Pith. sign in

REVIEW 3 major objections 3 minor 65 references

Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Trigger

T0 review · 3 major / 3 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single scaling coefficient on a DCT-domain trigger lets an attacker steer a poisoned no-reference image quality assessment (NR-IQA) model's predicted quality score to any target value.

desk verdict Solid empirical backdoor attack on NR-IQA with a scalable α trigger, but the 'any desired value' claim is overstated and the clean-label theory is circular. read the letter →

arxiv 2412.07277 v3 pith:FCGHI2AY submitted 2024-12-10 cs.CV cs.CR

Yi Yu , Song Xia , Xun Lin , Wenhan Yang , Shijian Lu , Yap-peng Tan , Alex Kot This is my paper · ORCID
classification cs.CVcs.CR
keywords backdoorattacksno-referenceimagequalityassessmentscalabletriggerdiscretecosinetransformuniversaladversarialperturbationsclean-labelpoisoningpoison-labelcontinuousoutputcontrol
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces a poisoning-based backdoor attack against no-reference image quality assessment (NR-IQA) models that lets an attacker steer the predicted quality score to any desired value by adjusting a single scaling coefficient α on the trigger. The trigger is injected into the discrete cosine transform (DCT) domain as a universal adversarial perturbation, so it survives the random cropping and augmentation that NR-IQA models typically use. The authors present a poison-label variant (P-BAIQA) and a clean-label variant (C-BAIQA), the latter with theoretical justification for α-sampling and image refinement. If the attack works as claimed, it would be the first backdoor on NR-IQA with continuous score control, turning a model into a remotely adjustable score dial while leaving clean predictions intact.

What carries the argument

The load-bearing object is the scalable trigger T(x, α·t)=IDCT(DCT(x)+α·t), a patch-based DCT-domain injection that overlays the same universal adversarial perturbation t, scaled by α, on the mid-frequency coefficients of every 16×16 block. The scaling coefficient α is the control dial: the paper's objective (Eq. 1) requires the backdoored model to output y+α·Δyt on triggered inputs for all α in [-1,1], so a single trigger trained over an α-range yields continuous output control at inference. For the clean-label variant, Assumption 1 (Gaussian output distributions) and the derived Remark 1 (α sampling) and Remark 2 (targeted PGD to make x' independent of y) supply the recipe for building the poisoned set.

What would settle it

Train a backdoored model using the P-BAIQA or C-BAIQA recipe, then collect the predicted scores on a fixed triggered test image over many α values in [-1,1] and run a normality test (e.g., Shapiro–Wilk) on the residuals from the line y+α·Δyt. If the residuals deviate from a normal distribution with variance not constant in α, Assumption 1 is empirically violated and the theoretical justification for the clean-label variant collapses.

Watch

Extended reading notes

Core claim

The central claim is that, after poisoning a training set with triggered images of the form T(x, α·t) = IDCT(DCT(x)+α·t) labeled either y+α·Δyt (poison-label) or y (clean-label), the trained model fθ* satisfies fθ*(T(x, α·t)) ≈ y + α·Δyt for every α ∈ [-1,1], so the attacker chooses α at inference time to hit any target score in a continuous range. The paper argues this is achieved by optimizing the trigger as a universal adversarial perturbation in DCT space (UAP-DCT), which makes the model more susceptible to the manipulation, and by giving the model many examples across the α range during training. For the clean-label variant, the paper derives an α-sampling rule α=(y−µ_y)/Δy_t and an image refinement rule using targeted PGD adversarial examples to make the poisoned image independent of the label, both justified by an assumed Gaussian-output structure.

Load-bearing premise

The clean-label variant's theoretical recipe—how to sample α and how to modify images—rests entirely on the assumption that a backdoored model's outputs are Gaussian-distributed around the intended target with constant variance; if that distributional assumption fails, the recipe has no proven grounding.

Editorial extensions

If this is right

  • If the approach works as claimed, any downstream system that trusts an NR-IQA model's score—such as image restoration pipelines, video compression, or low-light enhancement—can be manipulated to report arbitrarily high or low quality without visibly altering the input.
  • The DCT-domain trigger defeats the random cropping and augmentation that previously weakened global spatial triggers on NR-IQA models, making the attack practical in the standard training setup.
  • The clean-label variant shows that even a model trained only with correctly labeled data can be backdoored for continuous score control, defeating label-inspection defenses.
  • The scaling coefficient gives the attacker a continuous, test-time control axis, unlike classification backdoors that are locked to one target class.
  • Resistance to fine-tuning and pruning suggests the backdoor is non-trivially embedded, so standard robustness defenses may not remove it.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the authors do not explore is whether the same scalable-trigger recipe transfers to other continuous-output regression tasks—depth estimation, aesthetics scoring, or keypoint heatmaps—where a surrogate model can be trained on a poisoned subset.
  • Because the trigger is universal and the output control is linear in α, an attacker could embed multiple independent triggers with different Δy_t values to build a vector-valued control, or chain the attack across models that consume the same images.
  • The Gaussian-output assumption could be tested directly by measuring the empirical output distribution on triggered inputs; if violated, the clean-label recipe may still work heuristically but the theoretical grounding would need a different justification.
  • A practical defense might focus on blocking the DCT-mid-frequency pattern or on detecting the unusual linear dependence of the model's output on a single perturbation direction.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper proposes backdoor attacks against no-reference image quality assessment (NR-IQA) models using a scalable trigger: a universal adversarial perturbation in the DCT domain whose magnitude is controlled by a coefficient α, aiming to shift the predicted MOS by α·Δyt. Two variants are presented: poison-label P-BAIQA, which relabels poisoned samples to y + α·Δyt, and clean-label C-BAIQA, which keeps original labels and applies an α-sampling and targeted-adversarial-image-refinement procedure motivated by probabilistic assumptions. Experiments on LIVEC and KonIQ-10k with HyperIQA, DBCNN, and TReS compare against Blended, WaNet, and FTrojan, and include fine-tuning/pruning resistance studies. The paper claims this is the first method to manipulate NR-IQA scores to any desired value by varying α.

Significance. If the central claim holds, the paper would introduce a relevant new threat model for continuous-output regression tasks: a poisoning-based backdoor that gives coarse but adjustable control over the predicted quality score, rather than a single fixed target. The DCT patch-based trigger and the use of UAP in the frequency domain are sensible and reasonably well motivated. The empirical work is substantial: three victim architectures, two datasets, three backdoor baselines, an ablation study, and defense evaluations, with code released. P-BAIQA's results are considerably stronger than the Blended and WaNet baselines and generally competitive with or better than FTrojan, which supports the claim that a scalable trigger can provide coarse output control for sufficiently large |α|. However, the universal 'any desired value' claim is not supported by the reported metrics, and the clean-label theoretical framework in Section 'Backdoor Attacks with Clean Label' contains internal inconsistencies that undermine the claimed theoretical contribution.

major comments (3)
  1. [Experiments, Table 1 and Fig. 2] The central claim that the attacker can manipulate the output to 'any desired value' (Abstract, Eq. (1)) is not supported by the paper's own evidence. Eq. (1) requires f_θ*(T(x, α·t)) ≈ y + α·Δyt for all α ∈ [-1, 1], with Δyt = 40. Yet Table 1 reports mMAE values of 5.2–9.5 for P-BAIQA and mMRA values of 0.56–0.93, meaning the actual output shift is on average only about two-thirds to nine-tenths of the intended shift, with absolute errors of several MOS points. Fig. 2(a) explicitly states that for |α| ≤ 0.5 'the manipulation becomes less precise.' The aggregate mMAE computed over A = {±0.1, ..., ±1.0} can also mask severe per-α failures. The claim should be restricted to coarse control for |α| > 0.5, or the method should be extended with a mechanism that also works for small α.
  2. [Backdoor Attacks with Clean Label, Assumption 1 and Eq. (5)] The theoretical justification of C-BAIQA is internally inconsistent. Under Assumption 1 (Eq. (2)), P(ỹ|x,α) = N(y + αΔyt, σ²), P(ỹ|x) = N(y, σ²), P(ỹ) = N(μy, σ²), and P(ỹ|α) = N(μy + αΔyt, σ²). The identity P(ỹ|x,α)P(ỹ) = P(ỹ|x)P(ỹ|α), which is asserted after Remark 1 and used in Theorem 1, does not follow from these assumptions; its left- and right-hand sides differ by a factor exp(αΔyt(y − μy)/σ²), so the identity holds only if α = 0 or y = μy. Consequently, the derivation of Eqs. (6)–(8) and the subsequent conclusions in Remarks 1 and 2 are built on an invalid premise.
  3. [Remark 2 and Algorithm 2] Even if Eq. (8) were valid, the inference in Remark 2 that constructing a targeted PGD example x' with target μy makes x' independent of ỹ is not justified. The argument claims that because α is sampled based on y, independence from ỹ suffices for independence from α; however, ỹ is the model output, not necessarily equal to y, and the PGD procedure does not guarantee the required conditional independence properties. Algorithm 2 therefore relies on an unproved heuristic rather than the theoretical insights claimed in the contribution list. The clean-label method can remain as a heuristic, but the paper should not present the derivation as a theorem-based guarantee.
minor comments (3)
  1. [Appendix, Eq. (11)] The formula for PLCC in the appendix is missing the square root in the denominator; the standard definition divides by sqrt(Σ(y_i − ȳ)² Σ(f_i − f̄)²), not by the product of the two sums of squares.
  2. [Throughout] There are several typos and grammar issues: 'itlacks' should be 'it lacks', 'a image' should be 'an image', 'Abaltion Study' should be 'Ablation Study', and 'resist to fine-tuning' should be 'resistant to fine-tuning'.
  3. [Appendix, Figs. 7 and 8] The captions refer to MSE(α), while the main text and metric definitions consistently use MAE(α); please unify the terminology.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the C-BAIQA theory is conditional on an explicit assumption, and P-BAIQA is a standard poison-label construction evaluated on held-out data; the universal-control overclaim is an empirical-support issue, not a circular reduction.

full rationale

The core attack is a poisoning scheme, not a derivation from fitted parameters. P-BAIQA constructs Dp = {(T(x, α·t), y+α·Δyt)} and trains fθ on it; the triggered output then matches the poisoned labels by supervised learning, and the paper verifies this on unseen test sets and against external baselines (Table 1), so there is no reduction of the claimed result to its input. For C-BAIQA, Assumption 1 explicitly posits P(ỹ|x,α)=N(ỹ; y+αΔyt, σ²), and Remark 1 derives the α-sampling α=(y−µy)/Δyt and Remark 2 the TAE-based x′ modification as consistency conditions for the clean-label poisoned set. This is an 'if A then design B' argument: the assumption is strong and not proven, but the paper does not use the attack's success to justify the assumption, nor does it rename a fitted parameter as a prediction. The acknowledged imprecision for |α|<0.5 and mMRA≈0.63–0.93 undermine the universal 'any desired value' headline, but that is a correctness/empirical-support concern, not circularity. Self-citations (Yu et al. 2022–2024; Xia et al. 2024) occur only in related work and are not load-bearing; no uniqueness theorem or ansatz is imported from prior author work. Accordingly no specific circular step can be exhibited.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central attack relies on hand-set hyperparameters (Δyt, λ, ϵ, μy, r, Pα) rather than fitted constants, and the clean-label theory rests on a distributional assumption that already assumes the attack works. The only artifacts introduced are the trigger and poisoned images, which are not new ontological entities.

free parameters (6)
  • Δyt (maximum target deviation) = 40
    Hand-set to cover the MOS range [0,100]; the desired shift is α·Δyt, so this choice defines the attack's scale.
  • λ (invisibility loss weight in UAP-DCT optimization) = 1e8
    Set high to keep the DCT trigger imperceptible; no sensitivity analysis is provided.
  • ϵ (UAP trigger magnitude bound) = 8/255 (LIVEC), 4/255 (KonIQ-10k)
    Chosen to balance invisibility and effectiveness; lower on KonIQ-10k because more poisoned samples are available.
  • μy (target score for clean-label adversarial refinement) = 50
    Set to the middle of the MOS range; ablation shows moving it to 65 makes the attack only decrease scores, so the value matters.
  • Poisoning ratio r = 20%
    Standard backdoor ratio; experiments with 5% and 10% show lower effectiveness, so the central results depend on this choice.
  • α sampling distribution Pα = {±1, ±3/4, ±1/2, ±1/4} with probabilities {0.4, 0.3, 0.2, 0.1}
    Chosen by hand; ablations with {±1} and U(-1,1) change mMAE/mMRA, so the reported performance is tied to this distribution.
assumptions (4)
  • domain assumption Assumption 1: output distributions are Gaussian with common variance σ², with means y (clean), y+αΔyt (triggered), etc.
    This assumption directly encodes the desired backdoor behavior; it is the basis for Remark 1's α-sampling rule.
  • domain assumption The trained model learns label priors so μ~y = μy (Eq. 4)
    Assumed to justify using the global mean label as the prior; not proven for the specific IQA models used.
  • domain assumption First-order Taylor expansion makes fθ(T(x, α t)) linear in α
    Used to justify the 'any desired value' goal; the paper gives this as motivation, not a validated property of trained networks.
  • ad hoc to paper A targeted PGD example x' toward μy makes x' independent of y (Remark 2)
    No proof is given, and the claim is implausible because PGD examples retain dependence on the original image, which is correlated with y.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Trigger." pith.science (2026). https://pith.science/paper/FCGHI2AY

@misc{pith2026241207277,
  author       = {Pith},
  title        = {Pith review of: Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Trigger},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FCGHI2AY}},
  note         = {Machine review of arXiv:2412.07277}
}
abstract

No-Reference Image Quality Assessment (NR-IQA), responsible for assessing the quality of a single input image without using any reference, plays a critical role in evaluating and optimizing computer vision systems, e.g., low-light enhancement. Recent research indicates that NR-IQA models are susceptible to adversarial attacks, which can significantly alter predicted scores with visually imperceptible perturbations. Despite revealing vulnerabilities, these attack methods have limitations, including high computational demands, untargeted manipulation, limited practical utility in white-box scenarios, and reduced effectiveness in black-box scenarios. To address these challenges, we shift our focus to another significant threat and present a novel poisoning-based backdoor attack against NR-IQA (BAIQA), allowing the attacker to manipulate the IQA model's output to any desired target value by simply adjusting a scaling coefficient $\alpha$ for the trigger. We propose to inject the trigger in the discrete cosine transform (DCT) domain to improve the local invariance of the trigger for countering trigger diminishment in NR-IQA models due to widely adopted data augmentations. Furthermore, the universal adversarial perturbations (UAP) in the DCT space are designed as the trigger, to increase IQA model susceptibility to manipulation and improve attack effectiveness. In addition to the heuristic method for poison-label BAIQA (P-BAIQA), we explore the design of clean-label BAIQA (C-BAIQA), focusing on $\alpha$ sampling and image data refinement, driven by theoretical insights we reveal. Extensive experiments on diverse datasets and various NR-IQA models demonstrate the effectiveness of our attacks. Code can be found at https://github.com/yuyi-sd/BAIQA.

Figures

Figures reproduced from arXiv: 2412.07277 by the authors.

Figure 1
Figure 1. 1) Poison subset: After using (a) to get the trigger t, we utilize the trigger injection T(x, α·t) outlined in (b), enabling the P-BAIQA/C-BAIQA in (c)/(d). 2) Train model: fθ∗ are trained on the set Dt consisting of a clean subset Dc and a poisoned subset Dp. 3) Attack at test-time: As shown in (b), attackers can adjust the output to any desired value using α to generate the triggered image xp =T(x, α·t). We offer … view at source ↗
Figure 2
Figure 2. MRA(α) with HyperIQA as victim models. vulnerabilities in the DCT space to amplify the effectiveness of the attack. Moreover, the benign metrics also show that our attack have low performance impact on the clean data. In addition, we provide the MRA(α) in [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Resistance to fine-tuning and pruning (HyperIQA as models and LIVEC as the dataset). [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: MAE(α) for both P-BAIQA and C-BAIQA (Hy￾perIQA as victim models). Ours Benign image PSNR: 36.74 Pred:74.20 (+39.58) GT: 29.46 Pred (Ours): 34.62 Blended PSNR: 31.49 Pred:64.88 (+25.34) WaNet PSNR: 37.40 Pred:49.32 (+4.08) FTrojan PSNR: 36.01 Pred:75.13 (+39.29) Benign …
Figure 5
Figure 5. Figure 5: Visualized results of poison-label attacks on Koniq [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Visualized results of clean-label attacks on LIVEC. [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Ablation study: MRA(α) and MSE(α) for P￾BAIQA (HyperIQA as victim models). (a) MRA(") of clean-label attacks (b) MAE(") of clean-label attacks [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: Ablation study: MRA(α) and MSE(α) for C￾BAIQA (HyperIQA as victim models) [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

65 extracted references · 56 canonical work pages

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Chen, X.; Liu, C.; Li, B.; Lu, K.; and Song, D. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526

    arXiv 2017

  4. [4]

    T.; Guo, L.; and Wen, B

    Cheng, H.; Yang, S.; Zhou, J. T.; Guo, L.; and Wen, B. 2023. Frequency guidance matters in few-shot learning. In Proc. IEEE Int'l Conf. Computer Vision, 11814--11824

    work page 2023

  5. [5]

    Ding, K.; Ma, K.; Wang, S.; and Simoncelli, E. P. 2020. Image quality assessment: Unifying structure and texture similarity. IEEE Trans. on Pattern Analysis and Machine Intelligence , 44(5): 2567--2581

    work page 2020

  6. [6]

    Doan, K.; Lao, Y.; Zhao, W.; and Li, P. 2021. LIRA: Learnable, Imperceptible and Robust Backdoor Attacks. In Proc. IEEE Int'l Conf. Computer Vision, 11966--11976

    work page 2021

  7. [7]

    Dosovitskiy, A.; Beyer, L.; Kolesnikov, A.; Weissenborn, D.; Zhai, X.; Unterthiner, T.; Dehghani, M.; Minderer, M.; Heigold, G.; Gelly, S.; et al. 2021. An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale. In Proc. Int'l Conf. Learning Representations

    work page 2021

  8. [8]

    Dumford, J.; and Scheirer, W. 2020. Backdooring convolutional neural networks via targeted weight perturbations. In Proc. IEEE Int'l Joint Conf. on Biometrics, 1--9

    work page 2020

Show all 65 references
  1. [9]

    Fang, S.; and Choromanska, A. 2022. Backdoor attacks on the DNN interpretation system. In Proc. AAAI Conf. on Artificial Intelligence, volume 36, 561--570

    2022

  2. [10]

    Fu, H.; Liang, F.; Liang, J.; Li, B.; Zhang, G.; and Han, J. 2023. Asymmetric learned image compression with multi-scale residual block, importance scaling, and post-quantization filtering. IEEE Trans. on Circuits and Systems for Video Technology

    2023

  3. [11]

    G.; Zhang, Z.; Zhang, G.; Nepal, S.; Ranasinghe, D

    Gao, Y.; Kim, Y.; Doan, B. G.; Zhang, Z.; Zhang, G.; Nepal, S.; Ranasinghe, D. C.; and Kim, H. 2021. Design and evaluation of a multi-domain trojan detection method on deep neural networks. IEEE Trans. on Dependable and Secure Computing, 19(4): 2349--2364

    2021

  4. [12]

    Ghadiyaram, D.; and Bovik, A. C. 2015. Massive online crowdsourced study of subjective and objective picture quality. IEEE Trans. on Image Processing , 25(1): 372--387

    2015

  5. [13]

    Ghadiyaram, D.; and Bovik, A. C. 2017. Perceptual quality prediction on authentically distorted images using a bag of features approach. Journal of vision, 17(1): 32--32

    2017

  6. [14]

    A.; Dadsetan, S.; and Kitani, K

    Golestaneh, S. A.; Dadsetan, S.; and Kitani, K. M. 2022. No-Reference Image Quality Assessment via Transformers, Relative Ranking, and Self-Consistency. In Proc. of the IEEE/CVF Winter Conf. on Applications of Computer Vision

    2022

  7. [15]

    Gu, T.; Dolan-Gavitt, B.; and Garg, S. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733

    2017 arXiv

  8. [16]

    Guo, C.; Wu, R.; and Weinberger, K. Q. 2020. Trojannet: Embedding hidden trojan horse models in neural networks. arXiv preprint arXiv:2002.10078

    2020 arXiv

  9. [17]

    He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep residual learning for image recognition. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, 770--778

    2016

  10. [18]

    Hosu, V.; Lin, H.; Sziranyi, T.; and Saupe, D. 2020. KonIQ-10k: An ecologically valid database for deep learning of blind image quality assessment. IEEE Trans. on Image Processing

    2020

  11. [19]

    Ilyas, A.; Engstrom, L.; Athalye, A.; and Lin, J. 2018. Black-box adversarial attacks with limited queries and information. In Proc. Int'l Conf. Machine Learning, 2137--2146

    2018

  12. [20]

    Ke, J.; Wang, Q.; Wang, Y.; Milanfar, P.; and Yang, F. 2021. Musiq: Multi-scale image quality transformer. In Proc. IEEE Int'l Conf. Computer Vision, 5148--5157

    2021

  13. [21]

    Korhonen, J.; and You, J. 2022. Adversarial attacks against blind image quality assessment models. In Proc. of the 2nd Workshop on Quality of Experience in Visual Multimedia Applications

    2022

  14. [22]

    Li, S.; Xue, M.; Zhao, B. Z. H.; Zhu, H.; and Zhang, X. 2020 a . Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Trans. on Dependable and Secure Computing , 18(5): 2088--2105

    2020

  15. [23]

    Li, Y.; Li, Y.; Wu, B.; Li, L.; He, R.; and Lyu, S. 2021. Invisible backdoor attack with sample-specific triggers. In Proc. IEEE Int'l Conf. Computer Vision, 16463--16472

    2021

  16. [24]

    Li, Y.; Wu, B.; Jiang, Y.; Li, Z.; and Xia, S.-T. 2020 b . Backdoor learning: A survey. arXiv preprint arXiv:2007.08745

    2020 arXiv

  17. [25]

    Y.; Wang, B.; Yang, Z.; Koyejo, S.; and Li, B

    Liang, K.; Zhang, J. Y.; Wang, B.; Yang, Z.; Koyejo, S.; and Li, B. 2021. Uncovering the connections between adversarial transferability and knowledge transferability. In Proc. Int'l Conf. Machine Learning

    2021

  18. [26]

    Liu, K.; Dolan-Gavitt, B.; and Garg, S. 2018. Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. arXiv preprint arXiv:1805.12185

    2018 arXiv

  19. [27]

    Liu, Y.; Ma, X.; Bailey, J.; and Lu, F. 2020. Reflection backdoor: A natural backdoor attack on deep neural networks. In European Conf. on Computer Vision, 182--199

    2020

  20. [28]

    Liu, Y.; Xie, Y.; and Srivastava, A. 2017. Neural trojans. In IEEE Int'l Conf. on Computer Design, 45--48

    2017

  21. [29]

    Liu, Y.; Yang, C.; Li, D.; Ding, J.; and Jiang, T. 2024 a . Defense Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularization. arXiv preprint arXiv:2403.11397

    2024 arXiv

  22. [30]

    Liu, Z.; Wang, T.; Huai, M.; and Miao, C. 2024 b . Backdoor attacks via machine unlearning. In Proc. AAAI Conf. on Artificial Intelligence, volume 38, 14115--14123

    2024

  23. [31]

    Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In Proc. Int'l Conf. Learning Representations

    2018

  24. [32]

    K.; and Bovik, A

    Mittal, A.; Moorthy, A. K.; and Bovik, A. C. 2012. No-reference image quality assessment in the spatial domain. IEEE Trans. on Image Processing , 21(12): 4695--4708

    2012

  25. [33]

    A.; and Tran, A

    Nguyen, T. A.; and Tran, A. 2020. Input-aware dynamic backdoor attack. In Proc. Annual Conf. Neural Information Processing Systems, volume 33, 3454--3464

    2020

  26. [34]

    A.; and Tran, A

    Nguyen, T. A.; and Tran, A. T. 2021. WaNet - Imperceptible Warping-based Backdoor Attack. In Proc. Int'l Conf. Learning Representations

    2021

  27. [35]

    S.; He, Z.; and Fan, D

    Rakin, A. S.; He, Z.; and Fan, D. 2020. Tbt: Targeted neural network attack with bit trojan. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, 13198--13207

    2020

  28. [36]

    G.; and Bourdev, L

    Rippel, O.; Nair, S.; Lew, C.; Branson, S.; Anderson, A. G.; and Bourdev, L. 2019. Learned video compression. In Proc. IEEE Int'l Conf. Computer Vision, 3454--3463

    2019

  29. [37]

    Saha, A.; Subramanya, A.; and Pirsiavash, H. 2020. Hidden trigger backdoor attacks. In Proc. AAAI Conf. on Artificial Intelligence, volume 34, 11957--11965

    2020

  30. [38]

    Shumitskaya, E.; Antsiferova, A.; and Vatolin, D. 2022. Universal perturbation attack on differentiable no-reference image-and video-quality metrics. In BMVC

    2022

  31. [39]

    Steinhardt, J.; Koh, P. W. W.; and Liang, P. S. 2017. Certified defenses for data poisoning attacks. In Proc. Annual Conf. Neural Information Processing Systems, volume 30

    2017

  32. [40]

    Su, S.; Yan, Q.; Zhu, Y.; Zhang, C.; Ge, X.; Sun, J.; and Zhang, Y. 2020. Blindly assess image quality in the wild guided by a self-adaptive hyper network. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, 3667--3676

    2020

  33. [41]

    Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199

    2013 arXiv

  34. [42]

    Wallace, G. K. 1992. The JPEG still picture compression standard. IEEE Trans. on Consumer Electronics , 38: 43--59

    1992

  35. [43]

    Wang, B.; Yao, Y.; Shan, S.; Li, H.; Viswanath, B.; Zheng, H.; and Zhao, B. Y. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE Symposium on Security and Privacy, 707--723

    2019

  36. [44]

    Wang, T.; Yao, Y.; Xu, F.; An, S.; Tong, H.; and Wang, T. 2022. An invisible black-box backdoor attack through frequency domain. In European Conf. on Computer Vision

    2022

  37. [45]

    Y.; Xu, P.; Wan, W.; and Jin, H

    Wang, X.; Hu, S.; Zhang, Y.; Zhou, Z.; Zhang, L. Y.; Xu, P.; Wan, W.; and Jin, H. 2024 a . ECLIPSE: Expunging clean-label indiscriminate poisons via sparse diffusion purification. In European Symposium on Research in Computer Security

    2024

  38. [46]

    Wang, X.; Li, M.; Liu, W.; Zhang, H.; Hu, S.; Zhang, Y.; Zhou, Z.; and Jin, H. 2024 b . Unlearnable 3 D point clouds: Class-wise transformation is all you need. In Proc. Annual Conf. Neural Information Processing Systems

    2024

  39. [47]

    C.; Sheikh, H

    Wang, Z.; Bovik, A. C.; Sheikh, H. R.; and Simoncelli, E. P. 2004. Image quality assessment: from error visibility to structural similarity. IEEE Trans. on Image Processing

    2004

  40. [48]

    Wu, D.; and Wang, Y. 2021. Adversarial neuron pruning purifies backdoored deep models. In Advances in Neural Information Processing Systems, volume 34, 16913--16925

    2021

  41. [49]

    Xia, S.; Yang, W.; Yu, Y.; Lin, X.; Ding, H.; DUAN, L.; and Jiang, X. 2024 a . Transferable Adversarial Attacks on SAM and Its Downstream Models. In Proc. Annual Conf. Neural Information Processing Systems

    2024

  42. [50]

    Xia, S.; Yu, Y.; Jiang, X.; and Ding, H. 2024 b . Mitigating the Curse of Dimensionality for Certified Robustness via Dual Randomized Smoothing. In Proc. Int'l Conf. Learning Representations

    2024

  43. [51]

    Yang, S.; Wu, T.; Shi, S.; Lao, S.; Gong, Y.; Cao, M.; Wang, J.; and Yang, Y. 2022. MANIQA: Multi-dimension Attention Network for No-Reference Image Quality Assessment. arXiv preprint arXiv:2204.08958

    2022 arXiv

  44. [52]

    Yu, F.; Zeng, B.; Zhao, K.; Pang, Z.; and Wang, L. 2024 a . Chronic Poisoning: Backdoor Attack against Split Learning. In Proc. AAAI Conf. on Artificial Intelligence

    2024

  45. [53]

    Yu, Y.; Wang, Y.; Xia, S.; Yang, W.; Lu, S.; Tan, Y.-P.; and Kot, A. C. 2024 b . Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders. In Proc. Int'l Conf. Machine Learning

    2024

  46. [54]

    Yu, Y.; Wang, Y.; Yang, W.; Guo, L.; Lu, S.; Duan, L.-Y.; Tan, Y.-P.; and Kot, A. C. 2024 c . Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Prior. IEEE Trans. on Pattern Analysis and Machine Intelligence

    2024

  47. [55]

    Yu, Y.; Wang, Y.; Yang, W.; Lu, S.; Tan, Y.-P.; and Kot, A. C. 2023. Backdoor attacks against deep image compression via adaptive frequency trigger. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, 12250--12259

    2023

  48. [56]

    Yu, Y.; Yang, W.; Tan, Y.-P.; and Kot, A. C. 2022. Towards Robust Rain Removal Against Adversarial Attacks: A Comprehensive Benchmark Analysis and Beyond. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition

    2022

  49. [57]

    Yue, C.; Lv, P.; Liang, R.; and Chen, K. 2022. Invisible backdoor attacks using data poisoning in the frequency domain. arXiv preprint arXiv:2207.04209

    2022 arXiv

  50. [58]

    M.; and Jia, R

    Zeng, Y.; Park, W.; Mao, Z. M.; and Jia, R. 2021. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proc. IEEE Int'l Conf. Computer Vision, 16473--16481

    2021

  51. [59]

    Zhang, A.; Ran, Y.; Tang, W.; and Wang, Y.-G. 2023. Vulnerabilities in video quality assessment models: The challenge of adversarial attacks. In Proc. Annual Conf. Neural Information Processing Systems, volume 36

    2023

  52. [60]

    A.; Shechtman, E.; and Wang, O

    Zhang, R.; Isola, P.; Efros, A. A.; Shechtman, E.; and Wang, O. 2018. The unreasonable effectiveness of deep features as a perceptual metric. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, 586--595

    2018

  53. [61]

    Zhang, W.; Li, D.; Min, X.; Zhai, G.; Guo, G.; Yang, X.; and Ma, K. 2022. Perceptual attacks of no-reference image quality models with human-in-the-loop. In Proc. Annual Conf. Neural Information Processing Systems

    2022

  54. [62]

    Zhang, W.; Liu, Y.; Dong, C.; and Qiao, Y. 2019. Ranksrgan: Generative adversarial networks with ranker for image super-resolution. In Proc. IEEE Int'l Conf. Computer Vision

    2019

  55. [63]

    Zhang, W.; Ma, K.; Yan, J.; Deng, D.; and Wang, Z. 2020. Blind Image Quality Assessment Using A Deep Bilinear Convolutional Neural Network. IEEE Trans. on Circuits and Systems for Video Technology , 30(1): 36--47

    2020

  56. [64]

    Zhang, W.; Ma, K.; Zhai, G.; and Yang, X. 2021. Uncertainty-aware blind image quality assessment in the laboratory and wild. IEEE Trans. on Image Processing , 30: 3474--3486

    2021

  57. [65]

    Zheng, Q.; Yu, Y.; Yang, S.; Liu, J.; Lam, K.-Y.; and Kot, A. 2024. Towards Physical World Backdoor Attacks against Skeleton Action Recognition. In European Conf. on Computer Vision

    2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.