Pith. sign in

REVIEW 4 major objections 5 minor 33 references

Adversarial Transferability in Deep Denoising Models: Theoretical Insights and Robustness Enhancement via Out-of-Distribution Typical Set Sampling

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adversarial noise fools every denoising model because it leaves the Gaussian typical set; sampling from that outer set restores robustness.

desk verdict Interesting empirical phenomenon and a plausible-sounding story, but the proof of causality is missing and the defense gains look like generic higher-variance augmentation. read the letter →

arxiv 2412.05943 v1 pith:7I45II3M submitted 2024-12-08 cs.CV

Jie Ning , Jiebao Sun , Shengzhu Shi , Zhichang Guo , Yao Li , Hongwei Li , Boying Wu This is my paper · ORCID
classification cs.CV MSC 94A0868U1068Q32
keywords imagedenoisingadversarialtransferabilitytypicalsetasymptoticequipartitionpropertydefenseout-of-distributionsamplingGaussiannoisehigh-dimensionalgeometry
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the striking transferability of adversarial attacks across deep image denoising models—CNN, Transformer, unfolding, and plug-and-play alike—is a consequence of the geometry of Gaussian noise in high dimensions. Because denoising models are trained on i.i.d. Gaussian noise, they effectively learn the typical set that this noise occupies, which is a thin spherical shell. The paper proves that even very small adversarial perturbations move the input outside this typical set, with the largest deviation occurring when the perturbation points along the Gaussian noise direction; all models fail for the same reason, which is why a single perturbation defeats every model. This diagnosis yields a defense: a training strategy, Out-of-Distribution Typical Set Sampling (TS), that augments Gaussian noise with samples of lower log-probability density, drawn from the larger typical set that adversarial samples actually live in. The authors show that TS training improves robustness against L2- and L∞-bounded adversarial attacks while preserving or slightly improving ordinary denoising performance.

What carries the argument

The typical set of i.i.d. Gaussian noise, defined through the asymptotic equipartition property and the weak law of large numbers, is the object that carries the argument. In n dimensions the typical set is a thin spherical shell with radius √(nσ²) and volume bounded by approximately (√(2πe)σ)^n; the paper derives explicit bounds (Theorem 3.6, Theorem 3.8, Theorem 3.13, Propositions 3.14–3.16) showing that an adversarial perturbation of size η keeps the perturbed vector inside a larger typical set while moving it out of the training set. This geometry tells the authors where to sample: their TS algorithm repeatedly draws Gaussian noise and keeps samples with progressively lower log-pdf, so training covers the larger typical set that adversarial samples actually occupy.

What would settle it

Construct an input whose log-density is the same as an adversarial sample but whose perturbation direction is not aligned with the Gaussian noise direction, and test whether the denoiser fails equally hard; if the failure disappears, the claim that typical-set deviation alone, rather than direction, is the causal mechanism would be undermined.

Watch

Extended reading notes

Core claim

The central discovery, on the paper's own terms, is that the manifold of adversarial perturbations for a deep denoising model is essentially the complement of the Gaussian typical set from which training noise is drawn, so the same small perturbation that moves one sample off that manifold transfers to every model trained on Gaussian noise. Using the asymptotic equipartition property, the paper proves that a Gaussian vector in n dimensions lies, with probability approaching one, in a typical set of volume roughly (√(2πe)σ)^n and concentrated on the sphere ‖x‖₂² ≈ nσ²; an adversarial perturbation of radius η in L2 or L∞ leaves this set but remains in a slightly larger typical set whose size is bounded in Propositions 3.15 and 3.16. The paper therefore claims that the high adversarial transferability observed in image denoising is not a property of the attack, but of the shared Gaussian-noise statistics that all denoisers learn.

Load-bearing premise

The argument rests on the premise that a denoiser trained only on Gaussian-noise inputs from the typical set will fail on any input that leaves this set, i.e., low log-density under the training Gaussian distribution is by itself sufficient to cause large denoising error.

Editorial extensions

If this is right

  • If the typical-set explanation is correct, any denoiser trained with i.i.d. Gaussian noise will exhibit adversarial transferability regardless of architecture, dataset, or training procedure.
  • The TS training strategy can be applied to any denoising model without changing its structure, improving robustness with no loss, or a slight gain, in Gaussian denoising quality.
  • Because adversarial samples are confined to a slightly larger typical set, robustness can be increased by sampling from that set directly instead of generating adversarial samples, avoiding the computational cost of adversarial training.
  • The sphere-shell picture predicts that a model's failure under perturbation can be predicted by measuring how far the input lies from this shell, which could guide detection as well as defense.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension of the paper's logic is that input preprocessing that projects a perturbed image back onto the typical set, for instance by rescaling the norm of the noise component, could blunt attacks without any retraining.
  • If the mechanism is correct, the same typical-set analysis should apply to any regression task trained on a known noise distribution, not just Gaussian denoising, and to other noise families with similar concentration-of-measure behavior.
  • The theory predicts that high transferability will disappear if training noise is sampled uniformly from a broader shell rather than from the strict typical set; this is testable by retraining an existing model on TS-augmented data and measuring transfer across different architectures.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper studies adversarial transferability in deep image denoising models. It proposes that all denoising models learn the same Gaussian-noise typical set; adversarial perturbations push the noisy input out of this typical set, causing model failure and explaining why adversarial samples transfer across architectures. The authors prove concentration bounds: Theorem 3.6 locates Gaussian noise on a sphere; Lemmas 3.7 and 3.12 bound the log-density change under L2/L∞ perturbations; Theorems 3.8 and 3.13 show the perturbed sample remains in a larger typical set; Propositions 3.14–3.16 bound typical-set volumes. They then propose TS sampling, which draws Gaussian noise with lower log-density during training, and report experiments on DnCNN, DnCNN-B, CTNet, and DeamNet showing reduced performance loss under Denoising-PGD attacks while preserving Gaussian denoising quality, plus comparisons with mixed-noise training. Central claims: (i) high transferability is caused by the common Gaussian-noise distribution rather than structure or dataset; (ii) adversarial samples deviate from the typical set; (iii) such deviation is the cause of model failure; (iv) TS sampling defends by sampling a larger typical set.

Significance. If the causal story were established, the paper would give a first-principles explanation for a striking phenomenon (near-universal adversarial transferability in denoising) and a parameter-light defense that improves rather than sacrifices denoising quality, with the typical-set mechanism connecting to the existing 'concentration of measure' robustness literature. The paper also ships a self-contained AEP derivation for the Gaussian case and supports it with a hypothesis-testing experimental sequence (excluding architecture and training-data similarity, showing local patch attacks, and demonstrating direction dependence). As it stands, however, the load-bearing claim that typical-set deviation causes model failure is not derived and the defense experiments do not isolate that mechanism, so the significance is conditional on a gap that the manuscript itself acknowledges only implicitly.

major comments (4)
  1. [§3.4.5, item 3] The central causal claim is asserted, not proven: the text states that because models 'only learn from the typical set during training, they never encounter perturbations that deviate samples from this set. Thus, the models have difficulties to generalize on the adversarial samples.' None of the preceding theorems (3.6, 3.8, 3.13) involve the denoiser f, its loss, or its output error; they only bound the log-density of the input distribution. No Lipschitz, smoothness, or training-consistency condition links log-density under the training Gaussian to reconstruction error. As written, an input with low Gaussian density could in principle be denoised perfectly (e.g., a constant offset is perfectly corrected by any shift-equivariant denoiser), so the inference from concentration of measure to failure needs a theorem or a controlled experiment.
  2. [§3.1, Observation 2 and §3.4.3, Remark 1] The observation that only perturbations parallel to the Gaussian noise are harmful is consistent with a simpler mechanism than typical-set deviation: for n large, a parallel perturbation of norm η changes the log-density by about η√n/σ, while the observed severe failures occur at exactly that alignment. The paper's Theorems 3.8 and 3.13 give only set-containment results; Remark 1 claims the 'maximum difference' in density for parallel perturbations, which is a statement about the input distribution, not about the model. The experiment in §3.1 thus does not discriminate between 'deviation from the typical set' and 'increase of effective noise magnitude' as the cause of failure.
  3. [§4.3, Table 4] The defense experiments do not isolate the proposed mechanism. Mixing Gaussian noise at levels 25.5 and 26 yields robustness gains on Set12-Adv-L2 of 29.9174 and 30.0874 dB, respectively, essentially matching TS-Pres.'s 30.0871 dB, while Table 4 shows only single-run averages with no standard deviation, number of runs, or significance test. Since plain higher-noise training achieves the same robustness numbers, the claim that TS works 'because it samples the larger typical set in the direction of the Gaussian noise' is not supported; a minimal control would be training on Gaussian noise with the same effective L2 magnitude without the TS screening step.
  4. [Theorem 3.8 and Lemma 3.7] The bounds in Lemma 3.7 are not tight in the claimed sense. The proof uses the inequality ∥x+ξ∥²₂ ≤ ∥x∥²₂+η²+2η∥x∥₂, whose equality requires ξ to be a nonnegative multiple of x; the matching upper bound uses the reverse inequality with no lower-bound justification beyond symmetry. The resulting log-density bounds in the proof of Theorem 3.8 contain a sign inconsistency: the interval Ω is written with the lower endpoint η²−2η√(nσ²(1+2ϵ)) over 2nσ² minus ϵ, but Lemma 3.7's lower bound is negative with the same numerator; the final B₂ expression is justified only by taking absolute values. These issues do not invalidate the qualitative claim that log-density decreases, but the stated theorem as written is not a rigorous derivation.
minor comments (5)
  1. [§2.7, Eq. (2.4)] Equation (2.4) is garbled: the first and third lines both contain L(f₁(x), y) < L(x, y), which is dimensionally inconsistent (L operates on two images but is compared to a scalar), and the formatting of the case structure is broken. Please rewrite the definition of transferability cleanly.
  2. [§3.4.2, Theorem 3.6] The proof of Theorem 3.6 uses the calculus step '2σ²(log A + n(h(X) − ϵ)) < ∥x∥²₂' where log A = −(n/2)log(2πσ²); substituting h(X)=log(√(2πe)σ) gives boundary terms that cancel. The intermediate algebra is not shown and the current displayed inequality is not self-evident; a three-line derivation would help.
  3. [§3.4.4, Propositions 3.15 and 3.16] The prose interpretation of the volume bounds contains a typo: '2(η²/2σ² n⁻¹)2(η/σ n^{-1/2})' is written as though it decreases 'exponentially as n increases,' which is incorrect for the first factor, and the notation mixing n⁻¹ with the exponent n is confusing. Also, the claimed strict ordering Vol(A_ϵ) ≤ Vol(A_B2) ≤ Vol(A_B∞) is asserted from upper bounds rather than proven.
  4. [§4.2, Tables 2–4] All reported numbers are point estimates from a single training run with no error bars, seeds, or statistical tests; given the small average differences between TS-Pres. and the normal model (e.g., 30.390 vs. 30.387 dB on Set12-Gaussian), it is not possible to verify the claim of 'marginally improved denoising performance.'
  5. [§1 and §3.3.3] There are several citation inconsistencies: the FGSM citation in §3.3.3 is given as '[25]' (Szegedy et al.) when the text refers to Goodfellow et al., and the reference list contains '[31]' K. Zhang et al. but the text cites '[33]' for SSIM; please verify all in-text citation numbers against the bibliography.

Circularity Check

2 steps flagged · score 4.0 of 10

The AEP bounds are self-contained, but the causal step from typical-set deviation to denoiser failure is assumed in Section 3.4.5 and then 'validated' by the TS defense, which was constructed from that same assumption.

  1. other [Section 3.4.5, Summary of the Theoretical Explanation, third bullet]
    "Since deep image denoising models only learn from the typical set during training, they never encounter perturbations that deviate samples from this set. Thus, the models have difficulties to generalize on the adversarial samples."

    The theorems preceding this summary (Theorem 3.6, Theorem 3.8, Theorem 3.13) only bound where Gaussian noise and perturbed Gaussian noise lie in log-density and typical-set terms; none of them involves the denoiser f, its training objective, or its reconstruction error. The statement that the model 'only learn[s] from the typical set' and therefore fails on out-of-typical-set inputs is the paper's load-bearing causal premise, asserted here rather than derived. The rest of the paper uses this premise to design TS, so the later success of TS cannot independently confirm the premise; the causal link is assumed in the construction and then reused as the explanation.

  2. other [Section 4.2, paragraph following Table 2; compare with Table 4]
    "The success of the TS strategies also suggests that adversarial transferability between models is closely related to the artificial Gaussian noise added during the training process."

    TS was explicitly built from the same theory: Section 3.5.1 states that 'TS operates from the perspective of the probability density distribution, employing screening method to generate Gaussian noise with lower probability density.' Thus the defense's success is a consistency check of the design assumption, not an independent prediction of the theory. Moreover, Table 4 shows that simply mixing ordinary Gaussian noise at level 26 yields Set12-Adv-L2 PSNR 30.0874, essentially equal to TS-Pres.'s 30.0871, so the empirical outcome is equally explained by an increased effective noise magnitude; the TS-specific low-density mechanism is not uniquely supported, so citing TS's results as evidence for the typical-set causal story does not discriminate between the theory and a simpler alternative.

full rationale

The AEP-based derivation itself is parameter-free and self-contained: Theorem 3.6 correctly follows from the typical-set bound, and Theorems 3.8 and 3.13 correctly characterize where perturbed Gaussian noise lies. There is no equation-level circularity in those proofs. The circularity, such as it is, lies in the causal interpretation: the paper asserts, rather than proves, that deviation from the Gaussian typical set is what makes denoisers fail (Section 3.4.5). The TS defense is then constructed from exactly this asserted causal link (Section 3.5.1), and its empirical success is subsequently presented as evidence for the same assertion. That is a self-referential validation loop, not a formal derivation. The self-citation to the authors' prior work [17] is not load-bearing here, because the transferability phenomenon is re-examined and reproduced within this paper's own experiments. However, because the central theoretical content (the typical-set bounds) is genuine and the causal gap is an unsupported premise rather than a definitional identity, the overall circularity score is moderate rather than high.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The theoretical core rests on textbook AEP and the ad hoc causal assumption that low log-density implies denoising failure. TS has two hand-picked hyperparameters. No new physical entities are introduced.

free parameters (2)
  • TS mixing ratio = 2:1 (TS-Pres.) and 1:1 (TS-Def.)
    Hand-selected to balance robustness and denoising PSNR; no sensitivity analysis is reported.
  • Number of TS candidate draws K = not reported
    Algorithm 3.1 depends on K, but the experimental section never states its value.
assumptions (5)
  • standard math WLLN and AEP for iid continuous sequences hold as stated.
    Invoked in Theorem 3.2 and Theorem 3.6 to place Gaussian noise in the typical set; sourced to Cover and Thomas [26].
  • standard math Gaussian differential entropy h(X) = log(sqrt(2*pi*e)*sigma).
    Used in Lemma 3.5 and Theorem 3.6; the citation [24] is a robotics textbook, but the formula is canonical.
  • ad hoc to paper Denoising models trained on Gaussian noise never encounter samples outside the typical set and therefore fail on such samples.
    This is the load-bearing causal assumption in Section 3.4.5; no theorem or experiment directly proves low-density inputs cause large denoising error.
  • domain assumption PGD transferability in classification is poor, so denoising transferability must be due to model similarity.
    Section 3.1 uses this to reject Hypothesis 1.1 without a controlled comparison between classification and denoising attacks.
  • domain assumption Model behavior around a sample depends only on artificial Gaussian noise, not image content.
    Supported only by qualitative subspace plots on Set12; no statistical test is provided for Observation 3.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Transferability in Deep Denoising Models: Theoretical Insights and Robustness Enhancement via Out-of-Distribution Typical Set Sampling." pith.science (2026). https://pith.science/paper/7I45II3M

@misc{pith2026241205943,
  author       = {Pith},
  title        = {Pith review of: Adversarial Transferability in Deep Denoising Models: Theoretical Insights and Robustness Enhancement via Out-of-Distribution Typical Set Sampling},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7I45II3M}},
  note         = {Machine review of arXiv:2412.05943}
}
read the original abstract

Deep learning-based image denoising models demonstrate remarkable performance, but their lack of robustness analysis remains a significant concern. A major issue is that these models are susceptible to adversarial attacks, where small, carefully crafted perturbations to input data can cause them to fail. Surprisingly, perturbations specifically crafted for one model can easily transfer across various models, including CNNs, Transformers, unfolding models, and plug-and-play models, leading to failures in those models as well. Such high adversarial transferability is not observed in classification models. We analyze the possible underlying reasons behind the high adversarial transferability through a series of hypotheses and validation experiments. By characterizing the manifolds of Gaussian noise and adversarial perturbations using the concept of typical set and the asymptotic equipartition property, we prove that adversarial samples deviate slightly from the typical set of the original input distribution, causing the models to fail. Based on these insights, we propose a novel adversarial defense method: the Out-of-Distribution Typical Set Sampling Training strategy (TS). TS not only significantly enhances the model's robustness but also marginally improves denoising performance compared to the original model.

Figures

Figures reproduced from arXiv: 2412.05943 by the authors.

Figure 11
Figure 11. In Figure 11 (a-c), adversarial perturbations generated under [PITH_FULL_IMAGE:figures/full_fig_p029_11.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 28 canonical work pages

  1. [17]

    J. Ning, Y. Li, and Z. Guo , Evaluating similitude and robustness of deep image denoising models via adversarial attack , arXiv preprint arXiv:2306.16050, (2023)

    work page Pith review arXiv 2023

  2. [1]

    Biggio, I

    B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. ˇSrndi´c, P. Laskov, G. Giacinto, and F. Roli, Evasion attacks against machine learning at test time , in Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13, Springer, 2013, pp. 387– 402

    work page 2013

  3. [2]

    Chapelle, B

    O. Chapelle, B. Scholkopf, and A. Zien , Semi-supervised learning (chapelle, o. et al., eds.; 2006)[book reviews], IEEE Transactions on Neural Networks, 20 (2009), pp. 542–542

    work page 2009

  4. [3]

    Dabov, A

    K. Dabov, A. Foi, V. Katkovnik, and K. Egiazarian , Image denoising by sparse 3-d transform-domain collaborative filtering , IEEE Trans Image Process, 16 (2007), pp. 2080–95, https://doi.org/10.1109/tip.2007.901238, https://www.ncbi.nlm.nih.gov/ pubmed/17688213

    arXiv 2007

  5. [4]

    M. Elad, B. Kawar, and G. V aksman, Image denoising: The deep learning revolution and beyond—a survey paper, SIAM Journal on Imaging Sciences, 16 (2023), pp. 1594–1654

    work page 2023

  6. [5]

    F awzi, H

    A. F awzi, H. F awzi, and O. F awzi, Adversarial vulnerability for any classifier , Advances in neural information processing systems, 31 (2018)

    work page 2018

  7. [6]

    Gilmer, N

    J. Gilmer, N. Ford, N. Carlini, and E. Cubuk , Adversarial examples are a natural conse- quence of test error in noise , in International Conference on Machine Learning, PMLR, 2019, pp. 2280–2289

    work page 2019

  8. [7]

    I. J. Goodfellow, J. Shlens, and C. Szegedy, Explaining and harnessing adversarial exam- ples, 2015, https://arxiv.org/abs/1412.6572

    arXiv 2015

Show all 33 references
  1. [8]

    Z. Kai, W. Zuo, Y. Chen, D. Meng, and Z. Lei , Beyond a gaussian denoiser: Residual learning of deep cnn for image denoising , 2016

    2016

  2. [9]

    Kurakin, I

    A. Kurakin, I. Goodfellow, and S. Bengio , Adversarial machine learning at scale , arXiv preprint arXiv:1611.01236, (2016)

    2016 arXiv

  3. [10]

    Liang, J

    J. Liang, J. Cao, G. Sun, K. Zhang, L. V an Gool, and R. Timofte, Swinir: Image restora- tion using swin transformer , in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 1833–1844

    2021

  4. [11]

    Lysaker, A

    M. Lysaker, A. Lundervold, and X.-C. Tai, Noise removal using fourth-order partial differ- ential equation with applications to medical magnetic resonance images in space and time , IEEE Transactions on image processing, 12 (2003), pp. 1579–1590

    2003

  5. [12]

    Mahloujifar, D

    S. Mahloujifar, D. I. Diochnos, and M. Mahmoody , The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure , in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 33, 2019, pp. 4536–4543

    2019

  6. [13]

    Y. Mei, Y. F an, Y. Zhang, J. Yu, Y. Zhou, D. Liu, Y. Fu, T. S. Huang, and H. Shi, Pyramid attention network for image restoration , International Journal of Computer Vision, 131 (2023), pp. 3207–3225

    2023

  7. [14]

    Mkadry, A

    A. Mkadry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu , Towards deep learning models resistant to adversarial attacks , stat, 1050 (2017), p. 9

    2017

  8. [15]

    C. Mou, Q. W ang, and J. Zhang, Deep generalized unfolding networks for image restoration , in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 17399–17410

    2022

  9. [16]

    Nguyen, J

    A. Nguyen, J. Yosinski, and J. Clune , Deep neural networks are easily fooled: High con- fidence predictions for unrecognizable images , in Proceedings of the IEEE conference on computer vision and pattern recognition, 2015, pp. 427–436

    2015

  10. [18]

    Perona and J

    P. Perona and J. Malik , Scale-space and edge detection using anisotropic diffusion , IEEE Transactions on Pattern Analysis and Machine Intelligence, (1990)

    1990

  11. [19]

    Rajwade, A

    A. Rajwade, A. Rangarajan, and A. Banerjee , Image denoising using the higher order singular value decomposition, IEEE Transactions on Pattern Analysis and Machine Intel- ligence, 35 (2012), pp. 849–862

    2012

  12. [20]

    C. Ren, X. He, C. W ang, and Z. Zhao , Adaptive consistency prior based deep network for image denoising , in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 8596–8606

    2021

  13. [21]

    L. I. Rudin, S. Osher, and E. F atemi , Nonlinear total variation based noise removal algo- rithms, Physica D Nonlinear Phenomena, 60 (1992), pp. 259–268

    1992

  14. [22]

    Salamat, M

    N. Salamat, M. M. S. Missen, and V. Surya Prasath, Recent developments in computational color image denoising with pdes to deep learning: a review , Artificial Intelligence Review, 54 (2021), pp. 6245–6276

    2021

  15. [23]

    Shafahi, W

    A. Shafahi, W. R. Huang, C. Studer, S. Feizi, and T. Goldstein, Are adversarial examples This manuscript is for review purposes only. 36 J. NING, J. SUN, S. SHI, Z. GUO, Y. LI, H. LI, AND B. WU inevitable?, arXiv preprint arXiv:1809.02104, (2018)

    2018 arXiv

  16. [24]

    M. W. Spong, S. Hutchinson, and M. Vidyasagar, Robot modeling and control, John Wiley and Sons, 2020

    2020

  17. [25]

    Szegedy, W

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fer- gus, Intriguing properties of neural networks , 2014, https://arxiv.org/abs/1312.6199

    2014 arXiv

  18. [26]

    Thomas and A

    M. Thomas and A. T. Joy , Elements of information theory , Wiley-Interscience, 2006

    2006

  19. [27]

    C. Tian, M. Zheng, W. Zuo, S. Zhang, Y. Zhang, and C.-W. Lin , A cross transformer for image denoising , Information Fusion, 102 (2024), p. 102043

    2024

  20. [28]

    C. Xie, M. Tan, B. Gong, J. W ang, A. L. Yuille, and Q. V. Le , Adversarial examples improve image recognition, in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 819–828

    2020

  21. [29]

    S. Yoon, J. Choi, L. Yonghyeon, Y.-K. Noh, and F. C. Park , Adversarial distributions against out-of-distribution detectors , (2021)

    2021

  22. [30]

    Zhang, Y

    K. Zhang, Y. Li, W. Zuo, L. Zhang, L. V an Gool, and R. Timofte , Plug-and-play image restoration with deep denoiser prior , IEEE Transactions on Pattern Analysis and Machine Intelligence, 44 (2021), pp. 6360–6376

    2021

  23. [31]

    Zhang, W

    K. Zhang, W. Zuo, and L. Zhang , Ffdnet: Toward a fast and flexible solution for cnn-based image denoising , IEEE Transactions on Image Processing, 27 (2018), pp. 4608–4622

    2018

  24. [32]

    Zhang, J

    Q. Zhang, J. Xiao, C. Tian, J. Chun-Wei Lin, and S. Zhang , A robust deformed con- volutional neural network (cnn) for image denoising , CAAI Transactions on Intelligence Technology, 8 (2023), pp. 331–342

    2023

  25. [33]

    Zhou and S

    H. Zhou and S. Zhou , Scene categorization towards urban tunnel traffic by image qual- ity assessment , Journal of Visual Communication and Image Representation, 65 (2019), p. 102655, https://doi.org/https://doi.org/10.1016/j.jvcir.2019.102655. This manuscript is for review pu...

    2019

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.