Unrevealed Threats: A Comprehensive Study of the Adversarial Robustness of Underwater Image Enhancement Models

TL;DR

Facing vulnerability of learning-based UWIE models to adversarial perturbations, the paper proposes a general white-box attack protocol and two UWIE-oriented attacks, Pixel Attack and Color Shift Attack, tested on five models with UIEB and EUVP datasets. It shows that adversarial perturbations can substantially degrade PSNR and SSIM, even when perturbations are visually imperceptible, and that adversarial training can mitigate the attacks. The study introduces an additional robustness evaluation dimension for UWIE models and demonstrates practical defense strategies with limited trade-offs on clean images. This work informs secure deployment of UWIE systems in underwater exploration and monitoring.

Abstract

Learning-based methods for underwater image enhancement (UWIE) have undergone extensive exploration. However, learning-based models are usually vulnerable to adversarial examples so as the UWIE models. To the best of our knowledge, there is no comprehensive study on the adversarial robustness of UWIE models, which indicates that UWIE models are potentially under the threat of adversarial attacks. In this paper, we propose a general adversarial attack protocol. We make a first attempt to conduct adversarial attacks on five well-designed UWIE models on three common underwater image benchmark datasets. Considering the scattering and absorption of light in the underwater environment, there exists a strong correlation between color correction and underwater image enhancement. On the basis of that, we also design two effective UWIE-oriented adversarial attack methods Pixel Attack and Color Shift Attack targeting different color spaces. The results show that five models exhibit varying degrees of vulnerability to adversarial attacks and well-designed small perturbations on degraded images are capable of preventing UWIE models from generating enhanced results. Further, we conduct adversarial training on these models and successfully mitigated the effectiveness of adversarial attacks. In summary, we reveal the adversarial vulnerability of UWIE models and propose a new evaluation dimension of UWIE models.

Figures (8)

• Figure 1: Overall pipline of our study. In (a), the adversarial example $x^{\text{adv}}$makes the model $f(\cdot)$ generate unacceptable results. With our defense strategy, the defended model $f_{\text{d}}(\cdot)$ resists such attacks in (b). (c) demonstrates how we generate the adversarial example by utilizing the ground-truth $y$, where $\mathfrak{G} (\cdot)$ represents the adversarial attack method. In the defense process in (d), $x$ and $x^{\text{adv}}$ are both used for updating network parameters $\theta$ to help $f_{\text{d}}(\cdot)$ resist adversarial attacks.
• Figure 2: Quantitive results of adversarial attacks. PSNR and SSIM of undefended UWIE models under adversarial attack on dataset EUVP-I, with $\epsilon\in\{1/255, 2/255, 4/255, 8/255\}$ and iterations $t \in \{1, 5, 10, 15, 20\}$.
• Figure 3: Visual results of adversarial attacks. For each row, the images are degraded input, adversarial examples, original outputs, adversarial outputs of ADMNNet, and ground truth from left to right.
• Figure 4: Quantitive results of adversarial training. Each column demonstrates the PSNR and SSIM of defended UWIE models. AT represents UWIE models that undergo adversarial training and NT represents those not.
• Figure 5: Visual results of two different adversarial attacks. Each row represents the original outputs, the adversarial outputs of Pixel Attack, and the adversarial outputs of Color Shift Attack from up to down. Each column represents different instances.