通过对抗攻击评估深度图像去噪模型的相似性与鲁棒性
Evaluating Similitude and Robustness of Deep Image Denoising Models via Adversarial Attack
AI总结：
本文通过对抗攻击方法评估深度图像去噪模型的相似性和鲁棒性，发现主流模型在灰度和彩色图像中共享对抗样本集，提出鲁棒性相似性指标，表明数据驱动的非盲去噪模型最鲁棒。
摘要：
深度神经网络（DNNs）在图像去噪任务中表现出优于传统算法的性能。然而，DNNs在面对对抗攻击时不可避免地存在脆弱性。本文提出了一种对抗攻击方法，称为denoising-PGD，能够成功攻击所有当前深度去噪模型，同时保持噪声分布几乎不变。我们发现当前主流非盲去噪模型（DnCNN、FFDNet、ECNDNet、BRDNet）、盲去噪模型（DnCNN-B、Noise2Noise、RDDCNN-B、FAN）、插件式模型（DPIR、CurvPnP）和展开式去噪模型（DeamNet）在灰度和彩色图像中几乎共享相同的对抗样本集。共享的对抗样本集表明，这些模型在所有测试样本的邻域内具有相似的局部行为。因此，我们进一步提出一个指标来衡量模型的局部相似性，称为鲁棒性相似性。非盲去噪模型在彼此之间显示出较高的鲁棒性相似性，而混合驱动模型也与纯数据驱动的非盲去噪模型显示出较高的鲁棒性相似性。根据我们的鲁棒性评估，数据驱动的非盲去噪模型是最鲁棒的。我们使用对抗训练来补充对对抗攻击的脆弱性。此外，模型驱动的图像去噪BM3D在对抗攻击中表现出抗性。
英文摘要：
Deep neural networks (DNNs) have shown superior performance comparing to traditional image denoising algorithms. However, DNNs are inevitably vulnerable while facing adversarial attacks. In this paper, we propose an adversarial attack method named denoising-PGD which can successfully attack all the current deep denoising models while keep the noise distribution almost unchanged. We surprisingly find that the current mainstream non-blind denoising models (DnCNN, FFDNet, ECNDNet, BRDNet), blind denoising models (DnCNN-B, Noise2Noise, RDDCNN-B, FAN), plug-and-play (DPIR, CurvPnP) and unfolding denoising models (DeamNet) almost share the same adversarial sample set on both grayscale and color images, respectively. Shared adversarial sample set indicates that all these models are similar in term of local behaviors at the neighborhood of all the test samples. Thus, we further propose an indicator to measure the local similarity of models, called robustness similitude. Non-blind denoising models are found to have high robustness similitude across each other, while hybrid-driven models are also found to have high robustness similitude with pure data-driven non-blind denoising models. According to our robustness assessment, data-driven non-blind denoising models are the most robust. We use adversarial training to complement the vulnerability to adversarial attacks. Moreover, the model-driven image denoising BM3D shows resistance on adversarial attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
