Research map / Adversarial robustness and security / Attacks on text and graphs
Towards Robust Image Stitching: An Adaptive Resistance Learning against Compatible Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a stitching-oriented adversarial attack (SoA) and an adaptive adversarial training (AAT) via differentiable architecture search to make deep image stitching models robust without losing benign quality.
Problem
Deep learning image stitching models are vulnerable to imperceptible adversarial perturbations that corrupt feature matching and alignment in overlapping regions, and standard adversarial training degrades benign stitching quality.
Approach
A stitching-specific attack that amplifies alignment loss (homography error plus shared-region inconsistency) in overlapping areas, combined with adaptive adversarial training that searches the network architecture (DARTS-style, on a PWC-Net-based stitcher) under mixed clean and attacked data while training weights only on clean data.
Key results
- On UDIS-D under attack, the proposed method reaches EN 7.129 and SIQE 47.963 versus RSFI's 7.011 and 31.788 under attack, with the gap to benign performance much smaller.
- On RWCC, the proposed method's attacked results (e.g., EN 7.923, NIQE 3.526) stay close to its benign results (EN 8.327, NIQE 3.611), while VFIS and RSFI drop more under attack.
- SoA perturbations degrade stitching performance more than FGSM, BIM and PGD across VFIS, RSFI and the clean-trained baseline.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply SoA perturbations to stitching inputs (ablation) | VFIS, RSFI, and the clean-trained baseline · UDIS-D and RWCC | stitching performance | Hurt |
| use SoA + AAT instead of routine adversarial training | image stitching models · UDIS-D and RWCC, benign and attacked | SIQE: UDIS-D: RSFI 31.788 -> Ours 47.963; RWCC: RSFI 23.328 -> Ours 40.117 | Helped |
| use first-order derivatives instead of Bayesian optimization or quasi-Newton descent (ablation) | AAT architecture search · UDIS-D benign and attacked | SIQE: 45.023 -> 47.675; 29.960 -> 47.963; 44.071 -> 47.675; 28.073 -> 47.963 | Helped |
| use a three-scale pyramid rather than other scale configurations (ablation) | baseline stitching network · benign and SoA-attacked images | stitching performance | Helped |
| use the proposed candidate-operation set rather than alternative convolution candidate sets (ablation) | AAT stitching architecture · benign and adversarial data | stitching performance | Helped |
| train with Hybrid FGSM, BIM, and PGD perturbations instead of a single FGSM, BIM, or PGD perturbation (ablation) | AAT stitching model · attacked images | robustness | Helped |
| train with Clean + AAT rather than attacked perturbations (ablation) | AAT stitching model · benign versus attacked images | performance consistency | Hurt |
Surprising findings
- The proposed robust model's attacked performance exceeds benign performance of baselines, and on some metrics (e.g., UDIS-D SD, SIQE) it even slightly exceeds its own benign score under attack.
Limitations
- Evaluation relies on no-reference image quality metrics rather than geometric alignment error, so alignment accuracy is only indirectly measured.
- Only three attack types plus SoA are tested, and the search is restricted to a small candidate operation set.
Experimental setup
Datasets: MS-COCO UDIS-D RWCC
Benchmarks: UDIS-D test set (1106 pairs) RWCC (62 pairs)
Metrics: EN SF SD AG SIQE BR NIQE PI
Baselines: VFIS RSFI FGSM BIM PGD Bayesian optimization (DARTS solver) quasi-Newton (DARTS solver)
Builds on: PGD DARTS PWC-Net FGSM BIM
Closest papers by meaning
- Reconstructing the Image Stitching Pipeline: Integrating Fusion and Rectangling into a Unified Inpainting Model (NeurIPS 2024 · similarity 0.86)
- A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.85)
- VLMs can Aggregate Scattered Training Patches (NeurIPS 2025 · similarity 0.85)
- AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption (ICLR 2025 · similarity 0.85)
- Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models (CVPR 2025 · similarity 0.84)
- Learning Bregman Divergences with Application to Robustness (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.