{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T17:30:37Z","timestamp":1783791037958,"version":"3.55.0"},"reference-count":82,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T00:00:00Z","timestamp":1740787200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T00:00:00Z","timestamp":1740787200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T00:00:00Z","timestamp":1740787200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"NTU-PKU Joint Research Institute"},{"name":"Program of Beijing Municipal Science and Technology Commission Foundation","award":["Z241100003524010"],"award-info":[{"award-number":["Z241100003524010"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62088102"],"award-info":[{"award-number":["62088102"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Basic and Frontier Research Project of PCL"},{"name":"Major Key Project of PCL"},{"DOI":"10.13039\/501100021171","name":"Basic and Applied Basic Research Foundation of Guangdong Province","doi-asserted-by":"publisher","award":["2024A1515010454"],"award-info":[{"award-number":["2024A1515010454"]}],"id":[{"id":"10.13039\/501100021171","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2025,3]]},"DOI":"10.1109\/tpami.2024.3507873","type":"journal-article","created":{"date-parts":[[2024,11,28]],"date-time":"2024-11-28T18:53:07Z","timestamp":1732819987000},"page":"1674-1693","source":"Crossref","is-referenced-by-count":8,"title":["Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Prior"],"prefix":"10.1109","volume":"47","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2730-9553","authenticated-orcid":false,"given":"Yi","family":"Yu","sequence":"first","affiliation":[{"name":"Rapid-Rich Object Search (ROSE) Lab, Interdisciplinary Graduate Programme, Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yufei","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1692-0069","authenticated-orcid":false,"given":"Wenhan","family":"Yang","sequence":"additional","affiliation":[{"name":"Pengcheng Laboratory, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lanqing","family":"Guo","sequence":"additional","affiliation":[{"name":"School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6766-2506","authenticated-orcid":false,"given":"Shijian","family":"Lu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4491-2023","authenticated-orcid":false,"given":"Ling-Yu","family":"Duan","sequence":"additional","affiliation":[{"name":"School of Computer Science, Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yap-Peng","family":"Tan","sequence":"additional","affiliation":[{"name":"School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6262-8125","authenticated-orcid":false,"given":"Alex C.","family":"Kot","sequence":"additional","affiliation":[{"name":"School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-018-1070-x"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00031"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3083769"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3296408"},{"key":"ref5","article-title":"Density modeling of images using a generalized normalization transformation","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ball\u00e9"},{"key":"ref6","article-title":"Variational image compression with a scale hyperprior","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ball\u00e9"},{"key":"ref7","article-title":"Demystifying MMD GANs","author":"Bi\u0144kowski","year":"2018"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-88682-2_5"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1802.02611"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3058615"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00393"},{"key":"ref12","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017"},{"key":"ref13","article-title":"BadNL: Backdoor attacks against NLP models","volume-title":"Proc. ICML Workshop Adversarial Mach. Learn.","author":"Chen"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00796"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00391"},{"key":"ref16","article-title":"VillanDiffusion: A unified backdoor attack framework for diffusion models","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"Chou"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.350"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/IJCB48548.2020.9304875"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.02021"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3162397"},{"key":"ref24","article-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017"},{"key":"ref25","article-title":"TrojanNet: Embedding hidden trojan horse models in neural networks","author":"Guo","year":"2020"},{"key":"ref26","article-title":"Check your other door! establishing backdoor attacks in the frequency domain","volume-title":"Proc. Brit. Mach. Vis. Conf.","author":"Al Kader Hammoud"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref28","first-page":"6626","article-title":"GANs trained by a two time-scale update rule converge to a local Nash equilibrium","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"Heusel"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6736"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3065339"},{"key":"ref31","first-page":"2142","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ilyas"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00453"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1561\/116.00000069"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2024.3381598"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3202115"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2004.839613"},{"key":"ref37","article-title":"Context-adaptive entropy model for end-to-end optimized image compression","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Lee"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3021407"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01618"},{"key":"ref40","article-title":"Hidden backdoor attack against semantic segmentation models","author":"Li","year":"2021"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2022.3182979"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2017.16"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.2988453"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref49","article-title":"High-fidelity generative image compression","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Mentzer"},{"key":"ref50","first-page":"10794","article-title":"Joint autoregressive and hierarchical priors for learned image compression","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"Minnen"},{"key":"ref51","first-page":"3454","article-title":"Input-aware dynamic backdoor attack","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"Nguyen"},{"key":"ref52","article-title":"WaNet - imperceptible warping-based backdoor attack","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Nguyen"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2021.3101953"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3263619"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01321"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1981.1056282"},{"key":"ref57","first-page":"9759","article-title":"A little robustness goes a long way: Leveraging robust features for targeted transfer attacks","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"Springer"},{"key":"ref58","first-page":"3517","article-title":"Certified defenses for data poisoning attacks","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"Steinhardt"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2012.2221191"},{"key":"ref60","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy"},{"key":"ref61","article-title":"Variable rate image compression with recurrent neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Toderici"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/30.125072"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19778-9_23"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01746"},{"key":"ref66","first-page":"16913","article-title":"Adversarial neuron pruning purifies backdoored deep models","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"Wu"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00750"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3220849"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/s10489-023-04575-8"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-018-01144-2"},{"key":"ref73","article-title":"Lossy image compression with conditional diffusion models","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"Yang"},{"key":"ref74","article-title":"Benchmarking the robustness of spatial-temporal models against corruptions","volume-title":"Proc. Adv. Neural Inf. Process. Syst. Track Datasets Benchmarks","author":"Yi"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01179"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00592"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.3233\/faia230610"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00437"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00906"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01697"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/10873290\/10771646.pdf?arnumber=10771646","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,2,6]],"date-time":"2025-02-06T18:38:05Z","timestamp":1738867085000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10771646\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3]]},"references-count":82,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2024.3507873","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3]]}}}