Research map / Adversarial robustness and security / Certified and empirical robustness
Universal Robustness via Median Randomized Smoothing for Real-World Super-Resolution
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CertSR, a real-world super-resolution model built on ESRGAN that combines median randomized smoothing fine-tuning and inference to achieve robustness to diverse adversarial attacks and real-world corruptions, compared against PGD/FGSM/BIM/CW adversarial training.
Problem
Real-world single-image super-resolution fails on unseen corruptions and sensor noise, and existing robust SR (adversarial training) methods are attack-specific and do not generalize across attack types.
Approach
Applies median randomized smoothing (percentile smoothing of a Gaussian-perturbed SR network, with certified L2 bounds) to SR, using pixel-wise median over only about 21 Gaussian samples and fine-tuning on Gaussian-noised LR images, rather than adversarial training with attack-specific perturbations.
Key results
- CertSR achieves LPIPS 0.19 on noisy DIV2K vs 0.67 for ESRGAN and 0.37 for AD-L-PGD, with PSNR 26.35.
- Under adversarial attacks, CertSR gets best PSNR/SSIM/LPIPS against most attacks, e.g. LPIPS 0.18 under CW vs 0.61 for AD-L-CW (PSNR 26.66).
- On real-world NTIRE and AIM validation sets, CertSR gets the best average LPIPS (0.27) without training on those datasets.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use median randomized smoothing fine-tuning and inference instead of adversarial training | ESRGAN for robust super-resolution · DIV2K validation, noisy | LPIPS: 0.29 -> 0.19 | Helped |
| Use median randomized smoothing fine-tuning and inference instead of adversarial training | ESRGAN for robust super-resolution · DIV2K validation, blurry | LPIPS: 0.48 -> 0.44 | Helped |
| Use median randomized smoothing fine-tuning and inference instead of FGSM adversarial training | ESRGAN for robust super-resolution · DIV2K validation, FGSM attack | LPIPS: 0.19 -> 0.27 | Hurt |
| Use median randomized smoothing fine-tuning and inference instead of BIM adversarial training | ESRGAN for robust super-resolution · DIV2K validation, BIM attack | LPIPS: 0.26 -> 0.25 | Helped |
| Use median randomized smoothing fine-tuning and inference instead of PGD adversarial training | ESRGAN for robust super-resolution · DIV2K validation, PGD attack | LPIPS: 0.24 -> 0.24 | No clear effect |
| Use median randomized smoothing fine-tuning and inference instead of PGD adversarial training | ESRGAN for robust super-resolution · DIV2K validation, CW attack | LPIPS: 0.24 -> 0.18 | Helped |
| Apply CertSR without training or fine-tuning on the evaluation dataset | ESRGAN for real-world super-resolution · NTIRE validation | LPIPS: 0.23 -> 0.21 | Helped |
| Apply CertSR without training or fine-tuning on the evaluation dataset | ESRGAN for real-world super-resolution · AIM validation | LPIPS: 0.36 -> 0.33 | Helped |
Surprising findings
- Adversarial-training model AD-L-CW performs worst on real-world LPIPS and on noisy data (PSNR 19.47), despite being the best RSR on clean data.
- Only about 21 Gaussian samples are needed for median smoothing in SR, versus around 2000 in classification and detection prior work.
Limitations
- Robustness is certified only for a chosen sigma per perturbation, so the sigma must be tuned per corruption type.
- Median smoothing on blurry inputs gives only marginal gains over ESRGAN (LPIPS 0.44 vs 0.48, PSNR 22.11 vs 22.23).
Experimental setup
Datasets: DIV2K Flickr2K NTIRE 2020 real-world SR validation AIM 2019 real-world SR validation
Benchmarks: DIV2K validation NTIRE 2020 real-world SR AIM 2019 real-world SR
Metrics: PSNR SSIM LPIPS
Baselines: ESRGAN AD-L-PGD AD-L-FGSM AD-L-BIM AD-L-CW Impressionism ESRGAN-FS
Builds on: ESRGAN Median randomized smoothing Robust Super-Resolution (Castillo et al.) PGD adversarial training
Closest papers by meaning
- The Perception-Robustness Tradeoff in Deterministic Image Restoration (ICML 2024 · similarity 0.87)
- Noise-Free Optimization in Early Training Steps for Image Super-resolution (AAAI 2024 · similarity 0.86)
- NSARM: Next-Scale Autoregressive Modeling for Robust Real-World Image Super-Resolution (NeurIPS 2026 · similarity 0.86)
- Augmenting Perceptual Super-Resolution via Image Quality Predictors (CVPR 2025 · similarity 0.86)
- Low-Res Leads the Way: Improving Generalization for Super-Resolution by Self-Supervised Learning (CVPR 2024 · similarity 0.85)
- Uncertainty-Aware GAN for Single Image Super Resolution (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.