IOI: Invisible One-Iteration Adversarial Attack on No-Reference Image- and Video-Quality Metrics
Authors: Ekaterina Shumitskaya, Anastasia Antsiferova, Dmitriy S. Vatolin
ICML 2024 | Conference PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | We compared our method alongside eight prior approaches using image and video datasets via objective and subjective tests. Our method exhibited superior visual quality across various attacked metric architectures while maintaining comparable attack success and speed. We made the code available on Git Hub: https: //github.com/katiashh/ioi-attack. |
| Researcher Affiliation | Academia | 1ISP RAS Research Center for Trusted Artificial Intelligence, Moscow, Russia 2MSU Institute for Artificial Intelligence Moscow, Russia 3Lomonosov Moscow State University, Moscow, Russia. Correspondence to: Ekaterina Shumitskaya <ekaterina.shumitskaya@graphics.cs.msu.ru>. |
| Pseudocode | Yes | Algorithm 1 Relative gain aligning |
| Open Source Code | Yes | We made the code available on Git Hub: https: //github.com/katiashh/ioi-attack. |
| Open Datasets | Yes | NIPS2017 image dataset (2017) was used to evaluate attacks on three NR metrics. For evaluating methods on videos, we used 12 videos with 1280 720 resolution from the DERF dataset (2001). The datasets licenses allow usage for research purposes. |
| Dataset Splits | No | The paper does not specify explicit training, validation, or test dataset splits for its own experimental setup. It uses existing datasets to evaluate its attack method on pre-trained NR metrics. |
| Hardware Specification | Yes | The Py Torch realization of the IOI attack allows reaching 8 fps on the NVIDIA Tesla T4 GPU. |
| Software Dependencies | No | The paper mentions "PyTorch realization" but does not specify a version number for PyTorch or any other software dependencies. |
| Experiment Setup | Yes | Initially, we ran the proposed method with fixed parameters (lr = 0.1 and f = 0.07 for image data and lr = 0.1 and f = 0.05 for video data). To achieve high attack speed, our method yields perturbation by calculating the gradient of an attacked model using one access to the model. We further show that a one-iteration attack for each frame is more efficient than a many-iteration attack applied to only some frames. We employed an automatic process described in Algorithm 1 to ensure equal relative gain. Each attack has a parameter to regulate its strength. We denote this parameter as lr. The search process also halted if the reached relative gain did not improve for n = 5 search iterations. |