ML Security PapersBiRQA: Bidirectional Robust Quality Assessment for Images
Aleksandr Gushchin 1,2,3, Dmitriy S. Vatolin 1,2,3, Anastasia Antsiferova 1,2,4
1 ISP RAS Research Center for Trusted Artificial Intelligence
2 MSU Institute for Artificial Intelligence
Published on arXiv
2602.20351
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Anchored Adversarial Training lifts SROCC from 0.30–0.57 to 0.60–0.84 on KADID-10k under unseen white-box attacks, making BiRQA the only FR IQA model combining SOTA accuracy, real-time speed (~15 FPS at 1920×1080), and strong adversarial resilience.
Anchored Adversarial Training
Novel technique introduced
Full-Reference image quality assessment (FR IQA) is important for image compression, restoration and generative modeling, yet current neural metrics remain slow and vulnerable to adversarial perturbations. We present BiRQA, a compact FR IQA metric model that processes four fast complementary features within a bidirectional multiscale pyramid. A bottom-up attention module injects fine-scale cues into coarse levels through an uncertainty-aware gate, while a top-down cross-gating block routes semantic context back to high resolution. To enhance robustness, we introduce Anchored Adversarial Training, a theoretically grounded strategy that uses clean "anchor" samples and a ranking loss to bound pointwise prediction error under attacks. On five public FR IQA benchmarks BiRQA outperforms or matches the previous state of the art (SOTA) while running ~3x faster than previous SOTA models. Under unseen white-box attacks it lifts SROCC from 0.30-0.57 to 0.60-0.84 on KADID-10k, demonstrating substantial robustness gains. To our knowledge, BiRQA is the only FR IQA model combining competitive accuracy with real-time throughput and strong adversarial resilience.
Key Contributions
- BiRQA architecture: bidirectional multiscale pyramid with uncertainty-aware bottom-up (CSRAM) and top-down (SCGB) cross-scale gating for precise FR IQA
- Anchored Adversarial Training: theoretically grounded strategy using clean anchor samples and a ranking loss to provably bound pointwise prediction error under adversarial perturbations
- Lifts SROCC from 0.30–0.57 to 0.60–0.84 on KADID-10k under unseen white-box attacks while running ~3× faster than previous SOTA
🛡️ Threat Analysis
The paper's central security contribution is Anchored Adversarial Training, a defense against adversarial perturbations (white-box attacks) that manipulate neural FR IQA model outputs at inference time. The threat model, benchmarking under unseen attacks, and the novel training strategy are all squarely within the adversarial example defense space.