Evaluating Similitude and Robustness of Deep Image Denoising Models via Adversarial Attack
Deep neural networks (DNNs) have shown superior performance comparing to traditional image denoising algorithms. However, DNNs are inevitably vulnerable while facing adversarial attacks. In this paper, we propose an adversarial attack method named denoising-PGD which can successfully attack all the current deep denoising models while keep the noise distribution almost unchanged. We surprisingly find that the current mainstream non-blind denoising models (DnCNN, FFDNet, ECNDNet, BRDNet), blind denoising models (DnCNN-B, Noise2Noise, RDDCNN-B, FAN), plug-and-play (DPIR, CurvPnP) and unfolding denoising models (DeamNet) almost share the same adversarial sample set on both grayscale and color images, respectively. Shared adversarial sample set indicates that all these models are similar in term of local behaviors at the neighborhood of all the test samples. Thus, we further propose an indicator to measure the local similarity of models, called robustness similitude. Non-blind denoising models are found to have high robustness similitude across each other, while hybrid-driven models are also found to have high robustness similitude with pure data-driven non-blind denoising models. According to our robustness assessment, data-driven non-blind denoising models are the most robust. We use adversarial training to complement the vulnerability to adversarial attacks. Moreover, the model-driven image denoising BM3D shows resistance on adversarial attacks.
Code (0)
등록된 구현이 없습니다.
Tasks
Adversarial AttackDenoisingImage DenoisingSimilar Papers 제목 키워드 기반
Feature Denoising for Improving Adversarial Robustness
Adversarial attacks to image classification systems present challenges to convolutional networks and opportunities for understanding them. This study suggests that adversarial perturbations on images lead to noise in the…
Adversarial DefenseAdversarial RobustnessGeneral Classificationimage-classification+1On the Limitations of Denoising Strategies as Adversarial Defenses
As adversarial attacks against machine learning models have raised increasing concerns, many denoising-based defense approaches have been proposed. In this paper, we summarize and analyze the defense strategies in the fo…
DenoisingAdvFilter: Predictive Perturbation-aware Filtering against Adversarial Attack via Multi-domain Learning
High-level representation-guided pixel denoising and adversarial training are independent solutions to enhance the robustness of CNNs against adversarial attacks by pre-processing input data and re-training models, respe…
Adversarial AttackAdversarial RobustnessDenoisingRobust Image Denoising through Adversarial Frequency Mixup
Image denoising approaches based on deep neural networks often struggle with overfitting to specific noise distributions present in training data. This challenge persists in existing real-world denoising networks whi…
DenoisingImage DenoisingBeyond Pretrained Features: Noisy Image Modeling Provides Adversarial Defense
Recent advancements in masked image modeling (MIM) have made it a prevailing framework for self-supervised visual representation learning. The MIM pretrained models, like most deep neural network methods, remain vulnerab…
Adversarial DefenseAdversarial RobustnessDecoderDenoising+2