AnAT: Anchor-Based Adversarial Training for Image Quality Assessment
https://doi.org/10.15514/ISPRAS-2026-38(1)-16
Abstract
Full-Reference image quality assessment (FR-IQA) is essential for image compression, restoration, and generative modeling, yet current neural metrics remain slow and highly vulnerable to adversarial perturbations. We introduce Anchored Adversarial Training (AnAT) – a theoretically grounded defense strategy that employs clean “anchor” samples and a ranking-based regularization to explicitly bound pointwise prediction error under attacks. AnAT can be seamlessly integrated into existing FR-IQA architectures to enhance their robustness without degrading performance on clean data. Extensive experiments on five public FR-IQA benchmarks demonstrate that AnAT significantly improves resistance to unseen white-box attacks, lifting SROCC from 0.30–0.57 to 0.60–0.84 on KADID-10k, while maintaining or exceeding the accuracy of unprotected baselines. To our knowledge, this is the first adversarial training framework tailored specifically for full-reference IQA models.
Supporting agencies: The research was carried out using the MSU-270 supercomputer of Lomonosov Moscow State University.
About the Authors
Aleksandr Evgenievich GUSHCHIN
MSU Institute for Artificial Intelligence,
Ivannikov Institute for System Programming of the Russian Academy of Sciences,
Lomonosov Moscow State University
Russian Federation
Russian Federation
Received his M.S. degree in computer science from the Moscow State University in 2024. He is currently a postgraduate student at the MSU Graphics & Media Lab. His research interests involve image and video processing, quality assessment, and machine learning. Aleksandr is also a key contributor to the project analyzing video quality assessment methods, including their robustness to adversarial attacks.
Anastasia Vsevolodovna ANTSIFEROVA
MSU Institute for Artificial Intelligence,
Ivannikov Institute for System Programming of the Russian Academy of Sciences,
Lomonosov Moscow State University
Russian Federation
Russian Federation
Received her M.S. degree in computer science from Moscow State University in 2018. Currently, she is a postgraduate student at Moscow State University and a member of Video Group in MSU Graphics&Media Lab. Her research interests involve video codecs analysis and optimization, stereoscopic video subjective quality assessment. Anastasia is one of the contributors to MSU Video Codec Comparison Project and to the 3D video quality measurement project VQMT3D.
Dmitriy Sergeevich VATOLIN
MSU Institute for Artificial Intelligence,
Ivannikov Institute for System Programming of the Russian Academy of Sciences,
Lomonosov Moscow State University
Russian Federation
Russian Federation
Cand. Sci. (Phys.-Math.). He received his degree in 2000 from Moscow State University and is currently head of the CS MSU Graphics & Media Lab. His research interests include compression methods, video processing, and 3D-video techniques (depth from motion, focus and other cues, video matting, background restoration, and high-quality stereo generation), as well as 3D-video quality assessment (metrics for 2D-to-3D-conversion artifacts, temporal asynchrony, swapped views, and more). He is the creator of popular websites devoted to video processing and compression algorithms.
References
1. A. Gushchin, K. Abud, G. Bychkov, E. Shumitskaya, A. Chistyakova, S. Lavrushkin, B. Rasheed, K. Malyshev, D. Vatolin, and A. Antsiferova, Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metrics, in Proc. 42nd Int. Conf. on Machine Learning (ICML), Vancouver, Canada, Jul. 2025, poster.
2. Microsoft. 2013. A Behind the Scenes Look at How Bing is Improving Image Search Quality. Available at: https://blogs.bing.com/search-quality-insights/2013/08/23/a-behind-the-scenes-look-at-how-bing-is-improving-image-search-quality, accessed 12.10.2025.
3. Huang, Ziqi, Yinan He, Jiashuo Yu, Fan Zhang, Chenyang Si, Yuming Jiang, Wei Liu, Cewu Lu, and Yipeng Qin. 2024. VBench: Comprehensive Benchmark Suite for Video Generative Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 21807-21818.
4. Wu, Rongyuan, Tao Yang, Lingchen Sun, Zhengqiang Zhang, Shuai Li, and Li Song. 2024. SeeSR: Towards Semantics-Aware Real-World Image Super-Resolution. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 25456-25467.
5. Ding, Keyan, Kede Ma, Shiqi Wang, and Eero P. Simoncelli. 2021. Image Quality Assessment: Unifying Structure and Texture Similarity. International Journal of Computer Vision 129(4): pp. 1258-1281.
6. Kashkarov, Egor, Egor Chistov, Ivan Molodetskikh, and Dmitriy Vatolin. 2024. Can Full-Reference Image-Quality-Assessment Methods Serve as Perceptual Losses for Super-Resolution? Available at: https://arxiv.org/abs/2405.20392, accessed 12.10.2025.
7. Wang, Zhou, Alan C. Bovik, Hamid R. Sheikh, and Eero P. Simoncelli. 2004. Image Quality Assessment: From Error Visibility to Structural Similarity. IEEE Transactions on Image Processing 13(4): pp. 600-612.
8. Wang, Zhou, Eero P. Simoncelli, and Alan C. Bovik. 2003. Multiscale Structural Similarity for Image Quality Assessment. In The Thirty-Seventh Asilomar Conference on Signals, Systems & Computers, 2003, pp. 1398-1402. IEEE.
9. Zhang, Lin, Lei Zhang, Xuanqin Mou, and David Zhang. 2011. FSIM: A Feature Similarity Index for Image Quality Assessment. IEEE Transactions on Image Processing 20(8): pp. 2378-2386.
10. Zhang, Lin, and Hongyu Li. 2012. SR-SIM: A Fast and High Performance IQA Index Based on Spectral Residual. In 2012 19th IEEE International Conference on Image Processing, pp. 1473-1476. IEEE.
11. Sheikh, Hamid R., and Alan C. Bovik. 2006. Image Information and Visual Quality. IEEE Transactions on Image Processing 15(2): pp. 430-444.
12. Zhang, Richard, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. 2018. The Unreasonable Effectiveness of Deep Features as a Perceptual Metric. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 586-595.
13. Ding, Keyan, Kede Ma, Shiqi Wang, and Eero P. Simoncelli. 2022. Image Quality Assessment: Unifying Structure and Texture Similarity. IEEE Transactions on Pattern Analysis and Machine Intelligence 44(5): pp. 2567-2581.
14. Liu, Jianzhao, Xin Li, Yanding Peng, Tao Yu, and Zhibo Chen. 2022. SwinIQA: Learned Quality Assessment Using a Swin Transformer. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1795-1799.
15. Cheon, Manri, Sung-Jun Yoon, Byungyeon Kang, and Junwoo Lee. 2021. Perceptual Image Quality Assessment with Transformers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 433-442.
16. Lao, Shanshan, Yuan Gong, Shuwei Shi, Sidi Yang, Tianhe Wu, Jiahui Chen, Shi Guo, and Zhou Wang. 2022. Attentions Help CNNs See Better: Attention-Based Hybrid Image Quality Assessment Network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1140-1149.
17. Hosu, Vlad, Hanhe Lin, and Dietmar Saupe. 2020. TOPIQ: A Top-Down Approach to 3D-to-2D Image Quality Assessment. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pp. 2003-2012.
18. Liu, Yuming, Fan Zhang, and David R. Bull. 2017. RankIQA: Learning from Rankings for No-Reference Image Quality Assessment. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 5178–5187.
19. A. Gushchin, K. Abud, G. Bychkov, E. Shumitskaya, A. Chistyakova, S. Lavrushkin, B. Rasheed, K. Malyshev, D. Vatolin, and A. Antsiferova, Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metrics, in Proc. 42nd Int. Conf. on Machine Learning (ICML), Vancouver, Canada, Jul. 2025, poster.
20. Korhonen, Joni, and David M. Bull. 2019. Attacking Image Quality Assessment: Adversarial Examples for No-Reference IQA. In 2019 IEEE International Conference on Image Processing (ICIP), pp. 2344-2348. IEEE.
21. Shumitskaya, Anastasia, Dmitriy Vatolin, and others. 2023. Adversarial Attacks against No-Reference IQA Models. In CVPR Workshops, 2023.
22. Shumitskaya, Anastasia, and Dmitriy Vatolin. 2023. FACPA: Fast Adversarial Corruption and Patch Attack on No-Reference Image- and Video-Quality Metrics. In Tiny Papers @ ICLR 2023, Kigali, Rwanda, May 5, 2023. OpenReview.net.
23. Zhang, Richard, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. 2018. ELPIPS: Enhanced Learned Perceptual Image Patch Similarity. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops.
24. Zhang, Richard, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. 2018. ELPIPS: Enhanced Learned Perceptual Image Patch Similarity. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops.
25. Agarwal, Siddhant, et al. 2020. R-LPIPS: Robust Learned Perceptual Image Patch Similarity. In ECCV Workshops.
26. Chistyakova, Anna, Anastasia Antsiferova, Maksim Khrebtov, Sergey Lavrushkin, Denis Turdakov, Dmitriy Vatolin, and Denis Turdakov. 2024. Increasing the Robustness of Image Quality Assessment Algorithms to Adversarial Attacks via Gradient-Norm Regularization. Technologies 12: 220. Available at: https://doi.org/10.3390/technologies12110220, accessed 12.10.2025.
27. Liu, Yujia, Chenxi Yang, Dingquan Li, Jianhao Ding, and Tingting Jiang. 2024. Defending Against Adversarial Attacks on No-Reference Image Quality Models with Gradient Norm Regularization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 25554-25563.
28. Antsiferova, Anastasia, Khaled Abud, Aleksandr Gushchin, Ekaterina Shumitskaya, Georgii Bychkov, Sergey Lavrushkin, and Dmitriy Vatolin. 2024. Comparing the Robustness of Modern No-Reference IQA Metrics to Adversarial Attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, pp. 700-708.
29. Sheikh, Hamid, Muhammad Sabir, and Alan Bovik. 2006. A Statistical Evaluation of Recent Full Reference Image Quality Assessment Algorithms. IEEE Transactions on Image Processing 15: 3440–51. DOI: 10.1109/TIP.2006.881959.
30. Larson, Eric, and Damon Chandler. 2010. Most Apparent Distortion: Full-Reference Image Quality Assessment and the Role of Strategy. Journal of Electronic Imaging 19: 011006. DOI: 10.1117/1.3267105.
31. Ponomarenko, Nikolay, O. Ieremeiev, Vladimir Lukin, Karen Egiazarian, J. Astola, B. Vozel, et al. 2013. Color Image Database TID2013: Peculiarities and Preliminary Results. In 2013 European Workshop on Visual Information Processing, EUVIP 2013, pp. 106-111.
32. Lin, Hanhe, Vlad Hosu, and Dietmar Saupe. 2019. KADID-10k: A Large-Scale Artificially Distorted IQA Database. In 2019 Eleventh International Conference on Quality of Multimedia Experience (QoMEX), 1–3. DOI: 10.1109/QoMEX.2019.8743252.
33. Gu, Jinjin, Cai Haoming, Chen Haoyu, Ye Xiaoxing, Jimmy S. Ren, and Chao Dong. 2020. “PIPAL: A Large-Scale Image Quality Assessment Dataset for Perceptual Image Restoration.” In Computer Vision – ECCV 2020. August 23-28, 2020, Proceedings, Part XI 16, pp. 633-651. Springer.
34. Madry, Aleksander, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. Available at: https://arxiv.org/pdf/1706.06083, accessed 12.10.2025.
35. Carlini, Nicholas, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. 2019. On Evaluating Adversarial Robustness. Available at: https://arxiv.org/pdf/1902.06705, accessed 12.10.2025.
36. Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. 2014. Explaining and Harnessing Adversarial Examples. Available at: https://arxiv.org/pdf/1412.6572, accessed 12.10.2025.
37. Carlini, Nicholas, and David Wagner. 2017. Towards Evaluating the Robustness of Neural Networks. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 39-57. IEEE.
38. Croce, Francesco, and Matthias Hein. 2020. Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-Free Attacks. In International Conference on Machine Learning, pp. 2206-2216. PMLR.
39. Shumitskaya, Anastasia Antsiferova, and Dmitriy Vatolin. 2023. FACPA: Fast Adversarial Corruption and Patch Attack on No-Reference Image- and Video-Quality Metrics. In Tiny Papers @ ICLR 2023, Kigali, Rwanda, May 5, 2023. OpenReview.net.
40. Nie, Weili, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. 2022. DiffPure: Diffusion Models for Adversarial Purification. Available at: https://arxiv.org/pdf/2205.07460, accessed 12.10.2025.
41. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., & Polosukhin, I. (2017). Attention is all you need. Advances in neural information processing systems, 30.
Review
For citations:
GUSHCHIN A.E., ANTSIFEROVA A.V., VATOLIN D.S. AnAT: Anchor-Based Adversarial Training for Image Quality Assessment. Proceedings of the Institute for System Programming of the RAS (Proceedings of ISP RAS). 2026;38(1):241-254. (In Russ.) https://doi.org/10.15514/ISPRAS-2026-38(1)-16
Email this article 