超分辨率模型可被植入对抗性后门，导致下游分类出错。
The Double-Edged Sword of Data-Driven Super-Resolution: Adversarial Super-Resolution Models
- 在训练时将对抗行为嵌入模型权重，无需输入干扰
- 攻击成功率高，图像质量下降不足1%
- 适用于安全关键场景的模型验证与风险评估
数据驱动的超分辨率（SR）方法常作为成像流程中的预处理步骤，以提升分类和检测等下游任务性能。然而，这类SR模型为成像管道引入了此前未被关注的攻击面。本文提出AdvSR框架，证明可在训练阶段直接将对抗性行为嵌入SR模型权重，且推理时无需访问输入。与依赖输入扰动或后门触发器的已有攻击不同，AdvSR完全在模型层面运作。通过联合优化重建质量与目标对抗效果，生成的模型在标准图像质量指标下表现正常，却能引发下游误分类。我们在三种SR架构（SRCNN、EDSR、SwinIR）上搭配YOLOv11分类器进行评估，结果表明AdvSR模型能在图像质量下降小于1%的情况下实现高攻击成功率。该发现揭示了成像管道中新型模型级威胁，对安全关键应用中模型的来源与验证具有重要启示。
原文摘要 · Abstract (English)
Data-driven super-resolution (SR) methods are often integrated into imaging pipelines as preprocessing steps to improve downstream tasks such as classification and detection. However, these SR models introduce a previously unexplored attack surface into imaging pipelines. In this paper, we present AdvSR, a framework demonstrating that adversarial behavior can be embedded directly into SR model weights during training, requiring no access to inputs at inference time. Unlike prior attacks that perturb inputs or rely on backdoor triggers, AdvSR operates entirely at the model level. By jointly optimizing for reconstruction quality and targeted adversarial outcomes, AdvSR produces models that appear benign under standard image quality metrics while inducing downstream misclassification. We evaluate AdvSR on three SR architectures (SRCNN, EDSR, SwinIR) paired with a YOLOv11 classifier and demonstrate that AdvSR models can achieve high attack success rates with minimal quality degradation. These findings highlight a new model-level threat for imaging pipelines, with implications for how practitioners source and validate models in safety-critical applications.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。