Privacy-Shielded Image Compression: Defending Against Exploitation from Vision-Language Pretrained Models

Jiayin Xu; Kangsheng Yin; Wenhan Yang; Xuelin Shen

REVIEW 3 major objections 5 minor 12 references

Privacy-Shielded Image Compression: Defending Against Exploitation from Vision-Language Pretrained Models

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper argues that a single learned image-compression bitstream can be decoded by default into a version that hides semantic content from vision-language models, and into a full semantic version when a user-supplied condition is…

desk verdict One bitstream, two decodings, real novelty; but the privacy claim rests on β staying out of adversary's hands, and the paper never says who guards it. read the letter →

arxiv 2506.15201 v2 pith:PX4ZYYNS submitted 2025-06-18 cs.CV

Xuelin Shen , Jiayin Xu , Kangsheng Yin , Wenhan Yang This is my paper · ORCID

classification cs.CV

keywords privacy-preservingimagecompressionlearnedvision-languagepretrainedmodelsCLIPconditionaldecodinglatenttriggerinjectionuncertainty-awareencryptionbackdoorattack

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes Privacy-Shielded Image Compression (PSIC), a learned compression scheme whose single bitstream has two decoding modes. By default, the decoder produces an image that still looks good to people but is semantically opaque to vision-language pretrained models such as CLIP, so search engines and automated analyzers cannot mine it. If a user supplies a condition to the decoder, the same bitstream reconstructs a version that keeps the image's full semantic content. The authors argue this turns compression itself into a plug-and-play privacy defense, and they support it with experiments on retrieval, classification, facial attributes, and captioning.

What carries the argument

The load-bearing mechanism is conditional latent trigger injection. A Conditional Latent Trigger Generation (CLTG) module sits at each decoding block, maps the mode indicator $\beta$ through a two-layer MLP to a bias feature $f_\beta$, and fuses it into decoder features as $f_{\mathrm{CLTG}} = f_\beta W_d + f_{\mathrm{dec}}$, steering one shared latent toward either the encrypted or the full reconstruction. The Uncertainty-Aware Encryption-Oriented (UAEO) objective supplies the attack target: it uses Dempster-Shafer evidence to pick, for each image, the text prompt with the highest matching uncertainty in the CLIP embedding space, then maximizes similarity to that uncertain wrong label. An adaptive two-stage schedule alternates rate-distortion and rate-encryption updates, so the same encoder and bitstream serve both modes.

What would settle it

Encode an image with PSIC, then attempt to decode the default bitstream using the full-version condition $\beta_f$ without any authenticated channel, or by sweeping plausible condition values. If full semantic content (correct retrieval, captions, labels) comes out, the protection is a default setting rather than a privacy boundary.

Watch

Extended reading notes

Core claim

The central claim is that privacy protection and full information need not be separate encodings: one compact latent representation can be decoded into two mutually exclusive versions, selected by a mode condition. The paper's implementation trains an entropy-coded latent with the Conditional Latent Trigger Generation (CLTG) module, which injects condition-dependent bias features into every decoding block, and an Uncertainty-Aware Encryption-Oriented (UAEO) loss that drives the default decode toward text labels the target CLIP model is uncertain about, maximizing the chance of misleading it. The full version is trained with standard distortion losses, so it matches the rate-distortion behavior of the underlying learned codec. Experiments report attack success rates of roughly 80.8%, 72.3%, 67.0%, and 51.5% for text-to-image retrieval, image-to-text retrieval, classification, and facial attribute analysis, with the full version preserving baseline-level accuracy. The conclusion drawn is that a single compressor can serve both a privacy-protected default and an authorized full-fidelity mode from the same bitstream.

Load-bearing premise

The privacy guarantee rests on the assumption that whoever receives the bitstream cannot decode the full-information version, even though the condition that unlocks it must be transmitted to the decoder and is not protected as a secret.

Editorial extensions

If this is right

A platform can ship one bitstream and serve privacy-protected images by default, while the same file can be upgraded to full semantic content when a user supplies the right condition to the decoder.
Because the trigger lives in the latent representation rather than the input image, no separate poisoned encoding pass is needed, and the privacy mode does not add extra bitrate compared with an input-stage backdoor defense.
The conditional decoder can be attached to existing learned image compression backbones, so the privacy shield is an add-on rather than a new codec built from scratch.
The shielded mode transfers beyond the exact model it was trained against, as shown by degraded captioning quality on an unseen BLIP-2 captioner.
Authorized viewing keeps full semantic fidelity: the full version maintains the same rate-perception tradeoff as the underlying codec.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The authors leave implicit that the mode condition $\beta$ is transmitted alongside the bitstream and is not a cryptographic key; anyone who can decode the bitstream and obtain or guess $\beta_f$ can reconstruct the full semantic version, so the protection is a default-behavior shield rather than a hard access boundary.
If the condition space is small or guessable, an attacker could sweep plausible conditions and recover the full version; the paper reports no analysis of the condition's entropy or of guessing resistance.
The attack target is a single CLIP encoder at training time; a natural test the paper does not run is to evaluate the shielded bitstream against other CLIP architectures or non-CLIP multimodal encoders to see whether the semantic hiding transfers beyond the trained model.
The same conditional-trigger machinery could be repurposed for capability-based access control, with different high-entropy conditions releasing different semantic views of one bitstream, turning the compression decoder into a simple permission gate.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear colleague,

The thing worth knowing about this paper is that it actually delivers a genuinely new mechanism: one bitstream that decodes into two different images depending on a condition vector fed to the decoder. Previous LIC backdoor attacks like BAvAFT inject triggers at the input stage and need separate encoding runs for poisoned and clean modes. PSIC instead learns a conditional trigger generator at the latent level, so the same compressed representation yields an 'encrypted' default output and a 'full' output when the right condition appears. The paper shows this works across retrieval, classification, facial attributes, and unseen BLIP-2 captioning, with ASR gains over BAvAFT and comparable rate-distortion to the backbone. The UAEO uncertainty loss is a reasonable addition, and the ablation gives it some support. Code is promised. That is a solid engineering contribution.

The soft spots are real but not fatal to the core mechanism. The biggest one is the privacy framing. Section 3.1 states that 'alongside the bitstream, the customizable condition β must also be provided by the users and transmitted to the decoding side.' Nothing in the protocol treats β as a secret key or defines an authenticated channel. If an adversary — say the platform running the decoder, or anyone who intercepts the transmitted metadata — has βf, they can run the same decoder and recover the full semantic version. The experiments never simulate that adversary; they only compare default decodings. So the claim of shielding against exploitation by VLP models is not established by the reported evidence. The right fix is to re-scope the paper as conditional access or mode-switchable compression, or to add a real key-management story if privacy is the headline.

There are two smaller issues. Equation (8) writes arg min over u_in while the text says 'highest uncertainty'; those disagree, and the definition of u_in looks more like evidence proportion than standard DST uncertainty mass — a fixable inconsistency, but it needs one. And the empirical section has no error bars, multiple seeds, or statistical variation, with only one baseline (BAvAFT). For an attack paper, the lack of variance reporting makes the ASR numbers look flatter than they probably are.

The central mechanism holds up; the privacy claim does not. A serious editor should send this to review, because the conditional-decoding idea deserves the field's attention and the experiments show it works. But the revision must address the threat model and the UAEO equation before I would trust the framing.

Best, [Your name]

Referee Report

3 major / 5 minor

Summary. The paper proposes Privacy-Shielded Image Compression (PSIC), a learned image compression framework in which a single encoded bitstream can be decoded into two versions: a default 'encrypted' version that preserves perceptual quality while misleading a target vision–language model (CLIP), and a condition-triggered 'full' version that preserves full semantic information. The method uses a Conditional Latent Trigger Generation (CLTG) module to inject mode-dependent bias into the decoder, an Uncertainty-Aware Encryption-Oriented (UAEO) loss that selects misleading text prompts from CLIP's uncertainty estimates, and an alternating two-stage optimization to balance rate–distortion and rate–encryption objectives. Experiments on image–text retrieval, image classification, facial attribute analysis, image captioning, and PSNR are reported on top of an AE-Hyperprior backbone, with BAvAFT as a comparison baseline.

Significance. If the central claim were fully established, the paper would offer a practically useful plugin for learned image compression: one bitstream that can be decoded in two controllable modes without sacrificing rate–distortion performance on the 'full' path. The CLTG design and the uncertainty-guided selection of attack prompts are reasonable empirical ingredients, and the experiments show clear effects on the tested downstream tasks. The paper also promises code, which is a strength. However, the privacy interpretation is not supported by the protocol as written: the condition β is transmitted to the decoding side and is not treated as a secret, so the claimed 'defense against exploitation' collapses under a decoder-operator adversary. In addition, the UAEO description contains a mathematical inconsistency in Eq. (8). These issues affect the paper's central claim and reproducibility, respectively, so the manuscript needs substantive revision before the contribution can be accepted.

major comments (3)

[Sec. 3.1 and Sec. 3.2] The privacy claim presumes that the adversary only consumes the default decoded image and cannot supply the full-version condition βf. However, Sec. 3.1 states that 'alongside the bitstream, the customizable condition β must also be provided by the users and transmitted to the decoding side,' and Sec. 3.2 defines β ∈ {βe, βf}. Since β is a two-valued indicator (or, per the text, a keyword), an adversary who obtains the public bitstream can simply run the same decoder D(·, βf) to recover the full semantic version. The paper provides no authentication mechanism, no key derivation, no entropy argument, and no stated assumption that β is kept secret. The experiments only compare the two default decodings and never simulate an adversary who chooses β. Consequently, the headline claim of 'privacy shielding' or 'defending against exploitation' is not established; at best the method offers controllable/conditional decoding. Please either add a formal threat model in which β is a secret key and analyze the security accordingly, or re-frame the contribution as a conditional dual-mode compression method rather than a privacy defense.
[Sec. 3.3, Eq. (8)] There is an inconsistency between the text and Eq. (8). The text says the prompt tn 'with highest uncertainty' is obtained, but Eq. (8) writes tn = arg min_n u_{in}. If u is an uncertainty mass, the highest uncertainty corresponds to argmax, not argmin. If argmin is instead intentional, then u cannot be interpreted as uncertainty and the Dempster–Shafer connection is unclear. This makes the UAEO objective underspecified and impedes reproducibility; please correct the equation and confirm the intended selection rule (e.g., highest uncertainty should be argmax or the notation for u should be changed to an evidence/confidence mass).
[Sec. 4.1 and Fig. 3] The empirical evaluation does not include an adversarial setting that matches the claimed security property. The text reports only comparisons of the two default decodings and a single baseline (BAvAFT), with no confidence intervals, no seeds, and no statistical testing. The ASR metric is defined over samples that the baseline LIC model processes correctly, but the reported numbers are point estimates from what appear to be single runs. Please report variance across multiple runs and, more importantly, add an experiment that models an adversary with access to βf (or with a guessing strategy over β) to demonstrate whether the privacy property survives under a realistic threat model.

minor comments (5)

[Sec. 3.3, Eq. (5)] The scaling factor s in Eq. (5) is a free hyperparameter, but its value or selection criterion is never reported; please state the value used in the experiments.
[Sec. 3.4] The 'adaptive multi-objective optimization strategy' appears to be a fixed alternating schedule between rate–distortion and rate–encryption sessions; there is no described mechanism that adapts to training dynamics. Please either describe the adaptivity concretely or use a more neutral term such as 'alternating'.
[Fig. 3] The figure caption does not clearly associate each panel (a)–(h) with a downstream task, and the text refers to 'Fig. 3 (a)-(e)' for three tasks while also mentioning (f), (g), and (h); please make the panel-to-task mapping explicit and correct the references.
[Sec. 2.3 and Sec. 4.1] The related work covers backdoor attacks, but the comparison is limited to BAvAFT; the paper would be strengthened by discussing or comparing with other conditional/steerable learned image compression methods or recent CLIP-specific defenses.
[Sec. 1] The phrase 'plug-and-play and can be seamlessly integrated into most existing Learned Image Compression (LIC) models' is not demonstrated; the experiments use only the AE-Hyperprior backbone, and the CLTG injection requires structural changes to every decoding block. Please temper the claim or provide evidence on a second backbone.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: conditional decoding is defined by explicit equations and evaluated on held-out benchmarks; the BAvAFT self-citation is a non-load-bearing baseline.

full rationale

PSIC's derivation chain is self-contained. The two decoding versions are defined operationally by the mode indicator β in Eqs. (1)-(3), and the encrypted/full distinction is measured independently by downstream-task accuracy and attack success rate on held-out benchmarks (ImageNet-1k, CelebA, Flickr8k, Kodak), not by a quantity fitted during training. The UAEO loss in Eqs. (7)-(9) uses CLIP's own soft evidence to select the lowest-evidence text prompt, but this selection is part of the attack objective, not a hidden definition of the reported result; optimizing against the same CLIP model that is later used for evaluation is standard for targeted adversarial methods and does not make the measured success circular. The paper does not invoke a uniqueness theorem, import an ansatz from prior work by the same authors, or rename a known empirical pattern. The only self-citation is BAvAFT (Yu et al. 2023/2024), where present author Wenhan Yang is a co-author; it is used solely as a comparison baseline and does not carry any load-bearing premise in the derivation. The fact that the full-version condition βf is transmitted alongside the bitstream and could be used by any decoder operator is a threat-model limitation, not a circularity in the derivation chain.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on borrowed evidential-uncertainty machinery, an implicit single-model threat model, an assumed capacity for two mutually exclusive semantics in one latent, and an unexamined secrecy assumption for the mode condition. No new physical or conceptual entity is postulated.

free parameters (2)

Uncertainty scaling factor s in Eq. (5) = Not reported (stated s∈(0,1))
Determines how CLIP similarities map to evidence and thus which 'uncertain' prompts are selected by the UAEO loss.
Lagrange multipliers λ for rate-distortion and rate-encryption terms = Four values used, not listed
Standard rate-control hyperparameters; central to matching baseline bpp points but not a scientific free parameter. Listed for completeness.

assumptions (4)

domain assumption The evidence-extraction and uncertainty formulas in Eqs. (5)-(7), borrowed from Qin et al. (2022), correctly quantify cross-modal matching uncertainty for CLIP.
The UAEO loss selects training targets based on this uncertainty estimate; if the estimate is miscalibrated, the chosen 'uncertain' labels are not the intended noisy matches.
domain assumption A frozen CLIP ViT-B/32 model is an adequate proxy for the adversary's VLP model, and the defense transfers to unseen models (tested only with BLIP-2 for captioning).
All encryption objectives are optimized against this single CLIP; robustness to other VLP architectures is not demonstrated.
domain assumption A single entropy-coded latent can carry two mutually exclusive semantic readings without violating rate-distortion optimality.
The decoder is trained with alternating objectives; there is no capacity or trade-off analysis, only empirical results at four bpp points.
domain assumption The mode condition β is under user control and is not available to adversaries.
The paper transmits β alongside the bitstream and never specifies secrecy or authentication, yet the full-version guarantee depends on this.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Privacy-Shielded Image Compression: Defending Against Exploitation from Vision-Language Pretrained Models." pith.science (2026). https://pith.science/paper/PX4ZYYNS

@misc{pith2026250615201,
  author       = {Pith},
  title        = {Pith review of: Privacy-Shielded Image Compression: Defending Against Exploitation from Vision-Language Pretrained Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PX4ZYYNS}},
  note         = {Machine review of arXiv:2506.15201}
}

read the original abstract

The improved semantic understanding of vision-language pretrained (VLP) models has made it increasingly difficult to protect publicly posted images from being exploited by search engines and other similar tools. In this context, this paper seeks to protect users' privacy by implementing defenses at the image compression stage to prevent exploitation. Specifically, we propose a flexible coding method, termed Privacy-Shielded Image Compression (PSIC), that can produce bitstreams with multiple decoding options. By default, the bitstream is decoded to preserve satisfactory perceptual quality while preventing interpretation by VLP models. Our method also retains the original image compression functionality. With a customizable input condition, the proposed scheme can reconstruct the image that preserves its full semantic information. A Conditional Latent Trigger Generation (CLTG) module is proposed to produce bias information based on customizable conditions to guide the decoding process into different reconstructed versions, and an Uncertainty-Aware Encryption-Oriented (UAEO) optimization function is designed to leverage the soft labels inferred from the target VLP model's uncertainty on the training data. This paper further incorporates an adaptive multi-objective optimization strategy to obtain improved encrypting performance and perceptual quality simultaneously within a unified training process. The proposed scheme is plug-and-play and can be seamlessly integrated into most existing Learned Image Compression (LIC) models. Extensive experiments across multiple downstream tasks have demonstrated the effectiveness of our design.

Figures

Figures reproduced from arXiv: 2506.15201 by the authors.

**Figure 1.** In the default protected coding mode, our compression model protects images by preserving content similar to the original, while concealing machine-perceived semantics. Additionally, the model can encode images in a way that maintains both critical pixel fidelity and semantics. 1. Introduction In recent years, the rapid advancement of large-scale VisionLanguage Pretrained (VLP) models has transformed traditional t… view at source ↗

**Figure 2.** (a) Compressing pipeline of the proposed Privacy-Shielded Image Compression (PSIC). (b) Details of the proposed Conditional Latent trigger Generation (CLTG) module. (c) Intuitive illustration of the introduced Uncertainty-Aware Encryption-Oriented (UAEO) optimization function. over, under the default setting, only the encrypted version is produced. The full version is generated only when users provide customizable c… view at source ↗

**Figure 3.** Performance comparisons regarding the four employed downstream tasks. First Stage. As for the first stage, the encoder Eθ, entropy model Qϕ, and the conditional decoder Dψ, parameterized by θ, ϕ, ψ, respectively, are jointly optimized by alternating between rate-encryption and rate-perception criteria. In particular, we split the training iterations within one epoch into two sessions, and the corresponding training … view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Perceptual quality comparisons in terms of PSNR among the proposed PSIC, the LIC backbone network, and BAvAFT. • Facial attribute analysis: We utilize 10,000 images from the CelebA dataset (Liu et al., 2018), each labeled with 40 attributes (e.g., gender, age, express…

**Figure 5.** Figure 5: Visualization of performance in terms of perceptual quality and encryption efficiency. (a) (c) (b) (d) [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 6.** Figure 6: Ablation results for the proposed UAEO optimization function, illustrating encryption efficiency in (a), (b), and (c), and perceptual quality in (d). terms of PSNR is provided in [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

12 extracted references · 4 canonical work pages

[8]

Badnets: Identify- ing vulnerabilities in the machine learning model supply chain

Gu, T., Dolan-Gavitt, B., and Garg, S. Badnets: Identify- ing vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733,

arXiv
[9]

H., Yatskar, M., Yin, D., Hsieh, C.-J., and Chang, K.-W

Li, L. H., Yatskar, M., Yin, D., Hsieh, C.-J., and Chang, K.-W. Visualbert: A simple and performant baseline for vision and language. arXiv preprint arXiv:1908.03557,

arXiv 1908
[10]

and Singh, S

Minnen, D. and Singh, S. Channel-wise autoregressive en- tropy models for learned image compression. In 2020 IEEE International Conference on Image Processing (ICIP), pp. 3339–3343. IEEE,

work page 2020
[12]

Face-sensitive image-to- emotional-text cross-modal translation for multimodal aspect-based sentiment analysis

Yang, H., Zhao, Y ., and Qin, B. Face-sensitive image-to- emotional-text cross-modal translation for multimodal aspect-based sentiment analysis. In Proceedings of the 2022 conference on empirical methods in natural lan- guage processing, pp. 3324–3335,

work page 2022
[2008]

Imagenet: A large-scale hierarchical image database

Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248–255,

work page 2009
[2009]

Du, Y ., Liu, Z., Li, J., and Zhao, W. X. A survey of vision-language pre-trained models. arXiv preprint arXiv:2202.10936,

arXiv
[2015]

Generative text-guided 3d vision-language pretraining for unified medical image segmentation.arXiv preprint arXiv:2306.04811,

Chen, Y ., Liu, C., Huang, W., Cheng, S., Arcucci, R., and Xiong, Z. Generative text-guided 3d vision-language pretraining for unified medical image segmentation.arXiv preprint arXiv:2306.04811,

arXiv
[2018]

A new backdoor attack in cnns by training set corruption without label poison- ing

Barni, M., Kallas, K., and Tondi, B. A new backdoor attack in cnns by training set corruption without label poison- ing. In 2019 IEEE International Conference on Image Processing (ICIP), pp. 101–105,

work page 2019

Show all 12 references

[2019]

Chen, X., Fang, H., Lin, T.-Y ., Vedantam, R., Gupta, S., Doll´ar, P., and Zitnick, C. L. Microsoft coco captions: Data collection and evaluation server. arXiv preprint arXiv:1504.00325,

arXiv
[2020]

Sgva-clip: Semantic-guided visual adapting of vision-language mod- els for few-shot image classification

Peng, F., Yang, X., Xiao, L., Wang, Y ., and Xu, C. Sgva-clip: Semantic-guided visual adapting of vision-language mod- els for few-shot image classification. IEEE Transactions on Multimedia, 2023a. Peng, Z., Wang, W., Dong, L., Hao, Y ., Huang, S., Ma, S., and Wei, F. Kosmos-2...

arXiv
[2022]

Clip2video: Mas- tering video-text retrieval via image clip

Fang, H., Xiong, P., Xu, L., and Chen, Y . Clip2video: Mas- tering video-text retrieval via image clip. arXiv preprint arXiv:2106.11097,

arXiv
[2023]

arXiv preprint arXiv:2305.06500,

arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [8]

Badnets: Identify- ing vulnerabilities in the machine learning model supply chain

Gu, T., Dolan-Gavitt, B., and Garg, S. Badnets: Identify- ing vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733,

arXiv

[2] [9]

H., Yatskar, M., Yin, D., Hsieh, C.-J., and Chang, K.-W

Li, L. H., Yatskar, M., Yin, D., Hsieh, C.-J., and Chang, K.-W. Visualbert: A simple and performant baseline for vision and language. arXiv preprint arXiv:1908.03557,

arXiv 1908

[3] [10]

and Singh, S

Minnen, D. and Singh, S. Channel-wise autoregressive en- tropy models for learned image compression. In 2020 IEEE International Conference on Image Processing (ICIP), pp. 3339–3343. IEEE,

work page 2020

[4] [12]

Face-sensitive image-to- emotional-text cross-modal translation for multimodal aspect-based sentiment analysis

Yang, H., Zhao, Y ., and Qin, B. Face-sensitive image-to- emotional-text cross-modal translation for multimodal aspect-based sentiment analysis. In Proceedings of the 2022 conference on empirical methods in natural lan- guage processing, pp. 3324–3335,

work page 2022

[5] [2008]

Imagenet: A large-scale hierarchical image database

Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248–255,

work page 2009

[6] [2009]

Du, Y ., Liu, Z., Li, J., and Zhao, W. X. A survey of vision-language pre-trained models. arXiv preprint arXiv:2202.10936,

arXiv

[7] [2015]

Generative text-guided 3d vision-language pretraining for unified medical image segmentation.arXiv preprint arXiv:2306.04811,

Chen, Y ., Liu, C., Huang, W., Cheng, S., Arcucci, R., and Xiong, Z. Generative text-guided 3d vision-language pretraining for unified medical image segmentation.arXiv preprint arXiv:2306.04811,

arXiv

[8] [2018]

A new backdoor attack in cnns by training set corruption without label poison- ing

Barni, M., Kallas, K., and Tondi, B. A new backdoor attack in cnns by training set corruption without label poison- ing. In 2019 IEEE International Conference on Image Processing (ICIP), pp. 101–105,

work page 2019