SEGA: A Transferable Signed Ensemble Gaussian Black-Box Attack against No-Reference Image Quality Assessment Models

Yujia Liu¹, Dingquan Li³, Zhixuan Li², Tiejun Huang^1†

¹Peking University, ²Nanyang Technological University, ³Pengcheng Laboratory
^†Corresponding author.
IEEE Transactions on Pattern Analysis and Machine Intelligence, 2026

Paper Code

SEGA combines Gaussian smoothing, gradients ensembled from multiple source models, and content-aware perturbation filtering to improve black-box transferability while keeping adversarial changes less perceptible.

Abstract

No-reference image quality assessment models are vulnerable to adversarial examples, yet transfer-based black-box attacks remain difficult because different architectures learn dissimilar quality representations. SEGA improves transferable attacks through Gaussian-smoothed gradient estimation, source-model gradient ensembling, and a perturbation filter that suppresses visually conspicuous changes. Experiments across multiple NR-IQA models and datasets demonstrate strong transferability together with competitive perceptual quality.

Transferable and Imperceptible Attacks

Adversarial examples generated by SEGA and competing attacks.

Across CNN- and Transformer-based target models, SEGA preserves the visual appearance of the source image while producing adversarial examples with stronger cross-model transfer.

Perturbation Filtering

The two filtering masks remove perturbations in visually sensitive or semantically unhelpful regions. Ablations show how smoothing strength, sampling count, and ensemble size balance transferability and efficiency.

BibTeX

@article{liu2026sega,
  title={{SEGA}: A Transferable Signed Ensemble Gaussian Black-Box Attack against No-Reference Image Quality Assessment Models},
  author={Liu, Yujia and Li, Dingquan and Li, Zhixuan and Huang, Tiejun},
  journal={IEEE Transactions on Pattern Analysis and Machine Intelligence},
  year={2026},
  publisher={IEEE}
}