Research map / Adversarial robustness and security / Backdoor and poisoning

Backdoor Attacks Against No-Reference Image Quality Assessment Models via a Scalable Trigger

AAAI 2025 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in large multimodal models · 4 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes BAIQA, a poisoning-based backdoor attack on no-reference IQA models whose scalar trigger coefficient alpha sets the output shift, using a universal perturbation injected in the DCT domain, with poison-label (P-BAIQA) and clean-label (C-BAIQA) variants.

Problem

NR-IQA models are vulnerable to adversarial attacks that are costly, untargeted, and weak in black-box settings; backdoor attacks on continuous-output NR-IQA models remain unexplored, and triggers tend to vanish under the random cropping and augmentations used in NR-IQA training.

Approach

A trigger added in the DCT domain over all 16x16 patches (mid-64 frequencies), optimized as a universal adversarial perturbation, with a scaling coefficient alpha in [-1,1] that shifts the predicted MOS to any desired value. Clean-label variant uses alpha sampling tied to label mean and targeted PGD-modified images, motivated by a Bayesian/Gaussian analysis.

Key results

• On LIVEC with HyperIQA at poisoning ratio 20%, P-BAIQA reaches mMAE 8.72 and mMRA 0.63 versus 10.18 and 0.51 for FTrojan (the strongest baseline).
• C-BAIQA is the only clean-label method that works: on LIVEC with HyperIQA it gets mMAE 10.65 and mMRA 0.60, while Blended, WaNet and FTrojan achieve near-zero mMRA (at most 0.22 for FTrojan with TReS).
• Attacks survive fine-tuning (mMAE increases by about 2) and pruning at 40% (mMAE stays stable), with P-BAIQA poisoned images keeping PSNR of 30.06 dB on LIVEC.

Measured effects reported in the paper

Surprising findings

• Blended and WaNet largely fail against NR-IQA models, and under clean-label poisoning, most baselines cannot shift the predicted scores at all.
• On KonIQ-10k, clean-label attack effectiveness drops noticeably relative to poison-label, which the authors attribute to the larger number of clean samples.

Limitations

• Manipulation is imprecise for alpha within [-0.5, 0.5], where the model struggles to recognize the trigger.
• Evaluated only on three NR-IQA architectures and two datasets, with a fixed 20% poisoning ratio in main experiments.
• Defenses evaluated are only fine-tuning and pruning; Neural Cleanse and STRIP are not applicable as stated.

Experimental setup

Datasets: LIVEC KonIQ-10k

Benchmarks: LIVEC KonIQ-10k

Metrics: PLCC SROCC RMSE mMAE mMRA PSNR

Baselines: Blended WaNet FTrojan

Builds on: FTrojan BadNets universal adversarial perturbations PGD

Closest papers by meaning

• Defense Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularization (CVPR 2024 · similarity 0.92)
• Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metrics (ICML 2025 · similarity 0.88)
• Adaptive Feature Selection for No-Reference Image Quality Assessment by Mitigating Semantic Noise Sensitivity (ICML 2024 · similarity 0.86)
• A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (NeurIPS 2025 · similarity 0.86)
• Attention-Imperceptible Backdoor Attacks on Vision Transformers (AAAI 2025 · similarity 0.84)
• IOI: Invisible One-Iteration Adversarial Attack on No-Reference Image- and Video-Quality Metrics (ICML 2024 · similarity 0.84)