Rethinking Image Restoration for Object Detection
Authors: Shangquan Sun
Wenqi Ren
Tao Wang
Xiaochun Cao
Venue: NeurIPS 2022 Accept (2022)
Keywords: Image Restoration
Object Detection
Image Dehazing
Low Light Enhancement
Targeted Adversarial Attack

Abstract: Although image restoration has achieved significant progress, its potential to assist object detectors in adverse imaging conditions lacks enough attention. It is reported that the existing image restoration methods cannot improve the object detector performance and sometimes even reduce the detection performance. To address the issue, we propose a targeted adversarial attack in the restoration procedure to boost object detection performance after restoration. Specifically, we present an ADAM-like adversarial attack to generate pseudo ground truth for restoration training. Resultant restored images are close to original sharp images, and at the same time, lead to better results of object detection. We conduct extensive experiments in image dehazing and low light enhancement and show the superiority of our method over conventional training and other domain adaptation and multi-task methods. The proposed pipeline can be applied to all restoration methods and detectors in both one- and two-stage.

Rethinking Image Restoration for Object Detection
Shangquan Sun
Wenqi Ren
State Key Laboratory of Information Security Institute of Information Engineering
School of Cyber Science and Technology Sun Yat-sen University, Shenzhen Campus Shenzhen, China 518107 rwq reweenii@maal.l....... com
Chinese Academy of Sciences
Beijing, China 100093
sunshangquan@iie ac.
Tao Wang
Xiaochun Cao
Huawei Technologies Co., Ltd. Beijing, China 100085 wangtao10@huawei.. com
School of Cyber Science and Technology Sun Yat-sen University, Shenzhen Campus Shenzhen, China 518107
caoxiaochun@mail. syy.e edu. cn
Abstract
Although image restoration has achieved significant progress, its potential to assist object detectors in adverse imaging conditions lacks enough attention in the research community. It is reported that the existing image restoration methods cannot improve the object detector performance and sometimes detection performance. To address the issue, we propose a targeted adversarial attack in the restoration procedure boost object detection performance after restoration. Specifically, we present an ADAM-like adversarial attack to generate pseudo ground truth for restoration fine-tuning. Resultant restored images are close to original sharp images, and at the same time, lead to better object detection results. We conduct extensive experiments image dehazing and low light enhancement and show the superiority of our method over conventional training and other domain adaptation and multi-task methods. The proposed pipeline can be applied all restoration methods and both one- and two-stage detectors.
reduce the
Introduction
Image quality degradation is common in outdoor captured images and many image restoration methods have been developed to automatically recover sharp details from the degraded images. Typically, the goal of image restoration is to generate sharper results from which human vision can better identify the structural details and objects in the images. However, in many applications, large-scale images collected for high-level computer vision tasks (e.g., object detection, semantic segmentation, and autonomous driving) other than a visual examination by human. Though significant progress has been made in terms of the visual quality, its ability to serve pre-processing step for downstream vision tasks lacks enough research attention.
Object detection has achieved remarkable success as the boosting of deep neural networks. Many successful models, e.g., Raster-RCNN 322 and YOLOv3 [31, have been developed and deployed in real-world applications such autonomous driving 4 38 However, in the settings of the commonly used benchmark for object detection, poor weather and imaging conditions are intention- ally avoided 7 insufficient due to data bias [16] 99. The unbalanced data distribution toward clean images leads to a domain shift between properly captured images and low-quality ones in
"Corresponding Author.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

adverse environments [36]. The performance of object detector trained on high-quality samples thus downgrades sigmificantly in adverse imaging and weather conditions such as haze, rain, and low light
exposure 23 since the weather-related deterioration features distort captured image [2] 47
Many existing solutions to the issue lie in domain adaptation from clean images (source domain) to corrupted ones (target domain) [S 13, 36). They assume there exists a distribution shift between clean images and those in poor conditions, and adapt detectors by unsupervised weather-specific priors or domain adaptation components to align the features of two distributions to reduce domain discrepancy. However, the detector after adaptation is found to perform worse in the source domain than that without adaptation [23] since adapted detectors may focus on weather-relevant deterioration information. Another track to tackle the issue to jointly train simple visual quality enhancement module together with detection network [5] 233. However, these modules cannot provide satisfactory results compared to powerful restoration methods. Many artifacts and noise patterns occur when applying the enhancement module. It is also challenging to balance visual quality and detection performance by tuning apper-parameters during training. Since the detector is trained on corrupted samples or the combination of corrupted and clean samples, its performance clean samples may decrease, similar to the case of domain adaptation.
Different from previous works modifying object detectors, we address the issue by adapting restoration algorithmss such that recovered images can achieve both good visual quality and better detection results for detectors. Though image restoration methods produce satisfying results from the perspective of human eyes, detectors may consider them as variables following the distribution of an artificial neural network rather than the real-world, thus being confused by such covariate shift. Therefore, finding a pseudo ground truth close to the original sharp image potentially improves detection. To find such pseudo ground truth, a targeted adversarial attack can be employed to add an invisibly small perturbation to the original ground truth, on which the detector will give our desired prediction. The resultant adversarial examples are obtained by minimizing the loss of object detectors over perturbation, and can serve as pseudo ground truth for restoration algorithms. Such perturbation is trivial, so restoration models are not impacted to the greatest extent. During the fine-tuning stage, only the weights of restoration methods are updated and detectors keep unchanged. Thus the performance of detectors will not decline in the clean domain. Note that the goal of this paper is not the development of a new image restoration algorithm or a new object detection model. Instcad, propose targeted attack preprocessing of image ground truth to help improve the accuracy of downstream object detection. Specifically, we propose a momentum- based Adam 17 -variant adversarial example generation method to estimate pseudo ground truth.
Our contributions can be summarized as following:
1. We propose fine-tuning pipeline to improve detection performance and retain visually satisfactory restoration results. Specifically, we show multi-tast optimization problem of balancing both detection and restoration can be decomposed into targeted adversarial attack generation and a restoration problem. The pseudo ground truth generated by adversarial example generation is used for fine-tuning.
2. We design a momentum based ADAM-like iterative targeted adversarial example generation algorithm to estimate pseudo ground truth for restoration models fine-tuning. Rather than updating samples by first-order gradient in existing work, we compute ADAM-vvriant clipped and signed gradient with momentum estimation.
3. We conduct extensive experiments in two image restoration tasks, i.e., dehazing and low light enhancement for both one- and two-stage object detectors. We first evaluate the effect of our adversarial attack algorithm compared to existing ones on test sets. We then show our proposed fine-tuning pipeline effectively improves the detection performance gain of restoration algorithms as a pre-processing step of detectors compared to conventional training and other existing works.
2 Related Works
2.1 Restoration for Detection
In the image restoration task, many works have achieved promising performance in terms of visual quality and quantitative evaluations 24 8 20
35 33 Though many of them mention their potential

---

usage as a pre- processing for downstream high-level tasks (e.g., object detection and segmentation), only few of them experiments on how much gain of detection accuracy can be acquired before and
after the dehazing step. Dong et al. [8] simulate haze on KITTI 10) and show their method removes the synthetie haze effectively and can improve YOLOv3 31 detection predictions. Li et al. [20] publicize the RESIDE dataset, which contains subset in real-world hazy environment for evaluating object detection on dehazed results. A recent work [23] appends a differentiable image processing module consisting of multiple traditional filters on YOLOv3, and trains the module and YOLOv3 together on the combination of clean and hazy samples. Due to the limitation filters, generates many noises and artifacts and thus returns many false positive detection predictions.
In low-light environments, several object detection and semantic segmentation datasets have been collected. Yang et al. [46] create a benchmark for face detection in real-world low light condition. Loh et al. (26] publish a object detection benchmark in low light environment. Recently, Sakaridis er al. [34] collect a comprehensive semantic segmentation dataset in dark imaging condition. To tackle low-light enhancement task, ZeroDCE 12 is developed by formulating light enhancement as a task of image-specific curve estimation in the pixel-wise range. Its performance of helping face detection in low-light conditions is tested on DarkFace [46]. Ma et al. [27] recently develop a new Self-Calibrated Illumination (SCI) learning framework for fast, flexible, and robust brightening images in real-world low-light scenarios. They show its improvement for low-light face detection
and segmentation tasks on ACDC (34 and DarkFace 446 datasets.
The
works either merely experiment on synthetic datasets or have tune detection models together with restoration module, which limits the generalizability and extensibility of their works on real-world benchmarks and various tasks. In this work, we focus on proposing a plug-and-play targeted attack module for restoration algorithms to improve the performance of object detection without tuning detection models.
2.2
Adversarial Attack on Detector
After Szegedy et al. 337 finds that adding an imperceptible perturbation to image may fool neural
network classifier, many adversarial attack generation methods are presented in classification [T] 30
28 3 [8
Fewer works about adversarial attack on object detector are proposed (55 because of its
more complicated architecture and loss terms [4] 2]. Some works succeed in fooling detectors by either wearable patch (40 45 42 non-planar patch [50]
48
43
39]. Only limited works are Robust Adversarial Perturbation
14
about targeted attack. Dense Adversary Generation (DAG) 44
40 are designed for the two-stage detectors consisting of region proposal network. Other works such as Unified and Efficient Adversary (UEA) 41 and Targeted adversarial Objectness Gradient attack (TOG) 6 can attack both one-stage and two-stage detectors with more generic settings. UEA is a Generative Adversarial Network framework trained with class loss and feature loss that generates transferable adversarial images and videos. TOG [6] consists of three relatively powerful adversarial attack algorithms for object- vanishing, obbect-fariication, and object-mislabeling attacks, respectively. recent work 2 develops a content-aware blackbox adversarial attack framework based on TOG. In our work, we use TOG as the baseline for whitebox targeted adversarial example generation due to its flexibility and effectiveness in conducting extensive experiments. We assume detectors are whitebox because our goal is to improve its performance rather than fool it.
(RAP) [22], and Contextual Adversarial Perturbation (CAP)
3 Proposed Method
3.1 Pseudo Ground Truth Generation for Restoration
Denote a restoration model with parameters ws as and a detector with parameter @ as D. Suppose a dataset for training contains three components: corrupted images x, corresponding clean images x. the
and detection annotations y. Given that D only learns on clean samples {&, )) the prediction detector on corrupted samples D(x) is probably incorrect. Our aim is to fine-tune a restorer R such that the recovered image close to clean image, i.e., R(x) x &, and also the detector give correct prediction on the recovered image, i.e., D(R(x)) 9.
3

---

* ground
attacked ground truth
Bample Epace of
Bample Space of
(a)
(b)
Figure 1: aaA A diagram for the case where multi-task training cannot guarantee convergence towards the optimal solution. Suppose the blue elliptical region is sample space where detectors predict correctly. gi Vê (D))). f) denotes the gradient computed for updating g2 indicates the gradient of restoration loss, | x||. Any combination of the two at this iteration cannot make the recovered image X approach the elliptical region. However, we can find a pseudo ground truth in the region, x that is as close to & as possible. Updating towards it satisfy both the constraint of restoration and the requirement of correct detection. [Ibis VGG16 features distribution of five car patches. Each point represents a image patch. * is clean image, denotes corrupted patches, and A is attacked pseudo ground truth. We can clearly find that a feature shift occurs as its detection result gets better.
(x))))
Traditional supervised restoration problem is not involved with the detection objective and can be generally formulated as:
X arg argmin min [x(x) x||.
However, solely training with the objective I cannot guarantee a satisfactory result in subsequent object detection since the covariate shift and artifacts reported in 23 21]. Given that restoration an ill- pol-posed problem, various possible recovered images exist for a degraded one. Considering the inevitable image noises due hardware limitations during the image acquisition and transmission stage especially in adverse weather and imaging conditions, captured clean images can unnecessarily be regarded perfect ground truth.
Unlike conventional restoration methods, our goal is to find a balance between visual quality and detection performance on restored images. Our objective is to make detector D inference correctly on the restored image as close as possible to the clean image. Thus it can be considered as a multi-task optimization problem by combining the restoration constraint and object detection loss. We start by formulating it as follows,
P1 min / (D((Rxx)) v), s.t. ||x R S
R
min (D()),)) s.t. ||* S 8,
X
where x = R(x) is the recovered image, is a slackness coefficient indicating the allowed distance from the ground truth &. The constraint optimization problem cannot be solved casily due to the constraint. Thus we formulate its dual function as below by introducing a dual variable a 2 0 as,
d1 = min L(x) = (D(x). .) + al|$ -x|l.
(3)
Theorem For any 8 > O, there exists a 2 such that the optimal solution of 2 x", is also optimal for 3 and vise versa.
The proof of Theorem iis attached in the supplemental materials. The main idea is to use Lagrangian and a strong duality assumption. By Theorem I we can say the original problem Eq Eq and the dual problem is equivalent. However, the multi-task training faces difficulty in tuning the hyper-paramett a, and an improper a leads to either poor detection or restoration results. Figure shows a case where optimizing di cannot ensure correct detection.
Thus we further reformulate the objective and bypass the issue, By substituting 3 1. we get
d2 min ||
x|| + BE (D(2).

---

Algorithm 1:
Framework of Adam-variant adversarial example generation.
Input: Input dataset U with samples with annotation y, Detector D, Number of attack iteration T, Update stepsize X, Magnitude tolerance Perturbation Ò
Output: Attacked adversarial examples 8*
Assign 0.9, 83 0.999, le-
Initialize ma 0, Vo = 0, rand(-
x f clip(x z, 0, 1)
foreach (x. 8) in 21 do
foreach & in 1...T do
gx f VxLo(D(xx.))
m. f1m,-1 (1-
f 32V1-1 + (1-1111)) +11-32)
m f m,/(1- B9)
V +- ve/(1= - (8))
Update +- Asign jm htn//v/ +c];
z - clip(x - & 6)
clip(x z. 0)
Store x as pseudo clean image.
By Theorem T
again, we have
P2 min ||
x||, s.t. ((D()), Sr.
(5)
where is small slackness coefficient that regularizes the detection performance. By introducing an intermediate variable x that close enough to &, we have the expression of optimization,
min X
X|| where x arg min ||x x|| s.t. (D(x), Sr.
(6)
The solutions of 5 and 66 are equivalent when x 8* The problem can thus be separated into two optimization steps.
x arg min ||x x||, s.t. D(x) = ÿ,
R arg min [R(xx *+
R
Therefore, is an objective of targeted adversarial attack if we substitute for 8 and add box constraint ||x|| S 1. Then, (7) can yield a frreedlr-rrendly sample close the original ground truth, and (8) forces restoration models to learn the pattern mapping corrupted samples to the pseudo ground truth. The solution (5) can be approximately computed by the fine-tuning pipeline of sequentially optimizing 7 and (8)
3.2 Targeted Adversarial Attack Object Detector
Object detector DD receives an input image x and predicts label with n detected objects, i.e., y {(b", 6", bff 6 C,p)y 1..m.. where (b", 6a, 6 6") represents the location and region of bounding box for i-th object, C classification result and is prediction confidence. The existing method, TOG (6) designs group of loss terms specific for object detector. The adversarial example updated iteratively by signed and clipped first-order gradient the loss term as,
x+1 f- - Asign [xx L (D(x"), (x] x -- x + clip, (x -x.
where is the step size of perturbation update and 5 is the allowed perturbation scale centered at original input x. However, we note that the first-order gradient descent used in TOG may get stuck at sub-optimal or converge slowly. Therefore, we introduce the nomentum-based optimizer ADAM [17] optimize adversarial examples during updating perturbation, which widely used in optimizing parameters of neural networks during training. It can adaptively adjust learning rate
5

---

by second-order momentum and overcome sub-optimas with cumulative momentum. Therefore, we reformulate ( into
g Vx+ (D(x))
xt1 x Asign [ADAM(g)
(10)
x f x + clip, (x*+1_ x)
Finally, the generated pseudo ground truth X are used to fine-tune restoration models. The main step of the targeted adversarial attack is presented in Algorithm |
The convergence analysis of the algorithm is discussed in the supplemental material.
Experiments
4.1 Experimental Settings
We conduct experiments on two image restoration tasks, f.e., image dehazing and low-light image enhancement, and two detectors of YOLOv3 [3] and Faster-RCNN [32]
Dehazing Dataset: RTTS 20 a real-world hazy dataset with detection annotation for test purpose.
The object labels contain five categories, person, car, bus, bicycle, and motorcyele. To construct training set with both ground truth clean image and bounding box annotation, we select those PASCAL
VOC images with the above-mentioned five classes and simulate haze on them following 23 We
only simulate two scales of haze rather than ten in [23], and thus our training set is only 20% of theirs. RTTS contains 4,322 real-world hazy images. VOC_fog_tte train and VOC_fog_tt jest consist of 16,222 and 2,734 synthetic hazy images respectively.
Low-light Enhancement Dataset: ExDark [26] is a natural low light dataset for object detection consisting of ten classes, i.e., bicycle, boat, bottle, bus, car, cat, chair, dog, motorbike, person. Similar to dehazing task, we select those samples in PASCAL VOC with these ten categories and simulate low light corruption to form the training set, dubbed as VOC dark train. ExDark contains 2,563 real-world dark images. VOC_ train and VOC_ test consist of 12,334 and 3,760 synthetic dark images respectively.
Metrics: We adopt mean average precision (mAP) with an IOU threshold 50% as a metric for detection performance and Peak Signal-to-Noise Ratio (PSNR) and Structure Similarity Index Measure (SSIM) for restoration. Since our algorithm focuses on improving detection performance without sacrificing visual quality, we expect gain of mAP and as few degradations in PSNR/SSIM as possible.
Baselines: We evaluate our proposed fine-tuning procedure on four restoration models, i.e., MS- BDN 8 and GridDehaze [24] for the dehazing task as well as ZeroDCE [2] and SCI [27] for the low light enhancement task. We compare our fine-tuning pipeline with the traditional learning with only restoration loss. To test the generalization of our pipeline, we conduct experiments for two widely used detectors, i.e., YOLOv3 (31 and Faster-RCNN (32] We also compare our method against some domain-adaption approaches including DOLO
5) DSNet [15), and IA-YOLO (3
Implementation Details We use YOLOv3 447 with Darknet-53 backbone. We train both YOLOv3 [3I] and RaNN 32] on the clean images of VOC_fog _triittrann and VOC_dark train respectively. Then, their parameters data augmentation is utilized in the experiments. All experiments are conducted on an Nvidia Tesla V100 PCIe 32G GPU and implemented by PyTorch. We fine-tuned models with batch 1 at each iteration without cropping since the adversarial attack on detectors requires the whole image as input. The tuning number of epochs is 10 for all restoration models. The learning rate is set le-4 and the optimizer is ADAM with default settings for all models. For better learning for restoration, we replace all L1 loss with Charbonnier loss 1
fixed during fine-tuning image restoration methods. No
CCharbonnier (x, HWC ΣΣΣ
V (XI., S...,)2 X2
(11)
where À constant for numerical stability. We set as le-6. It variant of I.I loss and reported better in restoration [19].

---

(a) No attack
(b) TOG
Ours
(d) No attack
(e) TOG 6
(I) Ours
Figure 2: A comparison of object detection of different adversarial attack results RTTS 20 The 1st row the result of YOLOv3 31 and the 2nd that of Bester-RCNN 32
Pelidw
Putierer
Pundame
Phlldarer
Ple
Pi Pondame
(a) No attack
(b) TOG 6
Ours
(d) No attack
(c) TOG 6
(i) Ours
Figure 3: A comparison of object detection of different adversarial attack results on ExDark [26 The 1st row is the result of YOLOv3 [1 and the 2nd is that of Faster- Bester-RCNN [32].
4.2
Comparisons
4.2.1
Targeted Attack on Test Set
We first evaluate whether pseudo ground truth that enable better detection exists by performing adversarial attack on test sets of RTTS, VOC coC_fog_ttor test, VOC dark_ ferk, and ExDark. We compare method against TOG [6]. The result for YOLOv3 B1 given in Table Tad and that for Faster- RCNN 32] are reported in the supplemental material. We can observe that both detectors face significant performance degeneration from clean images to corrupted ones. The mAP of YOLOv3 decreases by nearly 15% (15.0%% and 14. 14.11% ()) on degraded images compared to clean ones for both VOC_fog_test and VOC dark test. After the targeted attack with small perturbation, detection accuracy increases significantly. For example, the mAP of YOLOv3 increases from 42.77% on RTTS over 70% after the attack. Compared TOG, our algorithm can boost detection performance by 2% - 7% higher.
We show two groups of samples for RTTS in Figure 2 and ExDark in Figure As shown, the detectors cannot work correctly on corrupted inputs. But attacked images enable detectors to predict better and more bounding boxes. Compared TOG, the images generated by our method lead to more accurate detection predictions. For example, Faster-RCNN cannot detect any car or bus in Figure 2d However,
detect 6 cars and buses correctly on the attacked image by method.
These experiments demonstrate that the theoretical pseudo ground truth that is close to the original ground truth, and enables better detection exists.
4.2.2 Dehazing for Detection
Then we show the experiments of restoration by fine-tuning with pseudo ground truth. We train restoration methods on VOC_fog_train and VOC_dark train and test them on VOC_fog_test, RTTS, VOC_dark test and ExDark. During fine-tuning with our proposed pipeline, clean images are replaced by attacked ones.
7

---

Table 1: The detection performance gain by different targeted adversarial attack methods on YOLOv3 ВЛ. 5 = 2/255 and À = 1/255. The experiment results with other configurations and Faster-RCNN shown in supplemental materials.
RTTS
Hazy images of VOC_ VOC_fog fest_ett
Clean images of VOC ___oo._ jost
no attack
TOG h
Ours
no attack
TOG G
Ours
attack
TOG [
Ours
bicycle
40.32
66.07
74.99
61.95
91.66
82.31
95.32
bus
22.99
64.76
75.02
67.52
93.72
96.18
77.78
96.54
98.10
car
49.93
73.84
79.37
75.24
94.89
96.46
83.83
96.49
97.70
metorcycle
36.24
72.93
58.13
82.06
person
64.39
82.27
84,91
71.56
91.61
94.19
83.58
94,20
95.74
42.77
71.98
ExDark
images of VOC dark_test
Clean images VOC S____dar__eee
no. attacck
TOG [
Ours
no. __aattnck
TOG G
Ours
no. ___attack
TOG [
Ours
bieycle
57.39
76.48
80.98
65.71
82.63
87.81
71.80
85.04
boal
21.15
52.03
63.42
27.58
55.16
67.77
38.44
63.38
73.62
bottle
53.85
76.41
82.05
47.98
68.99
77.33
60.37
79.91
85.25
bus
63.44
86.53
89,59
67.47
82.33
89.07
82.72
92.58
94.26
car
46.63
71.37
76.99
65.74
80.21
85.91
82.36
90.78
93.17
46.78
79.95
83.31
66.40
87.20
91.31
82.30
93.76
96.58
chair
31.24
72.47
79.01
30.14
53.1
62.76
50.99
71.09
79.93
dog
motarbike
40.43
63.38
65.63
68.57
80.49
83.40
82.73
87.78
89.21
person 52.82
77.56
80.75
67.84
80.18
83,90
81.97
89.54
90.94
mAP
46.27
74.29
79.29
56.88
75.69
81,99
70.99
84.68
88.83
Table The quantitative results of existing methods and ours with both restoration metrics and detection metrics on VOC_fog_lest and RTTS. CT refers to conventional training.
DAYOLO DSNet IA-YOLO
YOLOV3
YOLOv3+MSBDN
YOLOv3+GriDDehaze
CT
TOG
Ours
CT
TOG
Ours
mAP
55.11
67.40
67.40
66.88
77.05
77.52
77.66
69.29
77.93
78.36
VOC, fog__ree test
PSNR
1
14.65
13.50
28.72
28.54
28.53
27.83
27.41
27.42
SSIM
/
0,5914
0.5411
0.8852
0.8827
0.8823
0.8726
0.8644
0.8667
KITS
MAP
29.93
28.91
37.08
42.77
43.87
44.02
44.10
42.13
42.58
42.62
The main results of dehazing for detection by YOLOv3 31 are shown in Table We can find that MSBDN [8] fine-tuned by our algorithm can boost detection performance compared to conventional training methods with original ground truth and fine-tuning with TOG attack. Similar tendencies exist for GridDehaze (24] We show two groups of examples in Figure 2 Our method yields better
detection accuracy and keeps adequate restoration performance. However, previous work 23 as
shown in Figure 4b outputs unnatural images with many artifacts and noises.
(a) No restoration
(b)
23
(c)
g
(d)
H +urrs
(c)
24
24 +Ours
Figure 4: A comparison of object detection of different adversarial attack results RTTS 20 The last four columns perform detection by YOLOv3 31

---

Table 3: The quantitative results of existing methods and ours with both restoration metrics and detection metrics on VOC dark test and ExDark. CT refers to conventional training.
DAYOLO DSNet
YOLYOLO
YOLOv3
YOLOv3+SCI
YOLOv3+7enoDCCE
MAP
21.53
43.75
59.40
56.88
59.54
59.68
59.87
58.21
58.43
58.49
VOC_dark_Iew
PSNR
12.43
11.99
13.44
13.45
13.96
18.23
17.90
17.87
SSIM
0.5252
0.3923
0.4891
0.4908
0.5054
0.6350
0.6362
0.6357
ExDark
MAP
18.15
36.97
40.37
46.27
48.47
48.08
48.59
41.01
41.09
41.21
boot: 0.43
boot 0.55
(a) No restoration
(b)
23
(c) 12
(d)
12 +Ours
(c)
27
2
+Ours
Figure 5: A comparison object detection of different adversarial attack results on ExDark [20] The last four columns perform detection by YOLOv3 31
4.2.3 Low Light Enhancement for Detection
We show the main results of low light enhancement for object detection by YOLOv3 31 in Table 3 Compared to conventional training with original ground truth and fine-tuning with TOG attacked, SCI [27] fine-tuned by our method boosts detection performance. Similar tendencies exist for ZeroDCE [1]. We show two groups of examples Figure Our method yields better detection accuracy and, at the same time, keeps fair restoration performance.
4.2.4 Limitation
(a) No restoration
(b) 23
(c) S
(d) g +Ours
Figure 6: A failure case of object detection of different methods RTTS 20 The detector for (a),
(c) and (d) is YOLOv3 31. (a) is the result without restoration. (c) is the result after the restoration of MSBDN g with conventional fine-tuning. (d) is the result after the restoration of MSBDN g with our fine-tuning pipeline.
We note that directly performing the adversarial attack on test sets leads to significant boost in detection results as shown in Table [ However, the restoration models learning the map from comrupted image to pseudo ground truth cannot yield such significant improvement. The reason may be the restoration models are incapable learning perfectly the pattern attacked pseudo ground truth. The error between original and pscudo ground truths, which makes the attack ineffective. We

---

show a failure case in Figure Though the image is less hazy after restoration, the detector cannot obtain a better prediction on the recovered image.
Conclusion
In this work, present training procedure for image restoration aimed at better performance for downstream detectors without much visual quality degeneration. The training supervised by pseudo ground truth generated by the proposed ADAM-like targeted adversarial attack. We conduct extensive experiments in two restoration tasks, i.e., dehazing and low light enhancement for both one- and two-stage object detectors. We show our training pipeline effectively improves the detection performance gain of restoration algorithms as a pre-processing step compared to conventional training and other existing works.
Acknowledgments and Disclosure F Funding
Supported by the National Key R&D Program of China under Grant 2018AAA0002503,, National Natural Science Foundation China (No. 62025604, 62172409, U1803264), Beijing Natural Science Foundation (No. M22006).
References
[1] Andrés Bruhn, Joachim Weickert, and Christoph Schnörr. Lucas/kanade meets horn/schunck: Combining local and global optic flow methods. Int. Comput. Vision, 61(3):211-22) 1-11, 1, feb 2005.
[2] Zikui Cai, Xinxin Xie, Shasha Li, Mingjun Yin, Chengyu Song. Srikanth V Krishnamurthy. Amit moyyChowdhhry, and M Salman Asif. Context-aware transfer attacks for object detection. In AAAI, 2022.
[3] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pages 39-57, 2017.
[4] Xiaozhi Chen, Kaustay Kundu. Ziyu Zhang. Huimin Ma, Sanja Fidler, and Raquel Urtasun. Monocular 3d object detection for autonomous driving. June 2016.
[5] Yuhua Chen, Wen Li, Christos Sakaridis, Dengxin Dai, and Luc Van Gool. Domain adaptive faster r-cnn for object detection in the wild. In 2018 IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 3339-3348, 2018.
[6] Ka-Ho Chow, Ling Liu, Margaret Loper, Juhyun Bac, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wci, and Yanzhao Wu. Adversarial objectness gradient attacks in real-time object detection systems. In 2020 Second IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), pages 263-272, 2020.
[7] Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson. Uwe Franke, Stefan Roth, and Bertt Schiele. The cityscupes dataset for semantic urban scene understanding. pages 3213-3223, 2016.
[8] Hang Dong, Jinshan Pan, Lei Xiang, Zhe Hu, Xinyi Zhang, Fei Wang, and Ming-Hsuan Yang. Multi-scale boosted dehazing network with dense feature fusion. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 2154-2164, 2020.
[9] A Geiger, P Lenz, C Stiller, and R Urtasun. Vision meets robotics: The kitti dataset. Int. J. Rob. Res.. 12(11):12111137, 2013.
[10] Andreas Geiger, Philip Lenz, and Raquel Urtasun. Are ready for autonomous driving? the kitti vision benchmark suite. In 20/2 IEEE Conference Computer Vision and Pattern Recognition, pages 3354-3361, 2012.
[11] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. CoRR, abs/ 142.65522, 2015.
[12] Chunle Guo, Chongyi Li, Jichang Guo, Chen Change Loy, Junhui Hou, Sam Kwong. and Runmin Cong. Zero-reference deep curve estimation for low- low-light image enhancement. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 1777-1786. 2020.
10

---

[13] Mazin Hnewa and Hayder Radha. Multiscale domain adaptive yolo for cross-domain object detection. In 2021 IEEE International Conference Image Processing (ICIP), pages 3323-3327. IEEE, 2021.
[14] Lifeng Huang, Chengying Gao. Yuyin Zhou, Cihang Xie, Alan L. Yuille. Changqing Zou, and Ning Liu. Universal physical camouflage attacks object detectors. In 2020 IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pages 717-726, 2020.
[15] Shih-Chia Huang, Trung- Hicu Le, and Da- Wei Jaw. Dsnet: Joint semantic learning for object dctection in inclement weather conditions. IEEE transactions on pattern analysis and machine intelligence, 43(8)22623 2633, 2020.
[16] Xinyu Huang, Xinjing Cheng, Qichuan Geng, Binbin Cao, Dingfu Zhou, Peng Wang, Yuanqing Lin, and Ruigang Yang. The apolloscape dataset for autonomous driving. pages 1067-10676, 2018.
[17] Diederik Kingma and Jimmy Ba. Adam: method stochastic optimization. arXiv preprint arXiv: /412.9980, 2014.
[18] Alexey Kurakin, lan Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99-112. Chapman and Hall/CRC, 2018.
[19] Wei-Sheng Lai, Jia-Bin Huang, Narendra Ahuja, and Ming-Hsuan Yang. Deep laplacian pyramid works for fast and accurate super-resolution. In 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 5835-5843, 2017.
[20] Boyi Li, Wenqi Ren, Dengpan Fu, Dacheng Tao, Dan Feng, Wenjun Zeng, and Zhangyang Wang. Bench- marking single-image dehazing and beyond. IEEE Transactions on Image Procesing, 28( ::922-555 2019.
[21] Siyuan Li, Iago Breno Araujo, Wenqi Ren, Zhangyang Wang, Eric K. Tokuda, Roberto Hirata Junior, Roberto Cesar-Junior, Jiawan Zhang, Xiaojie Guo. and Xiaochun Cao. Single image deraining: A comprehensive benchmark analysis. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 3833 3833-3842, 2019.
[22] Yuezun Li, Daniel Tian, Mingching Chang, Xiao Bian, and Siwei Lyu. Robust adversarial perturbation on deep proposal-basee based models. In BMVC, 2018
[23] Wenyu Liu, Gaofeng Ren, Runsheng Yu. Shi Guo, Jianke Zhu, and Lei Zhang. Image-adaptive yolo for object detection adverse weather conditions. Proceedings of the AAAI Conference on Artificial Intelligence, 2022.
[24] Xiaohong Liu, Yongrui Ma. Zhihao Shi, and Jun Chen, Griddehazenet: Attention based multi scale network for image dehazing. In 2019 IEEE/CVF International Conference on Computer Vision (ICCV), pages 7313-7322, 2019.
[25] Xin Liu, Huanrui Yang, Linghao Song, Hai Li, and Yiran Chen. Dpatch: Attacking object detectors with adversarial patches. CoRR, abs/1806.022 880.02229. 2018.
[26] Yuen Peng Loh and Chee Seng Chan. Getting to know low-light images with the exclusively dark dataset. Computer Vision and Image Understanding, 178:30-42, 2019.
[27] Long Ma, Tengyu Ma, Risheng Liu, Xin Fan, and Zhongxuan Luo. Toward fast, flexible, and robust low-light image enhancement. CoRR, abs/2204. 10137, 2022.
[28] Seyed-Mohsen Moosavi-Dezfoolk Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. In 2016 IEEE Conference on Computer Vision and Pottern
Recognition (CVPR), pages 2574-2582, 2016.
[29] Srinivasa G Narasimhan and Shree K Nayar. Vision and the atmosphere. International journal of computer vision. (5(3):2333254 2002.
[30] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 427 427-436, 2015.
[31] Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. CoRR, abs/ http/804..0255 02767, 2018
[32] Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-tine sal-time object detection with region proposal networks. IEEE Transactions on Pattern Analysis and Machine Intelligence. 39(6): 1149, 2017.
11

---

[33] Wenqi Ren, Si Liu, Hua Zhang, Jinshan Pan, Xiaochun Cao, and Ming- Husig Yang. Single image dehazing via multi-scale convolutional neural networks. In European Conference on Computer Vision, 2016.
[34] Christos Sakaridis, Dengxin Dai, and Luc Van Gool. Acde:
The adverse conditions dataset with corre-
spondences for semantic driving scene understanding. In Proceedings of the IEEF/CVF International Conference on Computer Vision (ICCV), pages 10765-10775, October 2021.
[35] Yuanjie Shao, Lerenhan Li, Wenqi Ren, Changxin Gao, and Nong Sang. Domain adaptation for image dehazing. In IEEF/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
[36] Vishwanath A. Sindagi, Poojan Oza, Rajeev Yasarla, and Vishal M. Patel. Prior-based domain adaptive object detection for hazy and rainy conditions. In Andrea Vedaldi, Horst Bischof, Thomas Brox, and Jan-Michael Frahm, editors, Computer Vision ECCV 2020, pages 763-780, Cham, 2020. Springer International Publishing.
[37] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Forgus. Intriguing properties of neural networks. Jamuary 2014. 2nd International Conference on Learning Representations, ICLR 2014 Conference date: 14-04-2014 Through 16-04-2014.
[38] Gang Wang, Jingming Guo, Yupeng Chen, Ying Li, and Qian Xu. A pso and bfo-based learning strategy applicd to faster r-cnn for object detection in autonomous driving. IEEE Access, 7: 17118840-188 18859, 2019.
[39] Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8565-8574, 2021.
[40] Zhibo Wang, Siyan Zheng, Mengkai Song, Qian Wang, Alireza Rahimpour, and Hairong Qi. adypatterm: physical-world world attacks on deep person re-identification via adversarially transformable patterns. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages
2019.
[41] Xingxing Wei, Siyuan Liang. Ning Chen, and Xiaochun Cao. Transferable adversarial attacks for image and video object detection. In Priceedings of the 28th International Joint Conference on Artificial Intelligence, IJCAI 19. page 954 960. AAAI Press, 2019.
[42] Zuxuan Wu, Ser-Nam Lim, Larry Davis, and Tom Goldstein. Making an invisibility cloak: Real world adversarial attacks on object detectors. In European Conference Computer Vision, pages 1-17. Springer, 2020.
[43] Chaowei Xiao, Dawei Yang, Bo Li, Jia Deng, and Mingyan Liu. Meshadv: Adversarial meshes for visual recognition. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 6891-6900, 2019.
[44] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In 2017 IEFF International Conference on Computer Vision (ICCV), pages 1378-1387, 2017.
[45] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yo Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in physical world. In European conference on computer vision, pages 665-681. Springer, 2020.
[46] Wenhan Yang, Ye Yuan, Wenqi Ren, Jiaying Liu, Walter J. Scheirer, Zhangyang Wang, Taiheng Zhang Qiaoyong Zhong, Di Xie, Shiliang Pu, Yuqiang Zheng, Yanyun Qu, Yuhong Xie, Liang Chen, Zhonghao Li, Chen Hong. Hao Jiang, Siyuan Yang. Yan Liu, Xiaochao Qu, Pengfei Wan, Shuai Zheng, Minhui Zhong. Taiyi Su, Lingzhi He, Yandong Guo, Yao Zhao, Zhenfeng Zhu, Jinxiu Liang, Jingwen Wang. Tianyi Chen, Yuhui Quan, Yong Xu, Bo Liu, Xin Liu, Qi Sun, Tingyu Lin, Xiaochuan Li, Feng Lu, Lin Gu, Shengdi Zhou, Cong Cao. Shifeng Zhang, Cheng Chi, Chubing Zhuang. Zhen Lei. Stan Z. Li. Shizheng Wang. Ruizhe Liu, Dong Yi, Zheming Zuo, Jianning Chi. Huan Wang, Kai Wang, Yixiu Liu, Xingyu Gao. Zhenyu Chen, Chang Guo, Yongzhou Li, Huicai Zhong, Jing Huang, Heng Guo, Jianfei Yang. Wenjuan Liao, Jiangang Yang, Liguo Zhou, Mingyue Feng, and Likun Qin. Advancing image understanding in poor visibility environments: A collective benchmark study. IEEE Transactions on Image Processing, 29:5737-51 2020.
[47] Shaodi You. Robby T Tan, Rei Kawakami, Yasuhiro Mukaigawa, and Katsushi Ikeuchi. Adherent raindrop modeling, detectionand removal in video. IEEF transactions on pattern analysis and machine intelligence, 1819):171 2015.
[48] Xiaohui Zeng. Chenxi Liu, Si-Siang Wang. Weichao Qiu, Lingxi Xie, Yu- Yi-Wing Tai, Chi-Keung Tang, and Alan L. Yuille. Adversarial attacks beyond the image space. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4297-442244 4309, 2019.
12

---

[49] Hantao Zhang, Wengang Zhou, and Houqiang Li. Contextual adversarial attacks for object detection. In 2020 IEEE International Conference Multimedia and Expo (ICME), pages 1-6, 2020.
[50] Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong. CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild. In International Conference on Learning Representations, 2019.
13

---

Checklist
The checklist follows the references. Please read the checklist guidelines carefully for information how to answer these questions. For each question, change the default [TODO] to [Yes], [No], , or [N/A] You strongly encouraged to include justification to your answer, either by referencing the appropriate section of your paper or providing a brief inline description. For example:
Did you include the license to the code and datasets? [Yes] See Section ??.
Did you include the license the code and datasets? [No] The code and the data are proprietary.
Did you include the license to the code and datasets? [N/A]
Please do not modify the questions and only use the provided macros for your answers. Note that the Checklist section does not count towards the page limit. In your paper, please delete this instructions block and only keep the Checklist section heading above along with the questions/answers below.
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes] We have accurately expressed the main idea of the work.
(b) Did you describe the limitations of your work? [Yes] is described Section 4.2.4
(c) Did you discuss any potential negative socictal impacts of your work? [N/A] Our work does not have any potential negative society impacts.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes] We include the assumptions in Section
(b) Did you include complete proofs of all theoretical results? [Yes] We include complete proofs in Section 3.1 and supplemental materials.
3. If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as a URL)? [Yes] We include the code in supplemental materials.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] We include the training details in Section 4.1
(c) Did you report error bars (e.g., with respect the random seed after running experi- ments multiple times)? [No]
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] In Section 4.1]
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes]
(c) Did you include any new assets either the supplemental material or as URL.? [No]
(d) Did you discuss whether and how consent was obtained from people whose data you' 're
using/curating? [No]
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [No]
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [No]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, applicable? [No]
(c) Did you include the estimated hourly wage paid to participants and the total amount
spent participant compensation? [No]
14


Reviews:
[{"review_id": "QH5P1a8fRw1", "reviewer": "Reviewer_2EoB", "summary": "Aiming at better object detection performance in bad environments such as hazy or low-light scenes, this paper proposes a new training protocol where an image restoration model is supervised by pseudo ground truths. The pseudo ground truths are generated using an adversarial attack method (Adam-like targeted attack in this paper). By doing so, the trained model shows better object detection performance in hazy or low light scenes than existing studies and plain models.", "questions": "Please see the Strengths And Weaknesses section.", "limitations": "Yes, the authors mention the limitations of their work but do not mention potential negative social impact.", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Originality\n\nThe proposed approach is interesting and it looks different from existing studies.\n\nQuality\n\n- Although the proposed approach is promising and interesting, my main concern is that the proposed method does not show good performance when image restoration models are trained on the pseudo samples of the training set and are evaluated on the test set. This seems natural because the difference between the images before/after performing the attack is slight, and thus it is difficult to learn.\n\n- Another concern is that TOG achieves the almost same performance as the proposed method in Tables 2 and 3, indicating that the technical contribution of this work is limited.\n\n- To show the effectiveness, it would be better to compare the proposed method with a simple baseline method that simultaneously optimizes the image restoration and object detector to minimize the loss of object detection.\n\nClarify\n\n- There are several unclear points in this paper. For instance, what is \"Y\" in Tables 2 and 3? Also, what do you mean by \"detection\" in the caption of Table2? Finally, the authors mention that the mAP of YOLOv3 decreases by nearly 15% from that of clean images in lines 227 and 229, but where can we see the result of the clean images?\n\n- It is somewhat unclear what is conducted and is the purpose of the experiment in Section 4.2.1. Please elaborate on it.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "ASxWbk6izDi", "reviewer": "Reviewer_6L2X", "summary": "the proposes a fine-tuning approach to improve the object detection performance without reducing the visual quality of the restored image. To achieve the authors follow a target adversarial attack on the object detection task  in order to improve the detection performance and on the other hand they don't effect the restoration task optimization.", "questions": "Please refer weaknesses", "limitations": "Authors discussed limitations that are relevant to the proposed method", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- the paper proposes a simple technique that improves the object detection performance and on the other hand doesn't decrease the image restoration performance.\n- they generate adversarial samples using the second-order gradients and cumulative momentum approach.\n\nWeaknesses:\n- Why is the performance using the proposed method significantly less in table 2 and table 3.\n-  Can authors show zoomed versions of visualizations for easy understanding\n- Can authors explain while generating adversarial attack samples how are they maintain image properties like how are the authors make sure whether the adversarial attack image naturally possible image or not.\n- what happens if the images have multiple degradations will the proposed method still applicable \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["I don’t know"]}, "extra_text": {}}, {"review_id": "4uGrwtiFq-w", "reviewer": "Reviewer_owid", "summary": "The paper rethinks image restoration for object detection from the perspective of adversarial examples and proposes a fine-tuning pipeline by formulating the tasks of image restoration and object detection into one. Unlike most existing methods that focus on modifying object detectors, the paper attempts to adapt restoration algorithms for generating high-quality visual perception and better detection results. To this end, a momentum-based ADAM-like iterative targeted adversarial example generation algorithm is designed to produce pseudo ground truth for fine-tuning restoration models. The proposed methods are evaluated on two image restoration tasks, i.e., image dehazing and low-light image enhancement, and extensive experimental results demonstrate its superiority to state-of-the-arts both in quality and quantity.", "questions": "See the weaknesses in the above. ", "limitations": "The authors have addressed the limitations of the proposed method in the paper. ", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. Image restoration is usually viewed as a pre-processing for high-level computer vision tasks such as detection, but related discussions are rare in existing publications. The paper makes valuable explorations by formulating the two tasks into one.\n2. Different from the conventional methods that modify object detectors, the proposed approach aims to adapt the restoration algorithms for improving the performances of both tasks.\n3. The proposed Adam-variant adversarial example generation framework is based on Theorem 1, which is proved in the supplement, and thus becomes solid in theory.\n4. Extensive experiments are conducted on various datasets, including a dehazing dataset and a low-light enhancement dataset, to demonstrate the effectiveness of the proposed method both in quality and quantity.\n5. The paper is written well and easy to follow. It is good to illustrate the idea in Figure 1 and provide the proof and more analysis in the supplementary material.\n\nWeaknesses:\n1. L129 uses the math symbol D(x), while L131 utilizes D[R(x)]. It would be better to use a unified symbol. Similar typos are also present in equations 2, 3, and 5.\n2. In the sentence “where \\hat{x}^{*}=arg min_{x} ||\\hat{x}^{*}-\\hat{x}||” of equation 6, the symbol \\hat{x}^{*} have two different meanings, i.e., a determined value on the left and a variable on the right.\n3. In the captions of Tables 2 and 3, the word “ddetection” is a typo.\n4. How to determine the initialization of the Number of attack iterations T, Update stepsize λ, and the Magnitude tolerance of Perturbation δ?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept