Pith. sign in

REVIEW 2 major objections 6 minor 50 references

Stochastic BIQA: Median Randomized Smoothing for Certified Blind Image Quality Assessment

T0 review · 2 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Median smoothing gives blind IQA its first certified defense

desk verdict Genuinely new application of median smoothing to NR-IQA with a sound core theorem, but the 'certified' bounds are empirical quantiles from 2,000 samples with no confidence interval, so the provable claim overreaches as stated. read the letter →

arxiv 2411.12575 v1 pith:ELNIMIZI submitted 2024-11-19 eess.IV cs.CV

Ekaterina Shumitskaya , Mikhail Pautov , Dmitriy Vatolin , Anastasia Antsiferova This is my paper · ORCID
classification eess.IVcs.CV
keywords blindimagequalityassessmentcertifiedrobustnessmedianrandomizedsmoothingdenoisedno-referenceIQAadversarialdefensel2perturbationrankingloss
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to make no-reference image-quality metrics provably robust to small adversarial perturbations without giving up their agreement with human opinions. It proposes DMS-IQA, which replaces a metric's score on an image by the median of the metric's scores on many noisy copies of that image, after a small trained denoiser cleans the copies. The paper claims that for any perturbation $\Delta x$ with $\ell_2$ norm at most $\epsilon$, the defended score stays inside a certified interval, and that the defended metric's correlation with subjective scores beats prior median-smoothing defenses. If the claim holds, this is the first certified defense for blind IQA that preserves ranking performance.

What carries the argument

The load-bearing identity is the median-smoothing bound: with $p = \Phi(-\epsilon/\sigma)$ and $\bar p = \Phi(\epsilon/\sigma)$, the smoothed score of any perturbed image lies between the $p$ and $\bar p$ percentiles of the smoothed-score distribution on the clean image. The second piece is the denoiser, a lightweight seven-layer U-Net trained with three losses: MSE for pixel reconstruction, a ranking loss that penalizes pairs where the smoothed metric and the subjective scores disagree in order, and a target loss that keeps smoothed scores close to source-metric scores. The denoiser keeps the smoothed metric accurate; the median makes the bounds hold.

What would settle it

Recompute the certified interval on the same test images with 100,000 noise samples instead of 2,000; if the 2,000-sample interval fails to contain the larger-sample estimate, or the bounds shift by more than the reported certified delta, the guarantee is a small-sample artifact rather than a mathematical bound.

Watch

Extended reading notes

Core claim

The central claim is that median randomized smoothing, paired with a denoiser trained to preserve both pixel fidelity and the ranking behavior of the source metric, produces a certified no-reference IQA metric. For image $x$ and Gaussian noise $r$, the method outputs $G(M(D(x))) = \mathrm{med}[M(D(x+r))]$, and the median-smoothing theorem bounds $G(M(D(x+u)))$ between two percentile limits $H_p$ and $H_{\bar p}$ whenever $\lVert u\rVert_2 \le \epsilon$. Experiments across five NR metrics and three datasets report better SROCC and PLCC than plain MS and DMS, comparable certified deltas, and a smaller adversarial gain on attacked images.

Load-bearing premise

The certified bounds $S_l$ and $S_u$ are treated as exact guarantees, but they are empirical quantiles estimated from only 2,000 noise samples, with no stated confidence level.

Editorial extensions

If this is right

  • Any existing no-reference IQA metric can be protected by DMS-IQA without retraining the metric itself.
  • For perturbations within the certified radius $\epsilon$, an adversary cannot push the metric's score outside the announced interval $[S_l, S_u]$.
  • The defended metric can serve as a loss function for image-processing optimizers; the paper reports lower RMSE with DMS-IQA than with the undefended DBCNN metric in a denoising task.
  • Training the denoiser on multiple datasets improves transfer to an unseen dataset such as KADID.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 2,000-sample quantile estimates could be replaced by finite-sample confidence intervals, which would turn the empirical guarantee into a rigorous probabilistic one.
  • The method's practical robustness will depend on the base metric being locally smooth under Gaussian noise; metrics with sharp score discontinuities may need larger denoisers or more samples.
  • The same wrapper could be applied to video-quality metrics or full-reference similarity metrics by changing the target loss to compare similarity scores.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper proposes DMS-IQA, a defense for no-reference image quality assessment (NR-IQA) metrics based on median randomized smoothing with an auxiliary denoiser. The method is model-agnostic and does not require retraining the base metric. The authors report experiments on five NR-IQA metrics across three datasets, comparing with plain median smoothing (MS) and denoised median smoothing (DMS). They claim that DMS-IQA achieves better correlation with subjective scores (in terms of τSROCC and τPLCC) while maintaining comparable certified l2 robustness bounds (called certified deltas) for perturbation radii 0.06 and 0.36. They also show a use case where the smoothed metric is used as a loss for image denoising.

Significance. If the certified robustness claims were properly substantiated, this would be a valuable contribution: it is the first certified defense for no-reference IQA metrics, it is architecture-agnostic, and it does not require retraining the base metric. The theoretical core (Theorem 1, imported from Chiang et al.) is sound and transfers correctly to the composed metric M(D(.)). The denoiser training scheme with a ranking loss is a reasonable way to mitigate the accuracy loss of median smoothing, and the empirical results suggest that the proposed method preserves correlation better than the baselines. However, the paper's central 'guarantee' statement is not yet supported, because the reported bounds are empirical quantiles from only 2,000 noise samples with no finite-sample confidence level. This gap is fixable by adding standard concentration bounds or order-statistic confidence intervals, but as written it undermines the 'provable' claim.

major comments (2)
  1. [Section 4, 'Use cases' and Tables 3/4] The certified bounds Sl, Su, and CD reported in Tables 3 and 4 are empirical quantiles of M(D(x+r)) estimated from N=2,000 Gaussian samples, as stated in Section 4. Theorem 1 provides a population-level guarantee for the true quantiles of the smoothed function; it does not certify the finite-sample estimates. No confidence level, Clopper-Pearson interval, or any concentration bound is given. For the strong use case (ε/σ=2), the upper quantile corresponds to p=Φ(2)≈0.977, and with 2,000 samples the empirical order statistic can deviate substantially from the true quantile. Consequently, the sentence in Section 1 that the method 'guarantees ... the IQA score is bounded' is not established by the reported experiments. Please provide finite-sample confidence guarantees (e.g., binomial or order-statistic intervals) and report the bounds as confidence intervals, or soften the 'guarantee' language accordingly.
  2. [Section 3.3, Lemma 1] Lemma 1 as stated is not correct. If |a_i - b_i| ≤ Δ(X) for all i, then a pair (x_i, x_j) can change order only if |b_i - b_j| ≤ 2Δ(X), not ≤ Δ(X). The lemma's definition of t as 'arg min_{δ̂∈B} : δ̂ > Δ(X)' also has issues: it defines t as a value, not an index or a count, so the phrase 'at most t out of m(m−1)/2 possible ranking errors' is not well-formed. The correct statement would involve pairs with δ̂ ≤ 2Δ(X) and t as the number of such pairs. Since this lemma is presented as a theoretical basis for the rank-correlation behavior, it should be fixed or removed.
minor comments (6)
  1. [Section 3.1, Definition 3.1] The definition of τ-closeness uses Pearson correlation, while Remark 1 extends it to Spearman correlation. The tables report 'τSROCC' and 'τPLCC' with arrows indicating lower is better; please clarify how these numbers relate to the threshold τ in Definition 3.1 and state whether a specific τ value is considered acceptable.
  2. [Section 4.2, Eqs. (17)–(18)] Eq. (17) defines the attack as maximizing M(x+Δx)−M(x), but Eq. (18) defines a loss that includes M(x)−M(x+Δx) and the text says the loss is minimized. Please reconcile the sign convention and specify whether the optimizer maximizes or minimizes the objective.
  3. [Figure 2] The caption says 'Green dots represent the certified guarantees' but does not explain what the orange dots, blue dots, or error bars represent, nor how the averaging across images is performed. Please expand the caption for interpretability.
  4. [References] References [13] and [14] are the same paper (LipSim) listed twice; please consolidate them into a single entry and correct the citation numbering.
  5. [Section 3.2] The text states that 'In the Supplementary materials, we provide the results of experiments on finding the optimal values of Cr and Ct from Eq. (11) and the batch size N.' No supplementary material is included with this submission; please either provide it or remove the sentence.
  6. [Table 3] Table 3 reports results averaged over five NR-IQA metrics, but individual-metric results are not shown anywhere. Including per-metric tables in the supplementary material would strengthen the evaluation and allow readers to assess variance across architectures.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the certified-robustness guarantee is imported from external prior work and the correlation gains are evaluated on held-out test data; the finite-sample quantile issue is a statistical-support gap, not a circular reduction.

full rationale

The load-bearing guarantee is Theorem 1, quoted from Chiang et al. [6]; that theorem is external to this paper and is not derived from the authors' own fitted values, so importing it is not circular. The denoiser is trained with MSE, ranking, and target losses that use subjective labels, and the reported tauSROCC/tauPLCC are correlations with those same subjective labels; however, evaluation is on held-out test splits and the paper does not claim to predict labels directly from the fitted denoiser, so this is standard supervised validation rather than a definitional reduction. The self-citations ([1], [18], [35], etc.) are motivational or related-work context and are independently supported by the paper's own experiments, so they are not load-bearing. The finite-sample quantile estimation issue (N=2000 with no confidence interval for S_l and S_u) is a real correctness risk for the 'certified' wording, but it is a statistical-support gap, not circularity: the reported bounds are estimates of the theorem's quantities rather than quantities defined in terms of the conclusion.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central certified guarantee is imported from external prior work, Chiang et al. 2020. The paper's own contributions are a training objective and a new application, so the free parameters are mostly hyperparameters of the denoiser and smoothing procedure. No new mathematical entities are introduced.

free parameters (5)
  • noise scale sigma = 0.12 and 0.18
    Chosen by hand to balance defended metric SROCC and tight certified deltas; Section 4 states higher sigma leads to poor correlations.
  • perturbation radius epsilon = 0.06 and 0.36
    Attack budgets for the weak and strong use cases; selected to test performance under small and large perturbations.
  • loss weights Cr and Ct = not reported in main text
    Weights of the ranking loss and target loss in Eq. (11); results are deferred to supplementary material, so exact values are unavailable.
  • denoiser training batch size N = not reported in main text
    Batch size used in Eqs. (7) to (11); deferred to supplementary material.
  • number of smoothing samples = 2,000
    Selected as a trade-off between computational efficiency and estimation accuracy; directly affects the precision of the certified bounds.
assumptions (4)
  • standard math Median smoothing deviation bound (Theorem 1) from Chiang et al. [6] holds for the composed function M(D(.)).
    The paper cites the theorem without proof in Section 3.2.1 and relies on it for the certified guarantee.
  • domain assumption M(D(x)) can be treated as an arbitrary real-valued function of x, so the median smoothing theorem applies without Lipschitz assumptions.
    The paper imposes no smoothness or architecture constraints on M or D; median smoothing guarantees apply to arbitrary measurable functions, which is implicitly assumed.
  • domain assumption Pearson and Spearman correlations between metric outputs and subjective scores are valid measures of IQA performance.
    The τ-closeness definition and all evaluations treat human subjective scores as ground truth.
  • domain assumption The 80/10/10 dataset splits are independent enough for the trained denoiser to transfer to the test split.
    Section 4 trains denoisers on 80 percent of each dataset and tests on a disjoint 10 percent; no distribution shift is analyzed except in the transfer experiment in Table 6.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Stochastic BIQA: Median Randomized Smoothing for Certified Blind Image Quality Assessment." pith.science (2026). https://pith.science/paper/ELNIMIZI

@misc{pith2026241112575,
  author       = {Pith},
  title        = {Pith review of: Stochastic BIQA: Median Randomized Smoothing for Certified Blind Image Quality Assessment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ELNIMIZI}},
  note         = {Machine review of arXiv:2411.12575}
}
read the original abstract

Most modern No-Reference Image-Quality Assessment (NR-IQA) metrics are based on neural networks vulnerable to adversarial attacks. Attacks on such metrics lead to incorrect image/video quality predictions, which poses significant risks, especially in public benchmarks. Developers of image processing algorithms may unfairly increase the score of a target IQA metric without improving the actual quality of the adversarial image. Although some empirical defenses for IQA metrics were proposed, they do not provide theoretical guarantees and may be vulnerable to adaptive attacks. This work focuses on developing a provably robust no-reference IQA metric. Our method is based on Median Smoothing (MS) combined with an additional convolution denoiser with ranking loss to improve the SROCC and PLCC scores of the defended IQA metric. Compared with two prior methods on three datasets, our method exhibited superior SROCC and PLCC scores while maintaining comparable certified guarantees.

Figures

Figures reproduced from arXiv: 2411.12575 by the authors.

Figure 1
Figure 1. a) The overview of the proposed DMS-IQA method. b) Training scheme of the auxiliary denoiser. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Comparison of the proposed DMS-IQA method with [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 42 canonical work pages

  1. [1]

    Comparing the robustness of modern no-reference image-and video-quality metrics to adversarial attacks

    Anastasia Antsiferova, Khaled Abud, Aleksandr Gushchin, Ekaterina Shumitskaya, Sergey Lavrushkin, and Dmitriy Va- tolin. Comparing the robustness of modern no-reference image-and video-quality metrics to adversarial attacks. In Proceedings of the AAAI Conference on Artificial Intelli- gence, pages 700–708, 2024. 1, 3

    work page 2024

  2. [2]

    Fooling an automatic image quality estimator

    Benoit Bonnet, Teddy Furon, and Patrick Bas. Fooling an automatic image quality estimator. In MediaEval 2020- MediaEval Benchmarking Intiative for Multimedia Evalua- tion, pages 1–4, 2020. 2

    work page 2020

  3. [3]

    (cer- tified!!) adversarial robustness for free! In The Eleventh In- ternational Conference on Learning Representations , 2022

    Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvi- jotham, Leslie Rice, Mingjie Sun, and J Zico Kolter. (cer- tified!!) adversarial robustness for free! In The Eleventh In- ternational Conference on Learning Representations , 2022. 3

    work page 2022

  4. [4]

    Topiq: A top-down approach from semantics to distortions for image quality assessment

    Chaofeng Chen, Jiadi Mo, Jingwen Hou, Haoning Wu, Liang Liao, Wenxiu Sun, Qiong Yan, and Weisi Lin. Topiq: A top-down approach from semantics to distortions for image quality assessment. IEEE Transactions on Image Processing, 33:2404–2418, 2024. 5, 6, 8

    work page 2024

  5. [5]

    Densepure: Understanding diffusion models towards adver- sarial robustness

    Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anandkumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models towards adver- sarial robustness. In Workshop on Trustworthy and Socially Responsible Machine Learning, NeurIPS 2022, 2022. 3

    work page 2022

  6. [6]

    De- tection as regression: Certified object detection with median smoothing

    Ping-yeh Chiang, Michael Curry, Ahmed Abdelkader, Aounon Kumar, John Dickerson, and Tom Goldstein. De- tection as regression: Certified object detection with median smoothing. Advances in Neural Information Processing Sys- tems, 33:1275–1286, 2020. 3, 4, 5, 6, 8

    work page 2020

  7. [7]

    Increasing the robustness of image quality assessment models through adversarial training

    Anna Chistyakova, Anastasia Antsiferova, Maksim Khrebtov, Sergey Lavrushkin, Konstantin Arkhipenko, Dmitriy Vatolin, and Denis Turdakov. Increasing the robustness of image quality assessment models through adversarial training. Technologies, 12(11):220, 2024. 3

    work page 2024

  8. [8]

    Increasing the robustness of image quality assessment models through adversarial training

    Anna Chistyakova, Anastasia Antsiferova, Maksim Khrebtov, Sergey Lavrushkin, Konstantin Arkhipenko, Dmitriy Vatolin, and Denis Turdakov. Increasing the robustness of image quality assessment models through adversarial training. Technologies, 12(11), 2024. 1

    work page 2024

Show all 50 references
  1. [9]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In inter- national conference on machine learning, pages 1310–1320. PMLR, 2019. 3

    2019

  2. [10]

    Sparse adversarial video attack based on dual-branch neural network on industrial artificial intelligence of things

    Wenfeng Deng, Chunhua Yang, Keke Huang, Yishun Liu, Weihua Gui, and Jun Luo. Sparse adversarial video attack based on dual-branch neural network on industrial artificial intelligence of things. IEEE Transactions on Industrial In- formatics, 2024. 2

    2024

  3. [11]

    Perceptual quality assessment of smartphone photog- raphy

    Yuming Fang, Hanwei Zhu, Yan Zeng, Kede Ma, and Zhou Wang. Perceptual quality assessment of smartphone photog- raphy. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition , pages 3677–3686,

  4. [12]

    Massive online crowdsourced study of subjective and objective picture qual- ity

    Deepti Ghadiyaram and Alan C Bovik. Massive online crowdsourced study of subjective and objective picture qual- ity. IEEE Transactions on Image Processing, 25(1):372–387,

  5. [13]

    Lipsim: A provably robust perceptual similarity metric

    Sara Ghazanfari, Alexandre Araujo, Prashanth Krishna- murthy, Farshad Khorrami, and Siddharth Garg. Lipsim: A provably robust perceptual similarity metric. In The Twelfth International Conference on Learning Representations. 3

  6. [14]

    Lipsim: A provably robust perceptual similarity metric

    Sara Ghazanfari, Alexandre Araujo, Prashanth Krishna- murthy, Farshad Khorrami, and Siddharth Garg. Lipsim: A provably robust perceptual similarity metric. arXiv preprint arXiv:2310.18274, 2023. 1

    2023 arXiv

  7. [15]

    R-lpips: An adversarially robust perceptual similarity metric

    Sara Ghazanfari, Siddharth Garg, Prashanth Krishnamurthy, Farshad Khorrami, and Alexandre Araujo. R-lpips: An adversarially robust perceptual similarity metric. arXiv preprint arXiv:2307.15157, 2023. 1, 3

    2023 arXiv

  8. [16]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 6

    2014 arXiv

  9. [17]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harnessing Adversarial Examples. In3rd In- ternational Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. 1

    2015

  10. [18]

    Guardians of image quality: Benchmark- ing defenses against adversarial attacks on image quality metrics

    Alexander Gushchin, Khaled Abud, Georgii Bychkov, Eka- terina Shumitskaya, Anna Chistyakova, Sergey Lavrushkin, Bader Rasheed, Kirill Malyshev, Dmitriy Vatolin, and Anas- tasia Antsiferova. Guardians of image quality: Benchmark- ing defenses against adversarial attacks on imag...

    2024

  11. [19]

    Ad- versarial purification for no-reference image-quality met- rics: applicability study and new methods

    Aleksandr Gushchin, Anna Chistyakova, Vladislav Mi- nashkin, Anastasia Antsiferova, and Dmitriy Vatolin. Ad- versarial purification for no-reference image-quality met- rics: applicability study and new methods. arXiv preprint arXiv:2404.06957, 2024. 1, 3

    2024 arXiv

  12. [20]

    Koniq-10k: An ecologically valid database for deep learning of blind image quality assessment

    Vlad Hosu, Hanhe Lin, Tamas Sziranyi, and Dietmar Saupe. Koniq-10k: An ecologically valid database for deep learning of blind image quality assessment. IEEE Transactions on Image Processing, 29:4041–4056, 2020. 5, 6, 8

    2020

  13. [21]

    Can no-reference quality-assessment meth- ods serve as perceptual losses for super-resolution? arXiv preprint arXiv:2405.20392, 2024

    Egor Kashkarov, Egor Chistov, Ivan Molodetskikh, and Dmitriy Vatolin. Can no-reference quality-assessment meth- ods serve as perceptual losses for super-resolution? arXiv preprint arXiv:2405.20392, 2024. 1, 2, 7

    2024 arXiv

  14. [22]

    E- lpips: robust perceptual image similarity via random trans- formation ensembles

    Markus Kettunen, Erik H ¨ark¨onen, and Jaakko Lehtinen. E- lpips: robust perceptual image similarity via random trans- formation ensembles. arXiv preprint arXiv:1906.03973 ,

    1906 arXiv

  15. [23]

    Image robustness to adversarial attacks on no- reference image-quality metrics

    Daniil Konstantinov, Sergey Lavrushkin, and Dmitriy Va- tolin. Image robustness to adversarial attacks on no- reference image-quality metrics. In 2024 32nd European Signal Processing Conference (EUSIPCO), pages 611–615. IEEE, 2024. 2

    2024

  16. [24]

    Adversarial attacks against blind image quality assessment models

    Jari Korhonen and Junyong You. Adversarial attacks against blind image quality assessment models. In Proceedings of the 2nd Workshop on Quality of Experience in Visual Multi- media Applications, pages 3–11, 2022. 1, 2, 3

    2022

  17. [25]

    Ti-patch: Tiled physi- cal adversarial patch for no-reference video quality metrics

    Victoria Leonenkova, Ekaterina Shumitskaya, Anastasia Antsiferova, and Dmitriy Vatolin. Ti-patch: Tiled physi- cal adversarial patch for no-reference video quality metrics. arXiv preprint arXiv:2404.09961, 2024. 2 9

    2024 arXiv

  18. [26]

    Kadid-10k: A large-scale artificially distorted iqa database

    Hanhe Lin, Vlad Hosu, and Dietmar Saupe. Kadid-10k: A large-scale artificially distorted iqa database. In 2019 Eleventh International Conference on Quality of Multimedia Experience (QoMEX), pages 1–3. IEEE, 2019. 8

    2019

  19. [27]

    Defense against adversarial attacks on no- reference image quality models with gradient norm regu- larization

    Yujia Liu, Chenxi Yang, Dingquan Li, Jianhao Ding, and Tingting Jiang. Defense against adversarial attacks on no- reference image quality models with gradient norm regu- larization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 255...

    2024

  20. [28]

    Evaluating the vulnera- bility of deep learning-based image quality assessment meth- ods to adversarial attacks

    Hanene FZ Brachemi Meftah, Sid Ahmed Fezza, Wassim Hamidouche, and Olivier D´eforges. Evaluating the vulnera- bility of deep learning-based image quality assessment meth- ods to adversarial attacks. In 2023 11th European Work- shop on Visual Information Processing (EUVIP), pag...

    2023

  21. [29]

    Reasons for the superiority of stochastic estima- tors over deterministic ones: Robustness, consistency and perceptual quality

    Guy Ohayon, Theo Joseph Adrai, Michael Elad, and Tomer Michaeli. Reasons for the superiority of stochastic estima- tors over deterministic ones: Robustness, consistency and perceptual quality. In International Conference on Machine Learning, pages 26474–26494. PMLR, 2023. 4

    2023

  22. [30]

    Black-box adversarial attacks against im- age quality assessment models

    Yu Ran, Ao-Xiang Zhang, Mingjie Li, Weixuan Tang, and Yuan-Gen Wang. Black-box adversarial attacks against im- age quality assessment models. Expert Systems with Appli- cations, 260:125415, 2025. 2

    2025

  23. [31]

    U- net: Convolutional networks for biomedical image segmen- tation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U- net: Convolutional networks for biomedical image segmen- tation. In Medical image computing and computer-assisted intervention–MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, pa...

    2015

  24. [32]

    Denoised smoothing: A provable defense for pretrained classifiers

    Hadi Salman, Mingjie Sun, Greg Yang, Ashish Kapoor, and J Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers. Advances in Neural Information Pro- cessing Systems, 33:21945–21957, 2020. 3

    2020

  25. [33]

    Universal perturbation attack on differ- entiable no-reference image- and video-quality metrics

    Ekaterina Shumitskaya, Anastasia Antsiferova, and Dmitriy S Vatolin. Universal perturbation attack on differ- entiable no-reference image- and video-quality metrics. In 33rd British Machine Vision Conference 2022, BMVC 2022, London, UK, November 21-24, 2022. BMV A Press, 2022. 2

    2022

  26. [34]

    Ekaterina Shumitskaya, Anastasia Antsiferova, and Dmitriy S. Vatolin. Fast adversarial cnn-based perturbation attack on no-reference image- and video-quality metrics. In The First Tiny Papers Track at ICLR 2023, Tiny Papers @ ICLR 2023, Kigali, Rwanda, May 5, 2023. OpenReview.net,

    2023

  27. [35]

    Towards adversarial robustness verification of no- reference image- and video-quality metrics

    Ekaterina Shumitskaya, Anastasia Antsiferova, and Dmitriy Vatolin. Towards adversarial robustness verification of no- reference image- and video-quality metrics. Computer Vi- sion and Image Understanding, 240:103913, 2024. 1, 3

    2024

  28. [36]

    Ekaterina Shumitskaya, Anastasia Antsiferova, and Dmitriy S. Vatolin. IOI: Invisible one-iteration adversarial attack on no-reference image- and video-quality metrics. In Proceedings of the 41st International Conference on Machine Learning, pages 45329–45352. PMLR, 2024. 3

    2024

  29. [37]

    Applicability limitations of differentiable full-reference image-quality

    Maksim Siniukov, Dmitriy Kulikov, and Dmitriy Vatolin. Applicability limitations of differentiable full-reference image-quality. arXiv preprint arXiv:2212.05499, 2022. 1

    2022 arXiv

  30. [38]

    Unveiling the limitations of novel image quality metrics

    Maksim Siniukov, Dmitriy Kulikov, and Dmitriy Vatolin. Unveiling the limitations of novel image quality metrics. In 2023 IEEE 25th International Workshop on Multimedia Sig- nal Processing (MMSP), pages 1–6. IEEE, 2023. 2

    2023

  31. [39]

    Blindly assess image qual- ity in the wild guided by a self-adaptive hyper network

    Shaolin Su, Qingsen Yan, Yu Zhu, Cheng Zhang, Xin Ge, Jinqiu Sun, and Yanning Zhang. Blindly assess image qual- ity in the wild guided by a self-adaptive hyper network. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pages 3667–3676, 202...

    2020

  32. [40]

    Mem- net: A persistent memory network for image restoration

    Ying Tai, Jian Yang, Xiaoming Liu, and Chunyan Xu. Mem- net: A persistent memory network for image restoration. In Proceedings of the IEEE international conference on com- puter vision, pages 4539–4547, 2017. 3

    2017

  33. [41]

    Ex- ploring clip for assessing the look and feel of images

    Jianyi Wang, Kelvin CK Chan, and Chen Change Loy. Ex- ploring clip for assessing the look and feel of images. InPro- ceedings of the AAAI Conference on Artificial Intelligence , pages 2555–2563, 2023. 5, 6, 8

    2023

  34. [42]

    Exploring vulnerabilities of no-reference image quality as- sessment models: A query-based black-box method

    Chenxi Yang, Yujia Liu, Dingquan Li, and Tingting Jiang. Exploring vulnerabilities of no-reference image quality as- sessment models: A query-based black-box method. IEEE Transactions on Circuits and Systems for Video Technology,

  35. [43]

    Beyond score changes: Adversarial attack on no-reference image quality assessment from two perspec- tives

    Chenxi Yang, Yujia Liu, Dingquan Li, Yan Zhong, and Tingting Jiang. Beyond score changes: Adversarial attack on no-reference image quality assessment from two perspec- tives. arXiv preprint arXiv:2404.13277, 2024

    2024 arXiv

  36. [44]

    Vulnerabilities in video quality assessment models: The challenge of adversarial attacks

    Aoxiang Zhang, Yu Ran, Weixuan Tang, and Yuan-Gen Wang. Vulnerabilities in video quality assessment models: The challenge of adversarial attacks. Advances in Neural In- formation Processing Systems, 36, 2024. 2

    2024

  37. [45]

    Secure video qual- ity assessment resisting adversarial attacks

    Ao-Xiang Zhang, Yu Ran, Weixuan Tang, Yuan-Gen Wang, Qingxiao Guan, and Chunsheng Yang. Secure video qual- ity assessment resisting adversarial attacks. arXiv preprint arXiv:2410.06866, 2024. 3

    2024 arXiv

  38. [46]

    Beyond a gaussian denoiser: Residual learning of deep cnn for image denoising

    Kai Zhang, Wangmeng Zuo, Yunjin Chen, Deyu Meng, and Lei Zhang. Beyond a gaussian denoiser: Residual learning of deep cnn for image denoising. IEEE transactions on image processing, 26(7):3142–3155, 2017. 3

    2017

  39. [47]

    Blind image quality assessment using a deep bilinear convolutional neural network

    Weixia Zhang, Kede Ma, Jia Yan, Dexiang Deng, and Zhou Wang. Blind image quality assessment using a deep bilinear convolutional neural network. IEEE Transactions on Cir- cuits and Systems for Video Technology, 30(1):36–47, 2020. 5, 6, 8

    2020

  40. [48]

    Perceptual at- tacks of no-reference image quality models with human-in- the-loop

    Weixia Zhang, Dingquan Li, Xiongkuo Min, Guangtao Zhai, Guodong Guo, Xiaokang Yang, and Kede Ma. Perceptual at- tacks of no-reference image quality models with human-in- the-loop. Advances in Neural Information Processing Sys- tems, 35:2916–2929, 2022. 1, 2

    2022

  41. [49]

    Convolutional neural networks for image denoising and restoration

    Wangmeng Zuo, Kai Zhang, and Lei Zhang. Convolutional neural networks for image denoising and restoration. De- noising of photographic images and video: Fundamentals, open challenges and new trends, pages 93–123, 2018. 5

    2018

  42. [50]

    Hacking vmaf with video color and contrast distortion

    Anastasia Zvezdakova, Sergey Zvezdakov, Dmitriy Kulikov, and Dmitriy Vatolin. Hacking vmaf with video color and contrast distortion. arXiv preprint arXiv:1907.04807, 2019. 1 10

    1907 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.