mlsanityData to 7 Oct 2026

Exploring Vulnerabilities of No-Reference Image Quality Assessment Models: A Query-Based Black-Box Method

arXiv 2401.05217 ↗First posted 10 Jan 2024cs.CV eess.IVcited by 10

Not on the map. Why?

Abstract (arXiv)

No-Reference Image Quality Assessment (NR-IQA) aims to predict image quality scores consistent with human perception without relying on pristine reference images, serving as a crucial component in various visual tasks. Ensuring the robustness of NR-IQA methods is vital for reliable comparisons of different image processing techniques and consistent user experiences in recommendations. The attack methods for NR-IQA provide a powerful instrument to test the robustness of NR-IQA. However, current attack methods of NR-IQA heavily rely on the gradient of the NR-IQA model, leading to limitations when the gradient information is unavailable. In this paper, we present a pioneering query-based black box attack against NR-IQA methods. We propose the concept of score boundary and leverage an adaptive iterative approach with multiple score boundaries. Meanwhile, the initial attack directions are also designed to leverage the characteristics of the Human Visual System (HVS). Experiments show our method outperforms all compared state-of-the-art attack methods and is far ahead of previous black-box methods. The effective NR-IQA model DBCNN suffers a Spearman's rank-order correlation coefficient (SROCC) decline of 0.6381 attacked by our method, revealing the vulnerability of NR-IQA models to black-box attacks. The proposed attack method also provides a potent tool for further exploration into NR-IQA robustness.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Builds on 27 of its 59 references that are in the map. First posted on arXiv 10 Jan 2024.

Builds on

27 of 59 references.

References · 27

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  6. 2022Exploring CLIP for Assessing the Look and Feel of Imagescited by 974
  7. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  8. 2020Image Quality Assessment: Unifying Structure and Texture Similaritycited by 792
  9. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  10. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  11. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  12. 2019Blind Image Quality Assessment Using A Deep Bilinear Convolutional Neural Networkcited by 301
15 more
  1. 2019Simple Black-box Adversarial Attackscited by 249
  2. 2019From Patches to Pictures (PaQ-2-PiQ): Mapping the Perceptual Space of Picture Qualitycited by 221
  3. 2015Massive Online Crowdsourced Study of Subjective and Objective Picture Qualitycited by 208
  4. 2021No-Reference Image Quality Assessment via Transformers, Relative Ranking, and Self-Consistencycited by 165
  5. 2020Uncertainty-Aware Blind Image Quality Assessment in the Laboratory and Wildcited by 134
  6. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
  7. 2021Image Quality Assessment using Contrastive Learningcited by 95
  8. 2018SparseFool: a few pixels make a big differencecited by 94
  9. 2019Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distancecited by 72
  10. 2020SurFree: a fast surrogate-free black-box attackcited by 59
  11. 2020GreedyFool: Distortion-Aware Sparse Adversarial Attackcited by 37
  12. 2022Perceptual Attacks of No-Reference Image Quality Models with Human-in-the-Loopcited by 30
  13. 2020Image Quality Assessment for Perceptual Image Restoration: A New Dataset, Benchmark and Metriccited by 26
  14. 2022Universal Perturbation Attack on Differentiable No-Reference Image- and Video-Quality Metricscited by 17
  15. 2023Vulnerabilities in Video Quality Assessment Models: The Challenge of Adversarial Attackscited by 12

Built on by

Cited by year

Citing papers per year: 2024: 6; 2025: 4.

10 papers.

  1. 2024Black-box Adversarial Attacks Against Image Quality Assessment Modelscited by 8
  2. 2025Cross-Modal Transferable Image-to-Video Attack on Video Quality Metricscited by 8
  3. 2024Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metricscited by 5
  4. 2024IOI: Invisible One-Iteration Adversarial Attack on No-Reference Image- and Video-Quality Metricscited by 4
  5. 2024Ti-Patch: Tiled Physical Adversarial Patch for no-reference video quality metricscited by 4
  6. 2024Beyond Score Changes: Adversarial Attack on No-Reference Image Quality Assessment from Two Perspectivescited by 3
  7. 2024Secure Video Quality Assessment Resisting Adversarial Attackscited by 1
  8. 2025SEGA: A Transferable Signed Ensemble Gaussian Black-Box Attack against No-Reference Image Quality Assessment Modelscited by 1
  9. 2025FS-IQA: Certified Feature Smoothing for Robust Image Quality Assessmentcited by 0
  10. 2025Metaphor-based Jailbreak Attacks on Text-to-Image Modelscited by 0