PaperlayerView exact revision on arXiv

Source-linked AI summary

Universal Adversarial Examples in Remote Sensing: Methodology and Benchmark

Yonghao Xu, Pedram Ghamisi

arXiv:2202.07054v3cs.CV

TL;DR

Remote-sensing deep networks are vulnerable to adversarial examples, while black-box attacks are relevant when victim-model details are unavailable and transfer across networks is difficult. The paper proposes Mixup-Attack and Mixcut-Attack, which target shallow surrogate-model features, and reports transferable attacks across scene classification and semantic segmentation. It also provides UAE-RS as a dataset of black-box adversarial samples for remote sensing.

  • Problem

    Remote-sensing adversarial-attack research has mainly used white-box settings, although deployed victim-model details are often unavailable and transfer across network architectures is challenging.

    Source: §I · p. 2

  • Method

    Mixup-Attack and Mixcut-Attack use a surrogate model to attack shallow features by minimizing KL divergence between virtual-image and input-image features, with Mixup-Attack also combining cross-entropy loss.

    Source: §I · p. 2, §V · p. 13

  • Results

    The methods generate transferable adversarial examples that deceive most state-of-the-art networks in both scene classification and semantic segmentation, and Mixcut performs relatively worse than Mixup on semantic segmentation.

    Source: D. Black-Box Attacks on Semantic… · p. 11, §V · p. 13

  • Takeaways & Limitations

    UAE-RS provides black-box adversarial samples for remote sensing and may serve as a benchmark for developing adversarial defenses.

    Source: E. UAE-RS Dataset · p. 11, §V · p. 13

Abstract

from arXiv · show

Deep neural networks have achieved great success in many important remote sensing tasks. Nevertheless, their vulnerability to adversarial examples should not be neglected. In this study, we systematically analyze the universal adversarial examples in remote sensing data for the first time, without any knowledge from the victim model. Specifically, we propose a novel black-box adversarial attack method, namely Mixup-Attack, and its simple variant Mixcut-Attack, for remote sensing data. The key idea of the proposed methods is to find common vulnerabilities among different networks by attacking the features in the shallow layer of a given surrogate model. Despite their simplicity, the proposed methods can generate transferable adversarial examples that deceive most of the state-of-the-art deep neural networks in both scene classification and semantic segmentation tasks with high success rates. We further provide the generated universal adversarial examples in the dataset named UAE-RS, which is the first dataset that provides black-box adversarial samples in the remote sensing field. We hope UAE-RS may serve as a benchmark that helps researchers to design deep neural networks with strong resistance toward adversarial attacks in the remote sensing field. Codes and the UAE-RS dataset are available online (https://github.com/YonghaoXu/UAE-RS).

I. INTRODUCTION

Remote-sensing networks support important applications, but black-box attacks are needed when deployed victim models cannot be inspected and attacks must transfer across architectures. This introduction motivates shallow-feature attacks and presents Mixup-Attack, Mixcut-Attack, and UAE-RS; it also reviews box-constrained L-BFGS as prior attack work.

I. INTRODUCTION

  • Remote-sensing deep networks have advanced scene classification, object detection, and semantic segmentation, yet their vulnerability to adversarial examples raises reliability concerns for real-world systems.Prior attacks can produce perturbations that appear similar to original images while inducing wrong predictions with high confidence.Source: §I · p. 1
  • Black-box attacks address settings where victim-model details are unavailable, but transfer from a surrogate remains difficult because conventional attacks often target one network and may fail on different architectures.The introduction identifies common vulnerabilities across networks and transferable examples as critical challenges.Source: §I · p. 2
  • Mixup-Attack minimizes KL divergence between shallow features of a mixed-category image and the target image, combines that loss with cross-entropy, and adds the resulting gradients to the clean image.Mixcut-Attack instead constructs its mixed image from slices of images from different categories; the motivation is that shallow representations may be similar across networks.Source: §I · p. 2, Figure 2 · p. 2
  • The paper reports analysis of universal black-box adversarial examples, two attack methods evaluated on four benchmark datasets across scene classification and semantic segmentation, and UAE-RS as a proposed defense benchmark.The authors describe UAE-RS as the first remote-sensing dataset of black-box adversarial samples.Source: §I · p. 2

1) Box-Constrained L-BFGS:

  • Box-constrained L-BFGS formulates adversarial generation as finding a perturbation that makes the network predict a desired wrong label while keeping the perturbed image within [0, 1]^n.Because directly solving the constraint is difficult, Szegedy et al. approximate it using box-constrained L-BFGS and line search over the minimum c that achieves the desired prediction.Source: 1) Box-Constrained L-BFGS · pp. 2–3

2) Fast Gradient Sign Method:

The fast gradient sign method provides an efficient adversarial attack by perturbing an image along the sign of the input gradient of the loss. A small scalar controls the perturbation, and clipping keeps pixel values in range.

2) Fast Gradient Sign Method:

  • FGSM forms an adversarial image by adding a scaled sign of the loss gradient with respect to the input, then clipping the result.The input is an image with its true label; the scale is epsilon.Source: 2) Fast Gradient Sign Method · p. 3
  • The gradient is computed from the training loss J with respect to input x, and the sign operation determines the perturbation direction.The source also notes extensions that normalize the gradient using the ℓ2 or ℓ∞ norm.Source: 2) Fast Gradient Sign Method · p. 3
  • The clipping operation constrains the resulting image's pixel values, while epsilon controls the perturbation norm.Source: 2) Fast Gradient Sign Method · p. 3

3) Iterative Fast Gradient Sign Method:

The reviewed methods range from iterative gradient-sign attacks and distance-based optimization to black-box approaches that either query a victim or transfer attacks from a surrogate. Query-based methods estimate victim gradients through repeated output observations.

3) Iterative Fast Gradient Sign Method:

4) Carlini and Wagner’s Attack (C&W):

  • C&W encourages a wrong class to receive a larger probability score than other classes while directly optimizing distance between benign and adversarial examples.The objective includes a weighting factor μ.Source: 4) Carlini and Wagner’s Attack (C&W) · p. 3

B. Black-Box Attacks

  • Black-box attacks are divided into query-based and transfer-based approaches, with black-box settings requiring no or minimal victim-model knowledge.Source: B. Black-Box Attacks · p. 3

1) Query-Based Black-Box Attacks:

  • Query-based attacks perturb inputs and observe victim outputs, then reconstruct gradients numerically through repeated queries.Examples include greedy local search, orthonormal-basis sampling, Bayesian optimization, evolutionary algorithms, and meta-learning.Source: 1) Query-Based Black-Box Attacks · p. 3

2) Transfer-Based Black-Box Attacks:

Transfer-based black-box attacks use a surrogate model, but attacks may transfer poorly when its architecture differs from the unknown victim. Mixup-Attack targets shallow features using a cross-category virtual image, while Mixcut provides a sample-construction variant.

2) Transfer-Based Black-Box Attacks:

  • Surrogate attacks based on predicted logits may transfer poorly across different networks, motivating attacks on intermediate features, [22].Prior work also explored ensembles, intermediate-level attacks, and attention-map attacks to improve transferability –.Source: 2) Transfer-Based Black-Box Attacks · p. 3, §III · p. 4

III. METHODOLOGY

  • Shallow features preserve spatial detail and may share representations across networks, so the method aligns features of an input and a different-category virtual image.The authors propose this as a way to target a more common vulnerability than predicted logits.Source: §III · p. 4

A. Overview of the Proposed Method

  • Mixup-Attack constructs a cross-category linear-combination image, minimizes the KL divergence between its shallow features and the input’s, and combines that loss with cross-entropy.The adversarial example is generated by adding objective gradients to the clean image; momentum stabilizes update directions across iterations.Source: A. Overview of the Proposed Method · p. 4

B. Mixup and Mixcut Samples

  • Mixup extends two-sample interpolation [36] to images from multiple categories, with n_mix setting how many categories contribute to the virtual image.The paper sets n_mix = 10 in its experiments.Source: B. Mixup and Mixcut Samples · pp. 4–5
  • Mixcut replaces linear blending with binary-mask stitching: each image supplies a full-width horizontal strip, and the number of contributing categories is n_mix.The authors describe Mixcut as a simple variant of Mixup sampling.Source: B. Mixup and Mixcut Samples · pp. 4–5

C. Feature-Level Attack with Virtual Samples

The feature-level attack matches the adversarial example’s shallow-feature distribution to a virtual sample, while cross-entropy preserves pressure on the surrogate’s prediction. The combined loss is optimized iteratively to generate the adversarial example.

C. Feature-Level Attack with Virtual Samples

  • The mix loss minimizes the distribution discrepancy between shallow features of the adversarial example and the virtual sample using KL divergence.Maximizing the defined mix loss corresponds to minimizing that divergence.Source: C. Feature-Level Attack with Virtual… · p. 5
  • Algorithm 1 takes a surrogate, clean image and label, and Mixup or Mixcut sample, then computes the losses and updates the adversarial example using normalized accumulated gradients.The algorithm returns the final-iteration adversarial example.Source: C. Feature-Level Attack with Virtual… · p. 5
  • Cross-entropy on the surrogate’s predicted logits and the input’s true label supplements the mix loss because feature matching alone does not account for predictions.The complete objective is the mix loss plus β times cross-entropy.Source: C. Feature-Level Attack with Virtual… · p. 5
  • The method iteratively generates adversarial examples by applying the complete loss, with the clean input used to initialize the first iteration.The update uses step size α.Source: C. Feature-Level Attack with Virtual… · p. 5

D. Attack with Momentum

The method adds momentum to stabilize update directions across iterations. The supplied table caption identifies an evaluation of untargeted attack success rates on UCM.

D. Attack with Momentum

  • Momentum accumulates velocity in the gradient direction to stabilize update directions across iterations.The momentum term is initialized to zero.Source: D. Attack with Momentum · pp. 5–6
  • Table I reports success rates (%) for different untargeted adversarial attack methods on the UCM dataset.The supplied caption does not provide the table’s values or identify a winning method.Source: Table I · p. 6
  • The next adversarial example is calculated from the accumulated momentum term, following the method’s update procedure.The detailed Mixup-Attack and Mixcut-Attack procedure is given in Algorithm 1.Source: D. Attack with Momentum · p. 6

E. Extension to Semantic Segmentation

The authors extend the attack to semantic segmentation by using virtual samples and adapting the prediction loss for pixel-wise classification. The adapted loss upsamples predictions with bilinear interpolation.

E. Extension to Semantic Segmentation

  • For semantic segmentation, the method randomly selects 10 training images to create the Mixup or Mixcut virtual sample.The sample is generated using the previously defined construction procedures.Source: E. Extension to Semantic Segmentation · p. 6
  • The cross-entropy loss is modified for semantic segmentation, where classification is performed pixel by pixel.The modified expression uses the upsampling function on the surrogate prediction.Source: E. Extension to Semantic Segmentation · p. 6
  • The prediction upsampling uses bilinear interpolation before the loss is applied.The passage defines the image height and width as h and w.Source: E. Extension to Semantic Segmentation · p. 6

IV. EXPERIMENTS

Experiments use UCM and AID for scene classification and Vaihingen and Zurich Summer for semantic segmentation. The dataset descriptions and table captions establish the benchmark scope for both tasks.

1) Scene Classification:

  • UCM has 2,100 images across 21 land-use classes, while AID has 10,000 images across 30 aerial scene types.UCM images are 256×256 pixels; AID images are 600×600 pixels and span multiple resolutions.Source: 1) Scene Classification · p. 6
  • The scene-classification results include success rates for untargeted adversarial attack methods on AID.Table II is captioned as reporting the attack-method success rates on AID.Source: Table II · p. 7

2) Semantic Segmentation:

  • Vaihingen and Zurich Summer provide the semantic-segmentation benchmarks, with 33 aerial images and 20 satellite images, respectively.Vaihingen has 16 annotated images; experiments use five as the test set. Zurich Summer experiments also use five test images.Source: 2) Semantic Segmentation · p. 7
  • The module-contribution table is captioned for Mixup-Attack and Mixcut-Attack on scene classification.The caption identifies the table's task and scope, but does not provide its values.Source: Table III · p. 7

B. Experimental Settings and Implementation Details

The experimental setup compares untargeted black-box attack methods across scene classification and semantic segmentation. It fixes attack budgets and implementation choices, defines success rate for both tasks, and includes example adversarial images for UCM and AID.

Experimental protocol

  • FGSM, I-FGSM, C&W, TPGD, and Jitter serve as comparison methods alongside Mixup-Attack and Mixcut-Attack.The attacks are evaluated on both scene classification and semantic segmentation.Source: B. Experimental Settings and… · p. 7

Implementation details

  • All methods use ℓ∞ perturbations with ϵ = 1; iterative methods use α = 1 and five iterations.The iteration limit applies to I-FGSM, C&W, TPGD, Jitter, and the proposed methods.Source: B. Experimental Settings and… · p. 8
  • The surrogate feature function uses each model's first pooling layer, and β is set to 0.0005 for Mixup-Attack and 0.005 for Mixcut-Attack.Scale augmentation is also used to improve generalization.Source: B. Experimental Settings and… · p. 8

Examples

  • The UCM and AID examples pair each original scene image with its corresponding Mixcut-Attack adversarial example.Both sets of examples are identified as using ResNet18.Source: Figure 6 · p. 9, Figure 7 · p. 9

Evaluation

  • Success rate is the fraction of misclassified test samples for scene classification and misclassified valid pixels for semantic segmentation.Scene classification uses a random 50% training and 50% test split; attacks are generated on test samples and evaluated on different networks.Source: B. Experimental Settings and… · p. 9

C. Black-Box Attacks on Scene Classification

In black-box tests, Mixup-Attack outperforms comparison attacks on both scene classification and semantic segmentation, with especially strong reported transfer across different target models. The results also show a white-box trade-off for scene classification, task-specific differences for Mixcut-Attack, and different ablation patterns across the two tasks.

C. Black-Box Attacks on Scene Classification

  • On UCM, Mixup-Attack and Mixcut-Attack exceed 64% success versus about 31% for C&W when transferring from ResNet18 to Inception-v3.The authors report similar gains on AID and stronger transferability to different target models overall.Source: C. Black-Box Attacks on Scene… · pp. 9–10
  • In scene classification, Mixup-Attack reaches about 83% on a white-box UCM case where I-FGSM and C&W each reach 100%.The authors suggest the mix loss may trade some white-box performance for transferability; the proposed methods still exceed 80% in most cases.Source: C. Black-Box Attacks on Scene… · p. 10

C. Black-Box Attacks on Scene Classification; D. Black-Box Attacks on Semantic Segmentation

  • Combining cross-entropy and mix losses improves success over cross-entropy alone in both tasks; momentum further improves scene-classification results but adds relatively little in segmentation.Reported gains from adding mix loss are around 33 and 8 percentage points for Mixup-Attack and 12 and 5 for Mixcut-Attack in scene classification; in segmentation they are around 45 and 34, and 16 and 26, respectively.Source: C. Black-Box Attacks on Scene… · p. 10, D. Black-Box Attacks on Semantic… · p. 11

D. Black-Box Attacks on Semantic Segmentation

  • On Vaihingen, Mixup-Attack exceeds C&W by more than 30 percentage points, with success rates over 71% versus about 38%; similar results are reported for Zurich Summer.The authors report that Mixup-Attack outperforms comparison attacks by large margins in all tested black-box segmentation scenarios.Source: D. Black-Box Attacks on Semantic… · p. 11
  • Mixcut-Attack is less successful than Mixup-Attack on semantic segmentation, although it is competitive for scene classification.The authors suggest that changing spatial distribution without changing pixel values has less influence when the task classifies pixels individually.Source: D. Black-Box Attacks on Semantic… · p. 11

E. UAE-RS Dataset

UAE-RS collects adversarial examples generated by the proposed attacks and is presented as a remote-sensing benchmark for evaluating model resistance. Evaluations show substantial drops on its adversarial samples for both classification and segmentation models.

E. UAE-RS Dataset

  • UAE-RS is presented as the first remote-sensing adversarial-example dataset and as a potential benchmark for developing more resistant networks.It collects examples generated with Mixcut-Attack against ResNet18 for scene classification and Mixup-Attack against FCN8s for segmentation.Source: E. UAE-RS Dataset · pp. 11–12

1) UAE-RS Samples on Scene Classification:

  • UCM and AID adversarial examples can look very similar to their clean originals while fooling deep networks.The reported scene-classification evaluation finds that clean-set overall accuracy exceeds 90% for most models, while clean-to-adversarial accuracy gaps can exceed 70 percentage points.Source: 1) UAE-RS Samples on Scene… · p. 12

2) UAE-RS Samples on Semantic Segmentation:

  • For segmentation examples, adversarial images can look little different from clean images while causing SegNet to misclassify most pixels.The reported errors concentrate on low vegetation in Vaihingen and building in Zurich Summer.Source: 2) UAE-RS Samples on Semantic… · p. 12
  • On UAE-RS segmentation tests, all reported models lose mean F1 relative to clean sets, with gaps exceeding 30 percentage points in many cases.Most models exceed 70% mean F1 on clean tests; ContextNet has relatively smaller gaps on both datasets, which the authors identify as a possible robustness direction.Source: 2) UAE-RS Samples on Semantic… · p. 13

V. CONCLUSIONS AND DISCUSSIONS

Mixup-Attack and Mixcut-Attack generate transferable black-box adversarial examples that achieve high success rates across scene classification and semantic segmentation. The results also distinguish task-specific attack performance, model resistance patterns, and UAE-RS’s potential as a benchmark.

V. CONCLUSIONS AND DISCUSSIONS

  • Across four benchmark very high-resolution remote-sensing datasets, the methods generate transferable adversarial examples that fool most state-of-the-art networks in scene classification and semantic segmentation with high success rates.The authors also introduce Mixup-Attack and its simpler variant, Mixcut-Attack.Source: §V · p. 13
  • Mixcut-Attack achieves higher success rates in scene classification, whereas Mixup-Attack is more threatening in semantic segmentation, which requires pixel-wise classification.The authors suggest Mixcut’s changes to spatial distribution without changing pixel values may explain its weaker influence on segmentation.Source: §V · p. 13
  • Deeper architectures generally show stronger resistance to black-box attacks, while global-context networks show stronger resistance in semantic segmentation.Source: §V · p. 13
  • UAE-RS provides the first remote-sensing dataset of black-box adversarial samples and may serve as a defense benchmark; adversarial examples may also have potential for domain adaptation.The paper links that potential to reports that adversarial-example training can improve regularization and learn domain-invariant features.Source: §V · p. 13
Loading 2202.07054v3…