{"id":"70c21269-fcad-418c-8fb7-e0ea0de3049d","arxiv_id":"2504.17829","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Pre-trained single-image dehazing transformers are vulnerable to one-pixel and small L-infinity perturbations, and scale-and-bias or linear-adapter fine-tuning with adversarial training restores much of the robustness on RESIDE-Outdoor and two remote sensing datasets.","lead":"Dehazing systems that clean up hazy photos or drone images can be tricked by tiny adversarial changes, and a single altered pixel can cut output quality by about 2.8 dB. The authors propose two lightweight ways to fine-tune pre-trained dehazing transformers so they stay accurate while resisting such attacks, which matters for remote sensing and autonomous UAV applications.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Robustness gains are only measured under the exact attack used for training (same ℓ∞ budget, q=1 loss), with no adaptive or stronger attack; Table II also shows clean PSNR drops up to 5.2 dB, contradicting 'comparable clean performance'.","rationale":"In good faith, the paper does what it says: it defines a threat model, applies two standard attacks, and compares base versus fine-tuned models under that threat model. The vulnerability of base models to the reported PGD/OnePixel attacks is supported by Table II. The issue is not that the experiments are fabricated; it is that the headline 'significantly increasing protection' is only shown for the exact attack/defense configuration used during training. The known gradient-masking failure mode means the reported numbers cannot be taken at face value as a general robustness guarantee. The 'comparable clean performance' phrase is also contradicted by several entries in Table II, so the paper should either qualify the claim or report the accuracy-robustness trade-off per configuration. These are exactly the bases for a conditional verdict: the paper's conclusions are plausible but require an adaptive attack check and a more honest clean-performance characterization before acceptance. This leaves the reader's CONDITIONAL verdict unchanged.","tokens_in":7784,"tokens_out":7256,"duration_ms":68318,"concrete_test":"Run an adaptive attack evaluation on the LINEAD-AT and LINEAD-TRADES (λ=0.5) models from Table II: use PGD with the same 1/255 ℓ∞ budget but with the objective q=2 (MSE) and with an SSIM-based loss, 100 iterations, step size (1/255)/4, and 10 random restarts. If the adversarial PSNR of the fine-tuned models stays close to the reported values while the base model collapses, the robustness claim holds under a stronger, defense-agnostic search; if the fine-tuned PSNR drops toward base-model levels, the reported protection is an artifact of evaluating with the training attack.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that SB and LINEAD significantly increase protection against adversarial data rests on Table II's PGD-based ℓ∞ numbers. In Section II-A the attack objective is fixed to q=1, and in Section IV-A both AT and TRADES craft adversarial examples with the same ∥z∥∞=1/255 budget. Evaluation then uses the same attack, the same q=1 objective, and the same 1/255 budget, with no attack-iteration sweep, no random-restart or adaptive evaluation, and no alternative loss (e.g., MSE or SSIM). Under these conditions a defense can appear robust because the optimizer fails to find adversarial examples, not because the network is genuinely robust. This is a known failure mode for PGD-based defenses and directly threatens the 'protection' half of the claim. A second internal problem is the 'comparable clean performance' statement: in Table II, SB/AT clean PSNR drops from 33.71 to 29.08 (DehazeFormer-T) and from 34.86 to 29.64 (DehazeFormer-B), and LINEAD/AT drops to 31.13 on DehazeFormer-B; these are 2.2–5.2 dB losses, not 'comparable'.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies adversarial robustness of three pre-trained dehazing transformers (DehazeFormer-T, MB-TaylorFormer-B, DehazeFormer-B). It defines two attacks: a PGD-style L-infinity attack with an L1 objective and a modified one-pixel (L0) attack. It then proposes two lightweight fine-tuning strategies, Scale-and-Bias (SB) and LINEar ADaptation (LINEAD), and combines them with adversarial training (AT) and TRADES regularization. Experiments on RESIDE-Outdoor show that the base models are vulnerable to small perturbations and that the fine-tuned models improve robustness under the tested attacks, with additional evaluation on two remote-sensing datasets (HazyDet UAV and RICE-I) to demonstrate out-of-distribution transfer. The abstract claims that the methods achieve comparable clean performance while significantly increasing protection against adversarial data.","tokens_in":7948,"tokens_out":5508,"duration_ms":53133,"significance":"If the claims are fully supported, the paper would provide a practical parameter-efficient recipe for hardening dehazing transformers and would demonstrate that robustness partially transfers to out-of-distribution remote-sensing data. Strengths include the use of several modern transformer architectures, the evaluation on two external datasets, and the plan to release source code. However, the significance is substantially limited by two issues: the 'comparable clean performance' claim is contradicted by several entries in Table II, and the robustness evaluation is largely matched to the exact attack used in training, with no adaptive or alternative attacks. These issues affect the central claim and must be addressed before the results can be taken at face value.","major_comments":[{"comment":"The abstract's claim of 'comparable clean performance' is not supported by Table II. For example, on DehazeFormer-T the clean PSNR drops from 33.71 dB for the base model to 29.08 dB with SB AT and to 31.48 dB with LINEAD AT; on DehazeFormer-B it drops from 34.86 dB to 29.64 dB with SB AT and to 31.13 dB with LINEAD AT. Only the LINEAD TRADES variant with lambda=0.1 retains near-base clean PSNR (33.65 vs 33.71) on DehazeFormer-T, but at that setting the robustness gain at epsilon=1/255 is tiny (17.06 dB vs 16.26 dB for the base). The paper should either revise the abstract to qualify the clean-performance trade-off or report configurations that actually achieve comparable clean performance with meaningful robustness gains.","section":"Abstract and Table II"},{"comment":"The robustness evaluation is matched to the attack used for training: both AT and TRADES generate adversarial examples with the same L-infinity budget (1/255) and the same L1 objective (q=1) that is later used to evaluate robustness in Table II. Although the paper also reports results under a 4/255 budget, that evaluation still uses the same PGD-style attack and the same L1 objective. No adaptive attacks, no PGD iteration or restart sweeps, and no alternative loss functions (e.g., MSE or SSIM-based attacks) are reported. Under these conditions, the measured gains may partly reflect the defense being optimized for the exact attack that is used to evaluate it, rather than a genuinely more robust dehazing network. The central claim that the methods 'significantly increase protection against adversarial data' requires a broader, defense-aware attack evaluation.","section":"Section II-A and Section IV-A"},{"comment":"The TRADES regularization weight lambda is selected on the same RESIDE-Outdoor test set that is used for the final reported numbers. For DehazeFormer-T, Table II reports results for lambda=1.0, 0.5, and 0.1, and the text states that '0.5 worked best' without mentioning a separate validation split. Selecting hyperparameters on the test set invalidates the clean/robust trade-off comparison and risks overstating the best-case outcome. The authors should either use a proper validation set for model selection or explicitly state that the reported numbers are selection results rather than independent test-set evaluations.","section":"Section IV-A and Table II"},{"comment":"The attack implementation is underspecified. The L-infinity attack is described only as a 'standard first-order gradient method' with no mention of the number of PGD iterations, step size, number of random restarts, or convergence criteria. The L0/OnePixel attack is also described without key details such as the optimization algorithm, population size, number of generations, or maximum evaluations. Since the paper's empirical conclusions rest entirely on these attacks, the missing details make the results unreproducible and make it impossible to assess the actual strength of the attacks. Please provide complete attack configurations in the manuscript or in the released code.","section":"Section II-A and Section IV-A"}],"minor_comments":[{"comment":"The sentence 'Our methods results in comparable clean performance' contains a subject-verb agreement error; it should be 'Our methods result in comparable clean performance.'","section":"Abstract"},{"comment":"LINEAD tunes 41.5% to 43.6% of the network parameters (Table I), which is difficult to reconcile with the description of both SB and LINEAD as 'lightweight' fine-tuning strategies. Consider qualifying the term or distinguishing SB as the truly lightweight option.","section":"Table I and Section III-A"},{"comment":"The sentence 'Red indicates a drop below the original PSNR value' appears in the body text after Table III, but no red coloring is visible in the printed table. Please clarify the intended color coding or remove the sentence.","section":"Table III"},{"comment":"The fine-tuning procedure uses 5000 random patches per epoch, but the paper does not state whether the random sampler is seeded or whether results are averaged over multiple runs. Single-run results without variance or significance tests make it hard to judge whether small differences (e.g., 30.92 vs 31.48 dB) are meaningful.","section":"Section IV-A"},{"comment":"The notation 'l0-attack' is used inconsistently; the text elsewhere uses the Unicode symbol 'ℓ0'. Please use a consistent notation throughout.","section":"Section II-A"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a relevant and timely problem, but the central claims are currently stronger than the evidence. The clean-performance contradiction in Table II and the matched-attack evaluation are both load-bearing and need to be fixed before publication. The authors should also be asked to clarify the relationship to the prior dehazing attack work in [15], since the claim of being 'one of the first' robustness analyses for dehazing is somewhat undercut by that reference. If the authors can provide a proper validation split for lambda, a more complete attack evaluation, and a carefully calibrated abstract, the paper could become a solid contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a competent within-subfield paper. It applies DiffFit-style scale-and-bias adapters and linear adapters, plus TRADES and adversarial training, to pre-trained dehazing transformers, and shows that the fine-tuned models are more resistant to PGD l-infinity and one-pixel attacks under the tested budgets. The out-of-distribution tests on HazyDet and RICE-I are genuinely external and are the most convincing part of the paper; those results suggest the robustness partly transfers beyond RESIDE-Outdoor.\n\nThe novel bits are modest but real: a OnePixel variant adapted for image-to-image networks, and the first demonstration that lightweight adapters can harden dehazing transformers without full re-training. The paper is clearly written, the attack definitions are reasonable, and the parameter counts in Table I give a fair sense of the tuning cost.\n\nThe soft spots are concentrated in the evaluation. The robustness numbers come from the same attack configuration used during training: same l-infinity budget of 1/255, same q=1 objective, same PGD-style procedure. There is no adaptive attack, no iteration sweep, no random restart, and no alternative loss like MSE or SSIM. That leaves the measured gains vulnerable to the optimizer-failure artifact. I do not think this invalidates the qualitative story, but it does mean the 'protection' claim is only established for a narrow attack class. Second, the abstract says 'comparable clean performance,' but Table II shows clean PSNR drops of 2.2 to 5.2 dB for several SB/AT and LINEAD/AT configurations. The claim is defensible only for LINEAD with TRADES at low lambda. Third, the TRADES lambda was selected after looking at the RESIDE-Outdoor test numbers; there is no validation split. Fourth, there are no error bars or multiple seeds, so it is hard to tell whether the differences between methods are meaningful.\n\nThese are fixable issues, not fundamental ones. The remote sensing transfer results are the strongest evidence, and the overall direction is sensible. I would send this to a serious referee, but I would ask for an adaptive-attack evaluation, a proper validation split for lambda, multiple seeds with error bars, and a more careful wording of the clean-performance claim. The code link helps reproducibility. This is the kind of paper that would be useful to someone working on adversarial robustness for low-level vision or remote sensing dehazing, though I would not rely on the current robustness numbers without an adaptive evaluation.\n\nRecommendation: peer review it, with the expectation of a revised version.","headline":"A decent empirical study of parameter-efficient adversarial fine-tuning for dehazing transformers, with a real transfer result to remote sensing data, but the robustness claim is only shown under the exact attack used in training and the abstract overstates the clean-performance preservation.","tokens_in":8595,"tokens_out":2295,"would_cite":false,"duration_ms":24355,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that pre-trained single-image dehazing transformers are highly vulnerable to imperceptible adversarial noise—a single-pixel change can drop PSNR by up to 2.8 dB—and that two lightweight fine-tuning strategies…","keywords":["adversarial robustness","image dehazing","transformers","parameter-efficient fine-tuning","adversarial training","TRADES","remote sensing","one-pixel attack"],"falsifier":"Run a stronger attack than the one used for evaluation—for example, multi-restart PGD with 50 or more iterations, a larger budget such as 2/255, or an adaptive attack that backpropagates through the full fine-tuned model including the adapters—and check whether the fine-tuned models' PSNR under attack remains clearly above the base models' and above the hazy input's PSNR. If the gains shrink to a few dB or disappear under such attacks, the claim of 'significantly increasing protection' would be overstated.","tokens_in":7460,"feed_emoji":"🌫️","tokens_out":7147,"duration_ms":60495,"temperature":0.7,"pith_summary":"The paper shows that state-of-the-art image-to-image dehazing transformers—MB-TaylorFormer-B, DehazeFormer-T, and DehazeFormer-B—are vulnerable to adversarial perturbations, with even a one-pixel change decreasing output PSNR by as much as 2.8 dB on RESIDE-Outdoor. To counter this, it proposes fine-tuning only a small set of newly introduced parameters: trainable scale-and-bias vectors after each attention block (SB) or identity-initialized linear convolutions (LINEAD), combined with adversarial training or a TRADES-style regularization loss. These methods require tuning only a tiny fraction of the model's parameters, yet they keep clean-data PSNR comparable to the pre-trained base while substantially raising attack-time PSNR under an L-infinity budget of 1/255 per pixel and under one-pixel L0 attacks. The same fine-tuned models also resist attacks on out-of-distribution remote sensing datasets such as HazyDet UAV and RICE-I, where the base models' outputs degrade below the quality of the original hazy image.","feed_headline":"One-pixel noise cuts dehazing PSNR by 2.8 dB; fine-tuning blocks it","feed_subtitle":"Scale-and-bias and linear adapters shield pre-trained dehazing models from hidden pixel noise.","key_machinery":"The load-bearing mechanism is parameter-efficient fine-tuning of a frozen pre-trained dehazing transformer: after each Transformer/Attention block, the authors insert either per-channel scale and bias terms (SB, inspired by DiffFit) or trainable 3x3 convolutional layers initialized as identities (LINEAD). These adapters are the only parameters updated during adversarial fine-tuning, with adversarial examples crafted on the fly using a PGD-style L-infinity attack (budget 1/255) against a q=1 dissimilarity objective, and optionally a TRADES regularization term that enforces output consistency between clean and adversarial inputs. The identity initialization keeps the pre-trained mapping intact at the start, so the adapters gradually learn to absorb perturbations while preserving clean-image output.","core_discovery":"The central claim is that lightweight fine-tuning of frozen pre-trained dehazing transformers can achieve strong adversarial robustness without retraining from scratch. By inserting trainable scale-and-bias parameters (SB) or identity-initialized 3x3 linear layers (LINEAD) after each Transformer/Attention block, and updating only those parameters under an adversarial loss, the paper obtains models whose clean PSNR is close to the pre-trained original while attack-time PSNR under a 1/255 L-infinity attack rises by roughly 10 dB (for DehazeFormer-T, from about 16.3 dB to 26.5 dB with LINEAD+AT). The robustness also transfers to two remote sensing dehazing datasets, where the fine-tuned models keep PSNR above the hazy input under attack, unlike the base models that collapse below it.","pith_inferences":["Because the attack budget used for training (1/255) is identical to the budget used for evaluation, the reported robustness gains are likely an upper bound; testing with held-out budgets or adaptive attacks would probably reveal a smaller, though still positive, effect.","The success of identity-initialized linear adapters suggests that adversarial robustness can be learned as a low-rank correction on top of a frozen representation, a pattern that may extend to other image restoration tasks such as super-resolution or deraining.","The larger PSNR drop under one-pixel attacks for the bigger DehazeFormer-B hints that model capacity increases the diversity of exploitable features, so robustness measures may need to scale with model size."],"forward_implications":["Deployable dehazing systems can be hardened against imperceptible adversarial noise by fine-tuning only a tiny fraction of parameters—as low as 0.006% for SB—avoiding costly retraining from scratch.","Adversarial robustness transfers across domains: models fine-tuned on synthetic outdoor haze data remain robust on drone-view and satellite-imagery haze, which matters for remote sensing autonomy.","The clean-versus-robust trade-off can be controlled through the TRADES hyperparameter lambda, letting practitioners pick an operating point suited to their risk tolerance.","The one-pixel attack results (up to a 2.84 dB PSNR drop on the largest model) show that even minimal tampering can meaningfully degrade dehazing output, so robustness evaluation should accompany model deployment."],"supporting_citations":[{"why":"It supplies the first gradient-based attack against dehazing models that the paper's L-infinity attack builds on.","marker":"[15]"},{"why":"It provides the PGD attack and adversarial training procedure used to craft and fine-tune robust models.","marker":"[12]"},{"why":"It defines the TRADES robustness-accuracy trade-off loss used as the regularization alternative.","marker":"[18]"},{"why":"It introduces the OnePixel attack that the paper adapts to image-to-image dehazing as its L0 attack.","marker":"[16]"},{"why":"It describes the parameter-efficient DiffFit adaptation that inspired the Scale-and-Bias strategy.","marker":"[21]"},{"why":"It is the source of the MB-TaylorFormer-B base architecture.","marker":"[3]"},{"why":"It is the source of the DehazeFormer-T and DehazeFormer-B base architectures.","marker":"[4]"},{"why":"It provides the RESIDE-Outdoor dataset used for fine-tuning and in-distribution evaluation.","marker":"[7]"},{"why":"It provides the HazyDet UAV dataset used for out-of-distribution remote sensing evaluation.","marker":"[9]"},{"why":"It provides the RICE-I remote sensing dataset used for out-of-distribution evaluation.","marker":"[22]"}],"fun_headline_variants":["Lightweight fine-tuning shields dehazing transformers from 1-pixel attacks","Adversarial fine-tuning boosts dehazing robustness by 10 dB","Fine-tune a few parameters to make dehazing transformers robust","Only add small adapters to make dehazing transformers resist attacks","Scale-and-bias fine-tuning hardens dehazing transformers against noise"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The robustness conclusion rests on the premise that the PGD-style L-infinity attack with q=1 and the OnePixel-derived L0 attack are strong and representative enough to characterize adversarial vulnerability, since the paper uses the same 1/255 budget for both crafting and evaluating and reports no adaptive or stronger multi-restart attacks.","fun_headline_variants_meta":{"raw":{"variants":["Lightweight fine-tuning shields dehazing transformers from 1-pixel attacks","Adversarial fine-tuning boosts dehazing robustness by 10 dB","Fine-tune a few parameters to make dehazing transformers robust","Only add small adapters to make dehazing transformers resist attacks","Scale-and-bias fine-tuning hardens dehazing transformers against noise"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000989,"raw_usage":{"total_tokens":4162,"prompt_tokens":886,"completion_tokens":3276,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":502,"completion_tokens_details":{"reasoning_tokens":3186}},"tokens_in":502,"tokens_out":3276,"duration_ms":22426,"temperature":1.0,"reasoning_tokens":3186,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:41:32.200068+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a stronger attack than the one used for evaluation—for example, multi-restart PGD with 50 or more iterations, a larger budget such as 2/255, or an adaptive attack that backpropagates through the full fine-tuned model including the adapters—and check whether the fine-tuned models' PSNR under attack remains clearly above the base models' and above the hazy input's PSNR. If the gains shrink to a few dB or disappear under such attacks, the claim of 'significantly increasing protection' would be overstated.","supporting_citations":[{"cited_title":"Fool- ing the image dehazing models by first order gradient,","cited_arxiv_id":null,"evidence_quote":"It supplies the first gradient-based attack against dehazing models that the paper's L-infinity attack builds on."},{"cited_title":"Towards deep learning models resistant to adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"It provides the PGD attack and adversarial training procedure used to craft and fine-tune robust models."},{"cited_title":"Theoretically principled trade-off between robustness and accuracy,","cited_arxiv_id":null,"evidence_quote":"It defines the TRADES robustness-accuracy trade-off loss used as the regularization alternative."},{"cited_title":"One pixel attack for fooling deep neural networks,","cited_arxiv_id":null,"evidence_quote":"It introduces the OnePixel attack that the paper adapts to image-to-image dehazing as its L0 attack."},{"cited_title":"Difffit: Unlocking transferability of large diffusion models via simple parameter-efficient fine-tuning,","cited_arxiv_id":null,"evidence_quote":"It describes the parameter-efficient DiffFit adaptation that inspired the Scale-and-Bias strategy."},{"cited_title":"Mb-taylorformer: Multi-branch efficient transformer expanded by taylor formula for image dehazing,","cited_arxiv_id":null,"evidence_quote":"It is the source of the MB-TaylorFormer-B base architecture."},{"cited_title":"Vision transformers for single image dehazing,","cited_arxiv_id":null,"evidence_quote":"It is the source of the DehazeFormer-T and DehazeFormer-B base architectures."}],"review_version":1}