Scale-Invariant Adversarial Attack against Arbitrary-scale Super-resolution

TL;DR

This work defines a scale-invariant adversarial attack, SIAGT, for arbitrary-scale SR based on continuous, LIIF-style representations. By partitioning the continuous image into blocks and sampling finite coordinate points, SIAGT achieves resource-efficient degradation of SR outputs that is consistent across scales, and it further improves cross-model transferability via a coordinate-dependent loss that expands neighboring coordinate differences. The attack demonstrates strong effectiveness across LIIF and classical ASSR models on multiple datasets, with notable improvements in transferability and substantial time/memory savings over scale-dependent approaches. The results highlight robustness concerns for arbitrary-scale SR and present practical applications for copyright protection, while suggesting avenues for strengthening SR systems against continuous-representation adversaries.

Abstract

The advent of local continuous image function (LIIF) has garnered significant attention for arbitrary-scale super-resolution (SR) techniques. However, while the vulnerabilities of fixed-scale SR have been assessed, the robustness of continuous representation-based arbitrary-scale SR against adversarial attacks remains an area warranting further exploration. The elaborately designed adversarial attacks for fixed-scale SR are scale-dependent, which will cause time-consuming and memory-consuming problems when applied to arbitrary-scale SR. To address this concern, we propose a simple yet effective ``scale-invariant'' SR adversarial attack method with good transferability, termed SIAGT. Specifically, we propose to construct resource-saving attacks by exploiting finite discrete points of continuous representation. In addition, we formulate a coordinate-dependent loss to enhance the cross-model transferability of the attack. The attack can significantly deteriorate the SR images while introducing imperceptible distortion to the targeted low-resolution (LR) images. Experiments carried out on three popular LIIF-based SR approaches and four classical SR datasets show remarkable attack performance and transferability of SIAGT.

Figures (14)

• Figure 1: A comparison of the SR output (by LIIF chen2021learning) between the original LR image $I^{LR}$ and the adversarial image $I^{adv}$. Under arbitrary scales, the SR output of $I^{adv}$ generated by our attack method SIAGT are all deteriorated.
• Figure 2: Time and memory comparison (on average) between scale-invariant (SI) attack (ours) and scale-dependent (SD) attack choi2019evaluating at different scales against LIIF chen2021learning on Set5 bevilacqua2012low.
• Figure 3: Diagram of SIAGT on continuous image $I$. (L) Divide $I$ into 4 blocks and query $n$ coordinates (blue point) per block. (R) To improve the attack transferability on arbitrary-scale SR task, we propose to expand the value gap between the queried coordinate ($x_i$) (blue point) with its neighboring coordinate ($x_i + \Delta g_{i}$) (orange point) to construct $L_{TR}$ loss. Here we use the top-left portion of the (L) figure to illustrate the queried coordinates and their neighboring coordinates.
• Figure 4: Performance of LIIF on handling low-frequency and high-frequency information in the image.
• Figure 5: Visualization of the attack results by different SR models. (top-left) is the original input clean image, (top-right) is the adversarial image, and (bottom) is the SR output ($\times 4$) obtained from the adversarial images.