## 4 Experimental Setup
### Quantitative Results
#### 4.4.1 Cross-Dataset Evaluation Protocol  
To thoroughly evaluate the cross-domain generalization capabilities of UMFNet, we conducted experiments on several public low-light datasets.  
* **ExDark [1]**: Our base dataset containing 7363 low-light images with 12 object categories captured by smartphone cameras under illumination ranging from 0.1 to 15 lux.
* **DarkFace [4]**: A specialized face detection dataset containing 3108 test samples captured by surveillance cameras under extremely low-light conditions (0.05-5 lux) with significant motion blur artifacts.
* **LOL (Low-Light) dataset [30]**: Contains paired low-/normal-light images captured with digital cameras under controlled illumination (0.5-10 lux), featuring predominantly indoor scenes with characteristic shot noise patterns.
* **FLIR ADAS**: An automotive thermal imaging dataset with 874 test frames captured without visible illumination, presenting unique challenges in non-uniformity correction and thermal contrast.
* **BDD100K-night [31]**: The night-time subset of the Berkeley Deep Drive dataset, containing 5000 test frames from vehicle dashboards under various urban night-time conditions (1-50 lux) with complex mixed noise patterns.  
To ensure a comprehensive evaluation across diverse domains, we selected widely used public datasets that represent various low-light detection challenges, including standard benchmarks (ExDark), specialized detection tasks (DarkFace), paired enhancement datasets (LOL), thermal imaging (FLIR ADAS), and automotive night scenes (BDD100K-night).  
\[\mathcal{D}_{\text{test}}=\underbrace{\mathcal{D}_{\text{base}}}_{\text{In- distribution}}\cup\underbrace{\mathcal{D}_{\text{near}}}_{\text{Near-shift}}\cup\underbrace{\mathcal{D}_{\text{far}}}_{\text{Out-of-distribution}} \tag{18}\]  
Table 5 reveals UMFNet's robustness against various attack types.  
* **White-Box Attacks:** UMFNet shows a \(-7.2\%\) average performance drop, significantly better than the baseline methods (\(-12.3\%\)). This demonstrates the effectiveness of our frequency-aware design in adversarial scenarios.
* **Black-Box Attacks:** The minimal degradation (\(-4.0\%\)) indicates strong generalization to unseen perturbations.
* **Physical Attacks:** The \(-5.7\%\) drop, lower than that of typical methods (\(-9.2\%\)), validates our physics-informed approach.  
Table 6 details our evaluation framework configuration across six public datasets and custom physical simulations.  
\begin{table}
\begin{tabular}{l c c c} \hline \hline
**Attack Type** & **White-Box** & **Black-Box** & **Physical** \\ \hline Gaussian (\(\sigma=0.3\)) & \(-5.2\) & \(-3.1\) & \(-4.7\) \\ Compression Artifacts (QP = 45) & \(-7.8\) & \(-4.6\) & \(-6.3\) \\ Spectral Jamming (30\% HF) & \(-6.5\) & \(-2.9\) & \(-3.6\) \\ Projected Perturbation & \(-9.1\) & \(-5.4\) & \(-8.2\) \\ \hline UMFNet Average & \(-7.2\) & \(-4.0\) & \(-5.7\) \\ \hline \hline \end{tabular}
\end{table}
Table 5: EMVA 1288 Standard Adversarial Tests.  
The key advantages are as follows:  
* **A 9.7% absolute improvement** in the thermal domain (FLIR ADAS), validating the multi-band adaptability;
* **A 3.4% lower GDR** than SOTA competitors on synthetic data (BDD100K-night).