# Pasadena: Perceptually Aware and Stealthy Adversarial Denoise Attack

arXiv: https://arxiv.org/abs/2007.07097 · HTML: https://mlsanity.com/paper/2007.07097/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jul 2020.

## Built on by (most cited first, 14 of 14)

- [AVA: Adversarial Vignetting Attack against Visual Recognition](https://mlsanity.com/paper/2105.05558/) (2021)
- [NPC: Neuron Path Coverage via Characterizing Decision Logic of Deep Neural Networks](https://mlsanity.com/paper/2203.12915/) (2022)
- [Adversarial Relighting Against Face Recognition](https://mlsanity.com/paper/2108.07920/) (2021)
- [Learning to Adversarially Blur Visual Object Tracking](https://mlsanity.com/paper/2107.12085/) (2021)
- [Black-box Targeted Adversarial Attack on Segment Anything (SAM)](https://mlsanity.com/paper/2310.10010/) (2023)
- [ArchRepair: Block-Level Architecture-Oriented Repairing for Deep Neural Networks](https://mlsanity.com/paper/2111.13330/) (2021)
- [Evaluating Similitude and Robustness of Deep Image Denoising Models via Adversarial Attack](https://mlsanity.com/paper/2306.16050/) (2023)
- [Natural & Adversarial Bokeh Rendering via Circle-of-Confusion Predictive Network](https://mlsanity.com/paper/2111.12971/) (2021)
- [Stealthy Physical Masked Face Recognition Attack via Adversarial Style Optimization](https://mlsanity.com/paper/2309.09480/) (2023)
- [Benchmarking Shadow Removal for Facial Landmark Detection and Beyond](https://mlsanity.com/paper/2111.13790/) (2021)
- [STBA: Towards Evaluating the Robustness of DNNs for Query-Limited Black-box Scenario](https://mlsanity.com/paper/2404.00362/) (2024)
- [Semantic Adversarial Attacks on Face Recognition through Significant Attributes](https://mlsanity.com/paper/2301.12046/) (2023)
- [Defending Adversarial Patches via Joint Region Localizing and Inpainting](https://mlsanity.com/paper/2307.14242/) (2023)
- [MIGA: Mutual Information-Guided Attack on Denoising Models for Semantic Manipulation](https://mlsanity.com/paper/2503.06966/) (2025)

## Abstract (arXiv)

Image denoising can remove natural noise that widely exists in images captured by multimedia devices due to low-quality imaging sensors, unstable image transmission processes, or low light conditions. Recent works also find that image denoising benefits the high-level vision tasks, e.g., image classification. In this work, we try to challenge this common sense and explore a totally new problem, i.e., whether the image denoising can be given the capability of fooling the state-of-the-art deep neural networks (DNNs) while enhancing the image quality. To this end, we initiate the very first attempt to study this problem from the perspective of adversarial attack and propose the adversarial denoise attack. More specifically, our main contributions are three-fold: First, we identify a new task that stealthily embeds attacks inside the image denoising module widely deployed in multimedia devices as an image post-processing operation to simultaneously enhance the visual image quality and fool DNNs. Second, we formulate this new task as a kernel prediction problem for image filtering and propose the adversarial-denoising kernel prediction that can produce adversarial-noiseless kernels for effective denoising and adversarial attacking simultaneously. Third, we implement an adaptive perceptual region localization to identify semantic-related vulnerability regions with which the attack can be more effective while not doing too much harm to the denoising. We name the proposed method as Pasadena (Perceptually Aware and Stealthy Adversarial DENoise Attack) and validate our method on the NeurIPS'17 adversarial competition dataset, CVPR2021-AIC-VI: unrestricted adversarial attacks on ImageNet,etc. The comprehensive evaluation and analysis demonstrate that our method not only realizes denoising but also achieves a significantly higher success rate and transferability over state-of-the-art attacks.