{'fraction_non_alphanumeric': 0.035337537415361366, 'fraction_numerical': 0.009124989102321932, 'mean_word_length': 4.932080675745561, 'pattern_counts': {'":': 0, '<': 2, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Deep Image Destruction: A Comprehensive Study on Vulnerability of Deep Image-to-Image Models against Adversarial Attacks

Recently, the vulnerability of deep image classification models to adversarial attacks has been investigated. However, such an issue has not been thoroughly studied for image-to-image models that can have different characteristics in quantitative evaluation, consequences of attacks, and defense strategy. To tackle this, we present comprehensive investigations into the vulnerability of deep image-to-image models to adversarial attacks. For five popular image-to-image tasks, 16 deep models are analyzed from various standpoints such as output quality degradation due to attacks, transferability of adversarial examples across different tasks, and characteristics of perturbations. We show that unlike in image classification tasks, the performance degradation on image-to-image tasks can largely differ depending on various factors, e.g., attack methods and task objectives. In addition, we analyze the effectiveness of conventional defense methods used for classification models in improving the robustness of the image-to-image models.


Introduction
The deep learning technology brings us tremendous advantages in various computer vision fields. On the other side, recent studies have shown that deep learning-based algorithms are highly vulnerable to adversarial attacks, which add imperceptible noise to input images to fool the tar- get deep model. Such vulnerability has been investigated chiefly on image classification models [9,25].
Meanwhile, image-to-image models have also been developed. Unlike image classification models, image-toimage models cover much broader task objectives, including colorization [31], super-resolution [16], denoising [30], deblurring [20], and image-to-image translation [33]. Nevertheless, the vulnerability issue of deep models for imageto-image tasks has not been studied much compared to that of the image classification task. Because the way how image-to-image models deal with image data largely differs from that for image classification models, the characteristics of such a vulnerability issue may also differ from those for image classification.
For image classification models, an adversarial attack tries to enforce the input image to move out of the decision boundary (Figure 1a). Let X and X denote the original and attacked input images, respectively, i.e., X = X + ∆ for a small perturbation ∆. For a given classification model f c (·), which outputs a class label y for input X, the goal of the adversarial attack is to achieve f c ( X) = y. By contrast, because the image-to-image models output images instead of class probability distributions, the goal of an adversarial attack can be set to maximize the difference between the original output image f m (X) and the attacked output image f m ( X), where f m (·) is the target image-to-image model (Figure 1b), i.e., where d(·, ·) is a distance measure. Due to this fundamental difference of adversarial attacks between classification models and image-to-image models, the following essential research questions need to be answered, which is the objective of this paper.
• How can we measure the success of adversarial attacks for image-to-image models? The metrics used in image classification models (e.g., success rate) cannot be used.
• What are the characteristics of adversarial attacks for image-to-image models? Because of the different properties from the image classification models, the vulnerability of image-to-image models may appear differently in various factors.
• What are the right ways to improve the robustness of image-to-image models? The applicability of conventional defense methods used in image classification to image-to-image tasks needs to be examined.
To find answers, we conduct comprehensive and thorough investigations on the vulnerability of deep image-to-image models against adversarial attacks. We expose five popular image-to-image tasks to malicious attacks and examine various factors of the vulnerability. In addition, we examine the influence and feasibility of defense methods that are conventionally applied to image classification models.

Related Work
Adversarial Attack. Researchers have recently developed adversarial attack methods that can fool various deep image classification models [25]. Szegedy et al. [26] developed an optimization-based approach to make a given classification model produce wrong classification results with minimum amounts of input perturbation. Goodfellow et al. [9] proposed the fast gradient sign method (FGSM), which calculates the perturbation from the sign of the gradients obtained for a given classification model. Kurakin et al. [14] iteratively employed FGSM for better fooling performance, called I-FGSM. The attack methods have also been extended to investigate other vulnerability issues, e.g., finding universal perturbation [19] and measuring transferability among different models [17]. More recently, attack methods applicable for tasks other than classification have been developed. For instance, [7] proposed the feature disruptive attack (FDA) method, which attempts to find perturbation from the intermediate features of a given model. These focus on the image classification task, and an in-depth study on vulnerability of image-to-image models for various tasks has not been conducted.
Defenses against Adversarial Attack. Defense methods against attacks on classification models have also been proposed. One approach is to transform the input images before feeding them to a given model to reduce the amount of perturbation, including JPEG compression [6], bit depth reduction [29], and random resizing [28]. Another effective way is adversarial training, which uses images containing adversarial perturbation as training data [9,12,14].
To investigate the attacking patterns of the image-toimage models, we consider two types of attack methods that are used for image classification models and are applicable to image-to-image models: feature-based attack and gradient-based attack. As the feature-based attack, the FDA method [7] is employed. It tries to reduce the variance of the intermediate activations in the target model. It does not rely on the model output to find perturbation, so it can be used to attack image-to-image models as well as classification models. As the gradient-based attack, the I-FGSM method [5,14] is employed. It iteratively finds the attacked input X from the gradient sign of the L2 difference between the original output and attacked output images.
We set the pixel value scale of the images as [0, 255], and set a constraint to limit the amount of perturbation with varying values. See the Appendix section for the details of the employed models and attack methods.

Quantitative Vulnerability Evaluation
As we mentioned earlier, it is not possible to evaluate vulnerability of image-to-image models by directly employing conventional quantitative measures used for image classification models (e.g., success rate or fool rate). To this end, we design an evaluation metric based on the peak signal-to-noise ratio (PSNR) that is one of the most widely used metrics for evaluating the quality of the output images in image-to-image tasks. Because an adversarial attack aims to minimize the amount of perturbation in the input image but maximize the amount of deterioration in the output image, we first measure PSNR for both input and output images. The PSNR for the input (PSNR in ) is measured between the original input image X and the attacked one X, referring to the amount of injected perturbation. The PSNR for the output (PSNR out ) is measured between the output image for the original input image f m (X) and the output for the attacked input image f m ( X), quantifying the amount of deterioration due to the attack.
If an image-to-image model is more vulnerable to adversarial attacks than another, a smaller amount of perturbation injected into the input image can significantly deteriorate the quality of its output image. In that case, PSNR in would be larger (i.e., a less perturbed input image) while PSNR out would be smaller (i.e., a more deteriorated output image). Considering this, we define a vulnerability index (VI) that measures the degree of vulnerability. It is calculated as: When the VI value is larger, the model has higher vulnerability. It allows us to compare the level of vulnerability of multiple models easily. We also employ structural similarity (SSIM) instead of PSNR to measure VI and observe similar trends (see the Appendix section). Using VI, we conduct indepth analysis of the varying distortion patterns and factors affecting the vulnerability in Section 4.1.

Transferability of Universal Perturbations
An adversarial perturbation is basically found for each image, but it is also possible to find an adversarial perturbation that can affect any input image for a given model [19]. This so-called universal perturbation can be obtained by applying a given attack method (i.e., FDA or I-FGSM) to the averaged deterioration, instead of the deterioration of each output image. In addition, because the universal perturbation does not rely on a specific input image, it enables us to investigate its transferability [17], which refers to the applicability of the universal perturbation found for a model to another model. By measuring transferability of different universal perturbations, it is possible to determine whether some models have similar characteristics or not in terms of vulnerability.
We investigate the transferability of universal perturbations in two-fold (Section 4.2). We examine the transferability of universal perturbations from one image-to-image model to another. In addition, we further investigate the transferability of universal perturbations between image-toimage and image classification models, including VGG16 [24], ResNet-101 [11], and MobileNetV2 [22]. These can clarify whether the perturbations are transferable across different tasks, not only between image-to-image tasks but also from/to the image classification task that is a completely different type of task. To compare the perturbation on the same resolution across different models, we adjust all the input images to have a resolution of 224×224 pixels.

Characteristics of Adversarial Examples
Image-to-image models can exhibit various patterns of qualitative degradation depending on the characteristics of the perturbations. In classification, different characteristics of attack approaches are revealed mainly through changes in quantitative performance (e.g., success rate and computational complexity). In image-to-image tasks, however, the differences according to the input perturbations can be directly observed through changes in the output images. In this regard, we investigate the characteristics of adversarial perturbations by manipulating frequency components during the I-FGSM process, which was recently applied to the classification task [10,23]. Let ∆ (i) ∈ R W ×H×C denote the perturbation for a given input image X found at the ith iteration, where W , H, and C are the width, height, and number of channels of the input image, respectively. We obtain low-frequency components of the perturbation by where DCT(·) and IDCT(·) are the 2-D discrete cosine transform (DCT) and inverse DCT, respectively, • denotes the element-wise multiplication, and M ∈ R W ×H×C is a binary mask that extracts certain frequency components of the perturbation. For attacking the low-frequency subspace, the value of M at (w, h, c) is set to one when w≤rW and h≤rH, and zero otherwise. The parameter r ∈ [0, 1] controls the range of the low-frequency subspace. Finally, the I-FGSM update rule is applied from the gradient sign of the L2 difference between the original output image and the output image obtained from X + ∆ (i) . We also investigate the effectiveness of attacking the high-frequency subspace by setting the value of M at (w, h, c) to one when w≥(1 − r)W and h≥(1 − r)H, and zero otherwise. The results are presented in Section 4.3. Figure 2 compares the performance of the models in terms of VI, when is set to 8 (see the Appendix section for different values). We also employ random uniform noise as a baseline attack method, where the bound of noise is set to [− , ]. The VI values for the random noise are near 1, meaning that the input and output images have deteriorated similarly, and it is barely effective as an attack. By contrast, FDA and I-FGSM show significantly larger VI values than 1 except for DnCNN, proving that the adversarial attack approaches work well. In addition, FDA shows the VI value close to 1 for DeepDeblur, while I-FGSM shows a much  larger VI value. These can also be observed in Figure 3: Both FDA and I-FGSM fail to conceal changes in the input images of DnCNN, and FDA fails to deteriorate the output images of DeepDeblur, while I-FGSM results in significant degradation. It proves that VI is a reasonable measure to evaluate vulnerability of the image-to-image models. In the following, we go deeper into examining degradation patterns along with the VI values. While any successful attacks on image classification models result in incorrect classification, attacks on image-to-image models result in visual distortions in the output images, where distortion patterns can largely differ depending on various factors. In this regard, we investigate characteristics of vulnerability with respect to different tasks, attack approaches, model structures, and datasets. Relation to Tasks. Figure 3 shows example images obtained with and without the adversarial attacks. For all tasks, the attacks add hardly perceivable perturbation to the input images. However, significant quality deterioration can be found in the output images with various deterioration textures except denoising (as shown in Figure 2). The failure to attack the denoising models is because they are trained to identify and remove the elements unrelated to the original visual content in a given image. The models for the other tasks, on the contrary, try to find latent information from a given image (e.g., color for colorization and high-frequency details for deblurring and super-resolution) and recover the corrupted content. Because the visual components that each model tries to recover differ, different patterns of destruction are observed in the output images of different models. We discover more details by investigating transferability of the adversarial examples in Section 4.2. Relation to Attack Approaches. In the classification, the attack results are usually represented only as success rates regardless of attack methods. In the image-to-image tasks, however, characteristics of attack methods can directly affect the patterns of the quality degradation in the output images. This can be observed in Figure 3. Overall, the output images under I-FGSM look more corrupted than those under FDA. It is also shown as larger VI values for I-FGSM in Figure 2. Figure 4 shows another examples when DnCNN is employed. When FDA is used, the sharp textures are largely removed in the output image, which is mainly due to the reduction of the activations. By contrast, I-FGSM tries to deteriorate the quality of the output image as much as possible, resulting in noisy patterns. Relation to Model Structure. Several image-to-image models employ generative adversarial networks (GANs) [8] to improve perceptual quality of the output images. We observe that these models output more deteriorated images than the models without GANs when attacked. In Figure 2, DeepDeblur and CycleGAN, which employ GANs, show relatively larger VI values. This is also confirmed when SRResNet and SRGAN are compared in Figure 5. These two models share the same model structure, but SRGAN is trained with a GAN-based loss function for better perceptual quality. The models trained with GANs usually produce perceptually appealing sharp textures [4]. Thus, the perturbation in the input image can also be intensified in the output image. Relation to Training Datasets. The translation models share the same model structure, but they show different characteristics in terms of vulnerability and distortion patterns. In Figure 2, the model converting apples to oranges shows the least vulnerability, while the model converting horses to zebras is the most vulnerable among the translation models. Figure 6 depicts example images when FDA is employed. For converting apples to oranges, the model simply finds red regions and converts their colors to yellowish ones, meaning that it is primarily sensitive to color information in the input image. By contrast, due to grainy textures in the oranges, the model converting oranges to apples relies on complex analysis of the input image. The same applies to the models converting horses to zebras and Van Gogh's paintings to photos (see the Appendix section). Thus, there is more room for the attack to find effective perturbation for these models. This demonstrates that the vulnerability of the image-to-image models can differ depending on the employed dataset. Figure 7 shows the universal perturbation for each attack method and each task. First of all, the patterns of the perturbations differ depending on the attack method because of the differences in the attack objectives. While FDA tries to find a perturbation that can reduce the intermediate activations, I-FGSM tries to maximize the amount of output deterioration directly. In addition, the overall patterns of the perturbation differ depending on the task. For example, grouped colorful pixels can be found in the perturbation of the denoising model for I-FGSM because Gaussian noise-like perturbation, obtained in the other tasks, tends to be removed in the output images due to the denoising process. It is interesting to compare the perturbations obtained from image-to-image models with those obtained from image classification models. The former contains more granular textures, while the latter has thicker and bolder textures. One possible reason for the difference is due to the different architectures: The image classification models em- ploy spatial aggregation operations (e.g., max pooling, average pooling) to reduce the number of intermediate features, while the image-to-image models usually do not employ such operations to minimize loss of the information that can directly affect quality of output images. image-specific attack, the image-agnostic universal attack is applicable to image-to-image models. Moreover, I-FGSM generates perturbations stronger than those of FDA because of the different objectives: the deterioration in quality of the output images (I-FGSM) and the reduction of the activations (FDA). We investigate the transferability by applying a universal perturbation found in a model to another model. Specifically, we measure VI or a fooling rate of a target model for the universal perturbation found from another source model. Figure 9 summarizes the results for I-FGSM (see the Appendix section for FDA-based results). The universal perturbations are transferable between different models to some extent, and it is relatively more transferable when the source and target models are for the same task. For example, when one of the super-resolution models is set as a target model, attacking with the perturbations of the other super-resolution models shows higher VI values than employing perturbations of the models for the other tasks.

Universal Perturbations and Transferability
Overall, the perturbation found from an image-to-image model is more effective than that found from an image classification model to deteriorate outputs of the other imageto-image models. In other words, the averaged VI of the last three rows in Figure 9 is 1.09, which is smaller than the averaged VI of the other rows except for the cases when the source and target models are the same (1.16, t = −2.09, p < .05). The same observation can be found more obviously in the cases when an image classification model is used as a target model; the averaged fooling rate of the last three rows except for the values in the diagonal is 42%, which is significantly larger than that of the other rows (11%, t = 8.21, p < .01).
Surprisingly, however, the universal perturbations are sometimes transferable between an image-to-image model and a classification model. For instance, the perturbation found in DnCNN can fool MobileNetV2 with a fooling rate of almost 50%. In Figure 7b, it can be observed that the perturbation of DnCNN looks the most similar to that of VGG16 in terms of the tendency of texture patterns and variety of colors. However, the opposite is not applied; as the original attack on DnCNN does not work well, the perturbations of the classification models do not successfully attack DnCNN, either.

Characteristics of Adversarial Examples
We further investigate characteristics of perturbations by employing the frequency-aware attacks. Figure 10 shows the VI values for the low-frequency and high-frequency attacks when r is set to 1/4 (see the Appendix section for the results using different values of r). The results explain that the effectiveness of the frequency-aware attacks varies depending on the task. For instance, the deblurring model (DeepDeblur) is more vulnerable to lowfrequency perturbations than high-frequency ones, while the super-resolution models are more vulnerable to the high-frequency attack. Figure 11 shows example images obtained from models of these two tasks. In DeepDeblur, only the lowfrequency attack significantly deteriorates the quality of the output image because the model exploits information in the low-frequency components (i.e., blurred regions) to recover missing details. By contrast, the output image of EDSR is affected by both the low-frequency and high-frequency attacks. However, the low-frequency attack also significantly deteriorates the perceived quality of the input image, while the high-frequency attack does not. A super-resolution model finds latent textures through the high-frequency subspace of an input image; thus, the high-frequency attack works well. However, the low-frequency features in the input image, which do not have notable textures, appear in the output image without much change. Hence, the lowfrequency attack tries to add a large amount of perturbation to degrade the output, which leads to clearly visible deterioration in both the input and output images. These show that the frequency-dependent degree of vulnerability of a model is determined by its internal mechanism optimized for the task.

Defending Image-to-image Models
In the previous sections, we evaluated vulnerability of image-to-image models in various aspects. The next question is: Are the defense methods for image classification models applicable to image-to-image models? To investigate this, we examine the effectiveness of several possible defense methods for the image-to-image tasks, including image transformation and adversarial training, which are popular approaches in image classification tasks (as we mentioned in Section 2). For transformation-based approaches, we consider JPEG compression [6] (with a quality level of 75), random resizing [28], and bit reduction   [29] (to 4 bits for each channel). In addition, we consider geometric self-ensemble that was introduced in the super-resolution [16] to improve quality of the output images without additional training. For adversarial training, adversarial examples are obtained by I-FGSM. Figure 12 compares the performance of the defense methods in terms of VI, when I-FGSM is employed ( = 8).
The VI values obtained without applying any defense methods are also shown with diamond markers. Overall, the defense methods reduce influences of adversarial perturbations to some extent, i.e., the VI values are reduced. The JPEG compression shows the best effectiveness. Nevertheless, the VI values are still larger than 1, and this implies that deterioration in output images is not completely removed.
We note that defending image-to-image models brings another concern: It is not desirable if the original performance without attack is degraded due to the application of a defense method. For classification models, slight changes in the unattacked input image due to, for instance, image transformation-based defense do not alter the image content much and thus the classification result is expected to remain the same. However, for image-to-image models,  small changes in the input image due to defense can significantly affect the quality of the output image. In order to examine this, we compute original PSNR values from the ground-truth and output images when a defense is applied for unattacked input images. Figure 13 shows that the defense methods can lower the original performance, especially when transformation-based approaches except the geometric self-ensemble are employed. The geometric selfensemble most successfully preserves the original performance, which is followed by adversarial training. JPEG    compression, which is the most effective defense method in Figure 12, harms the original performance the most.   to-image models, i.e., significant deterioration is introduced in the output images when the input image is not attacked. The transformations directly affect the original textures of the input image. While the geometric self-ensemble method is originally for improving the original performance, the other transformation-based methods do not consider improving or preserving the original performance. Furthermore, these defense methods are not so effective when an adversarial attack is applied; the deterioration is still visible even though the amount of deterioration is reduced. These results give us the following insights. First, existing transformation-based approaches that are used in image classification models are not suitable for image-to-image tasks. When devising a defense method to manipulate the input image, it should be carefully designed to not damage the original performance. Second, improving the robustness of the models directly (e.g., adversarial training) may be a more promising solution to defend image-to-image models against adversarial attacks.

Conclusion
We presented in-depth investigations on vulnerability of deep image-to-image models against adversarial attacks. Our study aimed to 1) examine vulnerability patterns in various aspects with a proper measure of success of adversarial attacks, 2) find characteristics of image-to-image models in terms of vulnerability across different tasks, and 3) evaluate applicability of existing defense methods. To this end, we defined a measure for image-to-image models, vulnerability index (VI), and our results showed that most state-of-theart image-to-image models are highly vulnerable to adversarial attacks and universal perturbations are even transferable across tasks. However, the attack results have significantly different characteristics depending on the task type, attack method, model structure, and dataset. Furthermore, we found that the vulnerability patterns characterized by the perturbation can also differ depending on the aforementioned factors. Finally, our results showed that many of the existing defense methods used for classification models are not suitable to image-to-image models and revealed the necessity of considering the original performance.

A. Appendix
Attack Methods. We consider two types of attack methods that are applicable to image-to-image models: a featurebased method and a gradient-based method.
As a feature-based attack, the FDA method [7] is considered. It tries to reduce the variance of the activation functions in the target model by maximizing the following function: where Φ is one of the intermediate features and C(w, h) is the mean values across the channel dimension. Because it does not rely on the model output to find a perturbation, it can be used to attack image-to-image models as well as classification models. The perturbation for an input image is obtained iteratively while the L ∞ norm of the perturbation is kept smaller than a constant . The number of iterations T is set to 50 and the amount of the perturbation at each iteration is set to /T . As a gradient-based attack, the I-FGSM method [5] is considered. Similarly to the original I-FGSM method for classification models [14], it iteratively finds the attacked input X as follows: where X (i) is the attacked image at the i-th iteration. Since f m (·) can be any model that outputs an image, this method can be applied to the image-to-image models. We set X (0) =X. As in FDA, the number of iterations T is set to 50. For all the attack methods, we set ∈ {1, 2, 4, 8, 16, 32} in the pixel value scale of [0, 255].
Models and Datasets. We consider 16 deep models for five popular image-to-image tasks: colorization, deblurring, denoising, super-resolution, and translation. Table 1 summarizes deep learning-based image-to-image models that are examined in this paper. For colorization, CIC [31] is used. For deblurring, DeepDeblur [20] is used. For denoising, three DnCNN models [30] are used, which are trained on grayscale images having Gaussian noise with σ=15, grayscale images having various levels of Gaussian noise (σ∈[0, 55]), and RGB images having various levels of Gaussian noise (σ∈[0, 55]). For super-resolution, EDSR [16], RCAN [32], CARN [2], SRResNet [15], and SRGAN [15] are used. For translation, three CycleGAN models [33] trained on three pairs of datasets in different domains (apple ↔ orange, horse ↔ zebra, and Van Gogh's paintings ↔ photos) are used. The models are trained with the procedures reported in the original paper. The training datasets are also the same to those used in the original papers.
Evaluation is performed using the datasets that are commonly used for evaluating each task in the literature. For colorization, we use the 1,000 images of the validation split of the ImageNet dataset [21] after cropping at the center regions and resizing to 224×224 pixels (i.e., the same size as the training images). For deblurring, we use the Köhler dataset [13]. For denoising, we employ 68 images in the BSD500 dataset [3] that are not used for training the models, as in [30]. For super-resolution, we employ the BSD100 dataset [18]. For translation, we employ the validation dataset provided in [33] for each translation pair. Implementation Details. We conduct our experiments on various CPUs (e.g., Intel Xeon CPU E5-1660v3, Intel Core i7-7700) and GPUs (e.g., NVIDIA GTX 1080, NVIDIA GTX 2080Ti). We implement our code by using TensorFlow with Python. We will make our code publicly available on GitHub.
Performance Comparison in Terms of PSNR. We first show the performance comparison in terms of VI for different attack methods employed with various values in Figure 15. In addition, we show the performance comparison in terms of the PSNR values for the input (PSNR in ) and the output (PSNR out ) in Figure 16. A curve closer to the lower right corner means that the corresponding model is more vulnerable, i.e., a small amount of perturbation in the input image results in a large amount of deterioration in the output image.
Output Degradation on Other Translation Models. To supplement the results in Figure 6, we show additional example images obtained from the CycleGAN models converting horses to zebras and Van Gogh's paintings to photos, when FDA is employed, in Figure 17.
Performance Comparison in Terms of SSIM. Along with the evaluation results in terms of PSNR, we also include the performance comparison in terms of structural similarity (SSIM) [27], which is not included in the main sections. Similar to the performance comparison in terms of VI derived from PSNR, we calculate the vulnerability index calculated on SSIM, i.e., VI SSIM =SSIM in /SSIM out , where SSIM in and SSIM out are the SSIM values for the input and output images, respectively.
The performance comparison is shown in Figure 18. The overall trend is similar to that shown in Figure 2. One noticeable difference is that VI SSIM penalizes the superresolution models more than the translation models, while the translation models appear more vulnerable in terms of VI calculated on PSNR. This is because although the pixelwise changes in the output images are larger for the translation models than for the super-resolution models, which makes VI higher for the former, the changes for the translation models tend to alter the image content (e.g., textures) and be less perceptually annoying than noise-like distortion in the super-resolution models, which is considered by VI SSIM .
In addition, the performance comparison in terms of SSIM in and SSIM out is shown in Figure 19.
Frequency-Aware Attack with Different Values of r. In Section 4.3, we show the frequency-aware attack, which finds the perturbation only in a low-frequency or high-frequency subspace. While the results obtained with r=1/4 are included in that section, we also report the results obtained with different values of r in this appendix. The quantitative performance comparison in terms of VI is shown in Figures 20 and 21. In addition, example input and output images are also shown in Figure 22.
Defenses against Adversarial Attacks. In Section 5, we discuss the effectiveness of conventional defense approaches in the image-to-image tasks. In this appendix, we show additional example results obtained from the models of five image-to-image tasks. Figure 23 shows visual examples of the transformation-based defenses, including JPEG compression, random resizing, bit reduction, and geometric self-ensemble. Figure 24 shows visual examples of the adversarial training-based defense. Adversarial training shows slightly better defense results than the image transformation methods in terms of both preserving the original performance and improving robustness against adversarial attacks.  [15] Yes ImageNet [21] subset BSD100 [18] Translation CycleGAN [33] (apple ↔ orange) Yes ImageNet [21] subset ImageNet [21] subset CycleGAN [33] (horse ↔ zebra) Yes ImageNet [21] subset ImageNet [21] subset CycleGAN [33] Figure 20. Performance comparison in terms of VI for the low-frequency attack with = 8.