Title: Vulnerabilities in Video Quality Assessment Models: The Challenge of Adversarial Attacks
Venue: NeurIPS 2023
Accepted: yes
Keywords: video quality assessment

adversarial attack

black-box

just noticeable difference
Abstract: No-Reference Video Quality Assessment (NR-VQA) plays an essential role in improving the viewing experience of end-users. Driven by deep learning, recent NR-VQA models based on Convolutional Neural Networks (CNNs) and Transformers have achieved outstanding performance. To build a reliable and practical assessment system, it is of great necessity to evaluate their robustness. However, such issue has received little attention in the academic community. In this paper, we make the first attempt to evaluate the robustness of NR-VQA models against
adversarial attacks, and propose a patch-based random search method for black-box attack. Specifically, considering both the attack effect on quality score and the visual quality of adversarial video, the attack problem is formulated as misleading the estimated quality score under the constraint of just-noticeable difference (JND). Built upon such formulation, a novel loss function called Score-Reversed Boundary Loss is designed to push the adversarial video’s estimated quality score far away from its ground-truth score towards a specific boundary, and the JND constraint is modeled as a strict $L_2$ and $L_\infty$ norm restriction. By this means, both white-box and black-box attacks can be launched in an effective and imperceptible manner. The source code is available at https://github.com/GZHU-DVL/AttackVQA.

Vulnerabilities in Video Quality Assessment Models: The Challenge of Adversarial Attacks

Abstract

No-Reference Video Quality Assessment (NR-VQA) plays an essential role in improving the viewing experience of end-users. Driven by deep learning, recent NR-VQA models based on Convolutional Neural Networks (CNNs) and Transformers have achieved outstanding performance. To build a reliable and practical assessment system, it is of great necessity to evaluate their robustness. However, such issue has received little attention in the academic community. In this paper, we make the first attempt to evaluate the robustness of NR-VQA models against adversarial attacks, and propose a patch-based random search method for black-box attack. Specifically, considering both the attack effect on quality score and the visual quality of adversarial video, the attack problem is formulated as misleading the estimated quality score under the constraint of just-noticeable difference (JND). Built upon such formulation, a novel loss function called Score-Reversed Boundary Loss is designed to push the adversarial video's estimated quality score far away from its ground-truth score towards a specific boundary, and the JND constraint is modeled as a strict L 2 and L ∞ norm restriction. By this means, both white-box and black-box attacks can be launched in an effective and imperceptible manner. The source code is available at https://github.com/GZHU-DVL/AttackVQA.

1 Introduction

In recent years, the service of 'we-media' has shown an explosive growth. It is reported that Facebook can produce approximately 4 billion video views per day [1]. Nevertheless, the storage and transmission of such volumes of video data pose a significant challenge to video service providers [2]. To address this challenge, video coding is employed to balance the tradeoff between coding efficiency and video quality. Therefore, Video Quality Assessment (VQA) has become a prominent research topic. In general, according to whether pristine video is applied as a reference, VQA can be divided into Full-Reference VQA (FR-VQA), Reduced-Reference VQA (RR-VQA), and No-Reference VQA (NR-VQA). Recently, Convolutional Neural Networks (CNNs) and Transformers have made great progress in NR-VQA. However, according to recent studies, Deep Neural Networks (DNNs) show vulnerability against adversarial examples [19]. To build a reliable and practical assessment system, it is of great necessity to evaluate the robustness of the NR-VQA models against adversarial attacks.

The threat of adversarial attacks has been studied in the task of image classification. Szegedy et al. [4] first found that an image injected with a small amount of imperceptible adversarial perturbations can mislead DNNs with high confidence. Moosav-DezFool et al. [5] suggested that universal perturbations can achieve attack effect on different samples. Athalye et al. [6] showed that adversarial examples can be applied in physical world. Since then, numerous adversarial attacks on CNNs and Transformers have been proposed [7; 8; 9; 24; 32].

NIYEA

HIVEA

Original

L

2

= 3 / 255,

L

∞

= 5 / 255

HIYEA

HIYEA

L 2 = 8 / 255, L ∞ = 10 / 255

Compared with its rapid development in the classification task, there have been few investigations of adversarial attacks in Quality Assessment (QA), including Image Quality Assessment (IQA) and Video Quality Assessment (VQA). Two pioneering works [44; 50] were the closest to this topic in scope. [44] first investigated the adversarial attack on IQA models. It optimized the perturbations with propagated gradients by NR-IQA models. Such perturbations were added to the original image to yield adversarial images. Multiple adversarial images could be generated under the constraint of different Lagrange multipliers, and those adversarial images added with the most perceptually invisible perturbation were selected according to human subjective experiments. This can be understood as a constraint limiting the perturbations below the just-noticeable difference (JND) threshold. [50] designed a universal perturbation as the fixed perturbation trained by a given IQA/VQA model to increase its output scores. Despite [44] and [50] have made early attempt of adversarial attack on IQA/VQA model, there still remain some important issues to be solved. Firstly, since human subjective experiments are both time-consuming and labor-intensive, the test set of [44] includes only 12 images, which is too small to be practical. Secondly, [50] aims to merely increase the estimated quality score outputted by the target model, which is not in line with the definition of adversarial attack. Thirdly, [50] cannot control the visual quality during optimization, and thus the adversarial videos suffer from obvious artifacts. Fourthly, the adversarial attacks in both [44] and [50] are ineffective in more practical black-box scenarios.

To address the above problems, this paper comprehensively investigates the robustness of NR-VQA models by adversarial attacks. Firstly, adversarial attack on NR-VQA model is mathematically modelled. The target NR-VQA model takes in the adversarial video and outputs the estimated quality score. Meanwhile, we define the anchor quality score as far away from its mean opinion score (MOS) in a specific direction. The optimization goal of such attack problem is to mislead the estimated quality score by means of pulling in the distance between the estimated and anchor quality scores under the constraint of restricting the distortion between the adversarial and original videos below the JND threshold. Specifically, the Score-Reversed Boundary Loss is designed to push the adversarial video's estimated quality score far away from its MOS towards a specific boundary. And limiting the L 2 and L ∞ norm of the perturbations below a rather strict threshold can be interpreted as a kind of JND constraint. In this paper, unless otherwise specified, the L 2 norm indicates the pixel-level L 2 norm averaged on the whole video. An example of applying the constraint of L 2 and L ∞ norm is given in Fig. 1. It can be observed that by means of limiting the L 2 and L ∞ norm of perturbations within a rather strict threshold of 3/255 and 5/255, the perturbations are imperceptible to human eyes, which can be considered to be below the JND threshold. The contributions of this work are summarized as follows:

Adversarial attacks on NR-VQA models are formulated as misleading the estimated quality score by means of pulling in the distance between the estimated and anchor quality scores under the JND constraint. To the best of our knowledge, this is the first work to apply adversarial attacks to investigate the robustness of NR-VQA models under black-box setting.

A novel loss function called Score-Reversed Boundary Loss is proposed to push the adversarial video's estimated quality score far away from its MOS towards a specific boundary. By means of minimizing such loss function, the generated adversarial video can effectively disable the NR-VQA models.

Adversarial attacks on NR-VQA models are implemented under white-box and black-box settings. Furthermore, a patch-based random search method is designed for black-box attack, which can significantly improve the query efficiency in terms of both the spatial and temporal domains.

2 Related work

2.1 NR-VQA models

With the rapid development of deep learning techniques, NR-VQA models based on CNNs and Transformers have received tremendous attention. Li et al. [25] extracted the 3D shearlet transform features from video blocks. Afterwards, logistic regression and CNN were simultaneously applied to exaggerate the discriminative parts of the features and predict the quality score. Li et al. [26] utilized ResNet [27] to extract features for each frame within video, which were fed into GRU [28] to construct the long-term dependencies in temporal domain. You and Korhonen [29] employed LSTM [30] to predict quality score based on the features extracted from small video cubic clips. Zhang et al. [40] reorganized the connections of human visual system, and comprehensively evaluated the quality score from spatial and temporal domains. Li et al. [31] transferred the knowledge from IQA to VQA, and applied SlowFast [34] to obtain the motion patterns of videos.

Xing et al. [35] were the first to introduce Transformer [38] into NR-VQA to implement space-time attention. Wu et al. [36] designed a spatial-temporal distortion extraction module, wherein the video Swin Transformer [42] was utilized to extract multi-level spatial-temporal features. Li and Yang [37] proposed a hierarchical Transformer strategy, wherein one Transformer was utilized to update the frame-level quality embeddings, and another Transformer was utilized to generate the video-level quality embeddings. To reduce the computational complexity of Transformers, Wu et al. [41] segmented the video frames into smaller patches, which were partially concatenated into fragments and fed into video Swin Transformer [42].

2.2 Adversarial attacks in classification

According to the knowledge of the attacker, adversarial attacks can be roughly divided into white-box and black-box attacks. In general, most white-box attacks rely on the propagated gradients of the target model. Goodfellow et al. [16] suggested that DNNs were susceptible to analytical perturbations due to their linear behaviors, and proposed the Fast Gradient Sign Method (FGSM). On this basis, Kurakin et al. [17] launched the attack via several steps, and clipped the pixel values within the glyph[epsilon1] -neighbourhood after each step. Similarly, Madry et al. [20] proposed a multi-step variation of FGSM called Projected Gradient Descent (PGD), wherein the updated adversarial example was projected on the L ∞ norm in each PGD iteration. Carlini and Wagner [3] formulated the adversarial attack as an optimization problem with different objective functions, which aimed to find adversarial examples with minimum perturbations. Papernot et al. [18] created adversarial examples by iteratively modifying the most significant pixel based on the adversarial saliency map.

However, in real-world scenarios, the gradients of the model may not be accessible to the attacker. Therefore, the black-box setting is a more practical attack scenario. Papernot et al. [21] performed a black-box attack by training a local surrogate model, and then used this surrogate model to generate adversarial examples that could mislead the target model. Chen et al. [22] proposed the Zeroth Order Optimization (ZOO) based attack to estimate the gradients of the target model. To improve the query efficiency of ZOO, Ilyas et al. [23] replaced the conventional finite differences method with natural evolution strategy in gradient estimation. Guo et al. [24] proposed a simple black-box attack, which iteratively injected perturbations that could lead to performance degradation of target model in a greedy way. Xiao et al. [43] proposed AdvGAN to generate perturbations via feed-forward process, which could accelerate the generation of adversarial examples in the inference stage.

3 Proposed method

3.1 Problem formulation

In this part, the adversarial attack on NR-VQA model is mathematically modelled as

where X denotes the number of frames within a video, and { I adv x } X x =1 and { I x } X x =1 denote the adversarial video and original video, respectively. f ( · ) denotes the estimated quality score outputted

Algorithm 1 White-box attack on NR-VQA model

1: Require: Estimated score by target NR-VQA model f ( · ) , anchor score b ( · ) , number of frames optimized in one round T , number of iterations in one round K , and step size β

by the target NR-VQA model, and b ( · ) denotes the anchor quality score which is far away from its MOS in a specific direction. L ( · ) is the loss function that measures the distance between the estimated and anchor quality scores. The closer the distance between the estimated and anchor quality scores, the further the distance between the estimated quality score and its MOS, and the stronger the effect of adversarial attack on misleading the estimated quality score. D ( · ) is the distortion between the original and adversarial videos. Restricting the distortion below the JND threshold indicates that the perturbations are imperceptible to human eyes. By means of minimizing the loss function under the JND constraint, the adversarial attack on NR-VQA model can be launched in an effective and undetectable manner.

To implement the adversarial attack according to Eq. (1), it is essential to design the loss function L . Although Mean Squared Error (MSE) Loss has been widely applied in regression problem, it is not suitable for adversarial attack on NR-VQA model. The reason is that a well-performed adversarial attack on NR-VQA model should possess the capability of leading the estimated quality score far away from its MOS in a specific direction, i.e., misleading the NR-VQA model to assign high-quality score to low-quality video, and vice versa. Although applying MSE Loss may push the estimated quality score away from the MOS, it cannot control the leading direction. In this paper, a loss function called Score-Reversed Boundary Loss ( L srb ) is proposed, which is formulated as

where

where the high or low quality of a video in Eq. (3) can be determined by its MOS in practice, and the boundaries of 0 and 1 are regarded as the anchor quality scores.

Besides, the perturbation distortion D between the original and adversarial videos is another issue to be addressed. In general, limiting D below the JND threshold indicates that such perturbations are invisible to human eyes. However, JND is empirically determined by many factors, including brightness, contrast between the background, and individual visual sensitivity. Therefore, some fields convert it into certain objective metrics for simple modeling, such as PSNR in video coding [10], SSIM in image/video enhancement [11], and L p norm in adversarial attacks [13]. Zhang et al. [44] introduced human subjective experiments to judge whether the perturbation distortion is below the JND threshold. However, such human subjective experiments are both time-consuming and labor-intensive. In this paper, we refer to the works in adversarial examples to construct the JND constraint [12; 13; 14]. Considering a pair of original and adversarial videos, the problem of constraining the distortion below the JND threshold can be converted into the problem of restricting their pixel-level L 2 and L ∞ norm to be lower than a rather strict threshold. Consequently, the optimization based on subjective JND can be automatically performed by the objective metrics.

Estimated

quality

score

Universal

perturbation

Universal

perturbation

Universal

perturbation

Universal

perturbation

Frame

T

Frame

T

-1

Frame 2

Frame 1

Query 1

Query 2

Query

N

-1

Query

N

NR-VQA model

3.2 White-box adversarial attack

In the case of white-box attack, the parameters of the target model are accessible to the attacker. Therefore, the steepest descent method can be applied to minimize the Score-Reversed Boundary Loss in Eq. (2). The process of generating an adversarial video has glyph[floorleft] X/T glyph[floorright] rounds, wherein T denotes the number of frames optimized in one round together. At the beginning of each round, the adversarial videos are generated by means of adding the original videos with initialized perturbations denoted as { A x } x + T x , whose element is independently sampled from a discrete set {-1 / 255 , 0 , 1 / 255 } . Afterwards, K iterations are applied in this round to optimize the perturbations, and the detailed steps of one iteration are as follows. Firstly, the obtained adversarial videos are fed into the target NR-VQA model, and the steepest descent direction of L srb can be calculated to optimize the perturbations. Secondly, the projected gradient descent method is utilized to limit the pixel-level L 2 and L ∞ norm of the perturbations within 1/255, which can be regarded as a kind of strict JND constraint. The pseudo-code of generating adversarial example for NR-VQA model under white-box setting is given in Algorithm 1.

3.3 Black-box adversarial attack

Compared with white-box attack, black-box attack is a more practical attack scenario, wherein only the final output of the model can be queried to optimize the adversarial examples. Note that the number of queries is an important evaluation metric in black-box attack. However, black-box attack on NR-VQA model pose great challenges from the following two aspects. Firstly, in most existing outstanding black-box attacks, the number of queries is positively correlated with the resolution of the video frame. As NR-VQA models are widely applied to 1080p and 2160p high-resolution datasets such as LIVE-VQC [15], YouTube-UGC [45], and LSVQ [46], its query resources may be quite expensive. Secondly, different frames within one video have different content characteristics. Therefore, to obtain better attack effect, each frame should be generated with a specific perturbation. However, one video may consist of hundreds of frames, which can lead to larger number of queries.

To reduce the query resources from the spatial and temporal perspective under black-box attack, we design a patch-based random search method, as illustrated in Fig. 2. In this part, the height and width of a video frame are denoted as H and W , respectively. The height and width of a patch are denoted as h and w , respectively. Each frame is divided into red, green, and blue channels, and each channel is further split into non-overlapping glyph[floorleft] H h glyph[floorright] ×glyph[floorleft] W w glyph[floorright] patches. In this way, each frame contains glyph[floorleft] H h glyph[floorright] ×glyph[floorleft] W w glyph[floorright]× 3 patches.

Like the white-box attack, we suppose that the process of generating an adversarial video has glyph[floorleft] X/T glyph[floorright] rounds. In one round, N queries are performed. The detailed steps of the optimization process in the n -th query are as follows. Firstly, for each of the T frames, Z patches, which are located in the same positions within these T frames, are randomly selected to be perturbed. Note that in each round of the attack, each of the Z patches would be selected once and only once, and all patches would be selected in N queries. Therefore, we can obtain N × Z = glyph[floorleft] H h glyph[floorright] ×glyph[floorleft] W w glyph[floorright]× 3 . For the convenience of

Algorithm 2 Black-box attack on NR-VQA model

1: Require: Estimated score by target NR-VQA model f ( · ) , anchor score b ( · ) , number of frames optimized in one round T , number of queries in one round N , perturbation magnitude γ , size of video frame H × W , and size of patch h × w 2: Input: Original video { I x } X x =1 3: Output: Adversarial video { I adv x } X x =1 4: for x = 0 to X by T do // The optimization process contains glyph[floorleft] X/T glyph[floorright] rounds. 5: { I adv x } x + T x ←{ I x } x + T x // Initialize the adversarial video. 6: R ←L srb ( f ( { I adv x } x + T x ) , b ( { I x } X x =1 )) 7: for n = 0 to N do // One round contains N queries. 8: Z ← max ( glyph[floorleft]glyph[floorleft] H h glyph[floorright] ×glyph[floorleft] W w glyph[floorright]× 3 /N glyph[floorright] , 1 ) // Select Z patches to perturb in one frame. 9: p n ← Encode information of the positions of the selected patches 10: m n ← Generate universal perturbation map from a discrete set {-γ, + γ } 11: for operation ∈ {-, + } do 12: { ˜ I adv x } x + T x ← Selected patches are injected with m n according to given operation 13: R ′ ←L srb ( f ( { ˜ I adv x } x + T x ) , b ( { I x } X x =1 ) ) // Evaluate the attack effect. 14: if R ′ < R then 15: { I adv x } x + T x ← { ˜ I adv x } x + T x // Update the adversarial video. 16: R ← R ′ 17: break

illustration, the information of the positions of the selected patches is encoded into a vector denoted as p K × 1 n , where K = glyph[floorleft] H h glyph[floorright] ×glyph[floorleft] W w glyph[floorright]× 3 . Each element in p n corresponds to a specific patch within the frame, and the element equals to 1 if such patch is perturbed, and 0 otherwise. Note that each of the T frames optimized in one round shares the same p n . Secondly, for these T × Z patches to be perturbed, a universal perturbation map m n is generated, wherein its dimension is the same as the dimension of the patch, and its element is independently sampled from a discrete set {-γ, + γ } . Thirdly, the selected T × Z patches are subtracted or added with the universal perturbation map, and the generated adversarial video is fed into the target NR-VQA model. Such perturbations would be kept if the Score-Reversed Boundary Loss in Eq. (2) decreases, and abandoned otherwise. Following the above three steps, an adversarial video with X frames can be generated. The pseudo-code of generating adversarial example for NR-VQA model under black-box setting is given in Algorithm 2.

By means of applying the patch-based random search method, the constraint of JND can be formulated under L ∞ or pixel-level L 2 norm. Firstly, the L ∞ norm between the original and adversarial videos is γ , which is the maximum modification range of each element in the adversarial video. Secondly, the frame-level L 2 norm between the original and adversarial videos can be formulated as

where the last inequality holds as different patches are selected once and only once in different rounds, and the last equality holds when all patches are injected with perturbations. And γ is set as 5/255 in black-box attack. Therefore, the pixel-level L 2 norm can be deduced that

4 Experiments

4.1 Experimental setup

NR-VQA models and datasets: Four representative NR-VQA models are tested in the experiments, including VSFA [26], MDTVSFA [39], TiVQA [49], and BVQA-2022 [31]. The experiments are

conducted on mainstream video datasets including KoNViD-1k [48], LIVE-VQC [15], YouTubeUGC [45], and LSVQ [46]. Specifically, LSVQ is further divided into two datasets according to their resolutions. Therefore, five datasets are applied in the experiments. For each of these five datasets, 50 videos are randomly selected to evaluate the effectiveness of adversarial attacks.

Evaluation metrics: The performance of NR-VQA model is evaluated by Spearman Rank order Correlation Coefficient (SRCC) and Pearson's Linear Correlation Coefficient (PLCC). Specifically, SRCC is used to measure the monotonic relationship between the predicted quality scores and the ground-truth quality scores, while PLCC is used to measure the accuracy of the predictions. Note that both SRCC and PLCC are evaluated on a batch of videos. However, in real attack scenario, the attacker may merely launch the adversarial attack on a few samples. In this case, the change range of SRCC and PLCC could be rather small, and thus these two metrics may not accurately reflect the attack effect. Therefore, we follow [44] to define a metric on a single video, which is calculated as

Table 3: Performance evaluations under black-box setting. Here, the performance before attack is marked in gray values within parentheses.

the average logarithmic ratio between the expected change in quality prediction and the actual change in quality prediction caused by adversarial video as

where the definition of f and b can be referred to Section 3.1, S denotes the number of videos in the test set. A higher value of R indicates better model robustness. With the above three metrics, the prediction accuracy and robustness against adversarial attacks can be comprehensively evaluated.

Implementation details: We download the authors' source code [26; 39; 49; 31], re-train the models and produce adversarial videos on the testing set. Since the estimated quality scores' scale among different NR-VQA models is different, we need to rescale the boundary. The rescaling details can be referred to in the appendix. For a specific dataset, the median of the MOS of the selected 50 videos is regarded as the threshold to decide whether a video is of high quality or low quality in Eq. (3). As for white-box attack, Adam optimizer [47] is applied, wherein the step size β is initialized as 3 × 10 -4 . K and T are set to 30 and 1. The pixel-level L 2 norm of perturbations is constrained within 1/255. As for black-box attack, N , T , and γ are set to 300, 1, 5/255. Both h and w are set to 56.

4.2 Performance evaluations under white-box setting

In this part, the performance of different NR-VQA models is evaluated under white-box setting, and the results under both pixel-level L 2 and L ∞ norm constraint are given in Tables 1 and 2, respectively. It can be observed that the State-of-the-Art (SOTA) NR-VQA models are completely disabled by adversarial attack. Specifically, such attack under both pixel-level L 2 and L ∞ norm constraint bring similar attack effects and lead to performance degradation of 194% and 195% on SRCC averaged on five datasets, demonstrating the vulnerabilities of these NR-VQA models. Meanwhile, the R values on all datasets approximate to 0, indicating that the adversarial attack with our proposed Score-Reversed Boundary Loss can push the estimated quality score towards the target boundary. Note that in white-box setting, the pixel-level L 2 and L ∞ norm of perturbations are constrained within 1/255 and 3/255, indicating that the degree of perturbation is kept on an extremely low level.

4.3 Performance evaluations under black-box setting

In this part, the performance of different NR-VQA models is evaluated under black-box setting, and the results are given in Table 3. It can be observed that the SRCC and PLCC of the attacked

Original

Under black-box setting

Under white-box setting

0.4

0.5

0.6

0.7

0.8



0.0

0.2

0.4

0.6

0.8

1.0

1.2







(a) White-box.

0.4

0.5

0.6

0.7

0.8



0.4

0.5

0.6

0.7

0.8







(b) Black-box.















k

























(c) White-box.











n



















(d) Black-box.

VSFA, MDTVSFA, and TiVQA are around 0, indicating that the attack effect on these models is quite remarkable. Although the attack effect on BVQA-2022 is less significant, it still brings performance degradation of 0.6449 on SRCC and 0.6254 on PLCC on the KoNViD-1k dataset. Such results indicate that the current VQA systems are not robust against adversarial attacks, and can be severely disturbed in the black-box setting. Note that according to Eq. (5), the theoretical upper bound of the pixel-level L 2 norm and L ∞ norm of the proposed patch-based random search method are both 5/255. Interestingly, in practical deployment, we find that only about 3/5 patches are injected with perturbations, and the pixel-level L 2 norm is around 3/255. In Fig. 3, the examples of the original video frames and the corresponding adversarial video frames under both white-box and black-box settings are presented, which are indistinguishable from their original counterparts by human eyes.

4.4 Ablation study

In this part, ablation studies are conducted from four aspects. Firstly, the effectiveness of the proposed Score-Reversed Boundary Loss is verified under black-box and white-box settings. The experiments are conducted via attacking VSFA on the KoNViD-1k dataset, and the results are given in Fig. 4. From Fig. 4(a) and 4(b), it can be seen that minimizing the Score-Reversed Boundary Loss achieves satisfied attack effect. Specifically, in the white-box setting, the quality scores estimated by the target NR-VQA model basically reach the target boundary. From Fig. 4(c) and 4(d), it can be observed that compared with the MSE Loss, the Score-Reversed Boundary Loss shows superiority in the query efficiency. In particular, in the white-box setting, the adversarial attack with the Score-Reversed Boundary Loss can completely disable the NR-VQA model with just a few iterations.

Secondly, our patch-based random search method is compared with the pixel-based random search method SimBA [24] under black-box setting. The experiments are conducted via attacking VSFA on the KoNViD-1k and LSVQ datasets, and the results are given in Table 4. We can see that compared with the pixel-based method, our method shows significant improvements in both attack effect and query efficiency. Specifically, our method merely consumes 300 queries to completely disable the NR-VQA model, while the pixel-based method barely has any attack effect with 1000 queries.

Thirdly, the number of frames optimized in one round, i.e., T , is investigated under both black-box and white-box settings. The experiments are conducted via attacking VSFA on the KoNViD-1k and LSVQ datasets, and the results are given in Table 5. From the perspective of the white-box setting, different values of T have little impact on the attack effect. However, in the black-box setting, smaller T corresponds to stronger attack effect. The reason is that different frames within one video have different characteristics, and thus optimizing the perturbations with smaller T can bring the potential of their individual differences to full play. Considering the attack effect, T is set to 1 in our method.

Fourthly, the impact of motion embeddings on the robustness of the model is explored under blackbox setting. Note that BVQA-2022 applies motion embeddings, while VSFA does not. In Table 6, the original BVQA-2022 and the BVQA-2022 without motion embeddings are compared. In Table 7, the original VSFA and the VSFA with motion embeddings are compared. It can be observed that the motion embeddings play an important role in improving the robustness of NR-VQA models against adversarial attacks. Specifically, the motion embeddings bring SRCC performance improvement of 0.2598 for BVQA-2022 and 0.2068 for VSFA. One possible reason is that the motion embeddings correspond to the inter-frame information in temporal domain. Therefore, the adversarial impact of perturbations added within frames may be weakened, resulting in an improvement of robustness.

5 Conclusions

In this paper, we fully investigate the robustness of NR-VQA models against adversarial attacks, and propose the Score-Reversed Boundary Loss for the attack problem. Extensive experiments have been conducted under both white-box and black-box settings, and the following conclusions can be drawn. Firstly, the existing SOTA NR-VQA models are vulnerable to adversarial attacks, which brings great challenges to build reliable and practical assessment systems. Secondly, the attack effect and query efficiency are influenced by different components, including the Score-Reversed Boundary Loss, the patch-based random search method, and the number of frames optimized in one round. Thirdly, motion embeddings have a positive impact on increasing the robustness of NR-VQA models, which may be the key for developing robust NR-VQA models. These findings present a promising direction for NR-VQA. Future work may include the following aspects. Firstly, it is desired to develop the learning-based attack method, i.e., apply a generator to produce perturbations to fool the NR-VQA models. Secondly, more characteristics, such as the information in the temporal domain, should be explored to improve the robustness of NR-VQA models.

Acknowledgments

This work was supported in part by the National Natural Science Foundation of China under Grants 62272116 and 62002075, and in part by the Guangdong Basic and Applied Basic Research Foundation under Grant 2023A1515011428. The authors acknowledge the Network Center of Guangzhou University for providing HPC computing resources.

References

99Firms. Facebook video statistics. https://99firms.com/blog/facebook-video-statistics/.

Y. Mao, M. Wang, S. Wang, and S. Kwong, 'High efficiency rate control for versatile video coding based on composite cauchy distribution,' IEEE Transactions on Circuits and Systems for Video Technology , vol. 32, no. 4, pp. 2371-2384, 2021.

N. Carlini and D. Wagner, 'Towards evaluating the robustness of neural networks,' in IEEE Symposium on Security and Privacy , pp. 39-57, 2017.

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus, 'Intriguing properties of neural networks,' arXiv preprint arXiv:1312.6199 , 2013.

S. M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, 'Universal adversarial perturbations,' in IEEE Conference on Computer Vision and Pattern Recognition , pp. 1765-1773, 2017.

A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, 'Synthesizing robust adversarial examples,' in International Conference on Machine Learning , pp. 284-293, 2018.

C. Laidlaw and S. Feizi, 'Functional adversarial attacks,' in Advances in Neural Information Processing Systems , pp. 10408-10418, 2019.

K. Mahmood, R. Mahmood, and M. V. Dijk, 'On the robustness of vision transformers to adversarial examples,' in International Conference on Computer Vision , pp. 7838-7847, 2021.

Z. Wei, J. Chen, M. Goldblum, Z. Wu, T. Goldstein, and Y.-G. Jiang, 'Towards transferable adversarial attacks on vision transformers,' in AAAI Conference on Artificial Intelligence , vol. 36, pp. 2668-2676, 2022.

X. Yang, W.S. Ling, Z.K. Lu, E.P. Ong, and S.S. Yao, 'Just noticeable distortion model and its applications in video coding,' Signal Processing: Image Communication, vol. 20, no. 7, pp. 662-680, 2005.

X. Dong and J. Wen, 'A pixel-based outlier-free motion estimation algorithm for scalable video quality enhancement.' Frontiers of Computer Science, vol. 9 pp. 729-740, 2015.

J. Rony, L. G. Hafemann, L. S. Oliveira, I. B. Ayed, R. Sabourin, and E. Granger, 'Decoupling direction and norm for efficient gradient-based L 2 adversarial attacks and defenses,' in IEEE Conference on Computer Vision and Pattern Recognition , pp. 4322-4330, 2019.

R. Pinot, R. Ettedgui, G. Rizk, Y. Chevaleyre, and J. Atif, 'Randomization matters how to defend against strong adversarial attacks,' in International Conference on Machine Learning , pp. 7717-7727, 2020.

F. Croce and M. Hein, 'Minimally distorted adversarial examples with a fast adaptive boundary attack,' in International Conference on Machine Learning , pp. 2196-2205, 2020.

Z. Sinno and A. C. Bovik, 'Large-scale study of perceptual video quality,' IEEE Transactions on Image Processing , vol. 28, no. 2, pp. 612-627, 2019.

I. J. Goodfellow, J. Shlens, and C. Szegedy, 'Explaining and harnessing adversarial examples,' in International Conference on Learning Representations , pp. 1-11, 2014.

A. Kurakin, I. J. Goodfellow, and S. Bengio, 'Adversarial examples in the physical world,' in International Conference on Learning Representations , pp. 1-11, 2017.

N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, 'The limitations of deep learning in adversarial settings,' in IEEE European Symposium on Security and Privacy , pp. 372-387, 2016.

N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, 'Distillation as a defense to adversarial perturbations against deep neural networks,' in IEEE Symposium on Security and Privacy , pp. 582-597, 2016.

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, 'Towards deep learning models resistant to adversarial attacks,' In International Conference on Learning Representations , pp. 1-23, 2018.

N. Papernot, P. McDaniel, I. J. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, 'Practical black-box attacks against machine learning,' in ACM on Asia Conference on Computer and Communications Security , pp. 506-519, 2017.

P. Chen, H. Zhang, Y. Sharma, J. Yi, and C.-J. Hsieh, 'ZOO: Zeroth order optimization based blackbox attacks to deep neural networks without training substitute models,' in ACM Workshop on Artificial Intelligence and Security , pp. 15-26, 2017.

A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, 'Black-box adversarial attacks with limited queries and information,' in International Conference on Machine Learning , pp. 2137-2146, 2018.

C. Guo, J. Gardner, Y. You, A. G. Wilson, and K. Weinberger, 'Simple black-box adversarial attacks,' in International Conference on Machine Learning , pp. 2484-2493, 2019.

Y. Li, L. Po, C. Cheung, X. Xu, L. Feng, F. Yuan, and K. Cheung, 'No-reference video quality assessment with 3D shearlet transform and convolutional neural networks,' IEEE Transactions on Circuits and Systems for Video Technology , vol. 26, no. 6, pp. 1044-1057, 2016.

D. Li, T. Jiang, and M. Jiang, 'Quality assessment of in-the-wild videos,' in ACM International Conference on Multimedia, pp. 2351-2359, 2019.

K. He, X. Zhang, S. Ren, and J. Sun, 'Deep residual learning for image recognition,' in IEEE Conference on Computer Vision and Pattern Recognition , pp. 770-778, 2016.

K. Cho, B. Merrienboer, C. Gulcehre, F. Bougares, H. Schwenk, and Y. Bengio, 'Learning phrase representations using RNN encoder-decoder for statistical machine translation,' arXivpreprint arXiv :1406.1078, 2014.

J. You and J. Korhonen, 'Deep neural networks for no-reference video quality assessment,' in IEEE International Conference on Image Processing , pp. 2349-2353, 2019.

S. Hochreiter and J. Schmidhuber, 'Long short-term memory,' Neural Computation , vol. 9, no. 8, pp. 1735-1780, 1997.

B. Li, W. Zhang, M. Tian, G. Zhai, and X. Wang, 'Blindly assess quality of in-the-wild videos via quality-aware pre-training and motion perception,' IEEE Transactions on Circuits and Systems for Video Technology , vol. 32, no. 9, pp. 5944-5958, 2022.

Y. Wang, J. Wang, Z. Yin, R. Gong, J. Wang, A. Liu, and X. Liu, 'Generating transferable adversarial examples against vision transformers,' in ACM International Conference on Multimedia , pp. 5181-5190, 2022.

Z. Liu, H. Mao, C.-Y. Wu, C. Feichtenhofer, T. Darrell, and S. Xie, 'A convnet for the 2020s,' in IEEE Conference on Computer Vision and Pattern Recognition , pp. 11976-11986, 2022.

C. Feichtenhofer, H. Fan, J. Malik, and K. He, 'SlowFast networks for video recognition,' in International Conference on Computer Vision, pp. 6201-6210, 2019.

F. Xing, Y.-G. Wang, H. Wang, L. Li, and G. Zhu, 'StarVQA: Space-time attention for video quality assessment,' in IEEE International Conference on Image Processing , pp. 2326-2330, 2022.

H, Wu, C, Chen, L, Liao, J, Hou, W, Sun, Q. Yan, and W. Lin, 'DisCoVQA: Temporal distortion-content transformers for video quality assessment,' IEEE Transactions on Circuits and Systems for Video Technology , to be published, doi: 10.1109/TCSVT.2023.3249741.

Z. Li and L. Yang, 'DCVQE: A hierarchical transformer for video quality assessment,' in Asian Conference on Computer Vision , pp. 2562-2579, 2022.

A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, 'Attention is all you need,' in Advances in Neural Information Processing Systems , pp. 5998-6008, 2017.

D. Li, T. Jiang, and M. Jiang, 'Unified quality assessment of in-the-wild videos with mixed datasets training,' International Journal of Computer Vision , vol. 129, no. 4, pp. 1238-1257, 2021.

A.-X. Zhang, Y.-G. Wang, W. Tang, L. Li, and S. Kwong, 'HVS revisited: A comprehensive video quality assessment framework,' arXivpreprint arXiv :2210.04158, 2022.

H. Wu, C. Chen, J. Hou, L. Liao, A. Wang, W. Sun, Q. Yan, and W. Lin, 'FAST-VQA: Efficient end-toend video quality assessment with fragment sampling,' in European Conference on Computer Vision , pp. 538-554, 2022.

Z. Liu, J. Ning, Y . Cao, Y . Wei, Z. Zhang, S. Lin, and H. Hu, 'Video swin transformer,' in IEEE Conference on Computer Vision and Pattern Recognition, pp. 3202-3211, 2022.

C. Xiao, B. Li, J.-Y . Zhu, W. He, M. Liu, and D. Song, 'Generating adversarial examples with adversarial networks,' in International Joint Conference on Artificial Intelligence , pp. 3905-3911, 2018.

W. Zhang, D. Li, X. Min, G. Zhai, G. Guo, X. Yang, and K. Ma, 'Perceptual attacks of no-reference image quality models with human-in-the-loop,' in Advances in Neural Information Processing Systems , pp. 2916-2929, 2022.

Y. Wang, S. Inguva, and B. Adsumilli, 'YouTube UGC dataset for video compression research,' in IEEE International Workshop on Multimedia Signal Processing, pp. 1-5, 2019.

Z. Ying, M. Mandal, D. Ghadiyaram, and A. C. Bovik, 'Patch-VQ: 'Patching Up' the video quality problem,' in IEEE Conference on Computer Vision and Pattern Recognition, pp. 14019-14029, 2021.

D. P. Kingma and J. Ba, 'Adam: A method for stochastic optimization,' arXiv preprint arXiv :1412.6980, 2014.

V. Hosu, F. Hahn, M. Jenadeleh, H. Lin, H. Men, T. Szirányi, S. Li, and D. Saupe, 'The konstanz natural video database (KoNViD-1k),' in International Conference on Quality of Multimedia Experience (QoMEX) , pp. 1-6, 2017.

A.-X. Zhang and Y.-G. Wang, 'Texture information boosts video quality assessment,' in IEEE International Conference on Acoustics, Speech and Signal Processing, pp. 2050-2054, 2022.

E. Shumitskaya, A. Antsiferova, and D. Vatolin. 'Universal perturbation attack on differentiable noreference image- and video-quality metrics,' in British Machine Vision Conference , pp. 1-12, 2022.

A Rescaling boundary

Due to the differences of the estimated quality scores' scale among different NR-VQA models, we rescale the boundaries of 0 and 1 to the scale of the estimated quality scores for different NR-VQA models as

where MOS.mean and MOS.std denote the mean and variance of the normalized MOS in the selected 50 videos, respectively. EST.mean and EST.std denote the mean and variance of the estimated quality scores in the selected 50 videos, respectively. Note that in our proposed adversarial attack, the boundary is set according to a specific original video's MOS and a pre-defined threshold determined by the median of MOS within the batch. In practice, these two conditions may not be available to the attacker, and the solutions are as follows. The first condition is to obtain a specific video's MOS. It is reasonable to manually annotate the video, as it did in the adversarial attack in classification task in the case of unaware of the ground-truth label. As an alternative approach, we can also apply a well-trained VQA model to obtain the estimated quality score, which can be regarded as the approximated MOS. The second condition is to obtain the threshold. We can apply the approaches in the first condition to obtain the approximate MOS for each video within the dataset, and then calculate the median value as the threshold. Besides, considering the workload for processing huge number of videos within the batch, the threshold can also be set to the average of the upper bound and lower bound of the scoring range for the dataset.

B Ablation study of perturbation on a few frames

The adversarial effect with respect to the number of frames to be perturbed is investigated under both black-box and white-box settings. The experiments are conducted via attacking VSFA on the KoNViD-1k and LSVQ-Test datasets, and the results are given in Tables 8 and 9, respectively. It can be observed that as the proportion of perturbed frames decreases, the attack effect is degraded under both white-box and black-box settings. Specifically, due to the difficulties of black-box attack, there is barely any attack effect when only 1/10 of frames are perturbed. By contrast, under the white-box setting, the NR-VQA model can still be fooled when a small number of frames are perturbed.

Ratio

0

1/10

1/5

1/2

all

C Limitation and potential societal impact

In this paper, we mainly attack the VQA models in the spatial domain, which makes it difficult to achieve an ideal attack effect against models with rich temporal information, such as BVQA-2022. Meanwhile, optimization-based attack strategies need to generate specific perturbations for each video, which have high requirements on computing resources. Secondly, according to our work, people could launch deliberate attack on VQA models, which may reduce the users' confidence of experiencing the VQA systems. In spite of this, we believe that in order to build a reliable and practical assessment system, it is of great necessity to evaluate their robustness. Therefore, this paper can raise awareness of vulnerability in existing VQA models, which greatly outweighs its risk.

KoNViD-1k

SRCC

PLCC

0.7882

0.6836

0.6199

0.4287

-0.0305

0.8106

0.7511

0.7127

0.5447

0.0586

LSVQ-Test

SRCC

PLCC

0.7865

0.7097

0.6597

0.5050

0.2386

0.7972

0.7378

0.7113

0.6013

0.2413

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies the adversarial robustness of NR-VQA models. A new loss function called Score-Reversed Boundary Loss is designed to push the  estimated quality score of adversarial video far away from its MOS towards a specific boundary. It also proposes a patch-based random search method for black-box attack. The impercetibility of adversarial video is constrained by a L2-constraint.\n\nSTRENGTHS:\n+ It establishes the first work on evaluating the adversarial robustness of NR-VQA models with reasonable motivations.\n+ Both white-box and black-box attack methods are designed.\n+ Rich experiments are conducted on mainstreaming VQA datasets to evaluate the adversarial robustness of multiple NR-VQA models.\n+ Insightful analysis of the adversarial robustness of specific design choices of NR-VQA models are provided.\n\nWEAKNESSES:\n- The definitons of f_{e} and f_{d} are a bit confusing. In my view, the parameters of NR-VQA models are not changed during the adversarial attack, so it would be better to simply define a NR-VQA model as f, then f(I) and f(I_{adv}) will the estiamted quality of the original and perturbed video, respectively. It's better to denote the disturbed score using another symbol without subscript. \n\n- The disturbed score is actually a target score the median MOS of videos from a VQA dataset is set as the threshold to determine whether a video is of high quality or low quality. However, there won't be a dataset with ground-truth MOS before the adversarial attack in may cases. It is not clear how to set the boundary given an arbitrary video with or without MOS in practice.\n\n- The L2-norm constraint is used to ensure the invisibility of perturbation. Why not using other L-norm contrainst is not explained. \n\n-  Do the authors rescale the quality predictions of all NR-VQA models within the range [0, 1] using nonlinear mapping?\n\nQUESTIONS:\n1, Is it possible use other FR-IQA as the fidelity measure as in [42]?\n\n2, Is it possible to only perturb a few frames (not all of them as done in the proposed method) to fool an NR-VQA models?\n\nLIMITATIONS:\nNot applicable.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-08"}

comments: SUMMARY:
This paper proposes a patch-based random search method for white-box attacks and black-box attacks for NR-VQA models. A Score-Reversed Boundary Loss is proposed to push the adversarial video's estimated quality score far away from its MOS towards a specific boundary. And the robustness of NR-VQA models is evaluated.

STRENGTHS:
1. This paper investigates the robustness of SOTA NR-VQA models against adversarial attacks.

2. The Score-Reversed Boundary Loss gives a useful guide for the decrease of  SROCC and PLCC.

WEAKNESSES:
- The comparsion with existed methods should be contrained, like [Shumitskaya, BMVC, 2022].

[Shumitskaya, BMVC, 2022] Ekaterina Shumitskaya, Anastasia Antsiferova, and Dmitriy S Vatolin. Universal perturbation attack on differentiable no-reference image- and video-quality metrics. In 33rd British Machine Vision Conference 2022, BMVC 2022, London, UK, November 21-24, 2022. BMVA Press, 2022. URL https://bmvc2022.mpi-inf.mpg.de/0790.pdf.

QUESTIONS:
- What is the patch selection strategy for Line 8 in Algorithm 2? What is the generated strategy for $\mathbf{m}_n$ in Line 10 in Algorithm 2? And what is the visibility of the perturbation of the attacked images?
- Whether four NR-VQA models are strictly trained on the training set, and the samples to be attacked are selected in the test set? The re-trained progress is not mentioned in the paper.

LIMITATIONS:
No limitation and societal impact is discussed.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-06-26

comments: SUMMARY:
The paper studies the adversarial robustness of No Reference Video Quality Assessment Algorithms. The paper introduces a new loss function, "Score-Reversed Boundary Loss," and demonstrates its usefulness in designing adversarial attacks for NR VQA algorithms. Overall the paper is well written, contains adequate evaluations, and a decent amount of ablation studies.

STRENGTHS:
1. Introduces the new loss function "Score-Reversed Boundary Loss" and demonstrate its usefulness in designing attacks for NR VQA algorithms
2. Thorough experimentation of the proposed approach on multiple NR VQA algorithms. 
3. Decent amount of ablation study

WEAKNESSES:
1. Video Quality Assessment is a Perceptual Science, and JND is motivated by Vision Science principles. However, the authors base their work on the claim that strict L2 norms would be sufficient to uphold JND constraints. The work does not guarantee that the adversarial videos are under the JND constraint for a "Human Eye." In this work, human eyes have not verified the adversarial videos are indeed under the JND constraint and the attacks are effective and imperceptible. The authors should have conducted some human study to verify their JND claim of using a strict L2 norm.
2. Also, the hyperparameter T=1 set for black-box attack gives the highest scores but potentially results in some sort of temporal flickering. Something that can be verified only by human eyes and not an L2 norm constraint. 

Minor Typo :
1. Line 178 pathes -> patches?

QUESTIONS:
Can strict L2 norms always result in upholding JND constraints?

LIMITATIONS:
1. The JND constraint is not based on the principles of Vision Science.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2023-07-04

comments: SUMMARY:
The adversarial attacks against video quality assessment models are proposed in both white box and black box scenarios.

STRENGTHS:
1. The problem is important and practical. 
2. The attempt to avoid subjective testing is a good try.
3. The attacks seem to work as in Tables 1 and 2.

WEAKNESSES:
1. The authors claim that "the problem of constraining the distortion below the JND threshold can be converted into the problem of restricting their pixel-level L2 norm below a rather strict threshold." A simple thought experiment would reveal that this is not true. Even if the threshold is set to $1/255$, we can simply use this budget to modify only a local region of pixels to be above JND.
2. The proposed method resembles those presented in the image/video classification literature and thus lacks novelty.
3. Why not use $\ell_\infty$-norm as the primary JND constraint?
4. The JND constraint should be more mathematically or experimentally justified.

QUESTIONS:
1. Why $f_d(\cdot)$ needs to take the test video as input?
2. What are the motivations of Eq. (3)?
3. What does the universal perturbation mean in the black box attack?

LIMITATIONS:
N.A.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-05