A method and system for adversarial attack on an image quality assessment model based on a heat map guide

Abstract

The application provides a heat map guidance-based image quality evaluation model attack method and system, and belongs to the technical field of black-box attack. The method comprises the following steps: S1, obtaining an original image and a target image quality evaluation model, setting a perturbation constraint and a query parameter, generating an initial adversarial sample and initializing a sensitivity heat map; S2, selecting an image perturbation region according to the sensitivity heat map, updating the perturbation in combination with a dynamic scheduling strategy, generating a candidate adversarial sample and obtaining a model output; S3, performing reward, punishment and smoothing update on the sensitivity heat map according to the target function change of the candidate sample and the current sample; and S4, outputting a final adversarial sample when a termination condition is reached. The application can effectively solve the problems of low attack success rate, poor query efficiency and insufficient generalization ability of the existing adversarial attack method in the image quality evaluation task, and provides technical support for the robustness test, security evaluation and defense mechanism design of the image quality evaluation model.

Description

Technical Field

[0001] This invention belongs to the field of black-box adversarial attack technology, and relates to a method and system for adversarial attacks on image quality assessment models based on heatmap guidance. Background Technology

[0002] With the development of artificial intelligence technology, image quality assessment methods based on deep learning networks have been widely used in scenarios such as image enhancement algorithm selection, adaptive video bitrate control, mobile shooting quality assessment, and visual media distribution. The assessment results directly affect the accuracy of subsequent decisions and user experience. In recent years, image quality assessment models based on convolutional neural networks and Transformer structures have achieved significant performance improvements. However, research shows that these deep neural networks generally suffer from adversarial vulnerability, meaning that even minute perturbations imperceptible to the human eye can significantly alter the model output, posing a potential threat to system reliability. Adversarial attacks can not only reveal model robustness defects but also promote model optimization and improvement by constructing extreme samples, which is of great significance for improving model stability and advancing perceptual modeling research.

[0003] Existing adversarial attack methods are mainly divided into transfer-based attack methods and query-based attack methods. Transfer-based attack methods generate adversarial examples under white-box conditions by constructing alternative models and then transferring them to the target model. They do not require access to the target model but rely on the structural similarity between the models. Query-based attack methods, on the other hand, interact with the target model and use output feedback to gradually optimize the perturbation. These include boundary search methods based on decision information and gradient estimation methods based on scoring information. These methods do not rely on alternative models but usually require high query overhead.

[0004] However, existing methods are mostly designed for image classification tasks and have significant limitations in image quality assessment scenarios. First, image quality assessment is a continuous output regression task, lacking a clear decision boundary, making boundary search-based attack methods difficult to implement effectively. Second, these models rely on global perception information, and perturbations in a single local region are unlikely to significantly affect the overall score, thus limiting the effectiveness of traditional attack strategies based on local sensitivity. In addition, gradient estimation methods based on scores are prone to bias in this scenario, reducing optimization efficiency and attack performance.

[0005] To address the aforementioned issues, existing technologies have improved two types of methods. In transfer-based methods, the transferability of adversarial examples is enhanced through multi-model ensembles, frequency domain perturbations, and feature space optimization, but the performance instability caused by differences in model structure remains difficult to overcome. In query-based methods, perturbation generation is guided by introducing prior information such as texture features, edge information, or salient regions to improve attack efficiency; however, these methods rely on specific priors or data distributions, have weak generalization ability, and their attack effectiveness is uncertain. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a heatmap-guided adversarial attack method and system for image quality assessment models, which solves the problem that existing adversarial attacks are limited in image quality assessment tasks due to the lack of decision boundaries, global perception characteristics, and inaccurate gradient estimation.

[0007] To achieve the above objectives, the present invention provides the following technical solution: A heatmap-guided adversarial attack method for image quality assessment models, comprising the following steps: S1. Initialization phase: Obtain the original image and target image quality assessment model, set perturbation constraints and query parameters, generate initial adversarial examples, and initialize the sensitivity heatmap and optimization target; S2. Heatmap-guided region selection and global perturbation update: During the iteration process, image regions are selected based on the sensitivity heatmap, and the region selection ratio is controlled by a dynamic scheduling strategy, so that the optimization process gradually transitions from the initial global exploration to the fine optimization of key regions; the perturbation is updated in the selected regions to generate candidate adversarial examples, which are then input into the target model to obtain the output results. S3. Dynamic Update of Heatmap: Based on the changes of candidate adversarial samples on the objective function relative to the current best sample, the sensitivity heatmap of the selected region is updated; when the perturbation improves the attack effect, the weight of the corresponding region is increased; otherwise, its weight is decreased, and the heatmap is smoothed and attenuated to maintain a stable spatial distribution. S4. Termination and Output: When the maximum number of queries is reached or the preset convergence condition is met, the iteration process is terminated and the final generated adversarial example is output.

[0008] Furthermore, step S1 specifically includes: S11. Obtain the original image and target model: Obtain the original image ,in , representing the height, width, and number of channels of the image, respectively; obtain the target image quality assessment model. Its output is a quality score. ,in and These are the lower and upper bounds of the scoring range, respectively; set the disturbance constraint threshold. This is used to limit the amplitude of counter-perturbations, making them imperceptible to the human eye; it also sets the maximum number of queries. And optimize relevant parameters; S12. Generate a random matrix of the same size as the original image. Its elements independently follow a uniform distribution. Construct an initial perturbation based on the aforementioned random matrix:

[0009] in, This represents an element-wise symbolic function, whose output value is... The initial perturbation is superimposed onto the original image to obtain the initial adversarial example:

[0010] in, This indicates a cropping operation on pixel values, restricting them to a range. Inside, to ensure the validity of the image; S13. Calculate the quality score of the original image. ; Regarding the first Adversarial examples generated in the next iteration Define its corresponding loss function. for:

[0011] in, This represents the preset quality score threshold, used to distinguish between low-quality and high-quality images; based on the above loss function, the optimization objective against perturbation is constructed as follows:

[0012] in, This indicates resistance to disturbances. ; S14. Initialize the sensitivity heatmap It corresponds one-to-one with the input image space and is used to represent the potential contribution of each pixel region to the model output; the initial value of the heatmap is set to a zero matrix or uniform distribution, and can be dynamically updated according to the model feedback in subsequent iterations.

[0013] Furthermore, step S2 specifically includes: S21, Based on the current iteration number and maximum number of iterations Dynamically calculate the current disturbance ratio :

[0014] in, This represents the initial perturbation ratio. For scheduling coefficients; according to Calculate the side length of each perturbation region :

[0015] in, This indicates a floor operation, which rounds down to the largest integer not greater than the result within the parentheses, to ensure the side length of the perturbation region is maintained. It is an integer; S22. Construct a hybrid region selection strategy based on a combination of sensitivity heatmap guidance and random selection; set the initial random selection probability. The probability of heatmap guidance is As the number of iterations increases, the probability of random selection gradually decreases.

[0016] in, The minimum random selection probability is preset. In each iteration, with The probability of randomly selecting a disturbance region, in order to The probability is selected based on the current sensitivity heatmap to determine the perturbation region; when using heatmap-guided selection, the current sensitivity heatmap is first evaluated. After normalization, the probability distribution of each pixel position being selected is obtained:

[0017] in, To prevent extremely small constants with a denominator of zero, a weighted random sampling method is then used based on this probability distribution to select... There are several regional center points, with each center point as the center and a side length of [missing information]. Construct a square perturbation region; regions with higher probability are also more likely to be selected. S23. Within the selected area, address the current disturbance. Update and generate candidate perturbations. The specific update method is as follows:

[0018] in: It is the perturbation constraint threshold. This is a region mask; it sets 1 to the selected region and 0 to the rest. ⊙ represents element-wise multiplication. Given a random matrix; construct candidate adversarial examples based on candidate perturbations:

[0019] S24, Select candidate samples Input the target model and calculate its loss value:

[0020] If the following conditions are met Then accept the update. Otherwise, keep the original perturbation: .

[0021] Furthermore, step S3 specifically includes: S31, in the In the next iteration, let the current adversarial example be... Candidate adversarial examples are Calculate the corresponding loss value for each. and The change in loss is defined as:

[0022] in, Let the loss function defined in step S13 be ; let the mask corresponding to the perturbation region selected in this iteration be . The change in loss is then allocated to the selected region, resulting in the updated regional contribution:

[0023] when This indicates that the candidate perturbation improves the attack effect, and the corresponding area receives a positive reward; conversely, it receives negative feedback. S32. Iteratively update the sensitivity heatmap based on the regional contribution update amount:

[0024] in: The updated coefficients are used to control the trade-off between historical information and current feedback. and These represent the heatmaps before and after the update, respectively. To avoid the heatmaps being too discrete or too concentrated, a spatial smoothing operation is introduced.

[0025] in, This represents a heatmap before spatial smoothing. The spatial smoothing function can be represented by mean filtering or Gaussian filtering in this embodiment; further, the updated heatmap is normalized:

[0026] in, To prevent extremely small constants with a denominator of zero.

[0027] The present invention also provides an adversarial attack system for an image quality assessment model based on a heatmap, which employs the method described above.

[0028] The beneficial effects of this invention are as follows: This invention proposes a heatmap-guided adversarial attack method and system for image quality assessment models. By constructing a directional loss function, introducing a sensitive heatmap dynamic modeling mechanism, and designing region selection and perturbation scheduling strategies, it achieves effective perturbation of the image quality assessment model output under black-box conditions. This provides a reliable technical means for model robustness analysis and security assessment. Its advantages are: this invention can improve the ability to characterize the model's response changes under adversarial perturbation, thus enhancing the effectiveness of robustness assessment, especially considering the continuous scoring output of image quality assessment models; and through a perturbation strategy combining global optimization and local fine-tuning, it more comprehensively reveals the model's performance under perturbation-constrained conditions. This invention reveals potential vulnerable areas of the model, helping to improve the coverage and accuracy of security assessments. By dynamically modeling the importance of image regions through sensitivity heatmaps, it achieves adaptive perturbation allocation, enhancing the analytical capabilities of key decision-making regions of the model while improving attack efficiency. Furthermore, by introducing a dynamic update mechanism based on loss changes and smoothing processing, the stability and generalization ability of the method are improved under different image and model conditions, thereby enhancing the reliability of the assessment results. In addition, this invention does not require obtaining the internal structure or gradient information of the target model; it only relies on output feedback to achieve adversarial attacks, making it suitable for security testing and robustness assessment in black-box environments, and possessing good versatility and practical application value.

[0029] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0030] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein: Figure 1 This is a flowchart illustrating the steps of an adversarial attack method for an image quality assessment model based on a heatmap-guided approach, as described in an embodiment of the present invention. Figure 2 This is a schematic diagram of the framework of an adversarial attack method for an image quality assessment model based on heatmap guidance in an embodiment of the present invention; Figure 3 This is a visual example diagram of the present invention. Detailed Implementation

[0031] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0032] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0033] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "front," and "rear" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0034] like Figures 1 to 3 The accompanying drawings are related to the methods and systems involved in the embodiments of the present invention. Each drawing illustrates the method flow, system structure, and key mechanisms of the present invention from different perspectives. Figure 1 Used to describe the overall execution process. Figure 2 Used to demonstrate the overall framework structure of the method. Figure 3 Used to illustrate the perturbation update process guided by heatmaps.

[0035] like Figure 1The diagram shown is a flowchart illustrating the overall execution process of the present invention. This flowchart describes the overall execution process of the invention, including an initialization phase, a heatmap-guided region selection and perturbation update phase, and a heatmap dynamic update phase. Specifically, the process begins at the start node in the initialization phase, where the original image, the target image quality assessment model, and related parameters are set, and initial adversarial samples and sensitivity heatmaps are generated. Subsequently, the perturbation optimization phase begins, where image regions are selected based on the current heatmap, candidate perturbations are generated, and model queries are performed on the candidate adversarial samples to calculate the corresponding loss values. Based on this, a decision mechanism is used to determine whether to accept the current perturbation update and whether the maximum number of iterations has been reached. If not, the perturbation update process continues until the termination condition is met, at which point the final adversarial sample is output.

[0036] Based on the above process, such as Figure 2 The diagram shown illustrates the overall framework of the method of this invention. From a structural perspective, it illustrates the main components of the invention and their relationships, including the original image input module, the image quality assessment model, the perturbation generation module, and the heatmap guidance module. The original image is input to the image quality assessment model to obtain a quality score. The perturbation generation module generates candidate adversarial examples based on the current perturbation state and inputs them back into the model to obtain feedback. The heatmap guidance module models the image space based on the model output and uses it to guide region selection during the perturbation generation process, thus forming a closed-loop processing structure based on model feedback.

[0037] Furthermore, such as Figure 3 The figure illustrates the relationship between the sensitivity heatmap and the perturbation distribution, as well as their dynamic changes, during iterative optimization. Initially, the perturbations are relatively uniformly distributed in the image space. As iterations proceed, the heatmap is updated based on changes in the model output, and the importance of different regions gradually becomes apparent. In subsequent iterations, the perturbations gradually concentrate in regions with higher weights in the heatmap, thus forming a spatial distribution structure that changes continuously with each iteration.

[0038] Combination Figure 1 and Figure 2 The specific scheme of the method shown is as follows: S1. Initialization phase: Obtain the original image and target image quality assessment model, set perturbation constraints and query parameters, generate initial adversarial examples, and initialize the sensitivity heatmap and optimization target.

[0039] As an optional implementation, to verify the applicability of the method under different data distributions and model structures, experiments were conducted using multiple image quality assessment datasets and image quality assessment models with different architectures. Specifically, the datasets included the LIVE (Laboratory for Image and Video Engineering) image quality assessment dataset, the CSIQ (Categorical Subjective Image Quality) dataset, and the TID2013 (Tampere ImageDatabase 2013) dataset. These datasets differ in image resolution, content type, and distortion type, covering various typical distortion forms such as compression distortion, blur distortion, and noise distortion, to cover diverse image quality assessment scenarios. The image quality assessment models employed different structural types of no-reference image quality assessment models, including models based on convolutional neural networks, models based on feature fusion, and models based on attention mechanisms or Transformer structures. In specific embodiments, the models include DBCNN (Deep Bilinear Convolutional Neural Network), UNIQUE (Unsupervised Image Quality Estimation), TReS (Transformer-based Image Quality Assessment), and LIQE (Learning-based Image Quality Evaluation). All of these models are used to score the output quality of the input image. Under the above conditions, the method of this invention performs perturbation optimization based on the model output, independent of any specific model structure or specific data distribution.

[0040] Specifically, S1 includes the following steps: S11. Obtain the original image The original image is the input image to be evaluated for quality, and its pixel values ​​are normalized to a range. Image size is Simultaneously, acquire the target image quality assessment model. The model is a pre-trained no-reference image quality assessment model used to output a quality score for the input image. A perturbation constraint threshold is set. This is used to limit the magnitude of the counter-perturbation; it also sets the maximum number of iterations. This is used to control the algorithm termination condition; it also sets the initial value of the perturbation ratio. and the number of regional updates It is used to control the scope and scale of the region involved in optimization during subsequent perturbation updates.

[0041] S12. Generate an initial perturbation of the same size as the original image. The perturbation is a randomly initialized matrix whose element values ​​are limited to a certain interval. Specifically, by generating a random matrix And calculate The initial perturbation is superimposed onto the original image, and the pixel values ​​are restricted to a legal range through a cropping operation to obtain the initial adversarial example.

[0042] S13, Transfer the original image Input the image quality assessment model to obtain the corresponding quality score. Based on this scoring result, a directional optimization strategy is set, when the original score... When the original score is high, the optimization direction is to improve the adversarial example score; when the original score is low... At that time, the optimization direction is to reduce the adversarial example score; construct the loss function for adversarial attacks:

[0043] Based on the above loss function, the optimization objective against perturbations is to minimize the loss value while satisfying the infinity norm constraint. .

[0044] S14. Initialize the sensitivity heatmap Its size is consistent with the spatial resolution of the input image, and it is used to characterize the potential influence of each region of the image on the model output. In one embodiment, the initial values ​​of the heatmap are set to a uniform distribution or a zero matrix, as the initial state for subsequent iterative updates.

[0045] S2. Heatmap-guided region selection and global perturbation update: During the iteration process, image regions are selected based on the sensitivity heatmap, and the region selection ratio is controlled by a dynamic scheduling strategy, so that the optimization process gradually transitions from the initial global exploration to the fine optimization of key regions; the perturbation is updated in the selected region to generate candidate adversarial samples, and the results are input into the target model to obtain the output.

[0046] Specifically, S2 includes the following steps: S21, Based on the current iteration number and maximum number of iterations Dynamically calculate the current disturbance ratio :

[0047] In this embodiment, the initial perturbation ratio Scheduling coefficient ;according to Calculate the side length of each perturbation region :

[0048] S22. Construct a hybrid region selection strategy based on a combination of sensitivity heatmap guidance and random selection. Set the initial random selection probability. The probability of heatmap guidance is As the number of iterations increases, the probability of random selection gradually decreases.

[0049] Among them, the minimum random selection probability .

[0050] In each iteration, with The probability of randomly selecting a disturbance region, in order to The probability of selecting a disturbance region is based on the current sensitivity heatmap. When using heatmap-guided selection, the current sensitivity heatmap is first... After normalization, the probability distribution of each pixel position being selected is obtained:

[0051] in, To prevent extremely small constants with a denominator of zero, a weighted random sampling method is then used based on this probability distribution to select... There are several regional center points, with each center point as the center and a side length of [missing information]. Construct a square perturbation region; regions with higher weights in the heatmap are more likely to be selected.

[0052] S23. Within the selected area, address the current disturbance. Update and generate candidate perturbations. The specific update method is as follows:

[0053] Where: Disturbance constraint threshold , This is a region mask; it sets 1 to the selected region and 0 to the rest. ⊙ represents element-wise multiplication. Given a random matrix; construct candidate adversarial examples based on candidate perturbations:

[0054] S24, Select candidate samples Input the target model and calculate its loss value:

[0055] If the following conditions are met Then accept the update. Otherwise, keep the original perturbation: .

[0056] S3. Dynamic Update of Heatmap: Based on the changes of candidate adversarial samples on the objective function relative to the current best sample, the sensitivity heatmap of the selected region is updated; when the perturbation improves the attack effect, the weight of the corresponding region is increased; otherwise, its weight is decreased, and the heatmap is smoothed and attenuated to maintain a stable spatial distribution.

[0057] Specifically, S3 includes the following steps: S31, in the In the next iteration, let the current adversarial example be... Candidate adversarial examples are Calculate the corresponding loss value for each. and Define the change in loss as:

[0058] in, Let the loss function defined in step S13 be ; let the mask corresponding to the perturbation region selected in this iteration be . The change in loss is then allocated to the selected region, resulting in the updated regional contribution:

[0059] when This indicates that the candidate perturbation enhances the attack effect, and the corresponding area receives a positive reward; when When, it indicates that the candidate perturbation reduces the attack effect, and the corresponding region receives negative feedback; when At that time, the corresponding area does not receive any feedback.

[0060] S32. Iteratively update the sensitivity heatmap based on the regional contribution update amount:

[0061] In this embodiment, the update coefficients This is used to control the trade-off between historical information and current feedback; to avoid the heatmap distribution being too discrete or concentrated, a spatial smoothing operation is introduced. In this embodiment, Gaussian filtering is used for smoothing.

[0062] Furthermore, the updated heatmap is normalized:

[0063] in, To prevent extremely small constants with a denominator of zero; the normalized thermogram satisfies It can be used for region selection in the next iteration.

[0064] S4. Termination and Output: When the maximum number of queries is reached or the preset convergence condition is met, the iteration process is terminated and the final generated adversarial example is output.

[0065] See Figure 3 This diagram illustrates the evolution of the sensitivity heatmap with iteration counts in an embodiment of the invention. It shows the spatial distribution changes of the sensitivity heatmap and the corresponding adversarial perturbation distribution at different iteration stages. As can be seen from the diagram, in the early optimization stage (0-2500 iterations), the heatmap distribution is relatively uniform, and perturbations are scattered across the entire image. At this time, the algorithm mainly uses random queries to establish an initial baseline of sensitivity for each region, ensuring sufficient global exploration capability. In the middle optimization stage (2500-7500 iterations), the heatmap gradually focuses on several highly sensitive regions, and perturbations gradually concentrate on key regions that have a significant impact on the model output. At this time, the algorithm prioritizes perturbation optimization of regions with higher weights in the heatmap, significantly improving attack efficiency. In the later optimization stage (7500-10000 iterations), highly sensitive regions tend towards local optima. The heatmap, through a reward-feedback mechanism, begins to focus on previously low-weight non-sensitive regions, achieving a reasonable allocation of global perturbations and avoiding insufficient optimization due to excessive focus on local areas. The above results show that the method of the present invention can adaptively guide the perturbation from global exploration to fine optimization of key areas while ensuring the concealment of the perturbation (the perturbation is always controlled within a threshold range imperceptible to the human eye). It effectively solves the problem that the attack effect of existing methods in image quality assessment tasks is limited due to neglecting global perception characteristics or over-reliance on local priors. It significantly improves the success rate and query efficiency of black-box attacks, while having good generalization ability and stability.

[0066] In this embodiment, our method is compared and analyzed with existing representative black-box adversarial attack methods. The methods compared include SHJA (an efficient black-box attack method based on decision boundaries) and Bandit (a gradient estimation attack method based on confidence scores). Experiments were conducted on the three standard image quality assessment datasets mentioned above and four different architectures of no-reference image quality assessment models. RGO (Rating Shift Ratio), SRCC (Spearman Rank Correlation Coefficient), and PLCC (Pearson Linear Correlation Coefficient) were used as evaluation metrics. A higher RGO value indicates a greater relative shift in the quality score of the adversarial example along the predetermined attack direction, meaning a more significant attack effect. A lower SRCC value indicates a worse consistency between the quality ranking output by the model after the attack and the subjective quality ranking, indicating a more severe disruption to the model's judgment of the relative quality relationships of different images. A lower PLCC value indicates a weaker linear correlation between the model's predicted score and the subjective quality score after the attack, indicating a more significant impact on the overall accuracy and stability of the model's scoring.

[0067] Table 1. Performance comparison of different black-box attack methods on four no-reference image quality assessment models.

[0068] As shown in Table 1, the method of this invention significantly outperforms SHJA and Bandit methods in all scenarios. The poor performance of traditional methods is due to the following reasons: SHJA relies on the explicit decision boundary in classification tasks, while image quality assessment is a continuous regression task lacking boundary definition, making it difficult to implement effectively; Bandit relies on gradient estimation, but the global perception characteristic of image quality assessment models leads to severe bias in local gradient estimation, limiting the attack effect. The method of this invention addresses the problem of missing decision boundaries by constructing a directional loss function, employs a global perturbation optimization combined with a heatmap-guided strategy to balance the global perception characteristic and regional sensitivity differences of image quality assessment models, and introduces a dynamic heatmap update mechanism based on loss changes to avoid gradient estimation bias. Experimental results show that the method of this invention can reduce the SRCC and PLCC indices of the image quality assessment model to a negative correlation level, effectively destroying the model's ranking ability, and significantly outperforming existing black-box attack methods.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A heatmap-guided adversarial attack method for image quality assessment models, characterized in that, The method specifically includes the following steps: S1. Initialization phase: Obtain the original image and target image quality assessment model, set perturbation constraints and query parameters, generate initial adversarial examples, and initialize the sensitivity heatmap and optimization target; S2. Heatmap-guided region selection and global perturbation update: During the iteration process, image regions are selected based on the sensitivity heatmap, and the region selection ratio is controlled by a dynamic scheduling strategy, so that the optimization process gradually transitions from the initial global exploration to the fine optimization of key regions; the perturbation is updated in the selected regions to generate candidate adversarial examples, which are then input into the target model to obtain the output results. S3. Dynamic Update of Heatmap: Based on the changes of candidate adversarial samples on the objective function relative to the current best sample, the sensitivity heatmap of the selected region is updated; when the perturbation improves the attack effect, the weight of the corresponding region is increased; otherwise, its weight is decreased, and the heatmap is smoothed and attenuated to maintain a stable spatial distribution. S4. Termination and Output: When the maximum number of queries is reached or the preset convergence condition is met, the iteration process is terminated and the final generated adversarial example is output. Step S3 specifically includes: S31, in the In the next iteration, let the current adversarial example be... Candidate adversarial examples are Calculate the corresponding loss value for each. and The change in loss is defined as: Let the mask corresponding to the perturbation region selected in this iteration be . The change in loss is then allocated to the selected region, resulting in the updated regional contribution: when This indicates that the candidate perturbation improves the attack effect, and the corresponding area receives a positive reward; conversely, it receives negative feedback. S32. Iteratively update the sensitivity heatmap based on the regional contribution update amount: in: The updated coefficients are used to control the trade-off between historical information and current feedback. and These represent the heatmaps before and after the update, respectively. To avoid the heatmaps being too discrete or too concentrated, a spatial smoothing operation is introduced. in, This represents a heatmap before spatial smoothing. The function represents a spatial smoothing function; it normalizes the updated heatmap. in, To prevent extremely small constants with a denominator of zero.

2. The adversarial attack method for image quality assessment model based on heatmap guidance according to claim 1, characterized in that, Step S1 specifically includes: S11. Obtain the original image and target model: Obtain the original image ,in , Indicates the height of the image, Indicates the width of the image. Represents the number of channels in an image; obtains the target image quality assessment model. Its output is a quality score. ,in and These are the lower and upper bounds of the scoring range, respectively; set the disturbance constraint threshold. This is used to limit the amplitude of counter-perturbations, making them imperceptible to the human eye; it also sets the maximum number of queries. And optimize relevant parameters; S12. Generate a random matrix of the same size as the original image. Its elements independently follow a uniform distribution. Construct an initial perturbation based on the aforementioned random matrix: in, This represents an element-wise symbolic function, whose output value is... The initial perturbation is superimposed onto the original image to obtain the initial adversarial example: in, This indicates a cropping operation on pixel values, restricting them to a range. Inside, to ensure the validity of the image; S13. Calculate the quality score of the original image. ; Regarding the first Adversarial examples generated in the next iteration Define its corresponding loss function. for: in, This represents the preset quality score threshold, used to distinguish between low-quality and high-quality images; based on the above loss function, the optimization objective against perturbation is constructed as follows: in, This indicates resistance to disturbances. Indicates the infinite norm constraint; S14. Initialize the sensitivity heatmap It corresponds one-to-one with the input image space and is used to represent the potential contribution of each pixel region to the model output; the initial value of the heatmap is set to a zero matrix or uniform distribution, and can be dynamically updated according to the model feedback in subsequent iterations.

3. The adversarial attack method for image quality assessment model based on heatmap guidance according to claim 2, characterized in that, Step S2 specifically includes: S21, Based on the current iteration number and maximum number of iterations Dynamically calculate the current disturbance ratio : in, This represents the initial perturbation ratio. For scheduling coefficients; according to Calculate the side length of each perturbation region : in, This indicates a floor operation, which rounds down to the largest integer not greater than the result within the parentheses, to ensure the side length of the perturbation region is maintained. It is an integer; S22. Construct a hybrid region selection strategy based on a combination of sensitivity heatmap guidance and random selection; set the initial random selection probability. The probability of heatmap guidance is The probability of random selection increases with the number of iterations. Gradual decay: in, The minimum random selection probability is preset. In each iteration, with The probability of randomly selecting a disturbance region, in order to The probability is selected based on the current sensitivity heatmap to determine the perturbation region; when using heatmap-guided selection, the current sensitivity heatmap is first evaluated. After normalization, the probability distribution of each pixel position being selected is obtained: in, Indicates the pixel position in the heatmap The corresponding sensitivity score, This represents the sum of the location sensitivity scores of all pixels in the current heatmap. To prevent extremely small constants with a denominator of zero, a weighted random sampling method is then used based on this probability distribution to select... There are several regional center points, with each center point as the center and a side length of [missing information]. Construct a square perturbation region; regions with higher probability are also more likely to be selected. S23. Within the selected area, address the current disturbance. Update and generate candidate perturbations. The specific update method is as follows: in: It is the perturbation constraint threshold. This is a region mask; it sets 1 to the selected region and 0 to the rest. ⊙ represents element-wise multiplication. Given a random matrix; construct candidate adversarial examples based on candidate perturbations: S24, Select candidate samples Input the target model and calculate its loss value: If the following conditions are met Then accept the update. Otherwise, keep the original perturbation: .

4. A heatmap-guided image quality assessment model adversarial attack system, characterized in that, The system employs the method as described in any one of claims 1 to 3.

Images