Generating Frequency-limited Adversarial Examples to Attack Multi-focus Image Fusion Models

Multi-focus image fusion techniques aim to generate all-in-focus clear images by fusing a set of images with different focused areas. Recently various deep learning based methods have been proposed for image fusion, but the robustness of these models is ignored, while neural networks are vulnerable to adversarial examples. In this work, we proposed a generator based method to attack decision map based multi-focus image fusion models. First, we train a multi-focus image fusion model as the local surrogate model and freeze its weights. Then, adversarial loss and feature separation loss are used to train the attack generator. The two losses maximize the distance of decision maps and feature maps between clean images and adversarial images respectively. Finally, the generated perturbations are limited to certain frequency components using a mask in the discrete cosine transform domain. Experimental results show that the proposed attacks result in serious performance degradation of target models. Besides, we analyze how neural networks recognize focus areas, and find that small multi-focus image fusion models mainly concern high-frequency features and are vulnerable to high frequency noises.