Beyond Score Changes: Adversarial Attack on No-Reference Image Quality Assessment from Two Perspectives

TL;DR

This paper introduces a novel adversarial attack framework targeting no-reference image quality assessment models, focusing on disrupting both individual image scores and inter-score correlations, revealing their vulnerability.

Contribution

It proposes a correlation-error-based attack framework and a two-stage SROCC-MSE-Attack method that effectively compromises NR-IQA models' robustness.

Findings

Significantly reduces SROCC to negative values

Maintains substantial changes in individual image scores

Achieves state-of-the-art attack performance across metrics

Abstract

Deep neural networks have demonstrated impressive success in No-Reference Image Quality Assessment (NR-IQA). However, recent researches highlight the vulnerability of NR-IQA models to subtle adversarial perturbations, leading to inconsistencies between model predictions and subjective ratings. Current adversarial attacks, however, focus on perturbing predicted scores of individual images, neglecting the crucial aspect of inter-score correlation relationships within an entire image set. Meanwhile, it is important to note that the correlation, like ranking correlation, plays a significant role in NR-IQA tasks. To comprehensively explore the robustness of NR-IQA models, we introduce a new framework of correlation-error-based attacks that perturb both the correlation within an image set and score changes on individual images. Our research primarily focuses on ranking-related correlation metrics like Spearman's Rank-Order Correlation Coefficient (SROCC) and prediction error-related metrics like Mean Squared Error (MSE). As an instantiation, we propose a practical two-stage SROCC-MSE-Attack (SMA) that initially optimizes target attack scores for the entire image set and then generates adversarial examples guided by these scores. Experimental results demonstrate that our SMA method not only significantly disrupts the SROCC to negative values but also maintains a considerable change in the scores of individual images. Meanwhile, it exhibits state-of-the-art performance across metrics with different categories. Our method provides a new perspective on the robustness of NR-IQA models.