Evaluating similitude and robustness of deep image denoising models via adversarial attack

Deep neural networks have shown superior performance compared to traditional image denoising algorithms. However, adversarial vulnerability accompanies this, and deep neural networks are susceptible to adversarial attacks. This highlights the vulnerabilities of deep neural networks in terms of robustness and raises concerns about the credibility of their decision-making outcomes. In this paper, we propose an image denoising adversarial attack method based on projected gradient descent and use it as an analytical tool to explore the robustness and similitude of deep image denoising models. By introducing the concentration inequalities, we demonstrate that the method adds only tiny adversarial perturbations to the image and can successfully attack all current deep image denoising models while preserving the underlying image distribution. Experiments show that the current mainstream non-blind denoising models, blind denoising models, plug-and-play models, and unfolding models share almost the same adversarial sample set. This indicates that all these models are highly similar, at least in the local behavior of all test sample neighborhoods. Most deep image denoising models are very vulnerable to adversarial attacks, and the non-blind image denoising models exhibit better robustness, but are still unsatisfactory. Therefore, we propose an image denoising adversarial defense strategy, which combines traditional and deep image denoising methods to enhance robustness against adversarial attacks.