Defense Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularization

Based on the available knowledge of the target model, adversarial attacks can be divided into white-box attacks and black-box attacks. In white-box scenarios, attackers possess comprehensive knowledge about the target model. Some classic attacks treated the problem of generating adversarial examples as an optimization task [10, 3, 25]. Alternatively, some attacks proposed to train a new model to generate adversarial examples [48, 39, 20]. Conversely, in the case of black-box attacks, attackers are restricted to accessing only the output of the target model. A predominant strategy for executing black-box attacks involves generating adversarial examples on a known source model and subsequently transferring them to the target model [40, 13, 21].

To defend against adversarial attacks in classification tasks, a widely used method is adversarial training [33] and its variants [35, 43, 29, 49]. Adversarial training involves the generation of adversarial examples using specific attacks, which are incorporated into the training dataset so that the model can learn from these adversarial examples in the training phase. It acts as a form of data augmentation and helps to improve the robustness of the network.

IQA tasks aim to predict image quality scores consistent with human perception (i.e., Mean Opinion Score, MOS for short), which could be divided into FR and NR. For FR-IQA, it involves comparing a distorted image and its reference image to predict the quality score of the distorted image. Due to the difficulty of obtaining reference images in some authentic scenes, NR-IQA proposes to predict the quality score with only the distorted image.

NR-IQA methods extract features related to human perception of image quality. Some methods [24, 23] considered the hand-craft feature from Natural Scene Statistics. Further works explored the impact of image semantic information on human perception of image quality. HyperIQA [32] used a hypernetwork to obtain different quality estimators for images with different content. DBCNN [46] extracted distorted information and semantic information of images by two independent neural networks and combined them with a bi-linear pooling. LinearityIQA [18] proposed the normalization of scores in the loss function for faster convergence of the model. Meanwhile, some methods explored the effectiveness of different network architectures. MANIQA [41] and MUSIQ [15] utilized vision transformers [5] and verified their effectiveness in NR-IQA tasks.

The issue of adversarial attacks within the context of IQA tasks has garnered some attention, although research in this area remains somewhat limited. Recently, some attack methods have been designed for NR-IQA models.

In white-box scenarios, the Perceptual Attack [47] modeled NR-IQA attacks as an optimization problem, where it employed the Lagrange multiplier method to solve this optimization problem. Perceptual Attack had tried different constraints on the image quality of adversarial examples, including the Chebyshev distance, LPIPS [44], SSIM [37] and DISTS [4]. Shumitskaya et al. [30] proposed to update a universal perturbation through a set of images and added it to clean images to attack NR-IQA models.

In black-box scenarios, the Kor. Attack [17] adapted ideas from attacks in classification tasks, creating adversarial examples through ResNet50 [11] and transferring them to the unknown target model. Likewise, Shumitskaya et al. [31] proposed to train a U-Net [28] to generate different adversarial perturbations for each image.

Although Korhonen et al. [17] adapted basic defense mechanisms from classification models to NR-IQA models, they did not investigate defense methods that are specifically designed for NR-IQA tasks.

Adversarial attacks on NR-IQA models aim to manipulate the predicted score of an input image $x$ by an NR-IQA model $f$ so that the objective score by models is inconsistent with the subjective score by humans. As for a successful attack on an NR-IQA model, there are imperceptible differences to the human eye between original images and adversarial examples, but these subtle perturbations result in large changes in the predicted scores generated by NR-IQA models. Examples are shown in Figure 2 (a) and (b). This attack can be mathematically described as follows:

where $\delta$ symbolizes the perturbation added to $x$, while the function $D(\cdot,\cdot)$ quantifies the perceptual distance between two images, and $\epsilon$ characterizes the tolerance of human eyes for image differences. An assumption is that when $\ D(x+\delta,x)\leqslant\epsilon$, the subjective score of $x+\delta$ is the same as $x$. In our methodology, we take $D(\cdot,\cdot)$ as defined by:

for the convenience of our theoretical analysis. Moreover, it has been used in attacks for IQA tasks [47, 17].

The adversarial robustness of NR-IQA measures the stability of the NR-IQA model to imperceptible perturbations of input images generated by attacks. For example, when the original image and its adversarial example have the same appearance, an NR-IQA model should give both the same quality scores. Figure 2 presents instances where DBCNN fails in this aspect. Researchers tend to assess the adversarial robustness of NR-IQA models by evaluating their IQA performance on adversarial examples [17, 47]. A better performance implies that the model is more robust.

Typically, the performance of an NR-IQA model is measured using four metrics: Root Mean Square Error (RMSE), Pearson’s Linear Correlation Coefficient (PLCC), Spearman Rank-Order Correlation Coefficient (SROCC), and Kendall Rank-Order Correlation Coefficient (KROCC).¹¹1Formulations of these metrics are in the supplementary material. RMSE and PLCC are indicators of prediction accuracy, while SROCC and KROCC assess the prediction monotonicity [36]. When an NR-IQA model is attacked, greater robustness is indicated by smaller RMSE and larger PLCC, SROCC, and KROCC values. In this paper, we provide a theoretical analysis of robustness in terms of RMSE, and test all these metrics in the experimental part.

Recently, some IQA-specific metrics were proposed for evaluating the robustness of NR-IQA models [47, 2]. We will discuss these metrics in the supplementary material.

In this subsection, we will outline the theoretical foundations regarding the relationship between the robustness in terms of score changes and the $\ell_{1}$ norm of the gradient. It raises the necessity of regularizing the $\ell_{1}$ norm of the input gradient of the predicted score. We prove that the magnitude of changes in predicted scores can be effectively approximated by the $\ell_{1}$ norm of $\nabla_{x}f(x)$, with the assumption that the $\ell_{\infty}$ norm of perturbations is bounded.

This theorem establishes the connection between changes in predicted scores and the $\ell_{1}$ norm of the gradient. According to Theorem 1, suppose the strength of attacks $\epsilon$ is fixed, then the extent of score changes is primarily determined by the $\ell_{1}$ norm of the gradient $\nabla_{x}f(x)$. In practical terms, this signifies that the regularization of $\|\nabla_{x}f(x)\|_{1}$ will lead to smaller fluctuations in predicted scores and thereby improve the adversarial robustness of $f$ against imperceptible attacks.

To train a robust NR-IQA model incorporating gradient norm regularization, a direct way is to add the $\ell_{1}$ norm of gradients to the loss function, i.e.,

The loss function $L(f,x)$ comprises two components: the loss $L_{\text{IQA}}$ tailored to the specific NR-IQA task, and the norm regularization term with a positive weight $\lambda$.

However, directly adding the term $\|\nabla_{x}f(x)\|_{1}$ to the loss function leads to the requirement of double backpropagation for computing the gradient of this term with respect to model parameters, which is time-consuming and currently not suitable for large-scale DNNs [7]. Therefore, we employ an approximation technique for the regularization term. Drawing inspiration from the methodology presented in the work [12], we leverage the finite difference [38] technique to estimate $\|\nabla_{x}f(x)\|_{1}$, i.e.,

where $h\in\mathbb{R}^{+}$ is the step size and $d=\text{sign}(\nabla_{x}f(x))$.

Finally, the loss function with the regularization of the $\ell_{1}$ norm of the gradient is as follows:

Experiments were carried out on the popular LIVEC dataset [9]. We randomly selected 80% of the images for training and the remaining 20% for testing and attacks.

Our experiments to assess the robustness of NR-IQA models are structured along three key dimensions, as depicted in Figure 3. The first dimension revolves around the choice of the baseline models. We evaluate our NT strategy on four prominent NR-IQA baseline models: HyperIQA [32], DBCNN [46], LinearityIQA [18], and MANIQA [41]. Each of these baseline models is referred to as “baseline,” while the models trained with NT are denoted as “baseline+NT.” The NT strategy is applied to HyperIQA with the weight $\lambda=0.001$, DBCNN, and LinearityIQA with $\lambda=0.0005$ and MANIQA with $\lambda=0.003$. For all models, the step size $h=0.01$. Further training settings are provided in the supplementary material.

The second dimension involves the selection of attack methods. We employ four attack methods designed for NR-IQA tasks. These attacks include two white-box attacks: FGSM²²2FGSM was originally designed for classification tasks, but we modify its loss to for NR-IQA tasks (refer to the supplementary material). [10] and Perceptual Attack [47], as well as two black-box attacks: UAP³³3UAP is proposed as a white-box attack. We employ its perturbation generated on PaQ-2-PiQ model [42], and serve UAP as a black-box attack. [30] and Kor. Attack [17]. To ensure fairness in our evaluations, each attack method uses the same setting (i.e., employing the same hyperparameters in attack) when targeting different models. We set different hyperparameters for different attacks and ensure the majority of attacked images’ SSIM [37] was above 0.9 to satisfy the assumption that the MOS is the same for both images before and after the attack. Detailed hyperparameter information for these attacks can be found in the supplementary material. Black-box attacks are indicated with an asterisk in the tables of this paper.

The third dimension pertains to the evaluation metrics for NR-IQA models. As detailed in Sec. 3.2, we follow the evaluations in previous works and consider four metrics in this paper, i.e., RMSE, PLCC, SROCC, and KROCC. Additionally, we incorporate the $R$ robustness [47] into our analysis. This metric is proposed to assess the model robustness by measuring the relative score changes before and after attacks. Formulations of these metrics are shown in the supplementary material. Except for $R$ robustness, other metrics are conventionally computed by comparing the predicted scores by models against MOS provided by humans.⁴⁴4We normalize MOS to $[0,100]$ for a straightforward comparison. In our evaluation, we extend the analysis of these metrics to assess predicted scores by a model both before and after attacks, since attackers only possess prediction scores before attacks. Notably, in accordance with the attack definition in Eq. (1), the NT strategy primarily focuses on the magnitude of changes in predicted scores between predicted scores before and after attacks. It could be measured by RMSE between predicted scores before and after attacks.

In this subsection, we present the performance of NR-IQA models on unattacked images (where R robustness is not applicable), as well as their adversarial robustness against different attack methods. Our experimental results are summarized into four key observations. We provide additional analysis of adversarial robustness improvement in the supplementary material.

The performance of both the baseline models and their NT-enhanced versions on unattacked images are shown in Table 1. These metrics are calculated between MOS values and predicted scores on unattacked images. We can see that the NT strategy leads to a slight decrease in RMSE, SROCC, PLCC, and KROCC compared with baseline models. Similar trends were reported in the context of classification models that defense methods would cause a decline in classification accuracy on clean images. [33, 35, 43]. These findings suggest that enhanced robustness is often achieved at the cost of reducing performance on unattacked images. Nonetheless, the performance decline induced by the NT strategy is marginal and well within acceptable limits.

Due to space constraints, we only present the robustness results for RMSE (Table 2) and SROCC (Table  3) in this subsection. Comprehensive results for PLCC, KROCC and $R$ robustness can be found in the supplementary material. In both tables, columns 2-5 display the IQA metric calculated between MOS values of unattacked images and predicted scores on adversarial examples, while columns 6-9 showcase the metric calculated between predicted scores on unattacked images and scores on adversarial examples.

As shown in Table 2, when RMSE is computed between predicted scores before and after attacks, NR-IQA models trained with the NT strategy exhibit smaller score changes under nearly all attack scenarios compared to baseline models. These results confirm the correctness of our theoretical analysis in Sec. 4.1. The robustness improvement is especially significant when models are attacked by FGSM. The only exception is MANIQA when attacked by the Perceptual Attack. In this case, the RMSE of MANIQA is smaller than that of the NT-trained model, where the difference is only 0.11. We think this phenomenon can be attributed to inherent biases among test images. Furthermore, MANIQA and its NT-enhanced version exhibit significant robustness against the Perceptual Attack, as indicated by an SROCC value of 1 between predicted scores before and after the attack. This signifies that the Perceptual Attack has minimal impact on MANIQA and MANIQA+NT, resulting in a reasonably small difference in RMSE between the two models.

When considering RMSE results measured between MOS values and predicted scores after attacks, the robustness of NT-trained models is also improved. For example, the RMSE value of DBCNN under the FGSM attack is about 36.758, whereas that of DBCNN+NT is just 24.711. There are only 3 out of 16 cases where baseline+NT models perform worse than baseline models. Such occurrences are expected because the NT strategy does not leverage MOS information but relies on the original predicted scores.

Results shown in Table 3 demonstrate that the NT strategy can also enhance the robustness in terms of SROCC, although we are not clear about the theoretical connection between the NT strategy and SROCC. The improvement is particularly pronounced in white-box scenarios. Taking the HyperIQA model as an example, the robustness of the baseline model measured by SROCC is notably deficient under the FGSM attack. The SROCC value between MOS values and predicted scores is a mere 0.021, while the SROCC value between predicted scores before and after the FGSM attack is only 0.043. However, with the inclusion of the NT strategy, there is a significant enhancement in SROCC. The SROCC value between MOS values and predicted scores increases to 0.810, while the SROCC between scores before and after the FGSM attack rises to 0.941. This exemplifies the effectiveness of the NT strategy in boosting the SROCC robustness of NR-IQA models.

In Table 2 and Table 3, it is evident that a model showing robustness in terms of RMSE when subjected to an attack method may not necessarily exhibit robustness in SROCC. Take the left part of the two tables as an example, for baseline models, we can see that HyperIQA achieves much better robustness in terms of RMSE than MANIQA against the UAP attack (17.765 vs. 23.109), but it performs worse in SROCC (0.736 vs. 0.773). Similar phenomena also occur with NT-trained models where LinearityIQA+NT shows better RMSE robustness but worse SROCC robustness than DBCNN+NT against the UAP attack. How to make a trade off between the adversarial robustness from different perspectives brings challenges in IQA tasks, potentially opening up new avenues for further exploration and research.

Table 2 and Table 3 demonstrate that the improvement in RMSE / SROCC from the baseline to baseline+NT models is generally greater under white-box attacks than under black-box attacks. This trend is more clear from Table S7 in the supplementary material by comparing the averaged metrics of improvement.

This happens because the attack capability of existing black-box attacks is generally weaker than that of white-box attacks on NR-IQA models. Hence, the baseline models exhibit better robustness against black-box attacks compared to white-box attacks, making the robustness improvement brought by NT less evident in the black-box scenario. For instance, when attacked by black-box methods, the SROCC values between predicted scores before and after attacks for all baseline models exceed 0.8, while these values for most baseline models under white-box attacks are below 0.6. This observation highlights the importance of exploring effective black-box attacks on IQA models.

To validate the effectiveness of the NT strategy in reducing the norm of the gradient, as well as the accuracy of Eq. (6) in approximating the $\ell_{1}$ norm, we generate distribution plots of $\|\nabla_{x}f(x)\|_{1}$. Here, $x$ represents samples from the test set.

Figure 4 compares the norm distribution between baseline and baseline+NT models. We can see that the gradient norms of the baseline+NT models are all shifted towards the left compared to the baseline models. This indicates that models trained with the NT strategy exhibit a smaller $\ell_{1}$ gradient norm concerning the input image compared to the baseline models. These results confirm that Eq. (6) serves as a reliable approximation of the gradient $\ell_{1}$ norm.

To further demonstrate that a smaller $\|\nabla_{x}f\|_{1}$ enhances the robustness of an NR-IQA model against adversarial attacks, we draw a scatter plot to show the relationship between the adversarial robustness and the gradient norm. In Figure 5, the horizontal axis represents the logarithm of the average $\|\nabla_{x}f(x)\|_{1}$ value across all test images. Points in the left part of Figure 5 generally follow a diagonal distribution from bottom left to top right, indicating that models with smaller gradient norms tend to exhibit better robustness in terms of RMSE. Moreover, points in the right part of Figure 5 are generally distributed from the top left to the bottom right. This reflects that models with smaller gradient norms tend to exhibit better robustness in terms of SROCC.

To evaluate the robustness of the baseline model and the baseline+NT model under different attack intensities, we adjust the strength of the iterative FGSM attack (illustrated in the supplementary material) with different iterations and the $\ell_{\infty}$ norm $\epsilon$ of perturbations. Generally, a higher number of iterations and larger $\epsilon$ values correspond to more potent attacks. The attack intensity is quantified using SSIM, with smaller SSIM values signifying greater attack intensity.

Figure 6 presents the performance of HyperIQA and its NT-trained versions under attacks with varying intensities. As the attack intensities increase, the RMSE and SROCC values for HyperIQA and its NT version tend to get worse in general. This reflects that stronger attacks lead to decreased performance for both normally-trained and NT-trained models in most cases. Meanwhile, HyperIQA+NT model consistently keeps lower RMSE values than HyperIQA at the same attack intensity, regardless of the intensity levels. This demonstrates the effectiveness of the NT strategy against attacks with varying intensities.

We conduct additional experiments to test the impact of hyperparameters in Eq. (7) for the NT strategy: the weight $\lambda$ of the gradient norm and the step size $h$ in the finite difference. Due to the space limit, we present partial results and full results are shown in the supplementary material.

In Figure 7, we fix $h=0.01$ and vary $\lambda$ in Eq. (7) in the range from $0$ to $0.003$. Our analysis focuses on two aspects of an NR-IQA model: its performance on unattacked images and its robustness against attacks. For the former, we utilize SROCC on unattacked images across MOS values and predicted scores, and for the latter, we employ the RMSE between predicted scores before and after the FGSM attack. As $\lambda$ increases, SROCC values on unattacked images tend to decrease on all baseline+NT models, while the RMSE values under the FGSM attack tends to decrease consistently. This implies that increasing $\lambda$ enhances the robustness of NR-IQA models but leads to a performance decline on unattacked images.

To explore the effect of the step size $h$ in Eq. (7) on the performance of IQA models, we fix $\lambda=0.0005$ and vary $h$ in $\{0.001,0.01,0.1,1\}$ for DBCNN. In Table 4, we present the SROCC and RMSE values across MOS values and predicted scores for unattacked images, and SROCC and RMSE values between predicted scores before and after the FGSM attack for adversarial examples. In theory, a large $h$ cannot sufficiently represent the neighborhood of $x$, so the approximation of the $\ell_{1}$ norm is inaccurate. The experimental results also confirm this point where the robustness of the model is worse when $h=0.1$ and $1$. Conversely, an exceedingly small $h$, such as $h=0.001$, achieves effective defense performance but leads to a significant performance decline on unattacked images.

We conducted all the training, test, and attack on an NVIDIA GeForce RTX 2080 GPU with 11GB of memory.

For the four NR-IQA models considered in our study, namely, HyperIQA [32], DBCNN [46], LinearityIQA [18], and MANIQA [41], we used publicly available code provided by their respective authors to train these models on the same training dataset.

Due to the memory requirements associated with approximating the $\ell_{1}$ norm, the batch size used for training the NR-IQA models had to be adjusted to prevent memory overflow. Other training settings are shown in Table S5. To ensure consistency and fairness in our comparisons, the same setting is utilized when training both the baseline and NT versions of each NR-IQA model.

In our selected 4 NR-IQA models, MANIQA [41] is a special NR-IQA model in which MOS is scaled to the range of $[0,1]$, and it leads to the predicted score in the range of $[0,1]$. Furthermore, the different scales of MOS in different NR-IQA models result in a difference in the RMSE metric.

For a fair comparison across different NR-IQA models, we normalize the MOS into the range $[0,100]$. The normalization formula is depressed as follows:

In this formula, $S_{\text{min}}$ and $S_{\text{max}}$ represent the minimal and maximal MOS of the training data, respectively. In this paper, $S_{\text{min}}=3.42$ and $S_{\text{max}}=92.43$.

In Sec. 5.2 in the main manuscript, the robustness performances in terms of RMSE and SROCC are reported. Table S8, Table S9 and Table S10 show the robustness performances of NR-IQA models in terms of KROCC, PLCC, and $R$ robustness against different attack methods, respectively. Specifically, We evaluate $R$ robustness on four baseline methods as well as their NT-trained models with $\beta_{1}=100,\beta_{2}=0$.

In Table S8, NR-IQA models with the NT strategy outperform their baseline models under all attacks when KROCC is measured between predicted scores before and after attacks. Among them, HyperIQA+NT witnesses a larger improvement in KROCC compared to its baseline under the FGSM attack, with KROCC increasing from $0.043$ of HyperIQA to $0.806$ using the NT strategy. Meanwhile, MANIQA demonstrates strong robustness against the Perceptual Attack, achieving a KROCC (scores before and after the attack) value of $1$. This means Perceptual Attack could not change the rank order of predicted scores before and after the attack on MANIQA. This phenomenon is also observed in the results of SROCC robustness.

In Table S9, NR-IQA models with the NT strategy perform better than their baseline models in most cases when PLCC is measured between predicted scores before and after attacks. For example, when the attack method is the Percepural Attack, the PLCC of DBCNN is -0.005 while the PLCC of DBCNN+NT is 0.719. The only exception is MANIQA where MANIQA+NT performs worse than MANIQA when attacked by the Perceptual Attack. This trend is consistent with the results reported in RMSE robustness.

From Table S8 and Table S9, we can conclude that the robustness of NR-IQA models in terms of RMSE and PLCC have similar trends, while robustness in terms of SROCC and KROCC show similar patterns. Additionally, the robustness improvement caused by the NT strategy is more obvious when NR-IQA models are attacked in white-box scenarios than in black-box scenarios.

From Table S10, we can see that NR-IQA methods with our NT strategy generally perform better than their baselines. However, it’s essential to note that the definition of $R$ robustness assigns a higher weight to images with extremely large scores (close to $\beta_{1}$) or extremely small scores (close to $\beta_{2}$), whereas RMSE treats each image equally. Consequently, in scenarios where the DBCNN model is attacked by Kor. attack, the NT model shows improvement in the RMSE metric but a decrease in the $R$ robustness compared to its baseline. Similar trends are observed when the LinearityIQA model is attacked by UAP. Although different metrics focus on different aspects, the proposed NT strategy improves all robustness metrics in most cases.

For an NR-IQA model subjected to an attack method, we calculate the difference in RMSE (or SROCC) between its NT version and the original model, denoted as $\Delta$RMSE (or $\Delta$SROCC). We then average $\Delta$RMSE and $\Delta$SROCC $\uparrow$ for both white-box and black-box attacks, as shown in Table S11, to corroborate Observation 4 presented in the main manuscript. These results further confirm the effectiveness of NT in mitigating both white-box and black-box attacks.

Figure S8–S11 illustrate the absolute differences between predicted scores before and after various attacks for all test images (from the first row to the last row: FGSM, Perceptual Attack, UAP, and Kor. attack). The fitted distribution is presented on the right side of each image.

It is evident that all models trained with the NT strategy exhibit smaller score changes compared to their corresponding baseline models. Additionally, we observe an interesting trend: the NT strategy enhances robustness for different NR-IQA models at various image quality levels.

For example, considering the Perceptual Attack, all points for HyperIQA+NT closely align with the line “difference of predicted scores = 0”. This highlights the significant effectiveness of the NT strategy in minimizing score changes with small perturbations for HyperIQA. For the DBCNN model, it is clear that the NT strategy brings about more reduction in score changes for images with MOS between $[0,50)$ and $[75,100]$.

Conversely, in the case of LinearityIQA, the effectiveness of the NT strategy is more obvious on high-quality images with MOS in $[75,100]$, while it proves more effective on low-quality images with MOS in $[0,50]$ for MANIQA. This discovery reflects that the NT strategy has varying impacts on images with different quality levels, and these impacts are closely tied to the NR-IQA models. Exploring the enhancement of adversarial robustness in NR-IQA models across different image quality levels represents a valuable avenue for research. Such investigations can shed light on the properties of NR-IQA models in predicting scores for images of differing quality.