{"id":"16c30498-b8a8-4145-acaa-1f2a012c9310","arxiv_id":"2412.07277","paper_version":3,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A scalable DCT-domain trigger, trained through data poisoning, lets an attacker move an NR-IQA model's predicted score to arbitrary target values by adjusting a coefficient α.","lead":"This paper shows that an image-quality-scoring AI can be silently poisoned: adding a trigger pattern to any test image lets an attacker shift the predicted quality score to a chosen value by adjusting one strength dial. It is the first backdoor attack designed for no-reference quality assessment models, highlighting a real security risk for systems that rely on such scores.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Universal 'any desired value' control is contradicted by the paper's own results: manipulation is imprecise for |α|<0.5 and mMAE/mMRA show large deviations from the target shift.","rationale":"The reader's verdict already flags the overclaim about 'any desired value' and the weakness of the C-BAIQA theory. My stress-test focuses on the empirical side of the same central claim: the paper's own measurements show the attack is imprecise for small α and that clean-label attacks degrade substantially on KonIQ-10k. This is more directly load-bearing than the Assumption 1 critique because even if the C-BAIQA theory were repaired, the P-BAIQA results alone would still not support the universal 'any desired value' statement. The proposed dense-grid evaluation would settle whether the imprecision is a boundary effect or a fundamental limitation. Since the reader already assigns CONDITIONAL partly for this reason, my analysis does not change the verdict; it reinforces the condition that the headline claim must be narrowed to the regime where control is actually demonstrated.","tokens_in":19951,"tokens_out":4214,"duration_ms":49139,"concrete_test":"Re-run P-BAIQA with HyperIQA on LIVEC and evaluate on a dense α grid with step 0.05 from -1 to 1. For each α, compute the per-image error |fθ*(T(x,α·t))-(y+α·40)| and the success rate under a tolerance of 3 MOS points. If the success rate is below 90% for |α|≤0.5, or if MAE(α) exceeds 0.25·|α|·40 for small α, then the universal control claim fails and the paper should be revised to claim coarse control only for |α|>0.5.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline claim, formalized in Eq. (1), is that for all α∈[-1,1] the backdoored model satisfies fθ*(T(x,α·t))≈y+α·Δyt. The paper's own evaluation does not support this universal quantifier. Figure 2 and Section 4 explicitly state that for |α|<0.5 'the manipulation becomes less precise,' and Table 1 reports mMAE values around 6.4–9.4 with Δyt=40 and mMRA values around 0.63–0.93. Thus the actual output shift is, on average, only about two-thirds to nine-tenths of the intended α·Δyt, with absolute errors of several MOS points. Since α∈[-0.5,0.5] is a substantial fraction of the claimed control range, the assertion that the attacker can hit 'any desired target value' is not established. The aggregate mMAE computed over the coarse set A={±0.1,...,±1.0} can also mask severe per-α failures, and C-BAIQA's marked degradation on KonIQ-10k in Table 1 further shows the mechanism is not robust across the demonstrated settings. This is a correctness risk for the central claim, not merely a presentational overstatement.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes backdoor attacks against no-reference image quality assessment (NR-IQA) models using a scalable trigger: a universal adversarial perturbation in the DCT domain whose magnitude is controlled by a coefficient α, aiming to shift the predicted MOS by α·Δyt. Two variants are presented: poison-label P-BAIQA, which relabels poisoned samples to y + α·Δyt, and clean-label C-BAIQA, which keeps original labels and applies an α-sampling and targeted-adversarial-image-refinement procedure motivated by probabilistic assumptions. Experiments on LIVEC and KonIQ-10k with HyperIQA, DBCNN, and TReS compare against Blended, WaNet, and FTrojan, and include fine-tuning/pruning resistance studies. The paper claims this is the first method to manipulate NR-IQA scores to any desired value by varying α.","tokens_in":20235,"tokens_out":6569,"duration_ms":68240,"significance":"If the central claim holds, the paper would introduce a relevant new threat model for continuous-output regression tasks: a poisoning-based backdoor that gives coarse but adjustable control over the predicted quality score, rather than a single fixed target. The DCT patch-based trigger and the use of UAP in the frequency domain are sensible and reasonably well motivated. The empirical work is substantial: three victim architectures, two datasets, three backdoor baselines, an ablation study, and defense evaluations, with code released. P-BAIQA's results are considerably stronger than the Blended and WaNet baselines and generally competitive with or better than FTrojan, which supports the claim that a scalable trigger can provide coarse output control for sufficiently large |α|. However, the universal 'any desired value' claim is not supported by the reported metrics, and the clean-label theoretical framework in Section 'Backdoor Attacks with Clean Label' contains internal inconsistencies that undermine the claimed theoretical contribution.","major_comments":[{"comment":"The central claim that the attacker can manipulate the output to 'any desired value' (Abstract, Eq. (1)) is not supported by the paper's own evidence. Eq. (1) requires f_θ*(T(x, α·t)) ≈ y + α·Δyt for all α ∈ [-1, 1], with Δyt = 40. Yet Table 1 reports mMAE values of 5.2–9.5 for P-BAIQA and mMRA values of 0.56–0.93, meaning the actual output shift is on average only about two-thirds to nine-tenths of the intended shift, with absolute errors of several MOS points. Fig. 2(a) explicitly states that for |α| ≤ 0.5 'the manipulation becomes less precise.' The aggregate mMAE computed over A = {±0.1, ..., ±1.0} can also mask severe per-α failures. The claim should be restricted to coarse control for |α| > 0.5, or the method should be extended with a mechanism that also works for small α.","section":"Experiments, Table 1 and Fig. 2"},{"comment":"The theoretical justification of C-BAIQA is internally inconsistent. Under Assumption 1 (Eq. (2)), P(ỹ|x,α) = N(y + αΔyt, σ²), P(ỹ|x) = N(y, σ²), P(ỹ) = N(μy, σ²), and P(ỹ|α) = N(μy + αΔyt, σ²). The identity P(ỹ|x,α)P(ỹ) = P(ỹ|x)P(ỹ|α), which is asserted after Remark 1 and used in Theorem 1, does not follow from these assumptions; its left- and right-hand sides differ by a factor exp(αΔyt(y − μy)/σ²), so the identity holds only if α = 0 or y = μy. Consequently, the derivation of Eqs. (6)–(8) and the subsequent conclusions in Remarks 1 and 2 are built on an invalid premise.","section":"Backdoor Attacks with Clean Label, Assumption 1 and Eq. (5)"},{"comment":"Even if Eq. (8) were valid, the inference in Remark 2 that constructing a targeted PGD example x' with target μy makes x' independent of ỹ is not justified. The argument claims that because α is sampled based on y, independence from ỹ suffices for independence from α; however, ỹ is the model output, not necessarily equal to y, and the PGD procedure does not guarantee the required conditional independence properties. Algorithm 2 therefore relies on an unproved heuristic rather than the theoretical insights claimed in the contribution list. The clean-label method can remain as a heuristic, but the paper should not present the derivation as a theorem-based guarantee.","section":"Remark 2 and Algorithm 2"}],"minor_comments":[{"comment":"The formula for PLCC in the appendix is missing the square root in the denominator; the standard definition divides by sqrt(Σ(y_i − ȳ)² Σ(f_i − f̄)²), not by the product of the two sums of squares.","section":"Appendix, Eq. (11)"},{"comment":"There are several typos and grammar issues: 'itlacks' should be 'it lacks', 'a image' should be 'an image', 'Abaltion Study' should be 'Ablation Study', and 'resist to fine-tuning' should be 'resistant to fine-tuning'.","section":"Throughout"},{"comment":"The captions refer to MSE(α), while the main text and metric definitions consistently use MAE(α); please unify the terminology.","section":"Appendix, Figs. 7 and 8"}],"recommendation":"major_revision","confidential_remarks":"The empirical P-BAIQA attack is a useful contribution and appears sound for coarse, large-magnitude score shifts, but the paper's headline claim of arbitrary target control is overstated and the clean-label theory section is not salvageable as written. I would not reject the paper solely on the overclaim, because the authors can reframe C-BAIQA as a heuristic, weaken the universal quantifier, and correct the PLCC formula. The main risk is that the current version overstates both the theoretical novelty and the practical precision of the attack."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nTwo things you should know about this paper. First, it actually works where it counts: P-BAIQA, the poison-label variant, reliably injects a backdoor into three NR-IQA models on two datasets, with clear advantages over Blended, WaNet, and FTrojan, and the code is public. Second, the headline claim—that the attacker can push the output to 'any desired target value' by scaling α—is not backed by the paper's own numbers.\n\nWhat's genuinely new is the combination of a DCT-domain universal adversarial perturbation as the trigger and a scaling coefficient α that maps a single trigger to a continuum of output targets. That is a natural idea but nobody had done it for NR-IQA, and the empirical support for P-BAIQA is solid. The DCT injection is a sensible answer to the patch-cropping problem in IQA training, and the invisibility numbers are good.\n\nThe soft spots are real but they are concentrated in two places. First, the universal quantifier in Eq. (1) is false as stated. Figure 2 and Section 4 admit that for |α|<0.5 the manipulation 'becomes less precise,' and the mMAE of 5–9 MOS points on a Δyt of 40 means the shift is typically 60–90% of the intended value, not exact. That is a meaningful gap, not a nit, and the abstract should be qualified. Second, the clean-label theory is circular. Assumption 1 essentially assumes the output distribution is Gaussian centered at the desired target, and Remark 1 then 'derives' the α sampling from it. The Bayes manipulation in Theorem 1 has a step that doesn't follow, and Remark 2's claim that a PGD adversarial example makes x' independent of y is asserted without proof. C-BAIQA also degrades on KonIQ-10k. These flaws matter because they undermine the theoretical framing, but they don't touch the core P-BAIQA result.\n\nBottom line: this is a useful empirical paper for the NR-IQA security community. It deserves a serious referee, but the authors should be asked to fix the overclaim and either repair or de-emphasize the theory. I'd send it to review with major-revision expectations.","headline":"Solid empirical backdoor attack on NR-IQA with a scalable α trigger, but the 'any desired value' claim is overstated and the clean-label theory is circular.","tokens_in":20812,"tokens_out":2780,"would_cite":true,"duration_ms":26739,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A single scaling coefficient on a DCT-domain trigger lets an attacker steer a poisoned no-reference image quality assessment (NR-IQA) model's predicted quality score to any target value.","keywords":["backdoor attacks","no-reference image quality assessment","scalable trigger","discrete cosine transform","universal adversarial perturbations","clean-label poisoning","poison-label poisoning","continuous output control"],"falsifier":"Train a backdoored model using the P-BAIQA or C-BAIQA recipe, then collect the predicted scores on a fixed triggered test image over many α values in [-1,1] and run a normality test (e.g., Shapiro–Wilk) on the residuals from the line y+α·Δyt. If the residuals deviate from a normal distribution with variance not constant in α, Assumption 1 is empirically violated and the theoretical justification for the clean-label variant collapses.","tokens_in":19697,"feed_emoji":"🎯","tokens_out":4815,"duration_ms":123185,"temperature":0.7,"pith_summary":"The paper introduces a poisoning-based backdoor attack against no-reference image quality assessment (NR-IQA) models that lets an attacker steer the predicted quality score to any desired value by adjusting a single scaling coefficient α on the trigger. The trigger is injected into the discrete cosine transform (DCT) domain as a universal adversarial perturbation, so it survives the random cropping and augmentation that NR-IQA models typically use. The authors present a poison-label variant (P-BAIQA) and a clean-label variant (C-BAIQA), the latter with theoretical justification for α-sampling and image refinement. If the attack works as claimed, it would be the first backdoor on NR-IQA with continuous score control, turning a model into a remotely adjustable score dial while leaving clean predictions intact.","feed_headline":"A DCT trigger dials image-quality scores to any value","feed_subtitle":"Poisoning an NR-IQA model with a scaled DCT trigger gives continuous, test-time control over predicted quality scores.","key_machinery":"The load-bearing object is the scalable trigger T(x, α·t)=IDCT(DCT(x)+α·t), a patch-based DCT-domain injection that overlays the same universal adversarial perturbation t, scaled by α, on the mid-frequency coefficients of every 16×16 block. The scaling coefficient α is the control dial: the paper's objective (Eq. 1) requires the backdoored model to output y+α·Δyt on triggered inputs for all α in [-1,1], so a single trigger trained over an α-range yields continuous output control at inference. For the clean-label variant, Assumption 1 (Gaussian output distributions) and the derived Remark 1 (α sampling) and Remark 2 (targeted PGD to make x' independent of y) supply the recipe for building the poisoned set.","core_discovery":"The central claim is that, after poisoning a training set with triggered images of the form T(x, α·t) = IDCT(DCT(x)+α·t) labeled either y+α·Δyt (poison-label) or y (clean-label), the trained model fθ* satisfies fθ*(T(x, α·t)) ≈ y + α·Δyt for every α ∈ [-1,1], so the attacker chooses α at inference time to hit any target score in a continuous range. The paper argues this is achieved by optimizing the trigger as a universal adversarial perturbation in DCT space (UAP-DCT), which makes the model more susceptible to the manipulation, and by giving the model many examples across the α range during training. For the clean-label variant, the paper derives an α-sampling rule α=(y−µ_y)/Δy_t and an image refinement rule using targeted PGD adversarial examples to make the poisoned image independent of the label, both justified by an assumed Gaussian-output structure.","pith_inferences":["A natural extension the authors do not explore is whether the same scalable-trigger recipe transfers to other continuous-output regression tasks—depth estimation, aesthetics scoring, or keypoint heatmaps—where a surrogate model can be trained on a poisoned subset.","Because the trigger is universal and the output control is linear in α, an attacker could embed multiple independent triggers with different Δy_t values to build a vector-valued control, or chain the attack across models that consume the same images.","The Gaussian-output assumption could be tested directly by measuring the empirical output distribution on triggered inputs; if violated, the clean-label recipe may still work heuristically but the theoretical grounding would need a different justification.","A practical defense might focus on blocking the DCT-mid-frequency pattern or on detecting the unusual linear dependence of the model's output on a single perturbation direction."],"forward_implications":["If the approach works as claimed, any downstream system that trusts an NR-IQA model's score—such as image restoration pipelines, video compression, or low-light enhancement—can be manipulated to report arbitrarily high or low quality without visibly altering the input.","The DCT-domain trigger defeats the random cropping and augmentation that previously weakened global spatial triggers on NR-IQA models, making the attack practical in the standard training setup.","The clean-label variant shows that even a model trained only with correctly labeled data can be backdoored for continuous score control, defeating label-inspection defenses.","The scaling coefficient gives the attacker a continuous, test-time control axis, unlike classification backdoors that are locked to one target class.","Resistance to fine-tuning and pruning suggests the backdoor is non-trivially embedded, so standard robustness defenses may not remove it."],"supporting_citations":[{"why":"Blended backdoor baseline; the targeted data-poisoning formulation this attack extends to continuous outputs.","marker":"Chen et al. 2017"},{"why":"BadNets, the canonical poisoning-based backdoor that defines trigger-effectiveness and stealthiness criteria.","marker":"Gu, Dolan-Gavitt, and Garg 2017"},{"why":"WaNet baseline; warping-based invisible trigger that fails on NR-IQA, highlighting the need for DCT injection.","marker":"Nguyen and Tran 2021"},{"why":"FTrojan baseline; frequency-domain trigger that BAIQA extends with UAP-trained universal triggers.","marker":"Wang et al. 2022"},{"why":"PGD attacks used to generate targeted adversarial examples for the clean-label image refinement step.","marker":"Madry et al. 2018"},{"why":"HyperIQA surrogate/victim model; used to train the surrogate and evaluate the attack.","marker":"Su et al. 2020"},{"why":"LIVEC dataset, one of the two evaluation benchmarks.","marker":"Ghadiyaram and Bovik 2015"},{"why":"KonIQ-10k dataset, the larger evaluation benchmark.","marker":"Hosu et al. 2020"}],"fun_headline_variants":["DCT backdoor lets attackers dial any image-quality score","Scalable trigger poisons IQA models for continuous score control","Backdoor attack tunes image-quality predictions with one dial","Poisoned DCT trigger gives continuous control over NR-IQA scores"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The clean-label variant's theoretical recipe—how to sample α and how to modify images—rests entirely on the assumption that a backdoored model's outputs are Gaussian-distributed around the intended target with constant variance; if that distributional assumption fails, the recipe has no proven grounding.","fun_headline_variants_meta":{"raw":{"variants":["DCT backdoor lets attackers dial any image-quality score","Scalable trigger poisons IQA models for continuous score control","Backdoor attack tunes image-quality predictions with one dial","Poisoned DCT trigger gives continuous control over NR-IQA scores"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000195,"raw_usage":{"total_tokens":1413,"prompt_tokens":1059,"completion_tokens":354,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":675,"completion_tokens_details":{"reasoning_tokens":284}},"tokens_in":675,"tokens_out":354,"duration_ms":4870,"temperature":1.0,"reasoning_tokens":284,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T18:56:16.295819+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a backdoored model using the P-BAIQA or C-BAIQA recipe, then collect the predicted scores on a fixed triggered test image over many α values in [-1,1] and run a normality test (e.g., Shapiro–Wilk) on the residuals from the line y+α·Δyt. If the residuals deviate from a normal distribution with variance not constant in α, Assumption 1 is empirically violated and the theoretical justification for the clean-label variant collapses.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"LIVEC dataset, one of the two evaluation benchmarks."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"KonIQ-10k dataset, the larger evaluation benchmark."},{"cited_title":"A.; and Tran, A","cited_arxiv_id":null,"evidence_quote":"WaNet baseline; warping-based invisible trigger that fails on NR-IQA, highlighting the need for DCT injection."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FTrojan baseline; frequency-domain trigger that BAIQA extends with UAP-trained universal triggers."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"PGD attacks used to generate targeted adversarial examples for the clean-label image refinement step."}],"review_version":1}