Evaluating Similitude and Robustness of Deep Image Denoising Models via Adversarial Attack

TL;DR

This paper introduces an adversarial attack method for deep image denoising models, revealing their shared vulnerabilities and proposing a measure called robustness similitude to assess their local behavior similarities.

Contribution

The study uncovers the shared adversarial vulnerabilities among various deep denoising models and introduces a new indicator to quantify their local behavior similarity.

Findings

All tested models share similar adversarial samples, indicating similar local behaviors.

Non-blind denoising models exhibit high robustness similitude among themselves.

Data-driven non-blind denoising models are the most robust against adversarial attacks.

Abstract

Deep neural networks (DNNs) have shown superior performance comparing to traditional image denoising algorithms. However, DNNs are inevitably vulnerable while facing adversarial attacks. In this paper, we propose an adversarial attack method named denoising-PGD which can successfully attack all the current deep denoising models while keep the noise distribution almost unchanged. We surprisingly find that the current mainstream non-blind denoising models (DnCNN, FFDNet, ECNDNet, BRDNet), blind denoising models (DnCNN-B, Noise2Noise, RDDCNN-B, FAN), plug-and-play (DPIR, CurvPnP) and unfolding denoising models (DeamNet) almost share the same adversarial sample set on both grayscale and color images, respectively. Shared adversarial sample set indicates that all these models are similar in term of local behaviors at the neighborhood of all the test samples. Thus, we further propose an indicator to measure the local similarity of models, called robustness similitude. Non-blind denoising models are found to have high robustness similitude across each other, while hybrid-driven models are also found to have high robustness similitude with pure data-driven non-blind denoising models. According to our robustness assessment, data-driven non-blind denoising models are the most robust. We use adversarial training to complement the vulnerability to adversarial attacks. Moreover, the model-driven image denoising BM3D shows resistance on adversarial attacks.