Generating Natural Adversarial Remote Sensing Images

Burnel, Jean-Christophe; Fatras, Kilian; Flamary, Rémi; Courty, Nicolas

doi:10.1109/tgrs.2021.3110601

Cited by 15 publications

(8 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Consequently, Delving into adversarial attacks against aerial detection paves a critical path to better explaining and improving model robustness. However, most adversarial attack methods [17], [19], [45]- [47] against aerial detection concentrate on the digital domain. In contrast, physical attacks against aerial detection are somewhat scarce, while it is more critical and practical.…”

Section: B Physical Attackmentioning

confidence: 99%

CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World

Lian¹,

Wang²,

Su³

et al. 2023

Preprint

View full text Add to dashboard Cite

Patch-based physical attacks have increasingly aroused concerns. However, most existing methods focus on obscuring targets captured on the ground, and some of these methods are simply extended to deceive aerial detectors. They smear the targeted objects in the physical world with the elaborated adversarial patches, which can only slightly sway the aerial detectors' prediction and with weak attack transferability. To address the above issues, we propose to perform Contextual Background Attack (CBA), a novel physical attack framework against aerial detection, which can achieve strong attack efficacy and transferability in the physical world even without smudging the interested objects at all. Specifically, the targets of interest, i.e. the aircraft in aerial images, are adopted to mask adversarial patches. The pixels outside the mask area are optimized to make the generated adversarial patches closely cover the critical contextual background area for detection, which contributes to gifting adversarial patches with more robust and transferable attack potency in the real world. To further strengthen the attack performance, the adversarial patches are forced to be outside targets during training, by which the detected objects of interest, both on and outside patches, benefit the accumulation of attack efficacy. Consequently, the sophisticatedly designed patches are gifted with solid fooling efficacy against objects both on and outside the adversarial patches simultaneously. Extensive proportionally scaled experiments are performed in physical scenarios, demonstrating the superiority and potential of the proposed framework for physical attacks. We expect that the proposed physical attack method will serve as a benchmark for assessing the adversarial robustness of diverse aerial detectors and defense methods. The code has been released at https://github.com/JiaweiLian/CBA.

show abstract

Section: B Physical Attackmentioning

confidence: 99%

CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World

Lian¹,

Wang²,

Su³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…A key observation is the generalisability of attacks from RGB to multispectral images [48,49]. Generative adversarial networks have been used to generate natural-looking hyperspectral adversarial examples [8].…”

Section: Adversarial Attacks In Remote Sensingmentioning

confidence: 99%

“…Based on the data collected, we optimised adversarial cubes under different combinations of loss terms: • Ψ: Adversarial biasing in the cloud-sensitive bands (8).…”

Section: Ablation Testsmentioning

confidence: 99%

Adversarial Attacks against a Satellite-borne Multispectral Cloud Detector

Du¹,

Law²,

Sasdelli³

et al. 2021

Preprint

View full text Add to dashboard Cite

Data collected by Earth-observing (EO) satellites are often afflicted by cloud cover. Detecting the presence of clouds-which is increasingly done using deep learning-is crucial preprocessing in EO applications. In fact, advanced EO satellites perform deep learning-based cloud detection on board the satellites and downlink only clear-sky data to save precious bandwidth. In this paper, we highlight the vulnerability of deep learning-based cloud detection towards adversarial attacks. By optimising an adversarial pattern and superimposing it into a cloudless scene, we bias the neural network into detecting clouds in the scene. Since the input spectra of cloud detectors include the nonvisible bands, we generated our attacks in the multispectral domain. This opens up the potential of multi-objective attacks, specifically, adversarial biasing in the cloud-sensitive bands and visual camouflage in the visible bands. We also investigated mitigation strategies against the adversarial attacks. We hope our work further builds awareness of the potential of adversarial attacks in the EO community.

show abstract

“…Remote sensing classification models have been proven unsafe by several researchers in the field of remote sensing image tasks [16][17][18][19][20][21]. Adversarial attacks against remote sensing image classification models were first proposed by Chen et al [16].…”

Section: Introductionmentioning

confidence: 99%

Local Pixel Attack Based on Sensitive Pixel Location for Remote Sensing Images

Liu

et al. 2023

Electronics

View full text Add to dashboard Cite

As deep neural networks (DNNs) are widely used in the field of remote sensing image recognition, there is a model security issue that cannot be ignored. DNNs have been shown to be vulnerable to small perturbations in a large number of studies in the past, and this security risk naturally exists in remote sensing object detection models based on DNNs. The complexity of remote sensing object detection models makes it difficult to implement adversarial attacks on them, resulting in the current lack of systematic research on adversarial examples in the field of remote sensing image recognition. In order to better deal with the adversarial threats that remote sensing image recognition models may confront and to provide an effective means for evaluating the robustness of the models, this paper takes the adversarial examples for remote sensing image recognition as the research goal and systematically studies vanishing attacks against a remote sensing image object detection model. To solve the problem of difficult attack implementation on remote sensing image object detection, adversarial attack adaptation methods based on interpolation scaling and patch perturbation stacking are proposed in this paper, which realizes the adaptation of classical attack algorithms. We propose a hot restart perturbation update strategy and the joint attack of the first and second stages of the two-stage remote sensing object detection model is realized through the design of the attack loss function. For the problem of the modification cost of global pixel attack being too large, a local pixel attack algorithm based on sensitive pixel location is proposed in this paper. By searching the location of the sensitive pixels and constructing the mask of attack area, good local pixel attack effect is achieved. Experimental results show that the average pixel modification rate of the proposed attack method decreases to less than 4% and the vanishing rate can still be maintained above 80%, which effectively achieves the balance between attack effect and attack cost.

show abstract

Generating Natural Adversarial Remote Sensing Images

Cited by 15 publications

References 28 publications

CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World

CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World

Adversarial Attacks against a Satellite-borne Multispectral Cloud Detector

Local Pixel Attack Based on Sensitive Pixel Location for Remote Sensing Images

Contact Info

Product

Resources

About