MIGA: Mutual Information-Guided Attack on Denoising Models for Semantic Manipulation
Guanghao Li, Mingzhi Chen, Hao Yu, Shuting Dong, Wenhao Jiang, Ming Tang, Chun Yuan
TL;DR
The paper addresses the vulnerability of deep denoisers to semantic manipulation by introducing MIGA, a Mutual Information-Guided Attack that minimizes the task-relevant mutual information $I(x; D(x_{ extsc{n}}+\delta) \mid C)$. It formulates a three-loss objective with perturbation constraint, reconstruction fidelity, and a mutual-information term, and handles both known and unknown downstream tasks via cross-entropy and a MINE-based estimator, respectively. Empirical results across four denoisers and five datasets demonstrate that MIGA achieves perceptually clean outputs while systematically altering downstream semantics, revealing a security risk in real-world denoising systems. The work also proposes task-specific evaluation metrics and shows robustness to several defenses, underscoring the urgency of developing more resilient denoising techniques for safety-critical applications.
Abstract
Deep learning-based denoising models have been widely employed in vision tasks, functioning as filters to eliminate noise while retaining crucial semantic information. Additionally, they play a vital role in defending against adversarial perturbations that threaten downstream tasks. However, these models can be intrinsically susceptible to adversarial attacks due to their dependence on specific noise assumptions. Existing attacks on denoising models mainly aim at deteriorating visual clarity while neglecting semantic manipulation, rendering them either easily detectable or limited in effectiveness. In this paper, we propose Mutual Information-Guided Attack (MIGA), the first method designed to directly attack deep denoising models by strategically disrupting their ability to preserve semantic content via adversarial perturbations. By minimizing the mutual information between the original and denoised images, a measure of semantic similarity. MIGA forces the denoiser to produce perceptually clean yet semantically altered outputs. While these images appear visually plausible, they encode systematically distorted semantics, revealing a fundamental vulnerability in denoising models. These distortions persist in denoised outputs and can be quantitatively assessed through downstream task performance. We propose new evaluation metrics and systematically assess MIGA on four denoising models across five datasets, demonstrating its consistent effectiveness in disrupting semantic fidelity. Our findings suggest that denoising models are not always robust and can introduce security risks in real-world applications.