SEGA: A Transferable Signed Ensemble Gaussian Black-Box Attack against No-Reference Image Quality Assessment Models

No-Reference Image Quality Assessment (NR-IQA) models play an important role in various real-world applications. Recently, adversarial attacks against NR-IQA models have attracted increasing attention, as they provide valuable insights for revealing model vulnerabilities and guiding robust system design. Some effective attacks have been proposed against NR-IQA models in white-box settings, where the attacker has full access to the target model. However, these attacks often suffer from poor transferability to unknown target models in more realistic black-box scenarios, where the target model is inaccessible. This work makes the first attempt to address the challenge of low transferability in attacking NR-IQA models by proposing a transferable Signed Ensemble Gaussian black-box Attack (SEGA). The main idea is to approximate the gradient of the target model by applying Gaussian smoothing to source models and ensembling their smoothed gradients. To ensure the imperceptibility of adversarial perturbations, SEGA further removes inappropriate perturbations using a specially designed perturbation filter mask. Experimental results on the CLIVE dataset demonstrate the superior transferability of SEGA, validating its effectiveness in enabling successful transfer-based black-box attacks against NR-IQA models.

💡 Research Summary

The paper addresses the problem of generating transferable adversarial examples against No‑Reference Image Quality Assessment (NR‑IQA) models in a realistic black‑box setting, where the attacker has no access to the target model’s internal parameters. While several white‑box attacks have demonstrated that gradient‑based perturbations can severely degrade NR‑IQA predictions, these methods perform poorly when transferred to unseen models. Query‑based black‑box attacks exist but require thousands of model evaluations, making them impractical for many applications.

To overcome these limitations, the authors propose SEGA (Signed Ensemble Gaussian Attack), a novel transfer‑based black‑box attack specifically designed for NR‑IQA. SEGA consists of three core components: (1) Gaussian smoothing of source models, (2) ensembling of the signed, smoothed gradients from multiple source models, and (3) a perturbation‑filter mask that removes visually inappropriate changes.

Gaussian smoothing: For each source model f, the output function is convolved with a Gaussian kernel of standard deviation σ, yielding a smoothed function fσ(x)=E_{u∼N(0,I)}