A Physically-Grounded Attack and Adaptive Defense Framework for Real-World Low-Light Image Enhancement

Abstract

Limited illumination often causes severe physical noise and detail degradation in images. Existing Low-Light Image Enhancement (LLIE) methods frequently treat the enhancement process as a blind black-box mapping, overlooking the physical noise transformation during imaging, leading to suboptimal performance. To address this, we propose a novel LLIE approach, conceptually formulated as a physics-based attack and display-adaptive defense paradigm. Specifically, on the attack side, we establish a physics-based Degradation Synthesis (PDS) pipeline. Unlike standard data augmentation, PDS explicitly models Image Signal Processor (ISP) inversion to the RAW domain, injects physically plausible photon and read noise, and re-projects the data to the sRGB domain. This generates high-fidelity training pairs with explicitly parameterized degradation vectors, effectively simulating realistic attacks on clean signals. On the defense side, we construct a dual-layer fortified system. A noise predictor estimates degradation parameters from the input sRGB image. These estimates guide a degradation-aware Mixture of Experts (DA-MoE), which dynamically routes features to experts specialized in handling specific noise intensities. Furthermore, we introduce an Adaptive Metric Defense (AMD) mechanism, dynamically calibrating the feature embedding space based on noise severity, ensuring robust representation learning under severe degradation. Extensive experiments demonstrate that our approach offers significant plug-and-play performance enhancement for existing benchmark LLIE methods, effectively suppressing real-world noise while preserving structural fidelity. The sourced code is available at https://github.com/bywlzts/Attack-defense-llie.

Figures (7)

• Figure 1: Visual comparison of existing LLIE methods against our proposed approach. While current methods demonstrate good brightness recovery, they often suffer from subpar noise suppression, as highlighted by the noisy regions. Our proposed adversarial framework demonstrably provides superior noise reduction while maintaining structural fidelity.
• Figure 2: Comparison of different LLIE training paradigms. (a) Data augmentation-based methods treat LLIE as a passive black-box mapping from augmented low-light inputs. (b) Degradation + contrastive learning methods generate negative samples via handcrafted degradations, but often overlook the physical nature of sensor noise and lack adaptation to degradation severity. (c) Our adversarial framework employs a physics-guided RAW domain attack for plausible noise and explicit priors. A sentinel noise predictor offers explicit noise awareness, while adaptive architectural and metric defenses respond to attack severity for targeted noise suppression and robust enhancement.
• Figure 3: Overview of the proposed physics-based adversarial framework. Attack stream (left, red):PDS analytically inverts clean sRGB images to the linear RAW domain, injects Poisson and Gaussian noise parameters $(k,\sigma)$ for sensor-level attacks, and re-projects the corrupted signal to sRGB via a forward ISP to generate realistic physics-based degraded samples with ground-truth physical priors ($\mathcal{P}_{att}$). Defense stream (right, green): A sentinel Noise Predictor estimates degradation parameters ($\mathcal{P}_{pre}$) from the low-light input and uses them to gate/modulate DA-MoE blocks and SFT layers, trained with a Dual-Domain Self-Supervised Loss. The DA-MoE is plug-and-play for existing enhancement backbones, and the AMD further adjusts the margin $m$ according to the injected noise parameters ($\mathcal{P}_{att}$) to maintain appropriate feature distances under varying degradation severities.
• Figure 4: Comparison of noise variance against signal intensity. The bottom grayscale strip represents increasing brightness. Naive sRGB-domain injection (orange) shows intensity-invariant variance, inconsistent with real sensors. In contrast, our PDS noise (red), generated via RAW-domain Poisson-Gaussian injection and ISP reprocessing, exhibits clear signal-dependent variance. This underscores the necessity of RAW-domain physics-based noise modeling for realistic low-light degradations.
• Figure 5: Visual comparison on the LOL-Blur dataset. The first two columns are the input and ground truth. For each method, we show the baseline result and its enhanced variant, where "+" indicates integrating our proposed adversarial framework. Zoom in for better inspection of noise suppression.