FS-IQA: Certified Feature Smoothing for Robust Image Quality Assessment
This work addresses robustness for IQA models used in applications like image processing and computer vision, offering a novel defense method that is incremental over prior certified approaches.
The paper tackles the problem of making Image Quality Assessment (IQA) models robust to adversarial attacks by proposing a certified defense method that applies noise in the feature space instead of the input space, resulting in up to 30.9% improvement in correlation with subjective quality scores and reducing inference time by 99.5% without certification.
We propose a novel certified defense method for Image Quality Assessment (IQA) models based on randomized smoothing with noise applied in the feature space rather than the input space. Unlike prior approaches that inject Gaussian noise directly into input images, often degrading visual quality, our method preserves image fidelity while providing robustness guarantees. To formally connect noise levels in the feature space with corresponding input-space perturbations, we analyze the maximum singular value of the backbone network's Jacobian. Our approach supports both full-reference (FR) and no-reference (NR) IQA models without requiring any architectural modifications, suitable for various scenarios. It is also computationally efficient, requiring a single backbone forward pass per image. Compared to previous methods, it reduces inference time by 99.5% without certification and by 20.6% when certification is applied. We validate our method with extensive experiments on two benchmark datasets, involving six widely-used FR and NR IQA models and comparisons against five state-of-the-art certified defenses. Our results demonstrate consistent improvements in correlation with subjective quality scores by up to 30.9%.