Deep neural networks (DNNs) have shown superior performance comparing to traditional image denoising algorithms. However, DNNs are inevitably vulnerable while facing adversarial attacks. In this paper, we propose an adversarial attack method named denoising-PGD which can successfully attack all the current deep denoising models while keep the noise distribution almost unchanged. We surprisingly find that the current mainstream non-blind denoising models (DnCNN, FFDNet, ECNDNet, BRDNet), blind denoising models (DnCNN-B, Noise2Noise, RDDCNN-B, FAN), plug-and-play (DPIR, CurvPnP) and unfolding denoising models (DeamNet) almost share the same adversarial sample set on both grayscale and color images, respectively. Shared adversarial sample set indicates that all these models are similar in term of local behaviors at the neighborhood of all the test samples. Thus, we further propose an indicator to measure the local similarity of models, called robustness similitude. Non-blind denoising models are found to have high robustness similitude across each other, while hybrid-driven models are also found to have high robustness similitude with pure data-driven non-blind denoising models. According to our robustness assessment, data-driven non-blind denoising models are the most robust. We use adversarial training to complement the vulnerability to adversarial attacks. Moreover, the model-driven image denoising BM3D shows resistance on adversarial attacks.

翻译：深度神经网络（DNNs）相较于传统图像去噪算法展现出优越性能，然而，面对对抗攻击时DNNs不可避免地存在脆弱性。本文提出一种名为denoising-PGD的对抗攻击方法，该方法能在保持噪声分布几乎不变的情况下成功攻击当前所有深度去噪模型。我们惊奇地发现，当前主流的非盲去噪模型（DnCNN、FFDNet、ECNDNet、BRDNet）、盲去噪模型（DnCNN-B、Noise2Noise、RDDCNN-B、FAN）、即插即用模型（DPIR、CurvPnP）以及展开去噪模型（DeamNet），分别在灰度图像和彩色图像上几乎共享同一对抗样本集。共享对抗样本集表明，这些模型在所有测试样本邻域内的局部行为具有相似性。为此，我们进一步提出一种衡量模型局部相似性的指标——鲁棒相似度。研究发现，非盲去噪模型彼此间具有高鲁棒相似度，而混合驱动模型与纯数据驱动的非盲去噪模型之间同样表现出高鲁棒相似度。根据我们的鲁棒性评估，数据驱动的非盲去噪模型最为鲁棒。我们采用对抗训练来弥补模型对对抗攻击的脆弱性。此外，模型驱动的图像去噪方法BM3D展现出对对抗攻击的抵抗能力。