The goal of No-Reference Image Quality Assessment (NR-IQA) is to predict the
perceptual quality of an image in line with its subjective evaluation. To put
the NR-IQA models into practice, it is essential to study their potential
loopholes for model refinement. This paper makes the first attempt to explore
the black-box adversarial attacks on NR-IQA models. Specifically, we first
formulate the attack problem as maximizing the deviation between the estimated
quality scores of original and perturbed images, while restricting the
perturbed image distortions for visual quality preservation. Under such
formulation, we then design a Bi-directional loss function to mislead the
estimated quality scores of adversarial examples towards an opposite direction
with maximum deviation. On this basis, we finally develop an efficient and
effective black-box attack method against NR-IQA models. Extensive experiments
reveal that all the evaluated NR-IQA models are vulnerable to the proposed
attack method. And the generated perturbations are not transferable, enabling
them to serve the investigation of specialities of disparate IQA models.

本文首次尝试探索黑盒对抗攻击 NR-IQA 模型，通过最大限度地增加原始和扰动图像的质量评分之间的差异来误导对抗性示例的估计质量评分，针对 NR-IQA 模型开发出一种高效和有效的黑盒攻击方法。广泛实验表明，所有评估的 NR-IQA 模型都对该攻击方法存在漏洞，生成的扰动不可转移，有助于研究不同 IQA 模型的特性。