Adversarial Attacks against a Satellite-borne Multispectral Cloud Detector

Du, Andrew; Law, Yee Wei; Sasdelli, Michele; Chen, Bin; Ken, Clarke,; Brown, Michael; Chin, Tat-Jun

doi:10.48550/arxiv.2112.01723

Cited by 3 publications

(6 citation statements)

References 50 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…3) Comparisons: We adopt a state-of-the-art physical attack approach from the work [16] (CVPR) as the comparison algorithm due to the existing related physical attack methods [17], [18], [41], [42] against aerial detectors all derived from this method. The target detector is still YOLOv2, YOLOv3, YOLOv5n, YOLOV5s, YOLOv5m, YOLOv5l, YOLOv5x, Faster R-CNN, SSD, and Swin Transformer.…”

Section: B Experimental Results In Digital Domainmentioning

confidence: 99%

“…The main reason for the better attack performance of our AP-PA is that we consider all detected objects, i.e., using the mean scores of all detected objects to optimize adversarial patches instead of the only one object with the biggest objectiveness score ( [16]- [18], [41], [42]), which can not only greatly drop the number of detected objects but also significantly improve the optimizing efficiency of adversarial patches.…”

Section: B Experimental Results In Digital Domainmentioning

confidence: 99%

“…Recently, some latest works [49]- [52] devote to crafting imperceptible perturbations to attack aerial image classifiers in the digital domain, while physical attacks on satellite and aerial imagery have not been extensively exploited. Some researchers apply adversarial patches to fool aerial imagery classifiers [40] and detectors [17], [41], [42] in the digital domain without verifying the attack efficacy in the physical world. Du et al [18] elaborate an adversarial patch that encloses the target object, which is robust enough against atmospheric conditions and temporal variability.…”

Section: Adversarial Attacks In Aerial Imagesmentioning

confidence: 99%

See 2 more Smart Citations

Benchmarking Adversarial Patch Against Aerial Detection

Lian¹,

Mei²,

Zhang³

et al. 2022

Preprint

View full text Add to dashboard Cite

Deep neural networks (DNNs) have become essential for aerial detection. However, DNNs are vulnerable to adversarial examples, which poses great security concerns for security-critical systems. To physically evaluate the vulnerability of DNNs-based aerial detection methods, researchers recently devised adversarial patches. Nonetheless, adversarial patches generated by existing algorithms are not strong enough and extremely time-consuming. Moreover, the complicated physical factors are not accommodated well during the optimizing process. In this paper, a novel adaptive-patch-based physical attack (AP-PA) framework is proposed to alleviate the above problems, which achieves state-of-the-art performance in both accuracy and efficiency. Specifically, the AP-PA aims to generate adversarial patches that are adaptive in both physical dynamics and varying scales, and by which the particular targets can be hidden from being detected. Furthermore, the adversarial patch is also gifted with attack effectiveness against all targets of the same class with a patch outside the target (No need to smear targeted objects) and robust enough in the physical world. In addition, a new loss is devised to consider more available information of detected objects to optimize the adversarial patch, which can significantly improve the patch's attack efficacy (Average precision drop up to 87.86% and 85.48% in white-box and blackbox settings, respectively) and optimizing efficiency. We also establish one of the first comprehensive, coherent, and rigorous benchmarks to evaluate the attack efficacy of adversarial patches on aerial detection tasks. Finally, several proportionally scaled experiments are performed physically to demonstrate that the elaborated adversarial patches can successfully deceive aerial detection algorithms in dynamic physical circumstances. The code is available at https://github.com/JiaweiLian/AP-PA.

show abstract

Section: B Experimental Results In Digital Domainmentioning

confidence: 99%

Section: B Experimental Results In Digital Domainmentioning

confidence: 99%

Section: Adversarial Attacks In Aerial Imagesmentioning

confidence: 99%

See 1 more Smart Citation

Benchmarking Adversarial Patch Against Aerial Detection

Lian¹,

Mei²,

Zhang³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Second, we move from adversarial examples to data poisoning attacks, and include an assessment of natural robustness. In [24], the authors explore adversarial attacks on a multispectral binary cloud classifier. Here, we consider multi-class segmentation models, and a more comprehensive study of robustness.…”

Section: Related Workmentioning

confidence: 99%

Quantifying the robustness of deep multispectral segmentation models against natural perturbations and data poisoning

Bishoff

Godfrey

McKay

et al. 2023

Algorithms, Technologies, and Applications for Multispectral and Hyperspectral Imaging XXIX

View full text Add to dashboard Cite

In overhead image segmentation tasks, including additional spectral bands beyond the traditional RGB channels can improve model performance. However, it is still unclear how incorporating this additional data impacts model robustness to adversarial attacks and natural perturbations. For adversarial robustness, the additional information could improve the model's ability to distinguish malicious inputs, or simply provide new attack avenues and vulnerabilities. For natural perturbations, the additional information could better inform model decisions and weaken perturbation effects or have no significant influence at all. In this work, we seek to characterize the performance and robustness of a multispectral (RGB and near infrared) image segmentation model subjected to adversarial attacks and natural perturbations. While existing adversarial and natural robustness research has focused primarily on digital perturbations, we prioritize on creating realistic perturbations designed with physical world conditions in mind. For adversarial robustness, we focus on data poisoning attacks whereas for natural robustness, we focus on extending ImageNet-C common corruptions for fog and snow that coherently and self-consistently perturbs the input data. Overall, we find both RGB and multispectral models are vulnerable to data poisoning attacks regardless of input or fusion architectures and that while physically realizable natural perturbations still degrade model performance, the impact differs based on fusion architecture and input data.

show abstract

“…They conduct both targeted and untargeted attacks to generate subtle adversarial perturbations that are imperceptible to human observers but can easily deceive DNNs-based models. Paper [237] proposes a UNet-based [10] GAN to enhance the optimizing efficiency and attack efficacy of the generated adversarial examples for Synthetic Aperture Radar Automatic Target Recognition (SAR-ATR) models. [238] aims to provide a thorough evaluation of the effects of adversarial examples on RSI classification.…”

Section: ) Image Classificationmentioning

confidence: 99%

Benchmarking Adversarial Patch Against Aerial Detection

Lian

Mei

Zhang

et al. 2022

IEEE Trans. Geosci. Remote Sensing

View full text Add to dashboard Cite

Deep neural networks (DNNs) have found widespread applications in interpreting remote sensing (RS) imagery. However, it has been demonstrated in previous works that DNNs are vulnerable to different types of noises, particularly adversarial noises. Surprisingly, there has been a lack of comprehensive studies on the robustness of RS tasks, prompting us to undertake a thorough survey and benchmark on the robustness of image classification and object detection in RS. To our best knowledge, this study represents the first comprehensive examination of both natural robustness and adversarial robustness in RS tasks. Specifically, we have curated and made publicly available datasets that contain natural and adversarial noises. These datasets serve as valuable resources for evaluating the robustness of DNNs-based models. To provide a comprehensive assessment of model robustness, we conducted meticulous experiments with numerous different classifiers and detectors, encompassing a wide range of mainstream methods. Through rigorous evaluation, we have uncovered insightful and intriguing findings, which shed light on the relationship between adversarial noise crafting and model training, yielding a deeper understanding of the susceptibility and limitations of various models, and providing guidance for the development of more resilient and robust models

show abstract

Adversarial Attacks against a Satellite-borne Multispectral Cloud Detector

Cited by 3 publications

References 50 publications

Benchmarking Adversarial Patch Against Aerial Detection

Benchmarking Adversarial Patch Against Aerial Detection

Quantifying the robustness of deep multispectral segmentation models against natural perturbations and data poisoning

Benchmarking Adversarial Patch Against Aerial Detection

Contact Info

Product

Resources

About