IOI: Invisible One-Iteration Adversarial Attack on No-Reference Image- and Video-Quality Metrics

TL;DR

The IOI paper tackles the vulnerability of no-reference image- and video-quality metrics to adversarial perturbations, proposing a fast, imperceptible one-iteration attack. It blends a baseline FGSM step with a frequency-domain frequency module and a local-variance weighting module to steer perturbations toward high-frequency, less visible regions while preserving temporal stability in videos. The approach yields higher objective metric gains and superior subjective visual quality compared with prior attacks, demonstrated on multiple NR models and datasets, and is accompanied by a public code release. This work provides a practical tool for benchmarking NR metric robustness and motivates the development of stronger defenses and more robust no-reference quality assessments.

Abstract

No-reference image- and video-quality metrics are widely used in video processing benchmarks. The robustness of learning-based metrics under video attacks has not been widely studied. In addition to having success, attacks that can be employed in video processing benchmarks must be fast and imperceptible. This paper introduces an Invisible One-Iteration (IOI) adversarial attack on no reference image and video quality metrics. We compared our method alongside eight prior approaches using image and video datasets via objective and subjective tests. Our method exhibited superior visual quality across various attacked metric architectures while maintaining comparable attack success and speed. We made the code available on GitHub: https://github.com/katiashh/ioi-attack.

Figures (8)

• Figure 1: An overview of the proposed IOI adversarial attack. $I$ is stands for input image, $I^p$ -- FGSM attacked image and $I^a$ -- the final IOI attacked image. Weights map is calculated using formula \ref{['eq:weights1']}.
• Figure 2: Comparison of weights used in prior and proposed methods. NVW and AdvJND assign non-zero weights for a background. Korhonen et al.'s weight total area is relatively small.
• Figure 3: Comparison of adversarial images generated using FGSM goodfellow_explaining_2015, SSAH luo_frequency-driven_2022, Zhang et al. zhang_perceptual_2022, NVW karli_improving_2021, Korhonen et al. korhonen_adversarial_2022, AdvJND chen_advjnd_2020, UAP shumitskaya2022universal, FACPA DBLP:conf/iclr/ShumitskayaAV23 and IOI (ours) attack methods when attacking PaQ-2-PiQ ying2020patches NR quality metric at one iteration with relative gain aligned by Algorithm \ref{['alg:example']}.
• Figure 4: Results of experiments when attacking PaQ-2-PiQ ying2020patches NR metric on the "Controlled Burn" video through I-FGSM attack kurakin2018adversarial with different numbers of iterations and altered frames.
• Figure 5: Spatial and temporal information for videos.