Exploring Vulnerabilities of No-Reference Image Quality Assessment Models: A Query-Based Black-Box Method

TL;DR

This paper addresses the vulnerability of no-reference image quality assessment (NR-IQA) models to black-box adversarial attacks by introducing a query-based method. It presents a novel score-boundary framework with adaptive iterative boundaries, and designs HVS-informed attack directions using edge/saliency masks and Just Noticeable Difference (JND) constraints, implemented within a SurFree-inspired optimization. The approach is evaluated on four NR-IQA models across LIVE and CLIVE datasets, demonstrating substantial degradation in correlation metrics (SROCC/PLCC/KROCC) and MAE while maintaining perceptual invisibility (SSIM/LPIPS), outperforming transfer-based and patch-based baselines. These findings reveal pronounced vulnerabilities of NR-IQA models under black-box threats and provide a practical tool for studying and improving NR-IQA robustness in real-world systems.

Abstract

No-Reference Image Quality Assessment (NR-IQA) aims to predict image quality scores consistent with human perception without relying on pristine reference images, serving as a crucial component in various visual tasks. Ensuring the robustness of NR-IQA methods is vital for reliable comparisons of different image processing techniques and consistent user experiences in recommendations. The attack methods for NR-IQA provide a powerful instrument to test the robustness of NR-IQA. However, current attack methods of NR-IQA heavily rely on the gradient of the NR-IQA model, leading to limitations when the gradient information is unavailable. In this paper, we present a pioneering query-based black box attack against NR-IQA methods. We propose the concept of score boundary and leverage an adaptive iterative approach with multiple score boundaries. Meanwhile, the initial attack directions are also designed to leverage the characteristics of the Human Visual System (HVS). Experiments show our method outperforms all compared state-of-the-art attack methods and is far ahead of previous black-box methods. The effective NR-IQA model DBCNN suffers a Spearman's rank-order correlation coefficient (SROCC) decline of 0.6381 attacked by our method, revealing the vulnerability of NR-IQA models to black-box attacks. The proposed attack method also provides a potent tool for further exploration into NR-IQA robustness.

Figures (6)

• Figure 1: An NR-IQA model (DBCNN) is attacked in a black-box scenario. The top left shows the predicted quality scores by DBCNN on the LIVE dataset for original images and adversarial examples generated by our attack method. The bottom left shows the SROCC/PLCC/KROCC before and after the attack. The right figures show two sample images before and after the attack as well as the predicted scores.
• Figure 2: The framework of the proposed attack method.
• Figure 3: High-quality images randomly selected from the KADID-10k dataset in the first/third row, their names are labeled in the top left corner. The corresponding extracted texture and noised images are in the second/fourth row.
• Figure 4: Adversarial examples from different attack methods on the LIVE dataset. Each row shows one attacked NR-IQA model, and each column corresponds to one attack method. The predicted quality score is shown on the top of each image. The SSIM value between the adversarial example and the original image is shown at the bottom of each image. Our method is marked with bold.
• Figure 5: Adversarial examples from different attack methods on the CLIVE dataset. Each row shows one attacked NR-IQA model, and each column corresponds to one attack method. The predicted quality score is shown on the top of each image. The SSIM value between the adversarial example and the original image is shown at the bottom of each image. Our method is marked with bold.