Organizations: School of Engineering and Applied Science, University of Pennsylvania · S.M.A.R.T. Nexus Center of Excellence, Xiamen University Malaysia · School of Artificial Intelligence and Robotics, Xiamen University Malaysia · Emory College of Arts and Sciences Computer Science, Emory University
Generative low-light enhancers recover plausible texture but may hallucinate structure; restoration networks preserve structure but can leave regions under-enhanced, and neither advantage is spatially uniform. Therefore, we formulate selective generative enhancement as a decision problem: determine where overriding a frozen base expert is beneficial and refuse to switch when the evidence is insufficient. We propose VetoNet, an auditable regional routing framework centered on a certified veto. It first measures the complementary strengths and routing direction of a frozen restoration generative pair, then predicts the utility of regional overrides from deployment-available signals alone and admits an override only when a distribution-free harm-budget certificate says the perceptual (LPIPS) risk budget allows it. Experiments across multiple expert pairs and domains show that VetoNet adapts its routing behavior to the strength and reliability of the available evidence. When expert complementarity is sufficiently predictable, it achieves statistically significant certified gains; when the relative strengths of the experts change, it correspondingly reverses the routing direction; and when routing evidence is weak or affected by cross-domain shift, it conservatively vetoes switching.
Figures & tables
Figure 1: An example illustrating that different LLIE methods may exhibit complementary effects.
Figure 2: Overview of the VetoNet pipeline.
Dataset (test n )
Pair (base first)
Quality-mode gain
Certified gain
Certified harm
LOL-v1 (15)
DiffLL ( G ) ∣ Rf
+0.0065[+0.0030,+0.0102]
+0.0028[+0.0007,+0.0054]
6.7%
LOLv2-syn (100)
Rf ( R ) ∣ DiffRet
−0.0002[−0.0018,+0.0014]
+0.0014[+0.0005,+0.0025]
9.0%
LOLv2-real (100)
DiffRet ( G ) ∣ Rf
+0.0006[−0.0026,+0.0039]
0 (abstains)
0.0%
LOLv2-real, modern pair modern-pair audit † (100)
GSAD ( G ) ∣ CIDNet
−0.0043[−0.0058,−0.0027]
+0.00023[+0.00007,+0.00044]
0.0%
Table 1: Final-test outcomes on the LOL family. The first three rows are selection-independent pre-registered endpoints; the modern-pair row is reported as a disclosed audit outcome because the official test set informed expert-pair selection. Gains are mean per-image LPIPS relative to the fixed base expert (paired-bootstrap 95% CIs). Rf: Retinexformer; DiffRet: Diff-Retinex. SICE terminal test: Sec. 6 .Sec. 6 .
Premise
Value
Oracle headroom vs. fixed expert
+0.0106[+0.0092,+0.0121]
Area at which the oracle already wins
2.5% (saturates near 20%)
Router margin over random / darkness
+0.0109 / +0.0114 (CI lower bound >0 )
over residual / uncertainty
+0.0053 / +0.0101 (CI lower bound >0 )
Gain capture / mean regret
57.2% / 0.0046
Darkness cue vs. no routing
LPIPS 0.1164 vs. 0.1110 (worse)
Table 2: Evidence-I premises (LOL-v1 validation, n=65 , 20% area budget, paired-bootstrap 95% CIs; last row from LOLv2-real validation). Cue-by-cue tables are in the supplementary.
Figure 3: Counterfactual gain under syn degradations of LOL-v1 inputs.
Setting
SS λ⋆
SS harm (CP95)
LTT λ⋆
LTT harm
first-safe λ⋆
harm
v1 (Rf+DiffLL)
0.0197
4/65 = 6.2% [1.7,15.0]
abstains ( α=.15 : 0.0236)
—
0.0197
4/65
v1_syn (Rf+DiffRet)
0.0133
0/65
0.0172
0/65
0.0133
0/65
v1_real (Rf+DiffRet)
0.0056
0/65 (abstains)
0.0056
0/65
0.0056
0/65
v1_cid (CIDNet+DiffLL)
0.0133
11/65 = 16.9%
0.0172
3/65=4.6%
0.0108
13/65 = 20.0%
v1_cgr (CIDNet+GSAD, degraded basin)
0.0069
7/65 = 10.8% [4.4,20.9]
0.0069
7/65
0.0069
7/65
v1_cgr det-path regeneration
0.0069
4/65 = 6.2%
0.0069
4/65
0.0069
4/65
Table 3: Certificate comparison on the LOL-family validation sets ( n=65 , α=0.10 , ε=0 ). We compare the deployed safe-suffix (SS) rule, valid LTT ( δ=0.05 ), and the ’first-safe’ conformal baseline. Bold highlights the LTT repair of v1_cid and the corrected official-state modern pair; degraded-basin runs are retained for audit completeness. v1 cid = CIDNet+DiffLL; v1 cgr = CIDNet+GSAD.
Figure 4: Certificate behavior across risk budgets. (a) Empirical harm versus nominal risk α for the three earliest settings using frozen calibration scores. (b) Certified capture and empirical harm at α=0.10 for the four early LOL-family settings; v1_cid is shown at the valid-LTT repaired point, and its negative capture ( −0.04 ) is clipped. Full sweeps are provided in the supplementary; modern-pair results are reported in Table 3 .
Condition
Cert. harm
Area
Qual. harm
Guard det.
After guard
clean
6.2%
0.043
18.5%
6.2%
4.6%
noise s1–s3
4.6–10.8%
0.004–0.006
86–99%
51–100%
0–1.5%
blur s1–s3
10.8–56.9%
0.012–0.050
25–92%
100%
0%
dark s2–s3
15.4–32.3%
0.031–0.092
29–39%
86–100%
0–4.6%
dark s1 (residual)
27.7%
0.087
35.4%
32%
20.0%
Table 4: Stress test on LOL-v1 validation under full-image distribution shifts with zero recalibration. The full per-condition grid is provided in the supplementary.
Figure 5: Stress test under input shift on LOL-v1 validation with zero recalibration. (a) Harm of the certified and quality modes with CP95 intervals. (b) Harm after applying the input-envelope guard.
Figure 6: Qualitative examples (red boxes indicate the displayed crops; stochastic experts are shown at seed 1). (a) LOL-v1: the certificate preserves useful refinement. (b) LOLv2-syn: the quality mode hallucinates structure and color, while the certificate vetoes the harmful override. (c) GSAD process-state bistability: the same input and weights produce a degraded state and the published state. (d) SICE: the certificate admits no override, so the output matches the fixed CIDNet expert.