A Physically-Grounded Attack and Adaptive Defense Framework for Real-World Low-Light Image Enhancement

Tongshun Zhang; Pingping Liu; Yuqing Lei; Zixuan Zhong; Qiuzhan Zhou; Zhiyuan Zha

cs.CVMar 15, 2026

A Physically-Grounded Attack and Adaptive Defense Framework for Real-World Low-Light Image Enhancement

Authors: Tongshun Zhang, Pingping Liu, Yuqing Lei, Zixuan Zhong, Qiuzhan Zhou, Zhiyuan Zha

Organizations: College of Computer Science and Technology, Jilin University, Changchun 130015, P.R. China · Key Laboratory of Symbolic Computation and Knowledge Engineering of Ministry of Education, Jilin University, Changchun 130015, P.R. China · College of Software, Jilin University, Changchun 130015, P.R. China · College of Communication Engineering, Jilin University, Changchun 130015, P.R. China

Abstract

Limited illumination often causes severe physical noise and detail degradation in images. Existing Low-Light Image Enhancement (LLIE) methods frequently treat the enhancement process as a blind black-box mapping, overlooking the physical noise transformation during imaging, leading to suboptimal performance. To address this, we propose a novel LLIE approach, conceptually formulated as a physics-based attack and display-adaptive defense paradigm. Specifically, on the attack side, we establish a physics-based Degradation Synthesis (PDS) pipeline. Unlike standard data augmentation, PDS explicitly models Image Signal Processor (ISP) inversion to the RAW domain, injects physically plausible photon and read noise, and re-projects the data to the sRGB domain. This generates high-fidelity training pairs with explicitly parameterized degradation vectors, effectively simulating realistic attacks on clean signals. On the defense side, we construct a dual-layer fortified system. A noise predictor estimates degradation parameters from the input sRGB image. These estimates guide a degradation-aware Mixture of Experts (DA-MoE), which dynamically routes features to experts specialized in handling specific noise intensities. Furthermore, we introduce an Adaptive Metric Defense (AMD) mechanism, dynamically calibrating the feature embedding space based on noise severity, ensuring robust representation learning under severe degradation. Extensive experiments demonstrate that our approach offers significant plug-and-play performance enhancement for existing benchmark LLIE methods, effectively suppressing real-world noise while preserving structural fidelity. The sourced code is available at https://github.com/bywlzts/Attack-defense-llie.

Figures & tables

Fig. 1: Visual comparison of existing LLIE methods against our proposed approach. While current methods demonstrate good brightness recovery, they often suffer from subpar noise suppression, as highlighted by the noisy regions. Our proposed adversarial framework demonstrably provides superior noise reduction while maintaining structural fidelity.

Fig. 2: Comparison of different LLIE training paradigms. (a) Data augmentation-based methods treat LLIE as a passive black-box mapping from augmented low-light inputs. (b) Degradation + contrastive learning methods generate negative samples via handcrafted degradations, but often overlook the physical nature of sensor noise and lack adaptation to degradation severity. (c) Our adversarial framework employs a physics-guided RAW domain attack for plausible noise and explicit priors. A sentinel noise predictor offers explicit noise awareness, while adaptive architectural and metric defenses respond to attack severity for targeted noise suppression and robust enhancement.

Fig. 3: Overview of the proposed physics-based adversarial framework . Attack stream (left, red): PDS analytically inverts clean sRGB images to the linear RAW domain, injects Poisson and Gaussian noise parameters $(k,\sigma)$ for sensor-level attacks, and re-projects the corrupted signal to sRGB via a forward ISP to generate realistic physics-based degraded samples with ground-truth physical priors ( $\mathcal{P}_{att}$ ). Defense stream (right, green): A sentinel Noise Predictor estimates degradation parameters ( $\mathcal{P}_{pre}$ ) from the low-light input and uses them to gate/modulate DA-MoE blocks and SFT layers, trained with a Dual-Domain Self-Supervised Loss . The DA-MoE is plug-and-play for existing enhancement backbones, and the AMD further adjusts the margin $m$ according to the injected noise parameters ( $\mathcal{P}_{att}$ ) to maintain appropriate feature distances under varying degradation severities.

Fig. 4: Comparison of noise variance against signal intensity. The bottom grayscale strip represents increasing brightness. Naive sRGB-domain injection (orange) shows intensity-invariant variance, inconsistent with real sensors. In contrast, our PDS noise (red), generated via RAW-domain Poisson-Gaussian injection and ISP reprocessing, exhibits clear signal-dependent variance. This underscores the necessity of RAW-domain physics-based noise modeling for realistic low-light degradations.

Method	Venue	LOL-Blur				LOL-v1
Method	Venue	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	FID $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	FID $\downarrow$
LEDNet [ 15 ]	ECCV 22	25.79	0.8500	0.1670	17.89	23.32	0.9029	0.0972	40.38
LEDNet+	Ours	26.40 (+0.61)	0.8664 (+0.0164)	0.1282 (-0.0388)	13.95 (-3.94)	23.37 (+0.05)	0.9014 (-0.0015)	0.0868 (-0.0104)	34.75 (-5.63)
Restormer [ 13 ]	CVPR 22	25.21	0.8367	0.2190	25.19	23.31	0.8865	0.1298	62.70
Restormer+	Ours	25.83 (+0.62)	0.8655 (+0.0288)	0.1214 (-0.0976)	13.81 (-11.38)	23.45 (+0.14)	0.9033 (+0.0168)	0.0874 (-0.0424)	35.32 (-27.38)
FourLLIE [ 11 ]	MM 23	22.48	0.7289	0.2596	26.85	20.06	0.8401	0.2409	88.17

TABLE I: Results on LOL-Blur and LOL-v1 Datasets. Our plug-in almost improves PSNR/SSIM and reduces LPIPS/FID across all baselines, with particularly large gains on LPIPS and FID.

Fig. 5: Visual comparison on the LOL-Blur dataset. The first two columns are the input and ground truth. For each method, we show the baseline result and its enhanced variant, where “+” indicates integrating our proposed adversarial framework. Zoom in for better inspection of noise suppression.

Fig. 6: Visual comparisons with state-of-the-art methods on LOL-v1 dataset. Zoom in for better detail recovery.

Method	Real-LOL-Blur
Method	NIQE $\downarrow$	BRISQUE $\downarrow$	PI $\downarrow$
LEDNet [ 15 ]	5.169	42.801	5.030
LEDNet+	4.506 (-0.663)	35.609 (-7.192)	4.339 (-0.691)
Restormer [ 13 ]	5.457	36.682	5.488
Restormer+	4.154 (-1.303)	25.911 (-10.771)	3.874 (-1.614)
FourLLIE [ 11 ]	5.983	43.892	6.214

TABLE II: Results on the Real-LOL-Blur dataset using models pretrained on LOL-Blur.

Method	Real-LOL-Blur
Method	NIQE $\downarrow$	BRISQUE $\downarrow$	PI $\downarrow$
LEDNet [ 15 ]	5.322	31.849	5.535
LEDNet+	5.280 (-0.042)	30.419 (-1.430)	5.486 (-0.049)
Restormer [ 13 ]	5.287	34.544	5.461
Restormer+	4.925 (-0.362)	32.913 (-1.631)	4.898 (-0.563)
FourLLIE [ 11 ]	5.796	41.620	5.791

TABLE III: Results on the Real-LOL-Blur dataset using models pretrained on LOL-v1.

Method	GoPro		SID
Method	PSNR $\uparrow$	SSIM $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$
Retinexformer [ 10 ]	29.14	0.8808	25.74	0.6951
Retinexformer+	29.10 (-0.04)	0.8839 (+0.0031)	26.80 (+1.06)	0.7012 (+0.0061)
Wave-Mamba [ 38 ]	26.94	0.8273	23.57	0.6740
Wave-Mamba+	27.03 (+0.09)	0.8296 (+0.0023)	23.98 (+0.41)	0.6846 (+0.0106)
CWNet [ 12 ]	30.71	0.9104	25.82	0.7024

TABLE IV: Quantitative results on the GoPro and SID datasets.

Settings	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	FID $\downarrow$
FourLLIE (Baseline)	20.06	0.8401	0.2409	88.17
w/o Noise Predictor	20.83	0.8675	0.2277	84.95
w/o Gaussian-noise Expert	20.79	0.8723	0.2173	83.91
w/o Poisson-noise Expert	21.12	0.8746	0.1857	79.74
w/o Gate	20.89	0.8788	0.1962	80.80
w/o SFT layer	21.25	0.8801	0.1745	78.62

TABLE V: Ablation study on modules.

Variant	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	FID $\downarrow$
FourLLIE (Baseline)	20.06	0.8401	0.2409	88.17
w/o $\mathcal{L}_{\text{metric}}$	20.24	0.8459	0.2225	83.46
w/o $\mathcal{L}_{\text{consist}}$	21.05	0.8774	0.1857	79.74
w/o $\mathcal{L}^{\text{normal}}_{\text{np}}$	21.25	0.8749	0.1851	78.67
w/o $\mathcal{L}^{\text{low}}_{\text{np}}$	20.87	0.8698	0.1873	79.91
FourLLIE+ (Ours)	21.34	0.8815	0.1524	76.87

TABLE VI: Ablation of loss terms.

Weight	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	FID $\downarrow$
Baseline	20.06	0.8401	0.2409	88.17
$\lambda_{\text{con}}=0.3$	20.46	0.8752	0.2085	81.03
$\lambda_{\text{con}}=0.7$	21.37	0.8803	0.1840	77.56
$\lambda_{\text{met}}=0.001$	20.91	0.8560	0.1985	79.04
$\lambda_{\text{met}}=0.05$	21.32	0.8801	0.1842	78.58
$\lambda_{\text{met}}=0.1$	20.74	0.8785	0.1969	80.87

TABLE VII: Sensitivity to loss weights on LOL-v1.

Fig. 7: Efficiency comparison. We report Params, FLOPs, and average inference time per image for FourLLIE and CWNet.

Explore similar work

Single-Stage Signal Attenuation Diffusion Model for Low-Light Image Enhancement and Denoising
Apr 7, 2026Ying Liu, Junchao Zhang, Caiyun WuLow-Light Image Enhancement Diffusion Models for Image Restoration
School of Aeronautics and Astronautics, Central South University, Changsha 410083, China · Hunan Provincial Key Laboratory of Optic-Electronic Intelligent Measurement and Control, Changsha 410083, China
InterLight: Leveraging Intrinsic Illumination Priors for Low-Light Image Enhancement
May 19, 2026Ziqi Wang, Xu Zhang, Laibin Chang +3Image Enhancement Low-Light Image Enhancement
National Engineering Research Center for Multimedia Software, School of Computer Science, Wuhan University · Department of Computer Science, University of Macau · Department of Computer Vision, Mohamed bin Zayed University of Artificial Intelligence +1
Internally Referenced Low-Light Enhancement
May 27, 2026Peiyuan He, Hainuo Wang, Hengxing Liu +2Self-Supervised Learning Low-Light Image Enhancement
College of Intelligence and Computing, Tianjin University, Tianjin 300350, China

Apr 7, 2026J/K move · Enter open · S save

Single-Stage Signal Attenuation Diffusion Model for Low-Light Image Enhancement and Denoising

Ying Liu, Junchao Zhang, Caiyun Wu

School of Aeronautics and Astronautics, Central South University, Changsha 410083, China · Hunan Provincial Key Laboratory of Optic-Electronic Intelligent Measurement and Control, Changsha 410083, China

Low-Light Image Enhancement Diffusion Models for Image Restoration Image Denoising Physics-Informed Diffusion Models

Open paper AskPDF arXiv

Diffusion models excel at image restoration via probabilistic modeling of forward noise addition and reverse denoising, and their ability to handle complex noise while preserving fine details makes them well-suited for Low-Light Image Enhancement (LLIE). Mainstream diffusion based LLIE methods either adopt a two-stage pipeline or an auxiliary correction network to refine U-Net outputs, which severs the intrinsic link between enhancement and denoising and leads to suboptimal performance owing to inconsistent optimization objectives. To address these issues, we propose the Signal Attenuation Diffusion Model (SADM), a novel diffusion process that integrates the signal attenuation mechanism into the diffusion pipeline, enabling simultaneous brightness adjustment and noise suppression in a single stage. Specifically, the signal attenuation coefficient simulates the inherent signal attenuation of low-light degradation in the forward noise addition process, encoding the physical priors of low-light degradation to explicitly guide reverse denoising toward the concurrent optimization of brightness recovery and noise suppression, thereby eliminating the need for extra correction modules or staged training relied on by existing methods. We validate that our design maintains consistency with Denoising Diffusion Implicit Models(DDIM) via multi-scale pyramid sampling, balancing interpretability, restoration quality, and computational efficiency.

Abstract

Explore similar work

Single-Stage Signal Attenuation Diffusion Model for Low-Light Image Enhancement and Denoising

InterLight: Leveraging Intrinsic Illumination Priors for Low-Light Image Enhancement

Internally Referenced Low-Light Enhancement