⚡ electrical engineering

Evaluating Similitude and Robustness of Deep Image Denoising Models via Adversarial Attack

This paper introduces a "denoising-PGD" adversarial attack method that reveals a surprising shared vulnerability and high local similarity (robustness similitude) across diverse deep image denoising models, leading to the conclusion that data-driven non-blind models are the most robust while model-driven approaches like BM3D exhibit inherent resistance.

Original authors: Jie Ning, Jiebao Sun, Yao Li, Zhichang Guo, Wangmeng Zuo

Published 2026-05-01

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jie Ning, Jiebao Sun, Yao Li, Zhichang Guo, Wangmeng Zuo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, high-tech photo cleaner. You feed it a messy, grainy picture, and it magically wipes away the dirt to reveal a perfect, clear image. For years, these "Deep Neural Network" cleaners have been the best in the world, far outperforming the old-school methods.

But this paper asks a scary question: What if the dirt itself is a trick?

The researchers discovered that you can add a tiny, invisible layer of "fake dirt" to a noisy photo. To the human eye, the photo looks exactly the same as before. But to the smart photo cleaner, this fake dirt is a trap. It confuses the machine so badly that instead of cleaning the photo, the machine smears it, blurs it, or creates weird artifacts. It's like putting a tiny, invisible sticker on a stop sign that makes a self-driving car think it's a speed limit sign.

Here is the breakdown of their findings using simple analogies:

1. The "Universal Trap" (The Big Surprise)

The researchers created a specific type of "fake dirt" (called denoising-PGD) designed to trick one specific photo cleaner. They expected it to only work on that one machine.

The Shock: They found that this same fake dirt tricked every single modern photo cleaner they tested.

The Analogy: Imagine you invent a specific key that opens one lock. You expect it to fail on other locks. But instead, you find that this one key opens every lock in the building, regardless of whether the lock is old, new, fancy, or simple.
The Result: This means that all these different, complex AI models are actually thinking in very similar ways when they look at a picture. They all have the same "blind spot."

2. The "Robustness Similitude" (How Alike Are They?)

Because the same trick worked on everyone, the researchers invented a new way to measure how similar these models are. They call it Robustness Similitude.

The Analogy: Think of these AI models as different chefs. If you give them all the same "poisoned ingredient" and they all choke on it in the exact same way, you know they are using very similar recipes, even if they claim to be different.
The Finding: The "pure" AI chefs (data-driven models) are very similar to each other. Even the "hybrid" chefs (who mix old rules with new AI) are surprisingly similar to the pure AI chefs. The only ones who didn't choke were the "old-school" chefs (classic model-driven methods like BM3D).

3. The "Old School" vs. The "New AI"

The paper tested the classic, non-AI method called BM3D.

The Analogy: While the fancy AI chefs were fooled by the invisible poison, the old-school chef just shrugged it off. The poison didn't work on him.
The Finding: The traditional, math-based methods are actually more resistant to these tricks than the fancy deep learning models. This explains why some security systems still use the old methods to "clean" data before passing it to AI.

4. The "Continuous Trap Zone"

The researchers looked closely at where the trick worked. They found that the "bad zone" isn't just a single point; it's a whole continuous area.

The Analogy: Imagine a minefield. Usually, you think mines are scattered randomly. But here, they found that the mines are laid out in a giant, continuous circle. If you step anywhere in that circle, you trigger the trap.
The Finding: Because the "trap zone" is so big and continuous, it's very easy to accidentally step into it, which is why the attack works so well on so many different models.

5. Can We Fix It? (Adversarial Training)

The researchers tried to teach the AI to ignore the poison. They did this by feeding the AI examples of the "fake dirt" during its training, essentially saying, "Don't fall for this!"

The Analogy: It's like training a dog to ignore a specific fake snake.
The Result: It worked! The AI became much harder to trick. Surprisingly, making the AI tougher against the trick didn't make it worse at its normal job; in fact, it cleaned normal photos even better than before, removing some of the weird smudges the AI usually creates.

Summary

The Problem: Modern AI photo cleaners are surprisingly fragile. A tiny, invisible change to the noise in a photo can break them.
The Discovery: All these different AI models are so similar that one trick breaks them all.
The Exception: The old, non-AI methods are tough and resist these tricks.
The Solution: You can train the AI to be tougher, and it actually gets better at its normal job too.

The paper concludes that while deep learning is powerful, it has a shared weakness that we need to understand and fix.

1. Problem Statement

Deep Neural Networks (DNNs) have achieved state-of-the-art performance in image denoising, surpassing traditional model-driven methods. However, DNNs are known to be vulnerable to adversarial attacks, where imperceptible perturbations cause significant performance degradation.

The Gap: While adversarial attacks are well-studied in image classification, they are under-explored in image denoising (a regression task).
The Challenge: Existing attacks often alter the noise distribution significantly, making it unclear if performance drops are due to the attack or simply a change in noise characteristics. Furthermore, the robustness and internal similarities between different denoising architectures (non-blind, blind, plug-and-play, unfolding) remain unknown.
Goal: To propose an adversarial attack that maintains the original noise distribution while successfully fooling denoising models, and to use this attack to evaluate the robustness and structural similarity of various deep denoising models.

2. Methodology

A. Denoising-PGD (Proposed Attack)

The authors propose denoising-PGD, an adversarial attack method based on the Projected Gradient Descent (PGD) framework, specifically adapted for image denoising.

Input: A noisy image $x = u + n$ (where $u$ is clean, $n$ is Gaussian noise).
Objective: Generate an adversarial noise image $x'$ such that the denoised output $D(x')$ has significantly lower quality than $D(x)$ , while keeping the noise distribution nearly identical to Gaussian.
Loss Function: Unlike classification attacks that maximize classification error, this method minimizes the similarity between the denoised output and the ground truth clean image.
$\min \gamma(x' - x) \quad \text{s.t.} \quad E(D(x), y) - E(D(x'), y) > M$
Where $E$ is a metric like PSNR, SSIM, or MAE, and $M$ is a threshold for a successful attack.
Key Constraint: The perturbation is added to the noise image (not the clean image) to ensure the resulting noise distribution remains close to Gaussian, preventing the attack from being attributed to a shift in noise levels.

B. Robustness Similitude (DMRS)

To investigate why adversarial samples transfer so well between different models, the authors introduce a metric called Denoising Model Robustness Similitude (DMRS).

Concept: They analyze the "adversarial space" by generating noise samples on a circle in the high-dimensional space surrounding the Gaussian noise image.
Measurement: They calculate the Intersection over Union (IoU) of the "radar diagrams" representing the adversarial regions of two different models.
Hypothesis: If two models share the same adversarial sample set (high DMRS), they possess similar local behaviors and decision boundaries in the neighborhood of test samples.

C. Defense: Adversarial Training

The paper evaluates adversarial training as a defense mechanism, where the model is retrained using a mix of clean Gaussian noise and adversarial noise images.

D. L2-Denoising-PGD

To further ensure the noise distribution remains strictly Gaussian, the authors propose L2-denoising-PGD, which imposes an L2 constraint on the perturbation, forcing the adversarial noise to adhere more strictly to the Gaussian distribution assumption.

3. Key Contributions

Denoising-PGD Attack: A novel adversarial attack method that successfully degrades the performance of deep denoising models while keeping the noise distribution almost unchanged (imperceptible to the human eye).
Discovery of High Similitude: The study reveals that all current mainstream deep denoising models (non-blind, blind, plug-and-play, and unfolding) share almost the same adversarial sample set. This implies that despite different architectures and training paradigms, these models learn highly similar local functions.
Robustness Ranking:
- Most Robust: Data-driven non-blind models (e.g., DnCNN, ECNDNet).
- Moderately Robust: Model-data hybrid-driven models (e.g., DPIR, DeamNet).
- Least Robust: Blind denoising models (e.g., DnCNN-B, Noise2Noise).
Transferability: The attack exhibits unexpectedly high transferability across different model types, which is rare in classification tasks (where PGD usually has low transferability). This confirms the high structural similarity of deep denoising networks.
Defense Validation: Adversarial training significantly improves robustness (reducing PSNR drop from ~0.8dB to ~0.1dB) without degrading performance on clean Gaussian noise.
Model-Driven Resistance: The classical model-driven method BM3D shows strong resistance to these adversarial attacks, unlike deep learning models.

4. Experimental Results

Performance Drop: On the Set12 dataset (noise level $\sigma=25$ $σ = 25$ ), the attack caused:
- DnCNN (Non-blind): PSNR drop of ~0.8 dB.
- DnCNN-B (Blind): PSNR drop of ~4.0 dB (significantly more vulnerable).
- DPIR (Plug-and-Play): PSNR drop of ~2.1 dB.
Transferability: Adversarial samples generated for DnCNN caused significant performance drops in FFDNet, ECNDNet, DnCNN-B, RDDCNN-B, DPIR, and DeamNet.
Similitude Scores (DMRS):
- Non-blind models showed ~97% similitude with each other.
- Hybrid models (DPIR, DeamNet) showed ~90-94% similitude with non-blind models.
- Blind models showed lower similitude (~50-60%) with non-blind models but high similitude with each other.
Color Images: The attack was extended to RGB images (FFDNet), showing similar transferability trends, though slightly less effective than on grayscale images.
Adversarial Training: After training with adversarial samples, the model's vulnerability dropped drastically (PSNR residual reduced from 0.88dB to 0.16dB), and the model actually produced better results on clean Gaussian noise than the original model by reducing artifacts.

5. Significance and Implications

Vulnerability of Deep Denoising: Despite high PSNR scores, deep denoising models are fragile and can be easily "fooled" by the same small perturbation, regardless of their architecture.
Unified Behavior: The finding that diverse models share the same adversarial space suggests that deep denoising tasks may have converged to a specific, narrow solution manifold, making them collectively vulnerable.
Defense Strategy: Adversarial training is proven to be an effective defense, improving both robustness and general denoising quality.
Role of Classical Methods: The resistance of BM3D suggests that classical model-driven methods may serve as a robust "purifier" or preprocessing step in adversarial defense pipelines, a role often assumed by deep learning but which deep learning itself fails to secure against these specific attacks.
New Research Direction: This work establishes "Image Denoising Adversarial Attack" as a distinct and critical research area, moving beyond classification to regression-based vision tasks.