# Perceptual Attacks of No-Reference Image Quality Models with Human-in-the-Loop

arXiv: https://arxiv.org/abs/2210.00933 · HTML: https://mlsanity.com/paper/2210.00933/

## Key facts

- Cited by 30 papers in the map (data through 14 Oct 2026).
- Builds on 33 of its 71 references that are in the map.
- First posted on arXiv 3 Oct 2022.

## Builds on (most cited first, 30 of 33)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [Do ImageNet Classifiers Generalize to ImageNet?](https://mlsanity.com/paper/1902.10811/) (2019)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [Image Quality Assessment: Unifying Structure and Texture Similarity](https://mlsanity.com/paper/2004.07728/) (2020)
- [Spatial Pyramid Pooling in Deep Convolutional Networks for Visual Recognition](https://mlsanity.com/paper/1406.4729/) (2014)
- [End-to-end Optimized Image Compression](https://mlsanity.com/paper/1611.01704/) (2016)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [On Evaluating Adversarial Robustness](https://mlsanity.com/paper/1902.06705/) (2019)
- [KonIQ-10k: An ecologically valid database for deep learning of blind image quality assessment](https://mlsanity.com/paper/1910.06180/) (2019)
- [Adversarial Examples for Semantic Segmentation and Object Detection](https://mlsanity.com/paper/1703.08603/) (2017)
- [From Patches to Pictures (PaQ-2-PiQ): Mapping the Perceptual Space of Picture Quality](https://mlsanity.com/paper/1912.10088/) (2019)
- [Massive Online Crowdsourced Study of Subjective and Objective Picture Quality](https://mlsanity.com/paper/1511.02919/) (2015)
- [Efficient Decision-based Black-box Adversarial Attacks on Face Recognition](https://mlsanity.com/paper/1904.04433/) (2019)
- [Perceptual Adversarial Robustness: Defense Against Unseen Threat Models](https://mlsanity.com/paper/2006.12655/) (2020)
- [Constructing Unrestricted Adversarial Examples with Generative Models](https://mlsanity.com/paper/1805.07894/) (2018)
- [Uncertainty-Aware Blind Image Quality Assessment in the Laboratory and Wild](https://mlsanity.com/paper/2005.13983/) (2020)
- [Perceptual Quality Prediction on Authentically Distorted Images Using a Bag of Features Approach](https://mlsanity.com/paper/1609.04757/) (2016)
- [When Human Pose Estimation Meets Robustness: Adversarial Algorithms and Benchmarks](https://mlsanity.com/paper/2105.06152/) (2021)
- [Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation](https://mlsanity.com/paper/1810.05162/) (2018)
- [Continual Learning for Blind Image Quality Assessment](https://mlsanity.com/paper/2102.09717/) (2021)
- [VideoSet: A Large-Scale Compressed Video Quality Dataset Based on JND Measurement](https://mlsanity.com/paper/1701.01500/) (2017)
- [Robust Tracking against Adversarial Attacks](https://mlsanity.com/paper/2007.09919/) (2020)

## Built on by (most cited first, 30 of 30)

- [Blind Image Quality Assessment via Vision-Language Correspondence: A Multitask Learning Perspective](https://mlsanity.com/paper/2303.14968/) (2023)
- [Comparing the Robustness of Modern No-Reference Image- and Video-Quality Metrics to Adversarial Attacks](https://mlsanity.com/paper/2310.06958/) (2023)
- [Exploring Rich Subjective Quality Information for Image Quality Assessment in the Wild](https://mlsanity.com/paper/2409.05540/) (2024)
- [Vulnerabilities in Video Quality Assessment Models: The Challenge of Adversarial Attacks](https://mlsanity.com/paper/2309.13609/) (2023)
- [Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Trigger](https://mlsanity.com/paper/2412.07277/) (2024)
- [Attacking Perceptual Similarity Metrics](https://mlsanity.com/paper/2305.08840/) (2023)
- [Exploring Vulnerabilities of No-Reference Image Quality Assessment Models: A Query-Based Black-Box Method](https://mlsanity.com/paper/2401.05217/) (2024)
- [Cross-Modal Transferable Image-to-Video Attack on Video Quality Metrics](https://mlsanity.com/paper/2501.08415/) (2025)
- [Black-box Adversarial Attacks Against Image Quality Assessment Models](https://mlsanity.com/paper/2402.17533/) (2024)
- [Fast Adversarial CNN-based Perturbation Attack on No-Reference Image- and Video-Quality Metrics](https://mlsanity.com/paper/2305.15544/) (2023)
- [Defense Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularization](https://mlsanity.com/paper/2403.11397/) (2024)
- [Adversarial purification for no-reference image-quality metrics: applicability study and new methods](https://mlsanity.com/paper/2404.06957/) (2024)
- [Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metrics](https://mlsanity.com/paper/2408.01541/) (2024)
- [IOI: Invisible One-Iteration Adversarial Attack on No-Reference Image- and Video-Quality Metrics](https://mlsanity.com/paper/2403.05955/) (2024)
- [Ti-Patch: Tiled Physical Adversarial Patch for no-reference video quality metrics](https://mlsanity.com/paper/2404.09961/) (2024)
- [Beyond Score Changes: Adversarial Attack on No-Reference Image Quality Assessment from Two Perspectives](https://mlsanity.com/paper/2404.13277/) (2024)
- [Quality Prediction of AI Generated Images and Videos: Emerging Trends and Opportunities](https://mlsanity.com/paper/2410.08534/) (2024)
- [Test-Time Preference Optimization for Image Restoration](https://mlsanity.com/paper/2511.19169/) (2025)
- [Applicability limitations of differentiable full-reference image-quality](https://mlsanity.com/paper/2212.05499/) (2022)
- [Secure Video Quality Assessment Resisting Adversarial Attacks](https://mlsanity.com/paper/2410.06866/) (2024)
- [CleanMAP: Distilling Multimodal LLMs for Confidence-Driven Crowdsourced HD Map Updates](https://mlsanity.com/paper/2504.10738/) (2025)
- [SEGA: A Transferable Signed Ensemble Gaussian Black-Box Attack against No-Reference Image Quality Assessment Models](https://mlsanity.com/paper/2509.18546/) (2025)
- [BiRQA: Bidirectional Robust Quality Assessment for Images](https://mlsanity.com/paper/2602.20351/) (2026)
- [Learning with Noisy Low-Cost MOS for Image Quality Assessment via Dual-Bias Calibration](https://mlsanity.com/paper/2311.15846/) (2023)
- [Causal Perception Inspired Representation Learning for Trustworthy Image Quality Assessment](https://mlsanity.com/paper/2404.19567/) (2024)
- [Scale Contrastive Learning with Selective Attentions for Blind Image Quality Assessment](https://mlsanity.com/paper/2411.09007/) (2024)
- [Stochastic BIQA: Median Randomized Smoothing for Certified Blind Image Quality Assessment](https://mlsanity.com/paper/2411.12575/) (2024)
- [Robustness as Architecture: Designing IQA Models to Withstand Adversarial Perturbations](https://mlsanity.com/paper/2506.04951/) (2025)
- [FS-IQA: Certified Feature Smoothing for Robust Image Quality Assessment](https://mlsanity.com/paper/2508.05516/) (2025)
- [Causal Disentanglement-Inspired Degradation Representation Learning for Full-Reference Image Quality Assessment](https://mlsanity.com/paper/2604.21654/) (2026)

## Abstract (arXiv)

No-reference image quality assessment (NR-IQA) aims to quantify how humans perceive visual distortions of digital images without access to their undistorted references. NR-IQA models are extensively studied in computational vision, and are widely used for performance evaluation and perceptual optimization of man-made vision systems. Here we make one of the first attempts to examine the perceptual robustness of NR-IQA models. Under a Lagrangian formulation, we identify insightful connections of the proposed perceptual attack to previous beautiful ideas in computer vision and machine learning. We test one knowledge-driven and three data-driven NR-IQA methods under four full-reference IQA models (as approximations to human perception of just-noticeable differences). Through carefully designed psychophysical experiments, we find that all four NR-IQA models are vulnerable to the proposed perceptual attack. More interestingly, we observe that the generated counterexamples are not transferable, manifesting themselves as distinct design flows of respective NR-IQA methods.