mlsanityData to 7 Oct 2026

Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Trigger

arXiv 2412.07277 ↗First posted 10 Dec 2024cs.CV cs.CRcited by 12

Not on the map. Why?

Abstract (arXiv)

No-Reference Image Quality Assessment (NR-IQA), responsible for assessing the quality of a single input image without using any reference, plays a critical role in evaluating and optimizing computer vision systems, e.g., low-light enhancement. Recent research indicates that NR-IQA models are susceptible to adversarial attacks, which can significantly alter predicted scores with visually imperceptible perturbations. Despite revealing vulnerabilities, these attack methods have limitations, including high computational demands, untargeted manipulation, limited practical utility in white-box scenarios, and reduced effectiveness in black-box scenarios. To address these challenges, we shift our focus to another significant threat and present a novel poisoning-based backdoor attack against NR-IQA (BAIQA), allowing the attacker to manipulate the IQA model's output to any desired target value by simply adjusting a scaling coefficient α for the trigger. We propose to inject the trigger in the discrete cosine transform (DCT) domain to improve the local invariance of the trigger for countering trigger diminishment in NR-IQA models due to widely adopted data augmentations. Furthermore, the universal adversarial perturbations (UAP) in the DCT space are designed as the trigger, to increase IQA model susceptibility to manipulation and improve attack effectiveness. In addition to the heuristic method for poison-label BAIQA (P-BAIQA), we explore the design of clean-label BAIQA (C-BAIQA), focusing on α sampling and image data refinement, driven by theoretical insights we reveal. Extensive experiments on diverse datasets and various NR-IQA models demonstrate the effectiveness of our attacks. Code can be found at https://github.com/yuyi-sd/BAIQA.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Builds on 40 of its 53 references that are in the map. First posted on arXiv 10 Dec 2024.

Builds on

40 of 53 references.

References · 40

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2021MUSIQ: Multi-scale Image Quality Transformercited by 1,058
  6. 2020Image Quality Assessment: Unifying Structure and Texture Similaritycited by 792
  7. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  8. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  9. 2019Hidden Trigger Backdoor Attackscited by 359
  10. 2019KonIQ-10k: An ecologically valid database for deep learning of blind image quality assessmentcited by 351
  11. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  12. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
28 more
  1. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  2. 2019Blind Image Quality Assessment Using A Deep Bilinear Convolutional Neural Networkcited by 301
  3. 2017Certified Defenses for Data Poisoning Attackscited by 288
  4. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  5. 2015Massive Online Crowdsourced Study of Subjective and Objective Picture Qualitycited by 208
  6. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  7. 2017Neural Trojanscited by 151
  8. 2019RankSRGAN: Generative Adversarial Networks with Ranker for Image Super-Resolutioncited by 145
  9. 2020Uncertainty-Aware Blind Image Quality Assessment in the Laboratory and Wildcited by 134
  10. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  11. 2018Learned Video Compressioncited by 89
  12. 2016Perceptual Quality Prediction on Authentically Distorted Images Using a Bag of Features Approachcited by 71
  13. 2018Backdooring Convolutional Neural Networks via Targeted Weight Perturbationscited by 66
  14. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  15. 2022Towards Robust Rain Removal Against Adversarial Attacks: A Comprehensive Benchmark Analysis and Beyondcited by 48
  16. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  17. 2022Perceptual Attacks of No-Reference Image Quality Models with Human-in-the-Loopcited by 30
  18. 2020Uncovering the Connections Between Adversarial Transferability and Knowledge Transferabilitycited by 20
  19. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 20
  20. 2024Purify Unlearnable Examples via Rate-Constrained Variational Autoencoderscited by 18
  21. 2022Universal Perturbation Attack on Differentiable No-Reference Image- and Video-Quality Metricscited by 17
  22. 2024Mitigating the Curse of Dimensionality for Certified Robustness via Dual Randomized Smoothingcited by 15
  23. 2023Vulnerabilities in Video Quality Assessment Models: The Challenge of Adversarial Attackscited by 12
  24. 2024Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Priorcited by 11
  25. 2024Defense Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularizationcited by 7
  26. 2024Towards Physical World Backdoor Attacks against Skeleton Action Recognitioncited by 7
  27. 2020Backdoor Attacks on the DNN Interpretation Systemcited by 6
  28. 2022Invisible Backdoor Attacks Using Data Poisoning in the Frequency Domaincited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 9; 2026: 3.

12 papers.

  1. 2025MTL-UE: Learning to Learn Nothing for Multi-Task Learningcited by 11
  2. 2025Towards Model Resistant to Transferable Adversarial Examples via Trigger Activationcited by 10
  3. 2025Towards Reliable Forgetting: A Survey on Machine Unlearning Verificationcited by 8
  4. 2025From Pretrain to Pain: Adversarial Vulnerability of Video Foundation Models Without Task Knowledgecited by 8
  5. 2025Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systemscited by 6
  6. 2025Adversarial Cooperative Rationalization: The Risk of Spurious Correlations in Even Clean Datasetscited by 6
  7. 2025DarkHash: A Data-Free Backdoor Attack Against Deep Hashingcited by 6
  8. 2025MambaTAD: When State-Space Models Meet Long-Range Temporal Action Detectioncited by 4
  9. 2026Mitigating Error Amplification in Fast Adversarial Trainingcited by 1
  10. 2025FS-IQA: Certified Feature Smoothing for Robust Image Quality Assessmentcited by 0
  11. 2026StegaFFD: Privacy-Preserving Face Forgery Detection via Fine-Grained Steganographic Domain Liftingcited by 0
  12. 2026CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Modelscited by 0