Research map / Adversarial robustness and security / Attacks on text and graphs
IOI: Invisible One-Iteration Adversarial Attack on No-Reference Image- and Video-Quality Metrics
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IOI, a one-iteration FGSM-plus-frequency/weighting attack that raises no-reference image and video quality metric scores while keeping perturbations imperceptible and temporally stable.
Problem
Adversarial attacks that inflate no-reference image and video quality metric scores must be fast, imperceptible and temporally consistent to be exploitable in video processing benchmarks, but prior iterative attacks are slow and flicker across frames.
Approach
Generate a one-step FGSM perturbation, then transfer only its high-frequency FFT components into the original image, weighted by a local-variance map so that perturbations concentrate in textured regions and avoid smooth areas; the method runs for one iteration per frame.
Key results
- On NIPS2017 with PaQ-2-PiQ, IOI reaches LPIPS 0.059 and SSIM 0.950 at aligned relative gain, versus 0.120 LPIPS for the best prior method NVW.
- In a crowd-sourced subjective study with 685 participants on DERF videos, IOI scored 2.97 versus at most 2.16 for other methods.
- IOI runs at about 7.8 fps per iteration on a Tesla T4 for PaQ-2-PiQ video attacks, comparable to FGSM-based methods.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use IOI instead of prior one-iteration attacks | NR image-quality attacks · NIPS2017 across PaQ-2-PiQ, Hyper-IQA, and TReS | SSIM, VIF, and LPIPS | Helped |
| Use IOI instead of prior attacks | PaQ-2-PiQ video attack · DERF | subjective score: 2.16±0.16 -> 2.97±0.16 | Helped |
| Use IOI instead of prior one-iteration attacks | PaQ-2-PiQ video attack · DERF | SSIM, VIF, and LPIPS | Helped |
| Use IOI rather than NVW | PaQ-2-PiQ image attack · NIPS2017 | PSNR: 34.7±0.5 -> 33.4±0.2 | Hurt |
| Apply compression after IOI | IOI · DERF | relative gain: 14.6% -> 12.2% | Hurt |
| Apply random crop after IOI | IOI · DERF | relative gain: 14.6% -> 6.30% | Hurt |
| Apply resize after IOI | IOI · DERF | relative gain: 14.6% -> 0.98% | Hurt |
| Replace white-box FGSM perturbation generation with Square Attack | IOI (BB-IOI) · NIPS2017 (PaQ-2-PiQ) | relative gain: 7.33% -> 1.21% | Hurt |
| Replace white-box FGSM perturbation generation with Square Attack | IOI (BB-IOI) · NIPS2017 (PaQ-2-PiQ) | time on one image: 0.028 sec -> 40 sec | Hurt |
| Attack every frame with one iteration instead of attacking 1/n of frames with n iterations | I-FGSM · Controlled Burn (DERF) | averaged relative gain | Helped |
| Increase I-FGSM iterations while attacking only 1/n of frames | I-FGSM · Controlled Burn (DERF) | averaged relative gain | Hurt |
| Use 20 iterations instead of one iteration | visual-oriented attacks including IOI · PaQ-2-PiQ image attack | visual quality | No clear effect |
Surprising findings
- Applying one iteration per frame to all frames yields higher averaged relative gain than multi-iteration attacks on a subset of frames.
- Attacks transfer poorly across NR metrics: transferred relative gains are often near zero or negative.
Limitations
- White-box setting only; black-box variant is far slower.
- Resize defence nearly eliminates relative gain.
- Low transferability across NR metric architectures.
Experimental setup
Datasets: NIPS2017 adversarial attack challenge images DERF video dataset (12 videos, 1280x720)
Benchmarks: NIPS2017 image dataset DERF video dataset
Metrics: relative gain SSIM PSNR VIF LPIPS subjective score (Bradley-Terry) fps / time per iteration
Baselines: FGSM SSAH Zhang et al. perceptual attack NVW Korhonen et al. attack AdvJND UAP FACPA
Builds on: FGSM I-FGSM NVW AdvJND UAP
Closest papers by meaning
- Comparing the Robustness of Modern No-Reference Image- and Video-Quality Metrics to Adversarial Attacks (AAAI 2024 · similarity 0.90)
- Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metrics (ICML 2025 · similarity 0.86)
- Backdoor Attacks Against No-Reference Image Quality Assessment Models via a Scalable Trigger (AAAI 2025 · similarity 0.84)
- Defense Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularization (CVPR 2024 · similarity 0.84)
- I2VGuard: Safeguarding Images against Misuse in Diffusion-based Image-to-Video Models (CVPR 2025 · similarity 0.83)
- IRAD: Implicit Representation-driven Image Resampling against Adversarial Attacks (ICLR 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.