ML Security PapersFS-IQA: Certified Feature Smoothing for Robust Image Quality Assessment
Ekaterina Shumitskaya 1,2,3, Dmitriy Vatolin 1,2,3, Anastasia Antsiferova 1,2,3,4
Published on arXiv
2508.05516
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Feature-space randomized smoothing improves correlation with subjective quality scores by up to 30.9% over prior certified defenses while reducing inference time by 99.5% and improving empirical robustness by 69.9%
FS-IQA
Novel technique introduced
We propose a novel certified defense method for Image Quality Assessment (IQA) models based on randomized smoothing with noise applied in the feature space rather than the input space. Unlike prior approaches that inject Gaussian noise directly into input images, often degrading visual quality, our method preserves image fidelity while providing robustness guarantees. To formally connect noise levels in the feature space with corresponding input-space perturbations, we analyze the maximum singular value of the backbone network's Jacobian. Our approach supports both full-reference (FR) and no-reference (NR) IQA models without requiring any architectural modifications, suitable for various scenarios. It is also computationally efficient, requiring a single backbone forward pass per image. Compared to previous methods, it reduces inference time by 99.5% without certification and by 20.6% when certification is applied. We validate our method with extensive experiments on two benchmark datasets, involving six widely-used FR and NR IQA models and comparisons against five state-of-the-art certified defenses. Our results demonstrate consistent improvements in correlation with subjective quality scores by up to 30.9%.
Key Contributions
- First certified defense for IQA operating in feature space rather than input space, preserving visual quality while guaranteeing robustness for both FR and NR IQA models without architectural modification
- Theoretical connection between feature-space noise levels and input-space perturbation radii via analysis of the maximum singular value of the backbone's Jacobian matrix
- Computationally efficient certification reducing inference time by 99.5% (uncertified) and 20.6% (certified) compared to prior methods, while improving quality score correlation by up to 30.9%
🛡️ Threat Analysis
Paper directly defends IQA models against adversarial input perturbations at inference time. The core contribution is a certified robustness method (randomized smoothing in feature space) that provides formal guarantees bounding quality score variations under adversarial input-space perturbations.