Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Universal Robustness via Median Randomized Smoothing for Real-World Super-Resolution

Zakariya Chaouai, Mohamed Tamaazousti

TL;DR

This work tackles real-world robust single-image super-resolution by introducing CertSR, a universal robustness framework built on Median Randomized Smoothing (MRS). By applying Gaussian noise and per-pixel medians, CertSR provides certifiable $l_2$-robustness for SR outputs and demonstrates superior generalization across diverse adversarial attacks and real-world corruptions. The method extends adversarial attacks to SR (FGSM, BIM, PGD, CW) and shows that MRS-based certification yields better perceptual fidelity (LPIPS) while maintaining competitive PSNR/SSIM compared to prior RSR approaches. The practical impact lies in a robust SR pipeline that performs well without fine-tuning on specific real-world degradations, offering a transferable and scalable solution for real-world imaging tasks.

Abstract

Most of the recent literature on image Super-Resolution (SR) can be classified into two main approaches. The first one involves learning a corruption model tailored to a specific dataset, aiming to mimic the noise and corruption in low-resolution images, such as sensor noise. However, this approach is data-specific, tends to lack adaptability, and its accuracy diminishes when faced with unseen types of image corruptions. A second and more recent approach, referred to as Robust Super-Resolution (RSR), proposes to improve real-world SR by harnessing the generalization capabilities of a model by making it robust to adversarial attacks. To delve further into this second approach, our paper explores the universality of various methods for enhancing the robustness of deep learning SR models. In other words, we inquire: "Which robustness method exhibits the highest degree of adaptability when dealing with a wide range of adversarial attacks ?". Our extensive experimentation on both synthetic and real-world images empirically demonstrates that median randomized smoothing (MRS) is more general in terms of robustness compared to adversarial learning techniques, which tend to focus on specific types of attacks. Furthermore, as expected, we also illustrate that the proposed universal robust method enables the SR model to handle standard corruptions more effectively, such as blur and Gaussian noise, and notably, corruptions naturally present in real-world images. These results support the significance of shifting the paradigm in the development of real-world SR methods towards RSR, especially via MRS.

Universal Robustness via Median Randomized Smoothing for Real-World Super-Resolution

TL;DR

This work tackles real-world robust single-image super-resolution by introducing CertSR, a universal robustness framework built on Median Randomized Smoothing (MRS). By applying Gaussian noise and per-pixel medians, CertSR provides certifiable -robustness for SR outputs and demonstrates superior generalization across diverse adversarial attacks and real-world corruptions. The method extends adversarial attacks to SR (FGSM, BIM, PGD, CW) and shows that MRS-based certification yields better perceptual fidelity (LPIPS) while maintaining competitive PSNR/SSIM compared to prior RSR approaches. The practical impact lies in a robust SR pipeline that performs well without fine-tuning on specific real-world degradations, offering a transferable and scalable solution for real-world imaging tasks.

Abstract

Most of the recent literature on image Super-Resolution (SR) can be classified into two main approaches. The first one involves learning a corruption model tailored to a specific dataset, aiming to mimic the noise and corruption in low-resolution images, such as sensor noise. However, this approach is data-specific, tends to lack adaptability, and its accuracy diminishes when faced with unseen types of image corruptions. A second and more recent approach, referred to as Robust Super-Resolution (RSR), proposes to improve real-world SR by harnessing the generalization capabilities of a model by making it robust to adversarial attacks. To delve further into this second approach, our paper explores the universality of various methods for enhancing the robustness of deep learning SR models. In other words, we inquire: "Which robustness method exhibits the highest degree of adaptability when dealing with a wide range of adversarial attacks ?". Our extensive experimentation on both synthetic and real-world images empirically demonstrates that median randomized smoothing (MRS) is more general in terms of robustness compared to adversarial learning techniques, which tend to focus on specific types of attacks. Furthermore, as expected, we also illustrate that the proposed universal robust method enables the SR model to handle standard corruptions more effectively, such as blur and Gaussian noise, and notably, corruptions naturally present in real-world images. These results support the significance of shifting the paradigm in the development of real-world SR methods towards RSR, especially via MRS.
Paper Structure (36 sections, 1 theorem, 13 equations, 5 figures, 12 tables)

This paper contains 36 sections, 1 theorem, 13 equations, 5 figures, 12 tables.

Table of Contents

  1. Introduction
  2. Related works
  3. Adversarial attacks and training on SR
  4. Adversarial attacks
  5. Fast Gradient Sign Method (FGSM)
  6. Basic Iterations Method (BIM)
  7. Projected Gradient Descent (PGD) CastilloAngela
  8. Carlini and Wagner attack (CW)
  9. Adversarial training
  10. The Main Method
  11. Median Randomized Smoothing (MRS)
  12. Median Randomized Smoothing for SR
  13. Super-Resolution Model
  14. CertSR
  15. Experimental Results
  16. ...and 21 more sections

Key Result

Lemma 4.1

A percentile-smoothed function $q_{p}$ with adversarial perturbation $\delta$ can be bounded as follows such that $\overline{p} = \Phi(\Phi^{-1}(p)+\frac{\epsilon}{\sigma})$ and $\underline{p} = \Phi(\Phi^{-1}(p)-\frac{\epsilon}{\sigma})$, where $\Phi$ is the standard Gaussian CDF.

Figures (5)

  • Figure 1: Visualization of both non-attacked and the corresponding attacked LR image subjected to various types of attacks, which we presented above, along with their predictions using ESRGAN LimBee, is provided in the first row. The top-left corner displays the ground truth image from the validation dataset of DIV2K AgustssonNtire2017challenge, while the clean LR image is shown below it. The LR image was attacked using FGSM, BIM, and PGD with perturbations bounded within a ball of radius $\epsilon=10/255$. For the CW attack, we utilized Adam Adam optimization to solve the problem in \ref{['CW_Optimization']} with a learning rate of $10^{-2}$ for 6 iterations and $c=0.01$.
  • Figure 2: Framework of our proposed CertSR method. In the training part, we add different samples of i.i.d. Gaussians with different standard deviations to the same LR image. We then calculate the median of predictions associated with each standard deviation. In the test part, we use MRS to certify our generator by adding sample i.i.d. Gaussians with the same standard deviation.
  • Figure 3: This figure presents the qualitative results of robust and non-robust methods for clean, sensor noise (noisy), and blurry DIV2K validation dataset.
  • Figure 4: This figure provides qualitative results concerning robust and non-robust methods against the most relevant adversarial attacks.
  • Figure 5: Qualitative results on Real-World Images. Comparison between the proposed methods including CertSR and state-of-the-art RSR method (AD-L-PGD CastilloAngela), for two corruption datasets: NTIRE and AIM. For reference, we show the input, the results of ESRGAN-FS method FritscheManuelseparationforreal-worldsuper-resolution, Impressionism method JiReal-worldsuper-resolutionviakernelestimationandnoiseinjection and the ground-truth (GT). Blue frames denote training and validation on the same dataset. Red frames denote training and validation on different datasets. The training dataset is indicated in gray just below the name of the methods.

Theorems & Definitions (1)

  • Lemma 4.1