adversarial region, linear updates of the adversarial perturbation a δ_a fail to reach effective adversarial examples within a few iterations, and instead require numerous small-step updates that progressively follow the loss-increasing trajectory. In contrast, for most points, one or two large-step updates along the negated gradient direction are sufficient to escape the adversarial region, which is consistent with the AAT property revealed above. Moreover, the Tube Model also accounts for the previously observed adversarial behaviors in LIC systems. For example, PGD2-GSM (37) exhibits pronounced oscillations when attacking with large step sizes. This can be attributed to step sizes exceeding the local straight-segment length of the tube-like adversarial region, leading to overshooting into benign regions and consequently inducing oscillatory dynamics. In summary, Tube Model provides a new geometric perspective on the adversarial region of LIC systems. Figure 5. Pipeline of our FTTR for adversarial defense. 3.4. Fast Test-Time Refinement for Defense Therefore, numerous iterations are unnecessary when TTR is deployed for defense purposes. In practice, TTR for defense typically requires only a few iterations, or even a single-step update. Motivated by this insight, we redesign TTR into a lightweight defense framework, termed Fast Test-Time Refinement (FTTR). Algorithm 1 Compression with Fast Test-Time Refinement (FTTR) Input: Adversarial example adv x_adv, LIC system f Parameter: Radius s of purifier d δ_d, iteration number K Output: Optimized ∗ y^* and ∗ z^* 1: Initialize d(0)∼Uniform(−s,s) δ_d^(0) (-s,s) 2: for k=1k=1 to K do 3: (k)=sgn(∇d(k−1)ℒFTTR(k)) g^(k)=sgn ( _ δ_d^(k-1)L_FTTR^(k) ) 4: d(k)=Clip(−s,s)(d(k−1)−s⋅K−sgn(k−1)⋅(k)) δ_d^(k)=Clip_(-s,s) ( δ_d^(k-1)-s· K^-sgn(k-1)· g^(k) ) 5: end for 6: # The following conditional branch is only used in practice to # ensure that benign performance is not degraded. 7: if ℒFTTR(adv,d(K))<ℒFTTR(adv,)L_FTTR( x_adv, δ_d^(K))<L_FTTR( x_adv, 0) then 8: return E(adv+d(K))E ( x_adv+ δ_d^(K) ) 9: else 10: return E(adv)E ( x_adv ) 11: end if FTTR initializes the purifier d(0) δ_d^(0) with uniform noise rather than zeros. This initialization incurs negligible overhead while nudging adversarial examples away from the adversarial region. The purifier is then refined through one or a few optimization steps. The refinement loss follows Equation 13 to jointly optimize multiple objectives. Specifically, to defend against compression rate collapse: (16) ℒBPP(k)=r(E(adv+d(k−1))),L_BPP^(k)=r (E ( x_adv+ δ_d^(k-1) ) ), For reconstruction quality, both the MSE loss: (17) ℒMSE(k)=MSE(f(adv+d(k−1)),adv),L_MSE^(k)=MSE (f ( x_adv+ δ_d^(k-1) ), x_adv ), and the MS-SSIM loss: (18) ℒMS-SSIM(k)=MS-SSIM(f(adv+d(k−1)),adv)L_MS-SSIM^(k)=MS-SSIM (f ( x_adv+ δ_d^(k-1) ), x_adv ) are adopted. When the refinement additionally aims to defend downstream attacks, an extra term: (19) ℒopt(k)=J(adv,d(k−1))L_opt^(k)=J ( x_adv, δ_d^(k-1) ) is incorporated, where J is the criterion of the downstream task. Accordingly, the kthk^th-step iterative objective is summarized as: (20) ℒFTTR(k)=ℒBPP(k)+λ1⋅ℒMSE(k)−λ2⋅ℒMS-SSIM(k)+λ3⋅ℒopt(k).L_FTTR^(k)=L_BPP^(k)+ _1·L_MSE^(k)- _2·L_MS-SSIM^(k)+ _3·L_opt^(k). To prevent excessive distortion, the purifier is constrained within an ℓ∞ _∞ ball of radius s. The first optimization step performs gradient descent along the negated sign gradient direction with step size s. Owing to the AAT property of LIC systems, this single large-step update is sufficient in most cases. When iteration K>1K>1, subsequent steps continue with a reduced step size of s/Ks/K. The complete procedure is summarized in Algorithm 1, while the overall pipeline is illustrated in Figure 5. 3.5. White-Box Robustness Mechanism The preceding analysis focuses on the gray-box setting, where refinement is disabled during attacks but enabled at test time. As discussed in Section 3.2, white-box robustness is crucial for LIC systems. Therefore, we further examine the white-box robustness. For most deep learning tasks, achieving white-box robustness remains challenging, because the groundtruth of adversarial examples are inaccessible. For instance, in classification systems, an image of dog may be perturbed to be misclassified as kangaroo. The defender has no access to its true label dog, making recovery to a benign state intractable. Consequently, existing defenses rely on transformations, adversarial training, or related techniques to alleviate adversarial effects. Unfortunately, while they mitigate the original adversarial vulnerabilities, they often introduce new ones. In other words, they merely induce a shift of the adversarial region, rather than shrinking or eliminating it, which lies at the heart of the difficulty in achieving white-box robustness. Figure 6. Illustrations on the shift and contraction of adversarial regions. TTR leverages the Input-as-Label to contract the adversarial region, enhancing white-box robustness. Figure 7. PSNR (dB) of PGD-attacked reconstructions under MSE. X-axis indicates perturbation budgets. w/o: attack/inference on undefended f. Noise: attack on undefended f, inference with noisy input. Gray-box: attack on undefended f, inference with FTTR. BPDA/Unroll: attack/inference with FTTR (see Appendix for details). The same notation applies hereafter. Figure 8. bpp of PGD-attacked reconstructions under bpp. Figure 9. PSNR and bpp of C&W-attacked reconstructions under joint MSE and bpp. Order of (a)-(e) follows Figure 7. Figure 10. Classification accuracy (%) of LIC-triggered downstream attacks. In contrast, LIC systems differ fundamentally from them. Under the control of a trusted third party over compression, storage, and transmission, the ground truth for any adversarial example is inherently available, since the reconstruction target is the adversarial example itself. We refer to this as the Input-as-Label property of LIC systems. TTR can serve as a white-box defense precisely because it exploits the Input-as-Label property of LIC systems. With an unlimited number of iterations, it is easy to see that TTR ensures that the loss can be reduced for any adversarial example, or at least remains non-increasing (because the trivial solution can be d∗=0 δ_d^*=0): (21) ∀adv,ℒ(adv+d∗)≤ℒ(adv).∀ x_adv, ( x_adv+ δ_d^* ) ( x_adv ). Equation 21 implies that TTR can be viewed as a mapping acting on the LIC system f that never increases the loss. As illustrated in Figure 6(b), each sample either preserves its loss or moves to a lower-loss state. Therefore, the adversarial region is contracted rather than shifted. This indicates that TTR improves the intrinsic robustness of the LIC system, rather than creating an illusion. Our FTTR is an efficient approximation of TTR. Benefiting from the revealed AAT property, extensive empirical results show that Equation 21 holds for most adversarial examples. However, since FTTR typically adopts a relatively large strength s, it may introduce excessive perturbations. When the adversarial perturbation is small, the negative effects introduced by FTTR may outweigh its benefits. Moreover, for similar reasons, FTTR may degrade benign performance. Therefore, we introduce a conditional branch to determine whether the purifier generated by FTTR provides a gain. If not, we set d(K)=0 δ_d^(K)=0, as shown in Algorithm 1. This ensures that Equation 21 also holds for FTTR. To clearly present the intrinsic robustness of FTTR, we disable this conditional branch in our experiments and evaluate the iteratively optimized purifier. In summary, this section theoretically established the white-box robustness mechanisms of TTR and our FTTR. The following extensive experiments will empirically validate them. 4. Experiments and Results 4.1. Setup LIC systems. We evaluate our FTTR across multiple representative LIC systems. Specifically, for untargeted distortion attacks, bitrate collapse attacks, and downstream degradation attacks, we evaluate on two advanced LIC systems DCAE (40) and CCA (21), and three classical models cheng2020-Attn (13), bmshj2018-hyperprior (6), and mbt2018 (44). For global semantic manipulation, following (37), we evaluate on DCAE, CCA, and HiFi-VRIC (8). Datasets. Experiments are conducted on Kodak dataset (32), a standard benchmark for compression, which contains 2424 RGB images of 512×768512× 768. For the downstream task of classification, we use the NIPS 2017 Adversarial Competition dataset 22 2 https://github.com/anlthms/nips-2017.git. Comprehensive Adversary Benchmarks. Prior study (58) evaluates only under the gray-box setting. In contrast, we establish a suite of adaptive adversary benchmarks to evaluate the white-box robustness, including BPDA (4) and Unroll (3). BPDA performs standard forward propagation through FTTR but approximates FTTR as an identity mapping during backpropagation, enabling efficient perturbation generation with approximate gradients. In contrast, Unroll explicitly unfolds the optimization process to obtain exact gradients, but incurs substantial computational overhead due to second-order gradients. More details are provided in the appendix. Besides, we also evaluate FTTR under the gray-box setting. Implementations. We set λ1 _1= 10310^3, λ2 _2=5050, s=0.040.04. Except for downstream defenses, λ3 _3 is 00. We adopt 1-step FTTR with K=11. Metrics. For reconstruction quality, we use pixel-level PSNR (dB), structural-level MS-SSIM, and semantic-level LPIPS and CLIP. For compression rate, we use bpp. Note that adversarial examples may cause excessively large bpp, making exact computation infeasible within a reasonable time. Therefore, we report the estimated bpp. For classification tasks, we use top-1 accuracy (%). 4.2. To ℓ∞ _∞ Untargeted Distortion Attacks This experiment evaluates the robustness of FTTR against ℓ∞ _∞ untargeted distortion attacks based on PGD, where the attack objective is the MSE loss. We compare five settings: (1) w/o: both attack and inference are performed on the undefended LIC system f. (2) Noise: the attack is performed on f, while uniform noise with strength 0.04 is added before inference on f. (3) Gray-Box: the attack is performed on f, while inference is performed on the FTTR-equipped LIC system fFTTRf_FTTR. (4) BPDA: adaptive white-box attacks are generated against fFTTRf_FTTR using BPDA, followed by inference on fFTTRf_FTTR. (5) Unroll: adaptive white-box attacks are generated against fFTTRf_FTTR using Unroll, followed by inference on fFTTRf_FTTR. The same protocol is used hereafter and is omitted for brevity. We generate adversarial examples with iterations T=400T=400, budgets ϵ∈6,8,10,12,14,16/255ε∈\6,8,10,12,14,16\/255, and step size ϵ/Tε/T. The PSNR results are reported in Figure 7, with MS-SSIM, LPIPS, and CLIP in the Figure 12. The visualizations are in the Figure 13. At ϵ=16/255ε=16/255, the w/o setting yields an average PSNR of only 9.909.90 dB, while the FTTR-equipped models maintain 24.58(+14.68)24.58(+14.68) dB and 25.00(+15.10)25.00(+15.10) dB under adaptive white-box BPDA and Unroll, respectively. These results demonstrate strong white- and gray-box robustness of FTTR against ℓ∞ _∞ MSE attacks. 4.3. To ℓ∞ _∞ Compression Rate Attacks This experiment evaluates the robustness of FTTR against ℓ∞ _∞ compression rate attacks based on PGD, where the attack objective is the bpp loss. Experimental settings follow Section 4.2. Results in Figure 8 demonstrate that FTTR achieves large robustness gains against ℓ∞ _∞ compression rate attacks. On average, at ϵ=16/255ε=16/255, FTTR reduces the bpp from 17.9717.97 in the w/o setting to 11.83(−6.14)11.83(-6.14) under BPDA and 11.57(−6.40)11.57(-6.40) under Unroll. The robustness gains vary across LIC systems. Remarkably, for DCAE, the bpp is reduced from 14.29 to 1.102 under BPDA and 1.27 under Unroll. This indicates that certain LIC models can achieve more substantial robustness improvements when combined with FTTR, highlighting the potential of FTTR for trustworthy standardized LIC systems. Table 1. Reconstruction performance on adversarial examples for high-resolution global semantic manipulation. FTTR denotes the Gray-Box. The best values are shown in bold. PSNR ↑ MS-SSIM ↑ LPIPS ↓ CLIP ↑ bpp ↓ DCAE w/o 12.970 0.403 0.687 0.724 1.312 Noise 19.146 0.593 0.658 0.830 0.291 FTTR 21.698 0.717 0.615 0.871 0.141 CCA w/o 15.704 0.579 0.380 0.786 4.084 Noise 21.536 0.834 0.180 0.940 3.746 FTTR 24.415 0.912 0.076 0.980 1.970 HiFi-VRIC w/o 12.635 0.390 0.687 0.626 11.148 Noise 16.464 0.618 0.530 0.748 9.718 FTTR 24.002 0.901 0.092 0.982 6.240 4.4. To ℓ2 _2 Joint Rate-Distortion Attacks We further evaluate FTTR against ℓ2 _2 joint R-D attacks based on C&W attack, where the objective is: (22) max−‖a‖2+c⋅[c1⋅r(E(adv))+c2⋅MSE(f(adv),)]. -\| δ_a\|_2+c· [c_1· r (E ( x_adv ) )+c_2·MSE (f ( x_adv ), x ) ]. c1c_1 and c2c_2 are set to 11 and 500500, respectively. Unlike the standard C&W attack, we fix three representative c of 500,750,1000500,750,1000. The attack uses Adam with a learning rate of 10−310^-3 for 10001000 iterations. Results in Figure 9 and visualizations in Figure 14 demonstrate the robustness against ℓ2 _2 attacks. At c=1000c=1000, on average, PSNR improves from 7.597.59 dB in the w/o setting to 26.71(+19.12)26.71(+19.12) dB under BPDA, while bpp decreases from 15.1915.19 to 7.58(−7.61)7.58(-7.61). Figure 11. Adversarial examples and reconstructions under global semantic manipulation. FTTR denotes the Gray-Box. 4.5. To Global Semantic Manipulations Beyond conventional attacks, we evaluate FTTR against the emerging global semantic manipulation (GSM). We use PGD2-GSM (37) with ϵ=0.10ε=0.10, while keeping other settings the same as the original paper. Since GSM typically requires tens of thousands of iterations, we only consider the gray-box threat setting here. Quantitative results in Table 1 and visualizations in Figure 11 demonstrate that FTTR effectively resists this challenging attack. 4.6. To LIC-Triggered Downstream Attacks We further evaluate FTTR against LIC-triggered downstream classification attacks, which generate adversarial examples that remain benign before LIC processing but cause downstream failures after compression and decompression. The attack is PGD with budget 8/2558/255, step size 1/2551/255 and iterations 4040. The classification models include ResNet-50 (24) and ViT-B/16 (15). The FTTR strength s is varied from 0.010.01 to 0.060.06 with an interval of 0.010.01. The classification loss is the cross-entropy loss, with λ3 _3 set to 11. Results in Figure 10 demonstrate that FTTR substantially improves robustness against LIC-triggered downstream attacks. At s=0.06s=0.06, our FTTR boosts the average downstream classification accuracy from 0.4%0.4\% under w/o setting to 28.1%(+27.7%)28.1\%(+27.7\%) under BPDA setting. 5. Conclusions and Limitations Existing robustness studies on LIC focus on gray-box setting, while the white-box robustness of LIC systems remains unexplored. This work presents the first systematic study on the potential of TTR as a white-box defense. We reveal the Asymmetric Adversarial Trajectory (AAT) property of LIC systems that TTR does not require numerous iterations when used for defense purposes. For most LIC systems, a few steps are sufficient. We explain this phenomenon through the hypothesized Tube Model and propose the Fast Test-Time Refinement (FTTR) framework for practical defense deployment. Our analysis shows that TTR and FTTR exploit the Input-as-Label property of LIC systems to contract the adversarial region rather than shift it, leading to genuine robustness improvements. Even with only 1-step FTTR, our experiments demonstrate remarkable white-box robustness gains under various threats. Further optimization of FTTR, such as adaptive strength control, remains an interesting and promising direction for future research. References Agustsson and Theis (2020) E. Agustsson and L. Theis Universally quantized neural compression. Advances in neural information processing systems 33, p. 12367–12376. Cited by: §2.1. Alexandre et al. (2019) D. Alexandre, C. Chang, W. Peng, and H. Hang Learned image compression with soft bit-based rate-distortion optimization. In 2019 IEEE International Conference on Image Processing (ICIP), p. 1715–1719. Cited by: §2.1. Andrychowicz et al. (2016) M. Andrychowicz, M. Denil, S. Gomez, M. W. Hoffman, D. Pfau, T. Schaul, B. Shillingford, and N. De Freitas Learning to learn by gradient descent by gradient descent. Advances in neural information processing systems 29. Cited by: §B.1, §1, §3.2, §4.1. Athalye et al. (2018) A. Athalye, N. Carlini, and D. Wagner Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. In International conference on machine learning, p. 274–283. Cited by: §B.1, §1, §1, §3.2, §4.1. Ballé et al. (2017) J. Ballé, V. Laparra, and E. P. Simoncelli End-to-end optimized image compression. In International Conference on Learning Representations, Cited by: §1, §2.1. Ballé et al. (2018) J. Ballé, D. Minnen, S. Singh, S. J. Hwang, and N. Johnston Variational image compression with a scale hyperprior. In International Conference on Learning Representations, Cited by: §1, §2.1, §4.1. Bross et al. (2021) B. Bross, Y. Wang, Y. Ye, S. Liu, J. Chen, G. J. Sullivan, and J. Ohm Overview of the versatile video coding (vvc) standard and its applications. IEEE Transactions on Circuits and Systems for Video Technology 31 (10), p. 3736–3764. Cited by: §1. Cai et al. (2022) S. Cai, Z. Zhang, L. Chen, L. Yan, S. Zhong, and X. Zou High-fidelity variable-rate image compression via invertible activation transformation. In Proceedings of the 30th ACM International Conference on Multimedia, p. 2021–2031. Cited by: §4.1. Cao et al. (2024) Z. Cao, Y. Bao, F. Meng, C. Li, W. Tan, G. Wang, and Y. Liang Enhancing adversarial training with prior knowledge distillation for robust image compression. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), p. 3430–3434. Cited by: §1, §2.3. Chen et al. (2025) K. Chen, P. Zhang, T. Qin, S. Wang, H. Yan, and H. Li Test-time adaptation for image compression with distribution regularization. In International Conference on Learning Representations, Vol. 2025, p. 95215–95232. Cited by: §2.4. Chen and Ma (2023) T. Chen and Z. Ma Toward robust neural image compression: adversarial attack and model finetuning. IEEE Transactions on Circuits and Systems for Video Technology 33 (12), p. 7842–7856. Cited by: §1, §1, §2.2, §2.3. Chen et al. (2026) Y. Chen, B. He, Z. Lyu, H. Hu, Q. Gu, Y. Tian, and G. Lu Adaptive learned image compression with graph neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 12150–12161. Cited by: §2.1. Cheng et al. (2020) Z. Cheng, H. Sun, M. Takeuchi, and J. Katto Learned image compression with discretized gaussian mixture likelihoods and attention modules. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 7939–7948. Cited by: §4.1. Djelouah and Schroers (2019) J. Djelouah and C. Schroers Content adaptive optimization for neural image compression. In Proc. IEEE Comput. Soc. Conf. Comput. Vis. Pattern Recognit, Vol. 2, p. 1–5. Cited by: §1, §2.4. Dosovitskiy et al. (2020) A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, et al. An image is worth 16x16 words: transformers for image recognition at scale. arXiv preprint arXiv:2010.11929. Cited by: §4.6. Feng et al. (2025) D. Feng, Z. Cheng, S. Wang, R. Wu, H. Hu, G. Lu, and L. Song Linear attention modeling for learned image compression. In Proceedings of the Computer Vision and Pattern Recognition Conference, p. 7623–7632. Cited by: §2.1. Feng et al. (2023) R. Feng, Z. Guo, W. Li, and Z. Chen Nvtc: nonlinear vector transform coding. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 6101–6110. Cited by: §2.1. Goodfellow et al. (2015) I. J. Goodfellow, J. Shlens, and C. Szegedy Explaining and harnessing adversarial examples. In International Conference on Learning Representations, Cited by: §1, §2.3. Guo et al. (2020) T. Guo, J. Wang, Z. Cui, Y. Feng, Y. Ge, and B. Bai Variable rate image compression with content adaptive optimization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, p. 122–123. Cited by: §2.4. Guo et al. (2021) Z. Guo, Z. Zhang, R. Feng, and Z. Chen Soft then hard: rethinking the quantization in neural image compression. In International Conference on Machine Learning, p. 3920–3929. Cited by: §2.1. Han et al. (2024) M. Han, S. Jiang, S. Li, X. Deng, M. Xu, C. Zhu, and S. Gu Causal context adjustment loss for learned image compression. Advances in Neural Information Processing Systems 37, p. 133231–133253. Cited by: §4.1. He et al. (2022) D. He, Z. Yang, W. Peng, R. Ma, H. Qin, and Y. Wang Elic: efficient learned image compression with unevenly grouped space-channel contextual adaptive coding. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 5718–5727. Cited by: §2.1. He et al. (2021) D. He, Y. Zheng, B. Sun, Y. Wang, and H. Qin Checkerboard context model for efficient learned image compression. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 14771–14780. Cited by: §2.1. He et al. (2016) K. He, X. Zhang, S. Ren, and J. Sun Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, p. 770–778. Cited by: §4.6. He et al. (2026) Q. He, Y. Li, Y. Jiang, H. Zhang, L. Li, and D. Liu Practical image compression with energy-guided asymmetric entropy modeling. In 2026 Data Compression Conference (DCC), p. 292–301. Cited by: §2.1. Jiang et al. (2024) W. Jiang, P. Ning, J. Yang, Y. Zhai, F. Gao, and R. Wang Llic: large receptive field transform coding with adaptive weights for learned image compression. IEEE Transactions on Multimedia 26, p. 10937–10951. Cited by: §2.1. Jiang et al. (2025) W. Jiang, J. Yang, Y. Zhai, F. Gao, and R. Wang MLIC++: linear complexity multi-reference entropy modeling for learned image compression. ACM Transactions on Multimedia Computing, Communications and Applications 21 (5), p. 1–25. Cited by: §2.1. Jiang et al. (2026) W. Jiang, Y. Zhai, J. Yang, F. Gao, and R. Wang Mlicv2: enhanced multi-reference entropy modeling for learned image compression. ACM Transactions on Multimedia Computing, Communications and Applications 22 (4), p. 1–23. Cited by: §1. Kalmykov et al. (2026) N. I. Kalmykov, R. Dibo, K. Shen, X. Zhonghan, A. Phan, Y. Liu, and I. Oseledets T-mla: a targeted multiscale log–exponential attack framework for neural image compression. Information Sciences, p. 123143. Cited by: §1, §2.2. Kim et al. (2024) J. Kim, S. Kim, W. Lee, and D. Oh Diversify, contextualize, and adapt: efficient entropy modeling for neural image codec. Advances in Neural Information Processing Systems 37, p. 45956–45974. Cited by: §2.1. Kingma and Ba (2015) D. P. Kingma and J. Ba Adam: a method for stochastic optimization. In International Conference on Learning Representations, Cited by: §A.1, §3.3. Kodak (1993) E. Kodak Kodak lossless true color image suite (photocd pcd0992). External Links: Link Cited by: §3.3, §4.1. Kurihara and Sun (2025) J. Kurihara and H. Sun Efficient adversarial attack and training on learned image compression. In 2025 Asia Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), p. 2453–2458. Cited by: §1, §1, §2.2, §2.3. Li et al. (2024a) C. Li, S. Yin, C. Jia, F. Meng, Y. Tian, and Y. Liang Multirate progressive entropy model for learned image compression. IEEE Transactions on Circuits and Systems for Video Technology 34 (8), p. 7725–7741. Cited by: §2.1. Li et al. (2024b) H. Li, S. Li, W. Dai, C. Li, J. Zou, and H. Xiong Frequency-aware transformer for learned image compression. In International Conference on Learning Representations, Cited by: §2.1. Li et al. (2025) Y. Li, H. Zhang, L. Li, and D. Liu Learned image compression with hierarchical progressive context modeling. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 18834–18843. Cited by: §2.1. Liang et al. (2026) J. Liang, C. Pun, W. Lin, and G. S. P. Mok Control your view: high-resolution global semantic manipulation in learned image compression. arXiv preprint arXiv:2605.08727. Cited by: §1, §1, §1, §2.2, §3.3, §4.1, §4.5. Liu et al. (2023a) J. Liu, H. Sun, and J. Katto Learned image compression with mixed transformer-cnn architectures. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 14388–14397. Cited by: §2.1. Liu et al. (2023b) K. Liu, D. Wu, Y. Wu, Y. Wang, D. Feng, B. Tan, and S. Garg Manipulation attacks on learned image compression. IEEE Transactions on Artificial Intelligence 5 (6), p. 3083–3097. Cited by: §2.2. Lu et al. (2025) J. Lu, L. Zhang, X. Zhou, M. Li, W. Li, and S. Gu Learned image compression with dictionary-based entropy model. In Proceedings of the Computer Vision and Pattern Recognition Conference, p. 12850–12859. Cited by: Figure 1, Figure 2, §3.3, §4.1. Lv et al. (2023) Y. Lv, J. Xiang, J. Zhang, W. Yang, X. Han, and W. Yang Dynamic low-rank instance adaptation for universal neural image compression. In Proceedings of the 31st ACM International Conference on Multimedia, p. 632–642. Cited by: §2.4. Ma and Wang (2024) J. Ma and R. Wang An imperceptible adversarial attack against reconstruction for learned image compression. In 2024 Data Compression Conference (DCC), p. 573–573. Cited by: §2.2. Madry et al. (2018) A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, Cited by: Figure 2. Minnen et al. (2018) D. Minnen, J. Ballé, and G. D. Toderici Joint autoregressive and hierarchical priors for learned image compression. Advances in neural information processing systems 31. Cited by: §4.1. Minnen and Singh (2020) D. Minnen and S. Singh Channel-wise autoregressive entropy models for learned image compression. In 2020 IEEE International Conference on Image Processing (ICIP), p. 3339–3343. Cited by: §2.1. Petitcolas (2025) F. A. Petitcolas Kerckhoffs’ principle. In Encyclopedia of Cryptography, Security and Privacy, p. 1342–1343. Cited by: §3.2. Presta et al. (2025) A. Presta, E. Tartaglione, A. Fiandrotti, and M. Grangetto Stanh: parametric quantization for variable rate learned image compression. IEEE Transactions on Image Processing 34, p. 639–651. Cited by: §2.1. Qian et al. (2022) Y. Qian, M. Lin, X. Sun, Z. Tan, and R. Jin Entroformer: a transformer-based entropy model for learned image compression. In International Conference on Learning Representations, Cited by: §2.1. Skodras et al. (2002) A. Skodras, C. Christopoulos, and T. Ebrahimi The jpeg 2000 still image compression standard. IEEE Signal processing magazine 18 (5), p. 36–58. Cited by: §1. Song et al. (2024) M. Song, J. Choi, and B. Han A training-free defense framework for robust learned image compression. arXiv preprint arXiv:2401.11902. Cited by: §1, §2.3. Sui et al. (2024a) Y. Sui, Z. Li, D. Ding, X. Pan, X. Xu, S. Liu, and Z. Chen Reconstruction distortion of learned image compression with imperceptible perturbations. In 2024 Data Compression Conference (DCC), p. 583–583. Cited by: §2.2. Sui et al. (2024b) Y. Sui, Z. Li, D. Ding, X. Pan, X. Xu, S. Liu, and Z. Chen Transferable learned image compression-resistant adversarial perturbations. In 2024 Data Compression Conference (DCC), p. 582–582. Cited by: §1, §1, §2.2. Sullivan et al. (2012) G. J. Sullivan, J. Ohm, W. Han, and T. Wiegand Overview of the high efficiency video coding (hevc) standard. IEEE Transactions on circuits and systems for video technology 22 (12), p. 1649–1668. Cited by: §1. Szegedy et al. (2013) C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199. Cited by: §1. Tramer et al. (2020) F. Tramer, N. Carlini, W. Brendel, and A. Madry On adaptive attacks to adversarial example defenses. Advances in neural information processing systems 33, p. 1633–1645. Cited by: §1, §2.3. Tsubota et al. (2023) K. Tsubota, H. Akutsu, and K. Aizawa Universal deep image compression via content-adaptive optimization with adapters. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, p. 2529–2538. Cited by: §2.4. Wallace (1991) G. K. Wallace The jpeg still picture compression standard. Communications of the ACM 34 (4), p. 30–44. Cited by: §1. Wu et al. (2025) C. Wu, Q. Wu, H. Wei, L. Wang, F. Meng, K. N. Ngan, L. Zhuo, and H. Li On the adversarial robustness of learning-based image compression against rate-distortion attacks. IEEE Transactions on Multimedia. Cited by: §1, §1, §1, §1, §2.2, §2.3, §2.3, §2.4, §3.2, §3.3, §3.3, §4.1. Yang et al. (2020) Y. Yang, R. Bamler, and S. Mandt Improving inference for neural image compression. Advances in Neural Information Processing Systems 33, p. 573–584. Cited by: §2.4. Yu et al. (2023) Y. Yu, Y. Wang, W. Yang, S. Lu, Y. Tan, and A. C. Kot Backdoor attacks against deep image compression via adaptive frequency trigger. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 12250–12259. Cited by: §2.2. Zhang et al. (2026) Y. Zhang, Y. Huang, and F. Zhu QARV++: an improved hierarchical vae for learned image compression. IEEE Transactions on Circuits and Systems for Video Technology. Cited by: §1, §2.1. Zhou et al. (2020) J. Zhou, A. Nakagawa, K. Kato, S. Wen, K. Kazui, and Z. Tan Variable rate image compression method with dead-zone quantizer. In Proceedings of the IEEE/cvf conference on computer vision and pattern recognition workshops, p. 162–163. Cited by: §2.1. Zhu et al. (2024) T. Zhu, H. Sun, X. Xiong, X. Zhu, Y. Gong, Y. Fan, et al. Attack and defense analysis of learned image compression. arXiv preprint arXiv:2401.10345. Cited by: §1, §2.3. Zou et al. (2022) R. Zou, C. Song, and Z. Zhang The devil is in the details: window-based attention for image compression. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 17492–17501. Cited by: §2.1. Appendix A Proofs A.1. Deduction of Equation 15 We follow the notations of the original Adam (31) paper and do not repeat the definitions here. In particular, the variable being optimized is the purifier d δ_d rather than the model parameters θ. The parameters are initialized as in the original Adam paper: (23) 0=,0=. m_0= 0,~ v_0= 0. The gradient at time step k is: (24) k=∇d(k−1)ℒpur. g_k= _ δ_d^(k-1)L_pur. At time step k, Adam updates the purifier d(k) δ_d^(k) as follows: (25) k=β1⋅k−1+(1−β1)⋅k,^k=k1−β1k, m_k= _1· m_k-1+(1- _1)· g_k,~ m_k= m_k1- _1^k, (26) k=β2⋅k−1+(1−β2)⋅k2,^k=k1−β2k, v_k= _2· v_k-1+(1- _2)· g_k^2,~ v_k= v_k1- _2^k, (27) d(k)=d(k−1)−α⋅^k^k+ϵ. δ_d^(k)= δ_d^(k-1)-α· m_k v_k+ε. By setting k=1k=1, we obtain: (28) 1=(1−β1)⋅1,^1=1, m_1=(1- _1)· g_1,~ m_1= g_1, (29) 1=(1−β2)⋅12,^1=12, v_1=(1- _2)· g_1^2,~ v_1= g_1^2, (30) d(1)=d(0)−α⋅1|1|+ϵ. δ_d^(1)= δ_d^(0)-α· g_1| g_1|+ε. Given d(0)= δ_d^(0)= 0 and ϵ≪|∇dℒpur|ε | _ δ_dL_pur|, it follows that: (31) d(1)=−α⋅sgn(1). δ_d^(1)=-α·sgn( g_1). Appendix B Supplementary Experiments B.1. Details of Adversary Benchmarks Unroll. In white-box scenarios, FTTR can be viewed as a standalone defense module preceding LIC system f: (32) fd=f∘FTTR. f_d=f . For a sample x and t-moment perturbation a(t) δ_a^(t), the attacker performs gradient ascent to optimize it: (33) a(t+1)=a(t)+α⋅∇a(t)ℒ(fd(+a(t)),). δ_a^(t+1)= δ_a^(t)+α· _ δ_a^(t)L(f_d( x+ δ_a^(t)), x). We expand the gradient in Equation 33 as follows: (34) ∇a(t)ℒ(fd(+a(t)),) _ δ_a^(t)L (f_d ( x+ δ_a^(t) ), x ) = = ∇a(t)ℒ(f(FTTR(+a(t))),) _ δ_a^(t)L (f (FTTR ( x+ δ_a^(t) ) ), x ) = = ∇a(t)ℒ(f(+a(t)+d(K)),) _ δ_a^(t)L (f ( x+ δ_a^(t)+ δ_d^(K) ), x ) = = ∂ℒ∂f⋅∂f∂(+a(t)+d(K))⋅∂(+a(t)+d(K))∂a(t) ∂ f· ∂ f∂ ( x+ δ_a^(t)+ δ_d^(K) )· ∂ ( x+ δ_a^(t)+ δ_d^(K) )∂ δ_a^(t) = = ∂ℒ∂f⋅∂f∂(+a(t)+d(K))⋅(+∂d(K)∂a(t)). ∂ f· ∂ f∂ ( x+ δ_a^(t)+ δ_d^(K) )· ( I+ ∂ δ^(K)_d∂ δ^(t)_a ). According to Algorithm 1, d(K) δ^(K)_d is obtained through an iterative optimization process with respect to a(t) δ^(t)_a. In our experiments, K=1K=1, and thus we have: (35) d(1)=Clip(−s,s)(d(0)−s⋅sgn(∇d(0)ℒFTTR(1))). δ_d^(1)=Clip_(-s,s) ( δ_d^(0)-s·sgn ( _ δ_d^(0)L_FTTR^(1) ) ). In our experiments, we adopt the straight-through estimation (STE) for Clip(⋅)Clip(·) and sgn(⋅)sgn(·) by assuming their gradients are identity mappings. Therefore, the partial derivative of d(1) δ_d^(1) with respect to a(t) δ_a^(t) is: (36) ∂d(1)∂a(t)=−s⋅∂a(t)(∇d(0)ℒFTTR(1)). ∂ δ_d^(1)∂ δ_a^(t)=-s· ∂ δ_a^(t) ( _ δ_d^(0)L_FTTR^(1) ). Equation 36, i.e., the second term inside the last summation parentheses in Equation 34, requires second-order derivatives. This is computationally expensive in practice. We implement the second-order derivatives using the PyTorch framework, where they are internally computed via Hessian-vector products (HVPs). This procedure is commonly referred to as unrolled optimization in previous literature (3). It represents a strong adaptive white-box attack against FTTR, as it obtains the complete gradient information through the defense module. Although this process is computationally complex, we still evaluate FTTR against this strong adversary as a benchmark in this work. BPDA. As unrolling incurs substantial computational overhead, we further explore BPDA (4) as a more efficient alternative. Specifically, BPDA approximates the backward pass of FTTR with an identity mapping while preserving its original forward computation. Consequently, the attack gradient is approximated as: (37) ∇a(t)ℒ(f(FTTR(+a(t))),) _ δ_a^(t)L (f (FTTR ( x+ δ_a^(t) ) ), x ) = = ∂ℒ∂f⋅∂f∂FTTR⋅∂FTTR∂(+a(t)) ∂ f· ∂ f · ∂ ( x+ δ_a^(t) ) ≈ ≈ ∂ℒ∂f⋅∂f∂FTTR⋅, ∂ f· ∂ f · I, thereby bypassing the expensive second-order derivatives required by unrolled optimization. Although BPDA provides only an approximate gradient, it has been widely adopted for evaluating defenses involving non-differentiable or iterative modules. In this work, we evaluate FTTR against both Unroll and BPDA to provide a comprehensive assessment under adaptive white-box attacks. Gray-Box Adversary Benchmarks. For gray-box adversary benchmarks, the attacker crafts adversarial examples based solely on the undefended LIC system f, i.e., (38) a=A(f,). δ_a=A (f, x ). Figure 12. MS-SSIM ↑ , LPIPS ↓ , and CLIP ↑ of PGD-attacked reconstructions under MSE. X-axis indicates perturbation budgets. Figure 13. Visualizations of PGD-attacked adversarial examples and their reconstructions under MSE on DCAE. Example indicates adversarial examples. Rec indicates reconstructions. Figure 14. Visualizations of ℓ2 _2 C&W-attacked adversarial examples and their reconstructions under joint objective of MSE and bpp on DCAE. Example indicates adversarial examples. Rec indicates reconstructions.