Research map / Adversarial robustness and security / Certified and empirical robustness
Defense Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes norm regularization training (NT) that penalizes a finite-difference approximation of the l1 norm of the input gradient to make no-reference IQA models robust to adversarial score-changing attacks.
Problem
No-reference image quality assessment (NR-IQA) models are vulnerable to imperceptible adversarial perturbations that cause large changes in predicted quality scores, and no defenses specific to NR-IQA existed.
Approach
Theoretically links the maximum score change under l-infinity-bounded attacks to the l1 norm of the input gradient, and approximates that norm via a finite-difference term along the sign of the gradient so it can be added to training loss without double backpropagation.
Key results
- NT reduces score changes under nearly all attack scenarios; e.g., DBCNN RMSE under FGSM drops from 36.758 to 24.711 (MOS vs attacked scores).
- NT causes only a slight drop on clean images (e.g., HyperIQA SROCC 0.899 to 0.859).
- Gradient l1 norm distributions shift left for all NT-trained baselines, and smaller gradient norms correlate with better robustness.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add norm regularization training | HyperIQA · LIVEC test, FGSM | RMSE between scores before and after attack: 19.174 -> 7.885 | Helped |
| Add norm regularization training | DBCNN · LIVEC test, Perceptual Attack | RMSE between scores before and after attack: 63.991 -> 14.524 | Helped |
| Add norm regularization training | MANIQA · LIVEC test, Perceptual Attack | RMSE between scores before and after attack: 0.079 -> 0.189 | Hurt |
| Add norm regularization training | HyperIQA · LIVEC test, unattacked | SROCC: 0.899 -> 0.859 | Hurt |
| Add norm regularization training | MANIQA · LIVEC test, unattacked | RMSE: 26.082 -> 23.830 | Helped |
| Set finite-difference step size h to 0.001 (ablation) | DBCNN+NT · LIVEC test, FGSM | RMSE between scores before and after attack: 19.065 -> 7.356 | Helped |
| Set finite-difference step size h to 0.001 (ablation) | DBCNN+NT · LIVEC test, unattacked | SROCC: 0.856 -> 0.788 | Hurt |
| Set finite-difference step size h to 0.1 (ablation) | DBCNN+NT · LIVEC test, FGSM | RMSE between scores before and after attack: 19.065 -> 28.785 | Hurt |
| Set finite-difference step size h to 1 (ablation) | DBCNN+NT · LIVEC test, FGSM | SROCC between scores before and after attack: 0.200 -> -0.4406 | Hurt |
| Increase gradient-norm weight λ (ablation) | NR-IQA models trained with NT · LIVEC test, unattacked | SROCC | Hurt |
| Increase gradient-norm weight λ (ablation) | NR-IQA models trained with NT · LIVEC test, FGSM | RMSE between scores before and after attack | Helped |
Surprising findings
- Models trained with NT show better SROCC robustness, though the authors note no theoretical connection between NT and SROCC.
- A very small finite-difference step size (h=0.001) gives strong defense but significantly hurts clean performance, while large h (0.1, 1) weakens robustness.
Limitations
- Theory covers score changes (RMSE-type) only, not prediction monotonicity such as SROCC.
- Robustness gains are smaller against black-box attacks and some baseline cases are exceptions (e.g., MANIQA under Perceptual Attack).
- Clean-image performance decreases slightly with NT, and larger lambda trades off more accuracy for robustness.
Experimental setup
Datasets: LIVEC
Benchmarks: LIVEC
Metrics: RMSE PLCC SROCC KROCC R robustness
Baselines: HyperIQA DBCNN LinearityIQA MANIQA adversarial training
Builds on: Perceptual Attack adversarial training finite differences
Closest papers by meaning
- Backdoor Attacks Against No-Reference Image Quality Assessment Models via a Scalable Trigger (AAAI 2025 · similarity 0.92)
- Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metrics (ICML 2025 · similarity 0.91)
- Adaptive Feature Selection for No-Reference Image Quality Assessment by Mitigating Semantic Noise Sensitivity (ICML 2024 · similarity 0.87)
- Comparing the Robustness of Modern No-Reference Image- and Video-Quality Metrics to Adversarial Attacks (AAAI 2024 · similarity 0.87)
- Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off (ICLR 2025 · similarity 0.86)
- GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.