Deceptive deraining attack: a restorative adversarial attack by rain removal

Abstract

Restoring images captured in adverse weather conditions can significantly enhance their visual quality, with widespread applications in fields such as autonomous driving. However, we observed a potential threat after image restoration: while the restored images are visually better, they may be adversarial for deep neural networks (DNNs). In light of this discovery, in this work, we explore a restorative attack approach, aiming to introduce adversarial perturbations in insensitive regions of the image while restoring images. In particular, we propose the deceptive deraining attack (DDA) method to generate more natural adversarial examples in the deraining scenario, denoted as DDA. In contrast to existing adversarial attack methods that degrade image quality, our DDA can efficiently introduce adversarial perturbations while enhancing the visual quality of rainy images. Specifically, we first restore the rainy image and derive the rain streak mask. Then the adversarial perturbations are added to the rain streak areas of the image according to the mask, and the perturbations are optimized by maximizing the classification loss to generate the adversarial image. Extensive experiments on synthetic rain datasets and real rain datasets indicate that the adversarial examples generated by our DAA are visually natural and maintain a high attack success rate on state-of-the-art DNNs.