Source-linked AI summary
Detection of Adversarial Attacks on Super-Resolvers Using Spectral Features
Emma J. Reid, Haley Duba-Sullivan, Tony G. Allen
TL;DR
Adversarial behavior embedded in super-resolution preprocessing models can target downstream vision tasks, but its detectability had not been explored. The paper uses radially averaged power spectral density with an XGBoost detector and benchmarks it against magnitude- and phase-based spectral detectors. The proposed detector performs better in most testing scenarios, with high-frequency features especially informative for EDSR and SwinIR attacks.
Problem
The detectability of adversarial attacks embedded in super-resolution weights had not been explored, despite their ability to target downstream vision tasks.
Source: §I · p. 1Method
The detector feeds a 256-bin radially averaged power spectral density feature vector from super-resolved images to an XGBoost classifier.
Source: §III · p. 2Results
The proposed detector has superior metrics in most testing scenarios, with average leave-one-out ROC-AUC 0.833 versus 0.760 for InputMFS and 0.493 for InputPFS.
Source: B. Detector Results · p. 3, §V · p. 3Takeaways & Limitations
For EDSR and SwinIR, the detector relies primarily on changes in the highest radial-frequency bins, while SRCNN influential features span a broader frequency range.
Source: C. Detector Explainability · p. 3
Abstract
from arXiv · showhide
The integration of deep learning models into image preprocessing pipelines such as super-resolution introduces a largely unexplored attack vector for adversaries targeting downstream tasks. To ensure trustworthiness of critical imaging pipelines, we must be able to detect adversarial behavior within preprocessing models. In this paper, we propose a spectral-based detection method for identifying adversarial attacks embedded in super-resolution model weights. More specifically, we use the radially-averaged power spectral density as a discriminative feature to train an extreme gradient boosting (XGBoost) detector, demonstrating detectability of model-level threats in super-resolution networks. We further benchmark our detector against magnitude- and phase-based Fourier spectrum detectors, evaluating each method across a range of training and cross-architecture scenarios. Our proposed detector out-performs the comparison detectors in most of these scenarios and indicates that high-frequency features are most informative for detecting AdvSR attacks across SR architectures.
I. INTRODUCTION
The paper frames AdvSR attacks embedded in super-resolution weights as a threat to downstream vision tasks, while noting that their detectability had not been explored. It proposes a spectral detector and examines which frequencies reveal the attacks.
I. INTRODUCTION
- Prior AdvSR models produced high-fidelity reconstructions while causing targeted misclassification across SRCNN, EDSR, and SwinIR architectures.An example targets YOLOv11 misclassification of war planes as trailer trucks while preserving image quality and causing high-confidence errors.Source: §I · p. 1, Figure 1 · p. 1
- Although prior work explored AdvSR’s viability as an attack vector, the authors had not yet explored the detectability of this attack.Source: §I · pp. 1–2
- The proposed detector uses radially averaged power spectral density and identifies high spatial frequencies as the main location of adversarial content.It is evaluated against existing spectral approaches and performs better in most test cases.Source: §I · p. 2
II. RELATED WORK
Prior detection approaches use several image or classifier-based signals, but standard attacks and AdvSR attacks differ in their frequency characteristics. The paper compares image-only spectral features to avoid dependence on downstream classifier access.
II. RELATED WORK
- Existing spectral detectors use Fourier magnitude or phase features, while standard attacks alter medium-frequency bands and super-resolution modifies high frequencies by design.An AdvSR detector must distinguish malicious high-frequency content from genuine super-resolution content.Source: §II · p. 2
- The proposed image-only method compares spectral features without requiring access to the downstream classifier, its weights, or internal activations.Its comparisons are with InputMFS and InputPFS, two image-only detectors.Source: §II · p. 2
III. PROPOSED METHOD
The method represents each super-resolved image with a radially averaged power spectrum. An XGBoost classifier uses the resulting frequency-bin features to distinguish clean from adversarial super-resolution outputs.
III. PROPOSED METHOD
- The method converts each super-resolved image to luminance, computes its shifted 2D Fourier power spectrum, and averages coefficients within normalized radial-frequency bins.Each bin spans a radial interval, and its value is the mean power of frequencies in that bin.Source: §III · p. 2
- The 256-bin radially averaged PSD vector is supplied to XGBoost to classify images from clean or adversarial super-resolution models.Radial averaging compresses features while retaining frequencies across the image spectrum; XGBoost was selected for speed and innate explainability.Source: §III · p. 2
IV. EXPERIMENTAL DATA AND RESULTS
This section covers detector training procedures, experimental results, and explainability.
IV. EXPERIMENTAL DATA AND RESULTS
- The section reports training procedures, experimental results, and discussion of the detector’s explainability and implications.Source: §IV · p. 2
A. Training Details
The experiments use a five-class ImageNet subset and separate training, validation, and testing data for the super-resolvers, YOLOv11, and the detector. Clean and adversarial super-resolvers generate labeled SR images from LR inputs, whose extracted spectral features train the detectors.
A. Training Details
- The ImageNet5 subset combines vehicular classes with three non-vehicular dummy classes to assess the impact of classifier complexity on attack detectability.Source: A. Training Details · p. 2
- Distinct training, validation, and testing sets are used, with separate training sets for the super-resolvers, YOLOv11, and XGBoost detector.Source: A. Training Details · p. 2
- Clean and adversarial super-resolvers process LR images into SR images labeled 0 and 1, respectively, and detectors train on extracted spectral features.Source: A. Training Details · p. 2
B. Detector Results
The proposed detector is evaluated across individual and cross-architecture training setups against InputMFS and InputPFS. It leads on EDSR and SwinIR and has the strongest average F1 and ROC-AUC in same-architecture tests, while SRCNN holdout exposes a generalization failure.
B. Detector Results
- Detectors are trained separately on SRCNN, EDSR, and SwinIR, in leave-one-out pairs, or jointly on all three, and evaluated using accuracy, F1, and AUC.The comparison uses the same test images at inference time; Table I covers detectors trained and tested on the same SR architecture.Source: B. Detector Results · p. 2, Table I · p. 3
- F1 score 0.924 and ROC-AUC 0.973 are the proposed detector’s three-architecture averages, above InputMFS’s 0.898 and 0.962 and InputPFS’s 0.476 and 0.503, respectively.Source: B. Detector Results · p. 3, Table I · p. 3
- ROC-AUC 0.833 is the proposed detector’s leave-one-out average, versus 0.760 for InputMFS and 0.493 for InputPFS; SRCNN holdout is a failure case for the proposed detector.When SRCNN is held out, it classifies every adversarial SRCNN output as clean; performance is strongest when EDSR or SwinIR is held out. The unified detector's SRCNN results suggest the failure reflects a correctable lapse in training data.Source: B. Detector Results · p. 3
C. Detector Explainability
The spectral differences between clean and adversarial outputs vary by SR architecture. The detector’s influential frequency bins likewise vary, with high frequencies dominating for EDSR and SwinIR and broader spectral influence for SRCNN.
C. Detector Explainability
- Adversarial EDSR and SwinIR outputs show increased power at the highest radial frequencies, while adversarial SRCNN outputs are lower than clean outputs at most of those frequencies.The power mismatch helps explain the leave-one-out discrepancies; without the increase, a detector trained on EDSR or SwinIR could infer that an input is clean.Source: C. Detector Explainability · p. 3
- For EDSR and SwinIR, the detector’s largest absolute Shapley values concentrate in the highest-frequency bins, whereas SRCNN’s influential features span a broader frequency range.Source: C. Detector Explainability · p. 3
- The EDSR and SwinIR AdvSR pattern contrasts with traditional Carlini&Wagner attacks, which have been observed to feature predominantly in mid-frequency bands,.The paper suggests evaluating low, mid, and high frequencies may be more robust to changes in SR models and attacks.Source: C. Detector Explainability · p. 3
V. CONCLUSION
The paper demonstrates detection of AdvSR attacks with spectral features and reports superior metrics to comparison detectors in most testing scenarios. Explainability is used to investigate where the detector falls short and why; future work targets robustness and generalizability.
V. CONCLUSION
- The detector generalizes across AdvSR models and produces superior metrics to comparison detectors in most testing scenarios.Source: §V · p. 3
- Explainability is incorporated to investigate where the detector falls short and why.Source: §V · p. 3
- Future work aims to improve detector robustness and generalizability to other SR architectures and model-weight attacks.Source: §V · p. 3