Abstract:Image denoising can remove natural noise that widely exists in images captured by multimedia devices due to low-quality imaging sensors, unstable image transmission processes, or low light conditions. Recent works also find that image denoising benefits the high-level vision tasks, e.g., image classification. In this work, we try to challenge this common sense and explore a totally new problem, i.e., whether the image denoising can be given the capability of fooling the state-of-the-art deep neural networks (DNNs) while enhancing the image quality. To this end, we initiate the very first attempt to study this problem from the perspective of adversarial attack and propose the adversarial denoise attack. More specifically, our main contributions are three-fold: First, we identify a new task that stealthily embeds attacks inside the image denoising module widely deployed in multimedia devices as an image post-processing operation to simultaneously enhance the visual image quality and fool DNNs. Second, we formulate this new task as a kernel prediction problem for image filtering and propose the adversarial-denoising kernel prediction that can produce adversarial-noiseless kernels for effective denoising and adversarial attacking simultaneously. Third, we implement an adaptive perceptual region localization to identify semantic-related vulnerability regions with which the attack can be more effective while not doing too much harm to the denoising. We name the proposed method as Pasadena (Perceptually Aware and Stealthy Adversarial DENoise Attack) and validate our method on the NeurIPS'17 adversarial competition dataset, CVPR2021-AIC-VI: unrestricted adversarial attacks on ImageNet, and Tiny-ImageNet-C dataset. The comprehensive evaluation and analysis demonstrate that our method not only realizes den-ising but also achieves a significantly higher success rate and transferability over state-of-the-art attacks.

AdvFilter: predictive perturbation-aware filtering against adversarial attack via multi-domain learning

AdvFilter: Predictive Perturbation-aware Filtering Against Adversarial Attack Via Multi-domain Learning.

Image denoising algorithm based on adversarial learning using joint loss function

An Adversarial Attack Via Feature Contributive Regions

Feature Denoising for Improving Adversarial Robustness

Pasadena: Perceptually Aware and Stealthy Adversarial Denoise Attack

Adversarial Monte Carlo denoising with conditioned auxiliary feature modulation

DifFilter: Defending Against Adversarial Perturbations with Diffusion Filter

Adaptive Wiener Filter and Natural Noise to Eliminate Adversarial Perturbation

On the Limitations of Denoising Strategies as Adversarial Defenses

Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser

A Patch-wise Adversarial Denoising Could Enhance the Robustness of Adversarial Training

Adversarial perturbation denoising utilizing common characteristics in deep feature space

Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction

Evaluating Similitude and Robustness of Deep Image Denoising Models via Adversarial Attack

Unifying Bilateral Filtering and Adversarial Training for Robust Neural Networks

Defense against adversarial attacks on deep convolutional neural networks through nonlocal denoising

Semantically Adversarial Learnable Filters

Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features

Enhanced countering adversarial attacks via input denoising and feature restoring