Papers
Topics
Authors
Recent
Gemini 2.5 Flash
Gemini 2.5 Flash
102 tokens/sec
GPT-4o
59 tokens/sec
Gemini 2.5 Pro Pro
43 tokens/sec
o3 Pro
6 tokens/sec
GPT-4.1 Pro
50 tokens/sec
DeepSeek R1 via Azure Pro
28 tokens/sec
2000 character limit reached

Black-box Adversarial Attacks Against Image Quality Assessment Models (2402.17533v2)

Published 27 Feb 2024 in cs.CV and eess.IV

Abstract: The goal of No-Reference Image Quality Assessment (NR-IQA) is to predict the perceptual quality of an image in line with its subjective evaluation. To put the NR-IQA models into practice, it is essential to study their potential loopholes for model refinement. This paper makes the first attempt to explore the black-box adversarial attacks on NR-IQA models. Specifically, we first formulate the attack problem as maximizing the deviation between the estimated quality scores of original and perturbed images, while restricting the perturbed image distortions for visual quality preservation. Under such formulation, we then design a Bi-directional loss function to mislead the estimated quality scores of adversarial examples towards an opposite direction with maximum deviation. On this basis, we finally develop an efficient and effective black-box attack method against NR-IQA models. Extensive experiments reveal that all the evaluated NR-IQA models are vulnerable to the proposed attack method. And the generated perturbations are not transferable, enabling them to serve the investigation of specialities of disparate IQA models.

PDF HTML Abstract
Ai Sparkles Streamline Icon: https://streamlinehq.com Summarize Bookmark Chat Bubble Oval Streamline Icon: https://streamlinehq.com Chat (Pro)
Definition Search Book Streamline Icon: https://streamlinehq.com
References (43)
  1. Square attack: A query-efficient black-box adversarial attack via random search. In Proceedings of the European Conference on Computer Vision (ECCV), pages 484–501, 2020.
  2. Final report from the video quality experts group on the validation of objective models of video quality assessment. ITU-T Standards Contribution COM, 2000.
  3. On the use of deep learning for blind image quality assessment. Signal, Image and Video Processing, 12:355–362, 2018.
  4. Deep neural networks for no-reference and full-reference image quality assessment. IEEE Transactions on Image Processing (TIP), 27(1):206–219, 2017.
  5. Towards evaluating the robustness of neural networks. In Proceedings of the IEEE Symposium on Security and Privacy (S&P), pages 39–57, 2017.
  6. A perceptually tuned subband image coder based on the measure of just-noticeable-distortion profile. IEEE Transactions on Circuits and Systems for Video Technology (TCSVT), 5(6):467–476, 1995.
  7. Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 321–338, 2019.
  8. Image quality assessment: Unifying structure and texture similarity. IEEE Transactions on Pattern Analysis and Machine Intelligence (TPAMI), 44(5):2567–2581, 2020.
  9. An image is worth 16x16 words: Transformers for image recognition at scale. In Proceedings of the International Conference on Learning Representations (ICLR), pages 1–22, 2021.
  10. Massive online crowdsourced study of subjective and objective picture quality. IEEE Transactions on Image Processing (TIP), 25(1):372–387, 2015.
  11. No-reference image quality assessment via transformers, relative ranking, and self-consistency. In Proceedings of the IEEE Winter Conference on Applications of Computer Vision (WACV), pages 1220–1230, 2022.
  12. Explaining and harnessing adversarial examples. In Proceedings of the International Conference on Learning Representations (ICLR), pages 1–11, 2015.
  13. No-reference image quality assessment with reinforcement recursive list-wise ranking. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), pages 8336–8343, 2019.
  14. Koniq-10k: An ecologically valid database for deep learning of blind image quality assessment. IEEE Transactions on Image Processing (TIP), 29:4041–4056, 2020.
  15. Simultaneous estimation of image quality and distortion via multi-task convolutional neural networks. In Proceedings of the IEEE International Conference on Image Processing (ICIP), pages 2791–2795, 2015.
  16. Deep cnn-based blind image quality predictor. IEEE Transactions on Neural Networks and Learning Systems (TNNLS), 30(1):11–24, 2018.
  17. Adversarial examples in the physical world. In Proceedings of the International Conference on Learning Representations (ICLR), pages 1–14, 2017.
  18. Most apparent distortion: Full-reference image quality assessment and the role of strategy. Journal of Electronic Imaging, 19(1):011006–011006, 2010.
  19. Simulating unknown target models for query-efficient black-box attacks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 11835–11844, 2021.
  20. Towards deep learning models resistant to adversarial attacks. In Proceedings of the International Conference on Learning Representations (ICLR), pages 1–28, 2018.
  21. Making a “completely blind” image quality analyzer. IEEE Signal Processing Letters (SPL), 20(3):209–212, 2012.
  22. A novel rank learning based no-reference image quality assessment method. IEEE Transactions on Multimedia (TMM), 24:4197–4211, 2021.
  23. The limitations of deep learning in adversarial settings. In Proceedings of the IEEE European Symposium on Security and Privacy (EuroS&P), pages 372–387, 2016.
  24. Image database tid2013: Peculiarities, results and perspectives. Signal Processing: Image Communication (SPIC), 30:57–77, 2015.
  25. Training meta-surrogate model for transferable adversarial attack. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), pages 9516–9524, 2023.
  26. Blind image quality assessment: A natural scene statistics approach in the dct domain. IEEE Transactions on Image Processing (TIP), 21(8):3339–3352, 2012.
  27. A statistical evaluation of recent full reference image quality assessment algorithms. IEEE Transactions on Image Processing (TIP), 15(11):3440–3451, 2006.
  28. Universal perturbation attack on differentiable no-reference image-and video-quality metrics. In Proceedings of the British Machine Vision Conference (BMVC), pages 1–12, 2022.
  29. Blindly assess image quality in the wild guided by a self-adaptive hyper network. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 3667–3676, 2020.
  30. Intriguing properties of neural networks. In Proceedings of the International Conference on Learning Representations (ICLR), pages 1–9, 2014.
  31. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing (TIP), 13(4):600–612, 2004.
  32. Blind image quality assessment based on high order statistics aggregation. IEEE Transactions on Image Processing (TIP), 25(9):4444–4457, 2016.
  33. Maniqa: Multi-dimension attention network for no-reference image quality assessment. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1191–1200, 2022.
  34. Vulnerabilities in video quality assessment models: The challenge of adversarial attacks. Advances in Neural Information Processing Systems (NeurIPS), 36, 2024.
  35. A feature-enriched completely blind image quality evaluator. IEEE Transactions on Image Processing (TIP), 24(8):2579–2591, 2015.
  36. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 586–595, 2018a.
  37. Blind image quality assessment using a deep bilinear convolutional neural network. IEEE Transactions on Circuits and Systems for Video Technology (TCSVT), 30(1):36–47, 2018b.
  38. Uncertainty-aware blind image quality assessment in the laboratory and wild. IEEE Transactions on Image Processing (TIP), 30:3474–3486, 2021.
  39. Perceptual attacks of no-reference image quality models with human-in-the-loop. Advances in Neural Information Processing Systems (NeurIPS), 35:2916–2929, 2022.
  40. Blind image quality assessment via vision-language correspondence: A multitask learning perspective. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 14071–14081, 2023.
  41. Just-noticeable difference estimation with pixels in images. Journal of Visual Communication and Image Representation, 19(1):30–41, 2008.
  42. Metaiqa: Deep meta-learning for no-reference image quality assessment. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 14143–14152, 2020a.
  43. A multiple attributes image quality database for smartphone camera photo quality assessment. In IEEE International Conference on Image Processing (ICIP), pages 2990–2994, 2020b.
User Edit Pencil Streamline Icon: https://streamlinehq.com
Authors (5)
  1. Yu Ran (6 papers)
  2. Ao-Xiang Zhang (7 papers)
  3. Mingjie Li (67 papers)
  4. Weixuan Tang (12 papers)
  5. Yuan-Gen Wang (25 papers)
Citations (3)
View on Semantic Scholar