Fine-Tuning Adversarially-Robust Transformers for Single-Image Dehazing

Ana Neacsu; Daniela Faur; Vlad Vasilescu

REVIEW 4 major objections 5 minor 22 references

Fine-Tuning Adversarially-Robust Transformers for Single-Image Dehazing

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that pre-trained single-image dehazing transformers are highly vulnerable to imperceptible adversarial noise—a single-pixel change can drop PSNR by up to 2.8 dB—and that two lightweight fine-tuning strategies…

desk verdict A decent empirical study of parameter-efficient adversarial fine-tuning for dehazing transformers, with a real transfer result to remote sensing data, but the robustness claim is only shown under the exact attack used in training and the abstract overstates the clean-performance preservation. read the letter →

arxiv 2504.17829 v1 pith:E3WPPET4 submitted 2025-04-24 cs.CV cs.AI

Vlad Vasilescu , Ana Neacsu , Daniela Faur This is my paper · ORCID

classification cs.CVcs.AI

keywords adversarialrobustnessimagedehazingtransformersparameter-efficientfine-tuningtrainingTRADESremotesensingone-pixelattack

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper shows that state-of-the-art image-to-image dehazing transformers—MB-TaylorFormer-B, DehazeFormer-T, and DehazeFormer-B—are vulnerable to adversarial perturbations, with even a one-pixel change decreasing output PSNR by as much as 2.8 dB on RESIDE-Outdoor. To counter this, it proposes fine-tuning only a small set of newly introduced parameters: trainable scale-and-bias vectors after each attention block (SB) or identity-initialized linear convolutions (LINEAD), combined with adversarial training or a TRADES-style regularization loss. These methods require tuning only a tiny fraction of the model's parameters, yet they keep clean-data PSNR comparable to the pre-trained base while substantially raising attack-time PSNR under an L-infinity budget of 1/255 per pixel and under one-pixel L0 attacks. The same fine-tuned models also resist attacks on out-of-distribution remote sensing datasets such as HazyDet UAV and RICE-I, where the base models' outputs degrade below the quality of the original hazy image.

What carries the argument

The load-bearing mechanism is parameter-efficient fine-tuning of a frozen pre-trained dehazing transformer: after each Transformer/Attention block, the authors insert either per-channel scale and bias terms (SB, inspired by DiffFit) or trainable 3x3 convolutional layers initialized as identities (LINEAD). These adapters are the only parameters updated during adversarial fine-tuning, with adversarial examples crafted on the fly using a PGD-style L-infinity attack (budget 1/255) against a q=1 dissimilarity objective, and optionally a TRADES regularization term that enforces output consistency between clean and adversarial inputs. The identity initialization keeps the pre-trained mapping intact at the start, so the adapters gradually learn to absorb perturbations while preserving clean-image output.

What would settle it

Run a stronger attack than the one used for evaluation—for example, multi-restart PGD with 50 or more iterations, a larger budget such as 2/255, or an adaptive attack that backpropagates through the full fine-tuned model including the adapters—and check whether the fine-tuned models' PSNR under attack remains clearly above the base models' and above the hazy input's PSNR. If the gains shrink to a few dB or disappear under such attacks, the claim of 'significantly increasing protection' would be overstated.

Watch

Extended reading notes

Core claim

The central claim is that lightweight fine-tuning of frozen pre-trained dehazing transformers can achieve strong adversarial robustness without retraining from scratch. By inserting trainable scale-and-bias parameters (SB) or identity-initialized 3x3 linear layers (LINEAD) after each Transformer/Attention block, and updating only those parameters under an adversarial loss, the paper obtains models whose clean PSNR is close to the pre-trained original while attack-time PSNR under a 1/255 L-infinity attack rises by roughly 10 dB (for DehazeFormer-T, from about 16.3 dB to 26.5 dB with LINEAD+AT). The robustness also transfers to two remote sensing dehazing datasets, where the fine-tuned models keep PSNR above the hazy input under attack, unlike the base models that collapse below it.

Load-bearing premise

The robustness conclusion rests on the premise that the PGD-style L-infinity attack with q=1 and the OnePixel-derived L0 attack are strong and representative enough to characterize adversarial vulnerability, since the paper uses the same 1/255 budget for both crafting and evaluating and reports no adaptive or stronger multi-restart attacks.

Editorial extensions

If this is right

Deployable dehazing systems can be hardened against imperceptible adversarial noise by fine-tuning only a tiny fraction of parameters—as low as 0.006% for SB—avoiding costly retraining from scratch.
Adversarial robustness transfers across domains: models fine-tuned on synthetic outdoor haze data remain robust on drone-view and satellite-imagery haze, which matters for remote sensing autonomy.
The clean-versus-robust trade-off can be controlled through the TRADES hyperparameter lambda, letting practitioners pick an operating point suited to their risk tolerance.
The one-pixel attack results (up to a 2.84 dB PSNR drop on the largest model) show that even minimal tampering can meaningfully degrade dehazing output, so robustness evaluation should accompany model deployment.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the attack budget used for training (1/255) is identical to the budget used for evaluation, the reported robustness gains are likely an upper bound; testing with held-out budgets or adaptive attacks would probably reveal a smaller, though still positive, effect.
The success of identity-initialized linear adapters suggests that adversarial robustness can be learned as a low-rank correction on top of a frozen representation, a pattern that may extend to other image restoration tasks such as super-resolution or deraining.
The larger PSNR drop under one-pixel attacks for the bigger DehazeFormer-B hints that model capacity increases the diversity of exploitable features, so robustness measures may need to scale with model size.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a competent within-subfield paper. It applies DiffFit-style scale-and-bias adapters and linear adapters, plus TRADES and adversarial training, to pre-trained dehazing transformers, and shows that the fine-tuned models are more resistant to PGD l-infinity and one-pixel attacks under the tested budgets. The out-of-distribution tests on HazyDet and RICE-I are genuinely external and are the most convincing part of the paper; those results suggest the robustness partly transfers beyond RESIDE-Outdoor.

The novel bits are modest but real: a OnePixel variant adapted for image-to-image networks, and the first demonstration that lightweight adapters can harden dehazing transformers without full re-training. The paper is clearly written, the attack definitions are reasonable, and the parameter counts in Table I give a fair sense of the tuning cost.

The soft spots are concentrated in the evaluation. The robustness numbers come from the same attack configuration used during training: same l-infinity budget of 1/255, same q=1 objective, same PGD-style procedure. There is no adaptive attack, no iteration sweep, no random restart, and no alternative loss like MSE or SSIM. That leaves the measured gains vulnerable to the optimizer-failure artifact. I do not think this invalidates the qualitative story, but it does mean the 'protection' claim is only established for a narrow attack class. Second, the abstract says 'comparable clean performance,' but Table II shows clean PSNR drops of 2.2 to 5.2 dB for several SB/AT and LINEAD/AT configurations. The claim is defensible only for LINEAD with TRADES at low lambda. Third, the TRADES lambda was selected after looking at the RESIDE-Outdoor test numbers; there is no validation split. Fourth, there are no error bars or multiple seeds, so it is hard to tell whether the differences between methods are meaningful.

These are fixable issues, not fundamental ones. The remote sensing transfer results are the strongest evidence, and the overall direction is sensible. I would send this to a serious referee, but I would ask for an adaptive-attack evaluation, a proper validation split for lambda, multiple seeds with error bars, and a more careful wording of the clean-performance claim. The code link helps reproducibility. This is the kind of paper that would be useful to someone working on adversarial robustness for low-level vision or remote sensing dehazing, though I would not rely on the current robustness numbers without an adaptive evaluation.

Recommendation: peer review it, with the expectation of a revised version.

Referee Report

4 major / 5 minor

Summary. The paper studies adversarial robustness of three pre-trained dehazing transformers (DehazeFormer-T, MB-TaylorFormer-B, DehazeFormer-B). It defines two attacks: a PGD-style L-infinity attack with an L1 objective and a modified one-pixel (L0) attack. It then proposes two lightweight fine-tuning strategies, Scale-and-Bias (SB) and LINEar ADaptation (LINEAD), and combines them with adversarial training (AT) and TRADES regularization. Experiments on RESIDE-Outdoor show that the base models are vulnerable to small perturbations and that the fine-tuned models improve robustness under the tested attacks, with additional evaluation on two remote-sensing datasets (HazyDet UAV and RICE-I) to demonstrate out-of-distribution transfer. The abstract claims that the methods achieve comparable clean performance while significantly increasing protection against adversarial data.

Significance. If the claims are fully supported, the paper would provide a practical parameter-efficient recipe for hardening dehazing transformers and would demonstrate that robustness partially transfers to out-of-distribution remote-sensing data. Strengths include the use of several modern transformer architectures, the evaluation on two external datasets, and the plan to release source code. However, the significance is substantially limited by two issues: the 'comparable clean performance' claim is contradicted by several entries in Table II, and the robustness evaluation is largely matched to the exact attack used in training, with no adaptive or alternative attacks. These issues affect the central claim and must be addressed before the results can be taken at face value.

major comments (4)

[Abstract and Table II] The abstract's claim of 'comparable clean performance' is not supported by Table II. For example, on DehazeFormer-T the clean PSNR drops from 33.71 dB for the base model to 29.08 dB with SB AT and to 31.48 dB with LINEAD AT; on DehazeFormer-B it drops from 34.86 dB to 29.64 dB with SB AT and to 31.13 dB with LINEAD AT. Only the LINEAD TRADES variant with lambda=0.1 retains near-base clean PSNR (33.65 vs 33.71) on DehazeFormer-T, but at that setting the robustness gain at epsilon=1/255 is tiny (17.06 dB vs 16.26 dB for the base). The paper should either revise the abstract to qualify the clean-performance trade-off or report configurations that actually achieve comparable clean performance with meaningful robustness gains.
[Section II-A and Section IV-A] The robustness evaluation is matched to the attack used for training: both AT and TRADES generate adversarial examples with the same L-infinity budget (1/255) and the same L1 objective (q=1) that is later used to evaluate robustness in Table II. Although the paper also reports results under a 4/255 budget, that evaluation still uses the same PGD-style attack and the same L1 objective. No adaptive attacks, no PGD iteration or restart sweeps, and no alternative loss functions (e.g., MSE or SSIM-based attacks) are reported. Under these conditions, the measured gains may partly reflect the defense being optimized for the exact attack that is used to evaluate it, rather than a genuinely more robust dehazing network. The central claim that the methods 'significantly increase protection against adversarial data' requires a broader, defense-aware attack evaluation.
[Section IV-A and Table II] The TRADES regularization weight lambda is selected on the same RESIDE-Outdoor test set that is used for the final reported numbers. For DehazeFormer-T, Table II reports results for lambda=1.0, 0.5, and 0.1, and the text states that '0.5 worked best' without mentioning a separate validation split. Selecting hyperparameters on the test set invalidates the clean/robust trade-off comparison and risks overstating the best-case outcome. The authors should either use a proper validation set for model selection or explicitly state that the reported numbers are selection results rather than independent test-set evaluations.
[Section II-A and Section IV-A] The attack implementation is underspecified. The L-infinity attack is described only as a 'standard first-order gradient method' with no mention of the number of PGD iterations, step size, number of random restarts, or convergence criteria. The L0/OnePixel attack is also described without key details such as the optimization algorithm, population size, number of generations, or maximum evaluations. Since the paper's empirical conclusions rest entirely on these attacks, the missing details make the results unreproducible and make it impossible to assess the actual strength of the attacks. Please provide complete attack configurations in the manuscript or in the released code.

minor comments (5)

[Abstract] The sentence 'Our methods results in comparable clean performance' contains a subject-verb agreement error; it should be 'Our methods result in comparable clean performance.'
[Table I and Section III-A] LINEAD tunes 41.5% to 43.6% of the network parameters (Table I), which is difficult to reconcile with the description of both SB and LINEAD as 'lightweight' fine-tuning strategies. Consider qualifying the term or distinguishing SB as the truly lightweight option.
[Table III] The sentence 'Red indicates a drop below the original PSNR value' appears in the body text after Table III, but no red coloring is visible in the printed table. Please clarify the intended color coding or remove the sentence.
[Section IV-A] The fine-tuning procedure uses 5000 random patches per epoch, but the paper does not state whether the random sampler is seeded or whether results are averaged over multiple runs. Single-run results without variance or significance tests make it hard to judge whether small differences (e.g., 30.92 vs 31.48 dB) are meaningful.
[Section II-A] The notation 'l0-attack' is used inconsistently; the text elsewhere uses the Unicode symbol 'ℓ0'. Please use a consistent notation throughout.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the robustness claims are empirical and are supported by out-of-distribution benchmarks, not derived from the method definitions or from a self-citation chain.

full rationale

The paper's derivation chain is an experimental one. The adversarial attacks in Eqs. (2)-(3) are standard PGD and OnePixel-style objectives; the SB and LINEAD fine-tuning strategies are architectural modifications initialized to identity and trained with AT/TRADES losses. The central claims are measured results: Table II compares base and fine-tuned models on the held-out RESIDE-Outdoor test set, and Table III reports results on HazyDet-UAV and RICE-I, which are outside the fine-tuning distribution. These external benchmarks provide independent evidence that the robustness gains are not merely reconstructed from the training objective. The only self-citation, Ref. [14], is cited as an example of a certified classification method and is not load-bearing for the dehazing results. Two methodological weaknesses should be noted but do not constitute derivation-chain circularity: (i) the TRADES weight λ was selected after testing a few values and no separate validation split is described, so the reported 'best' λ=0.5 may be partly tuned to the same benchmark used in Table II; and (ii) the ℓ∞ evaluation at ϵ=1/255 uses the same attack budget and q=1 objective used during adversarial training, so the 1/255 robustness numbers are partially matched to the training-time attack. The paper also evaluates at ϵ=4/255 and under ℓ0 attacks, and on out-of-distribution remote-sensing data, which are not identical to the training-time attack, so the central claim retains independent empirical content. The stated limitation that ℓ0 training was not assessed due to computational cost is a scope restriction, not a circular step.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

No new physical entities are introduced. The free parameters are standard training hyperparameters plus the TRADES weight, all chosen by the authors without validation splits. The axioms are domain assumptions common in dehazing and adversarial robustness evaluations.

free parameters (5)

TRADES regularization weight lambda = 0.5
Selected as best on the RESIDE-Outdoor test set (Section IV-A), illustrating a trade-off between clean and robust PSNR; tuning on the test set is a mild selection leak.
Fine-tuning learning rate = 1e-5
Fixed for all experiments with Adam; no sweep or sensitivity analysis reported (Section IV-A).
Fine-tuning epochs = 15
Chosen to limit compute; no ablation across epochs reported (Section IV-A).
Number of training patches per epoch = 5000
Random sampler draws 5000 patches per epoch; no sensitivity analysis reported (Section IV-A).
L-infinity attack budget for training = 1/255
Used to craft adversarial examples in AT and TRADES, and also one of the evaluation budgets, so training and test perturbation norms align (Section IV-A and Table II).

assumptions (4)

domain assumption The atmospheric scattering model y = x t + A(1-t) describes hazy images.
Equation (1) is the standard haze formation model, used implicitly in the interpretation of all results.
domain assumption PSNR and SSIM are adequate metrics for dehazing quality and adversarial disruption.
All comparisons in Tables II and III are made with PSNR and SSIM; no perceptual or downstream task evaluation is used.
domain assumption Adversarial training with L-infinity perturbations of 1/255 during fine-tuning transfers to OOD remote sensing data.
The OOD results in Table III assume that robustness learned on synthetic RESIDE patches generalizes to HazyDet and RICE-I under the same attack budget.
domain assumption The modified PGD and one-pixel attacks are strong enough to characterize robustness.
No adaptive attacks or attack-iteration sweeps are reported, but conclusions about comparative robustness rely on these attacks.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Fine-Tuning Adversarially-Robust Transformers for Single-Image Dehazing." pith.science (2026). https://pith.science/paper/E3WPPET4

@misc{pith2026250417829,
  author       = {Pith},
  title        = {Pith review of: Fine-Tuning Adversarially-Robust Transformers for Single-Image Dehazing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/E3WPPET4}},
  note         = {Machine review of arXiv:2504.17829}
}

read the original abstract

Single-image dehazing is an important topic in remote sensing applications, enhancing the quality of acquired images and increasing object detection precision. However, the reliability of such structures has not been sufficiently analyzed, which poses them to the risk of imperceptible perturbations that can significantly hinder their performance. In this work, we show that state-of-the-art image-to-image dehazing transformers are susceptible to adversarial noise, with even 1 pixel change being able to decrease the PSNR by as much as 2.8 dB. Next, we propose two lightweight fine-tuning strategies aimed at increasing the robustness of pre-trained transformers. Our methods results in comparable clean performance, while significantly increasing the protection against adversarial data. We further present their applicability in two remote sensing scenarios, showcasing their robust behavior for out-of-distribution data. The source code for adversarial fine-tuning and attack algorithms can be found at github.com/Vladimirescu/RobustDehazing.

Figures

Figures reproduced from arXiv: 2504.17829 by the authors.

**Figure 1.** Small adversarial noise disrupts i2i dehazing networks. of neural networks to withstand imperceptible perturbations, posing a high risk for remotely deployed systems. While protection methods for simple tasks such as classification continue to be developed [13, 14], image-to-image (i2i) networks lack the popularity of adversarial attacks and defenses. This poses a high risk for applications tasked with image restor… view at source ↗

**Figure 2.** Our two proposed fine-tuning methods. network structure s.t. different certifications over predictions can be formulated [14, 19]. However, these strategies come with a high computational overhead, which limits the size and complexity of the network. For this reason, we exclude them from this study and focus only on the first two categories, leaving their usage in dehazing as a future endeavor. III. METHODOLOGY A. F… view at source ↗

**Figure 3.** Dehazing results for a clean input sample attacked with [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Dehazing results for two samples from HazyDet UAV (first row) and RICE-I (second row) attacked with [PITH_FULL_IMAGE:figures/full_fig_p003_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 18 canonical work pages

[1]

Vision and the atmosphere,

S. G. Narasimhan and S. K. Nayar, “Vision and the atmosphere,” International Journal of Computer Vision, vol. 48, pp. 233–254, 2002

work page 2002
[2]

Single image haze removal using dark channel prior,

K. He, J. Sun, and X. Tang, “Single image haze removal using dark channel prior,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 33, no. 12, pp. 2341–2353, 2010

2010
[3]

Mb-taylorformer: Multi-branch efficient transformer expanded by taylor formula for image dehazing,

Y . Qiu, K. Zhang, C. Wang, W. Luo, H. Li, and Z. Jin, “Mb-taylorformer: Multi-branch efficient transformer expanded by taylor formula for image dehazing,” in Proc. International Conference on Computer Vision , 2023, pp. 12 802–12 813

work page 2023
[4]

Vision transformers for single image dehazing,

Y . Song, Z. He, H. Qian, and X. Du, “Vision transformers for single image dehazing,” IEEE Transactions on Image Process- ing, vol. 32, pp. 1927–1941, 2023

work page 1927
[5]

FFA-Net: Feature fusion attention network for single image dehazing,

X. Qin, Z. Wang, Y . Bai, X. Xie, and H. Jia, “FFA-Net: Feature fusion attention network for single image dehazing,” in Proc. AAAI Conference on Artificial Intelligence , vol. 34, no. 07, 2020, pp. 11 908–11 915

work page 2020
[6]

Dehaze- AGGAN: Unpaired remote sensing image dehazing using en- hanced attention-guide generative adversarial networks,

Y . Zheng, J. Su, S. Zhang, M. Tao, and L. Wang, “Dehaze- AGGAN: Unpaired remote sensing image dehazing using en- hanced attention-guide generative adversarial networks,” IEEE Transactions on Geoscience and Remote Sensing , vol. 60, pp. 1–13, 2022

work page 2022
[7]

Benchmarking single-image dehazing and beyond,

B. Li, W. Ren, D. Fu, D. Tao, D. Feng, W. Zeng, and Z. Wang, “Benchmarking single-image dehazing and beyond,” IEEE Transactions on Image Processing , vol. 28, no. 1, pp. 492–505, 2018

2018
[8]

Atmospheric light estimation based remote sensing image dehazing,

Z. Zhu, Y . Luo, H. Wei, Y . Li, G. Qi, N. Mazur, Y . Li, and P. Li, “Atmospheric light estimation based remote sensing image dehazing,” Remote Sensing, vol. 13, no. 13, p. 2432, 2021

work page 2021

Show all 22 references

[9]

HazyDet: Open-source benchmark for drone-view object detection with depth-cues in hazy scenes,

C. Feng, Z. Chen, R. Kou, G. Gao, C. Wang, X. Li, X. Shu, Y . Dai, Q. Fu, and J. Yang, “HazyDet: Open-source benchmark for drone-view object detection with depth-cues in hazy scenes,” preprint arXiv:2409.19833, 2024

2024 arXiv
[10]

Adaptive image dehazing and object tracking in UA V videos based on the template updating siamese network,

L. Sun, J. Chang, J. Zhang, B. Fan, and Z. He, “Adaptive image dehazing and object tracking in UA V videos based on the template updating siamese network,” IEEE Sensors Journal, vol. 23, no. 11, pp. 12 320–12 333, 2023

2023
[11]

Towards evaluating the robustness of neural networks,

N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy , 2017, pp. 39–57

2017
[12]

Towards deep learning models resistant to adversarial attacks,

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in Proc. International Conference on Learning Representations, 2018

2018
[13]

Certified adversarial robustness via randomized smoothing,

J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial robustness via randomized smoothing,” in Proc. International Conference on Machine Learning , 2019, pp. 1310–1320

2019
[14]

ABBA neural networks: Coping with positivity, expressivity, and robustness,

A. Neacs ¸u, J.-C. Pesquet, V . Vasilescu, and C. Burileanu, “ABBA neural networks: Coping with positivity, expressivity, and robustness,” SIAM Journal on Mathematics of Data Science, vol. 6, no. 3, pp. 649–678, 2024

2024
[15]

Fool- ing the image dehazing models by first order gradient,

J. Gui, X. Cong, C. Peng, Y . Y . Tang, and J. T.-Y . Kwok, “Fool- ing the image dehazing models by first order gradient,” IEEE Transactions on Circuits and Systems for Video Technology , vol. 34, no. 7, p. 6265–6278, 2024

2024
[16]

One pixel attack for fooling deep neural networks,

J. Su, D. V . Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,” IEEE Transactions on Evolutionary Computation, vol. 23, no. 5, pp. 828–841, 2019

2019
[17]

Achieving robustness in classi- fication using optimal transport with hinge regularization,

M. Serrurier, F. Mamalet, A. Gonz ´alez-Sanz, T. Boissin, J.-M. Loubes, and E. Del Barrio, “Achieving robustness in classi- fication using optimal transport with hinge regularization,” in Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 505–514

2021
[18]

Theoretically principled trade-off between robustness and accuracy,

H. Zhang, Y . Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jor- dan, “Theoretically principled trade-off between robustness and accuracy,” inProc. International Conference on Machine Learn- ing, 2019, pp. 7472–7482

2019
[19]

Training robust neural networks using Lipschitz bounds,

P. Pauli, A. Koch, J. Berberich, P. Kohler, and F. Allg ¨ower, “Training robust neural networks using Lipschitz bounds,”IEEE Control Systems Letters , vol. 6, pp. 121–126, 2021

2021
[20]

Improved regularization and robustness for fine-tuning in neural networks,

D. Li and H. Zhang, “Improved regularization and robustness for fine-tuning in neural networks,” vol. 34, 2021, pp. 27 249– 27 262

2021
[21]

Difffit: Unlocking transferability of large diffusion models via simple parameter-efficient fine-tuning,

E. Xie, L. Yao, H. Shi, Z. Liu, D. Zhou, Z. Liu, J. Li, and Z. Li, “Difffit: Unlocking transferability of large diffusion models via simple parameter-efficient fine-tuning,” in Proc. International Conference on Computer Vision , 2023, pp. 4230–4239

2023
[22]

A remote sensing image dataset for cloud removal,

D. Lin, G. Xu, X. Wang, Y . Wang, X. Sun, and K. Fu, “A remote sensing image dataset for cloud removal,” preprint arXiv:1901.00600, 2019

1901 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Vision and the atmosphere,

S. G. Narasimhan and S. K. Nayar, “Vision and the atmosphere,” International Journal of Computer Vision, vol. 48, pp. 233–254, 2002

work page 2002

[2] [2]

Single image haze removal using dark channel prior,

K. He, J. Sun, and X. Tang, “Single image haze removal using dark channel prior,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 33, no. 12, pp. 2341–2353, 2010

2010

[3] [3]

Mb-taylorformer: Multi-branch efficient transformer expanded by taylor formula for image dehazing,

Y . Qiu, K. Zhang, C. Wang, W. Luo, H. Li, and Z. Jin, “Mb-taylorformer: Multi-branch efficient transformer expanded by taylor formula for image dehazing,” in Proc. International Conference on Computer Vision , 2023, pp. 12 802–12 813

work page 2023

[4] [4]

Vision transformers for single image dehazing,

Y . Song, Z. He, H. Qian, and X. Du, “Vision transformers for single image dehazing,” IEEE Transactions on Image Process- ing, vol. 32, pp. 1927–1941, 2023

work page 1927

[5] [5]

FFA-Net: Feature fusion attention network for single image dehazing,

X. Qin, Z. Wang, Y . Bai, X. Xie, and H. Jia, “FFA-Net: Feature fusion attention network for single image dehazing,” in Proc. AAAI Conference on Artificial Intelligence , vol. 34, no. 07, 2020, pp. 11 908–11 915

work page 2020

[6] [6]

Dehaze- AGGAN: Unpaired remote sensing image dehazing using en- hanced attention-guide generative adversarial networks,

Y . Zheng, J. Su, S. Zhang, M. Tao, and L. Wang, “Dehaze- AGGAN: Unpaired remote sensing image dehazing using en- hanced attention-guide generative adversarial networks,” IEEE Transactions on Geoscience and Remote Sensing , vol. 60, pp. 1–13, 2022

work page 2022

[7] [7]

Benchmarking single-image dehazing and beyond,

B. Li, W. Ren, D. Fu, D. Tao, D. Feng, W. Zeng, and Z. Wang, “Benchmarking single-image dehazing and beyond,” IEEE Transactions on Image Processing , vol. 28, no. 1, pp. 492–505, 2018

2018

[8] [8]

Atmospheric light estimation based remote sensing image dehazing,

Z. Zhu, Y . Luo, H. Wei, Y . Li, G. Qi, N. Mazur, Y . Li, and P. Li, “Atmospheric light estimation based remote sensing image dehazing,” Remote Sensing, vol. 13, no. 13, p. 2432, 2021

work page 2021